[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6C0V9WDYHKS1D628HJWBWSP":3,"skill-same:01M6C0V9WDYHKS1D628HJWBWSP":89},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":49,"linkOnly":50,"markdownContent":51,"markdownBody":52,"frontMatter":53,"refName":54,"commitSha":55,"skillDirectory":56,"forksCount":14,"repositoryHtmlUrl":57,"repositoryHomepageUrl":6,"ownerHtmlUrl":58,"ownerBlogUrl":6,"ownerDescription":59,"updatedAt":60,"install":61,"resources":74},"01M6C0V9WDYHKS1D628HJWBWSP","django-security",null,"Review and harden security in the AS v2 Django\u002FDRF backend. Use when auditing RBAC access control, reviewing auth\u002FOAuth\u002Fimport code for vulnerabilities, or hardening an endpoint before deploy. Covers OWASP Top 10, IDOR, CSV injection, row-level scoping, and secrets — mapped to AS v2's session auth, capability RBAC, and Google OAuth.","matheusnorjosa\u002Faprender_sistema","matheusnorjosa","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F117673804?v=4","01M6C0S19FG12BDFBTRWY9TTEQ","Matheus Norjosa","01M6C0S1DF0YB17TKGEYC70GSP",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmatheusnorjosa\u002Faprender_sistema\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdjango-security\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48],"security","django security","django","injection","when","for","top","import","as","control","Access Control","backend","use","session","access","secrets","google","idor","endpoint","owasp","hardening","OAuth","csv","code","owasp top 10","rbac","deploy","auth","vulnerabilities","review","2026-11-10 10:12:30",false,"---\nname: django-security\ndescription: Review and harden security in the AS v2 Django\u002FDRF backend. Use when auditing RBAC access control, reviewing auth\u002FOAuth\u002Fimport code for vulnerabilities, or hardening an endpoint before deploy. Covers OWASP Top 10, IDOR, CSV injection, row-level scoping, and secrets — mapped to AS v2's session auth, capability RBAC, and Google OAuth.\n---\n\n# Django Security — AS v2\n\n## Audit Procedure (RBAC access control)\n\nRun in order; the audit is DONE only when every step passes.\n\n1. **Lint passes** — deterministic pre-pass:\n   `cd v2\u002Fbackend && python scripts\u002Frbac_lint.py apps\u002F` (exit 1 = finding).\n   It bans `user.groups.filter(name=...)` and `Is\u003CRole>` classes outside the\n   whitelist. Same job as CI `[required] backend rbac-lint`. It is this skill's\n   only scanner: IDOR and CSV injection were measured as scanners and failed\n   (0% precision); prove what the lint cannot decide with a test.\n2. **Every ViewSet has explicit `permission_classes`** — enumerate the ViewSets\n   touched; each must declare `HasPerm(\"codename\")` (or a composition), never\n   rely on the DRF default alone. If `get_permissions()` is overridden, confirm\n   it does not silently drop an `@action(permission_classes=...)` decorator.\n3. **`get_queryset()` enforces data-scope** — non-privileged users see only their\n   own rows (`filter(usuario=request.user)`); the full queryset is gated behind a\n   capability check via `user_has_any_perm(...)`. No `objects.all()` leak.\n   The IDOR bug lives in the scope's content (branch order, gerência filter,\n   writable owner field). Prove the scope with a test in two halves; a bare 403\n   proves nothing, since the capability gate returns it whatever the queryset does:\n   - **Positive control** — user A, holding the capability, hits an object in\n     A's own scope with the same verb → 2xx (200; 204 on DELETE).\n   - **Out of scope** — the same user A does GET\u002FPATCH\u002FDELETE on user B's object\n     → 404 (the scope lives in the queryset, so B's object does not exist for A).\n     Expect 403 only where the design is \"exists but you may not act on it\".\n4. **Secrets\u002Fconfig** — no hardcoded keys; production flags set (see A05);\n   `.gitignore` blocks the secret files (see Secrets Management). Leave secret\n   scanning to CI `[required] Secret Detection` (gitleaks + TruffleHog) and\n   GitHub push protection; no local secret scanner run.\n\nDONE = steps 1–4 all pass for the code under review.\n\n## OWASP Top 10 — AS v2 Specific\n\n### A01: Broken Access Control\n\nRBAC model, capability codenames, and the canonical ViewSet pattern that gates by\ncapability then scopes the queryset: **see [reference\u002Frbac-idor.md](reference\u002Frbac-idor.md)**.\nThat file is the single source for the IDOR \u002F row-level pattern — link to it, do not\nre-derive it.\n\n**Audit-specific checks** (beyond the [Audit Procedure](#audit-procedure-rbac-access-control)):\n- [ ] Bulk approve\u002Freject actions verify the capability per item, not once for the batch\n- [ ] `select_for_update()` on approval flows to prevent race conditions\n- [ ] No IDOR: a user cannot read `\u002Fsolicitacoes\u002F{id}\u002F` outside their scope\n- [ ] Frontend permission checks mirror backend (never trust client-side only)\n\n### A02: Cryptographic Failures\n\n**Our crypto surface:**\n- `GCAL_ENCRYPTION_KEY` — Fernet encryption for OAuth tokens\n- `SECRET_KEY` — Django session signing\n- `REDIS_PASSWORD` — Redis auth in production\n\n**Checklist:**\n- [ ] OAuth tokens encrypted at rest with Fernet (`GoogleOAuthCredential.access_token_encrypted` \u002F `refresh_token_encrypted`)\n- [ ] Key rotation tested via the `rotate_gcal_encryption_key` management command\n- [ ] `SECRET_KEY` from environment variable, never hardcoded\n- [ ] Sessions use HttpOnly + Secure + SameSite=Lax cookies\n- [ ] No sensitive data in URL query parameters (use POST body)\n\n### A03: Injection\n\n**SQL injection vectors in Django:**\n```python\n# DANGEROUS — never do this\nSolicitacao.objects.raw(f\"SELECT * FROM core_solicitacao WHERE id = {user_input}\")\nSolicitacao.objects.extra(where=[f\"status = '{request.GET['status']}'\"])\n\n# SAFE — parameterized queries\nSolicitacao.objects.filter(id=user_input)\nSolicitacao.objects.raw(\"SELECT * FROM core_solicitacao WHERE id = %s\", [user_input])\n```\n\n**CSV injection in exports** — use the SSOT helper, do not reimplement:\n```python\n# DANGEROUS — user-controlled data in CSV (a value like =CMD() executes in Excel)\nwriter.writerow([solicitacao.observacoes])\n\n# SAFE — SEC-007 helper prefixes formula chars (= + - @ TAB CR LF) with a single quote\nfrom apps.core.utils.csv_sanitize import sanitize_csv_value\nwriter.writerow([sanitize_csv_value(r.municipio.nome), r.aluno_qtde])\n```\n\nSanitize free text only: the helper turns numbers into text (`-5` → `'-5`).\nA new export = helper + an injection test on the endpoint (model:\n`v2\u002Fbackend\u002Fapps\u002Fcore\u002Ftests\u002Ftest_csv_export_injection.py`).\n\n### A04: Insecure Design\n\n**Our design patterns:**\n- Approval flow (PA-01~07) enforced at service layer, not view layer\n- Availability rules (RD-01~08) in `availability_service.py`, validated server-side\n- Status transitions via state machine, not arbitrary updates\n- AuditLog for all approval\u002Frejection operations\n\n### A05: Security Misconfiguration\n\n**Production checklist:**\n- [ ] `DEBUG = False`\n- [ ] `ALLOWED_HOSTS` explicitly set (not `['*']`)\n- [ ] `SECURE_SSL_REDIRECT = True`\n- [ ] `SESSION_COOKIE_SECURE = True`\n- [ ] `CSRF_COOKIE_SECURE = True`\n- [ ] `CSRF_COOKIE_HTTPONLY = True`\n- [ ] `X_FRAME_OPTIONS = 'DENY'` (anti-clickjacking)\n- [ ] `SECURE_HSTS_SECONDS = 31536000`\n- [ ] `INCLUDE_DEV_TOOLS = False` (CP-08)\n- [ ] Container runs as non-root (SEC-006)\n- [ ] `read_only: true` on container filesystem\n- [ ] Debug toolbar, silk, nplusone behind try\u002Fexcept ImportError\n\n### A07: Authentication Failures\n\n**Our auth model:**\n- Session-based (Redis backend), NOT JWT for web\n- CSRF token via HttpOnly cookie + `\u002Fapi\u002Fcsrf\u002F` endpoint\n- Account lockout: 10 attempts → 15 min block\n- Rate limiting: login 30\u002Fmin por IP (o escritório sai por um IP só) + bloqueio de conta (`ACCOUNT_LOCKOUT_THRESHOLD` 10 erros → 15 min); gcal_write 10\u002Fmin\n\n**Checklist:**\n- [ ] Login endpoint rate-limited (DRF throttle + Nginx)\n- [ ] Failed login attempts logged with IP + user-agent\n- [ ] Session cookie: `asv2sid`, age 7200s, SameSite=Lax\n- [ ] CSRF token refreshed after login\n- [ ] Logout clears session + CSRF cache\n\n### A08: Software and Data Integrity\n\n**Our supply chain:**\n- Docker images signed with Cosign (keyless OIDC)\n- SLSA provenance attestations\n- Trivy container scanning in CI\n- Gitleaks + TruffleHog secret detection\n- pip-audit for Python dependencies\n- npm audit for frontend dependencies\n\n### A09: Logging and Monitoring\n\n**Our logging:**\n- Structured JSON logging with request ID correlation\n- AuditLog model for approval\u002Frejection operations\n- Login\u002Flogout audit with IP + user-agent\n- Django-prometheus metrics at `\u002Fmetrics\u002F`\n\n**Security events to always log:**\n- Authentication failures (with IP)\n- Authorization failures (403s with user + resource)\n- CSRF failures\n- Rate limit triggers\n- OAuth token operations (create, refresh, revoke)\n\n## Secrets Management\n\n**Never commit:**\n- `.env` files with real credentials\n- `service_account.json` (Google)\n- `GCAL_ENCRYPTION_KEY` values\n- `SECRET_KEY` values\n- Database passwords\n\n**`.gitignore` already blocks** (`.env*` local variants and Google creds):\n```\n.env\n.env.local\n.env.*.local\n!.env.*.example\nservice_account.json\n*service_account.json\nbackend\u002Fservice_account.json   # v2\u002F.gitignore\n```\n\nVerify any new secret file is covered before committing — the ignore list is\nexplicit, not a blanket `.env.*`.\n","# Django Security — AS v2\n\n## Audit Procedure (RBAC access control)\n\nRun in order; the audit is DONE only when every step passes.\n\n1. **Lint passes** — deterministic pre-pass:\n   `cd v2\u002Fbackend && python scripts\u002Frbac_lint.py apps\u002F` (exit 1 = finding).\n   It bans `user.groups.filter(name=...)` and `Is\u003CRole>` classes outside the\n   whitelist. Same job as CI `[required] backend rbac-lint`. It is this skill's\n   only scanner: IDOR and CSV injection were measured as scanners and failed\n   (0% precision); prove what the lint cannot decide with a test.\n2. **Every ViewSet has explicit `permission_classes`** — enumerate the ViewSets\n   touched; each must declare `HasPerm(\"codename\")` (or a composition), never\n   rely on the DRF default alone. If `get_permissions()` is overridden, confirm\n   it does not silently drop an `@action(permission_classes=...)` decorator.\n3. **`get_queryset()` enforces data-scope** — non-privileged users see only their\n   own rows (`filter(usuario=request.user)`); the full queryset is gated behind a\n   capability check via `user_has_any_perm(...)`. No `objects.all()` leak.\n   The IDOR bug lives in the scope's content (branch order, gerência filter,\n   writable owner field). Prove the scope with a test in two halves; a bare 403\n   proves nothing, since the capability gate returns it whatever the queryset does:\n   - **Positive control** — user A, holding the capability, hits an object in\n     A's own scope with the same verb → 2xx (200; 204 on DELETE).\n   - **Out of scope** — the same user A does GET\u002FPATCH\u002FDELETE on user B's object\n     → 404 (the scope lives in the queryset, so B's object does not exist for A).\n     Expect 403 only where the design is \"exists but you may not act on it\".\n4. **Secrets\u002Fconfig** — no hardcoded keys; production flags set (see A05);\n   `.gitignore` blocks the secret files (see Secrets Management). Leave secret\n   scanning to CI `[required] Secret Detection` (gitleaks + TruffleHog) and\n   GitHub push protection; no local secret scanner run.\n\nDONE = steps 1–4 all pass for the code under review.\n\n## OWASP Top 10 — AS v2 Specific\n\n### A01: Broken Access Control\n\nRBAC model, capability codenames, and the canonical ViewSet pattern that gates by\ncapability then scopes the queryset: **see [reference\u002Frbac-idor.md](reference\u002Frbac-idor.md)**.\nThat file is the single source for the IDOR \u002F row-level pattern — link to it, do not\nre-derive it.\n\n**Audit-specific checks** (beyond the [Audit Procedure](#audit-procedure-rbac-access-control)):\n- [ ] Bulk approve\u002Freject actions verify the capability per item, not once for the batch\n- [ ] `select_for_update()` on approval flows to prevent race conditions\n- [ ] No IDOR: a user cannot read `\u002Fsolicitacoes\u002F{id}\u002F` outside their scope\n- [ ] Frontend permission checks mirror backend (never trust client-side only)\n\n### A02: Cryptographic Failures\n\n**Our crypto surface:**\n- `GCAL_ENCRYPTION_KEY` — Fernet encryption for OAuth tokens\n- `SECRET_KEY` — Django session signing\n- `REDIS_PASSWORD` — Redis auth in production\n\n**Checklist:**\n- [ ] OAuth tokens encrypted at rest with Fernet (`GoogleOAuthCredential.access_token_encrypted` \u002F `refresh_token_encrypted`)\n- [ ] Key rotation tested via the `rotate_gcal_encryption_key` management command\n- [ ] `SECRET_KEY` from environment variable, never hardcoded\n- [ ] Sessions use HttpOnly + Secure + SameSite=Lax cookies\n- [ ] No sensitive data in URL query parameters (use POST body)\n\n### A03: Injection\n\n**SQL injection vectors in Django:**\n```python\n# DANGEROUS — never do this\nSolicitacao.objects.raw(f\"SELECT * FROM core_solicitacao WHERE id = {user_input}\")\nSolicitacao.objects.extra(where=[f\"status = '{request.GET['status']}'\"])\n\n# SAFE — parameterized queries\nSolicitacao.objects.filter(id=user_input)\nSolicitacao.objects.raw(\"SELECT * FROM core_solicitacao WHERE id = %s\", [user_input])\n```\n\n**CSV injection in exports** — use the SSOT helper, do not reimplement:\n```python\n# DANGEROUS — user-controlled data in CSV (a value like =CMD() executes in Excel)\nwriter.writerow([solicitacao.observacoes])\n\n# SAFE — SEC-007 helper prefixes formula chars (= + - @ TAB CR LF) with a single quote\nfrom apps.core.utils.csv_sanitize import sanitize_csv_value\nwriter.writerow([sanitize_csv_value(r.municipio.nome), r.aluno_qtde])\n```\n\nSanitize free text only: the helper turns numbers into text (`-5` → `'-5`).\nA new export = helper + an injection test on the endpoint (model:\n`v2\u002Fbackend\u002Fapps\u002Fcore\u002Ftests\u002Ftest_csv_export_injection.py`).\n\n### A04: Insecure Design\n\n**Our design patterns:**\n- Approval flow (PA-01~07) enforced at service layer, not view layer\n- Availability rules (RD-01~08) in `availability_service.py`, validated server-side\n- Status transitions via state machine, not arbitrary updates\n- AuditLog for all approval\u002Frejection operations\n\n### A05: Security Misconfiguration\n\n**Production checklist:**\n- [ ] `DEBUG = False`\n- [ ] `ALLOWED_HOSTS` explicitly set (not `['*']`)\n- [ ] `SECURE_SSL_REDIRECT = True`\n- [ ] `SESSION_COOKIE_SECURE = True`\n- [ ] `CSRF_COOKIE_SECURE = True`\n- [ ] `CSRF_COOKIE_HTTPONLY = True`\n- [ ] `X_FRAME_OPTIONS = 'DENY'` (anti-clickjacking)\n- [ ] `SECURE_HSTS_SECONDS = 31536000`\n- [ ] `INCLUDE_DEV_TOOLS = False` (CP-08)\n- [ ] Container runs as non-root (SEC-006)\n- [ ] `read_only: true` on container filesystem\n- [ ] Debug toolbar, silk, nplusone behind try\u002Fexcept ImportError\n\n### A07: Authentication Failures\n\n**Our auth model:**\n- Session-based (Redis backend), NOT JWT for web\n- CSRF token via HttpOnly cookie + `\u002Fapi\u002Fcsrf\u002F` endpoint\n- Account lockout: 10 attempts → 15 min block\n- Rate limiting: login 30\u002Fmin por IP (o escritório sai por um IP só) + bloqueio de conta (`ACCOUNT_LOCKOUT_THRESHOLD` 10 erros → 15 min); gcal_write 10\u002Fmin\n\n**Checklist:**\n- [ ] Login endpoint rate-limited (DRF throttle + Nginx)\n- [ ] Failed login attempts logged with IP + user-agent\n- [ ] Session cookie: `asv2sid`, age 7200s, SameSite=Lax\n- [ ] CSRF token refreshed after login\n- [ ] Logout clears session + CSRF cache\n\n### A08: Software and Data Integrity\n\n**Our supply chain:**\n- Docker images signed with Cosign (keyless OIDC)\n- SLSA provenance attestations\n- Trivy container scanning in CI\n- Gitleaks + TruffleHog secret detection\n- pip-audit for Python dependencies\n- npm audit for frontend dependencies\n\n### A09: Logging and Monitoring\n\n**Our logging:**\n- Structured JSON logging with request ID correlation\n- AuditLog model for approval\u002Frejection operations\n- Login\u002Flogout audit with IP + user-agent\n- Django-prometheus metrics at `\u002Fmetrics\u002F`\n\n**Security events to always log:**\n- Authentication failures (with IP)\n- Authorization failures (403s with user + resource)\n- CSRF failures\n- Rate limit triggers\n- OAuth token operations (create, refresh, revoke)\n\n## Secrets Management\n\n**Never commit:**\n- `.env` files with real credentials\n- `service_account.json` (Google)\n- `GCAL_ENCRYPTION_KEY` values\n- `SECRET_KEY` values\n- Database passwords\n\n**`.gitignore` already blocks** (`.env*` local variants and Google creds):\n```\n.env\n.env.local\n.env.*.local\n!.env.*.example\nservice_account.json\n*service_account.json\nbackend\u002Fservice_account.json   # v2\u002F.gitignore\n```\n\nVerify any new secret file is covered before committing — the ignore list is\nexplicit, not a blanket `.env.*`.\n",{"name":5,"description":7},"main","9e3a882d83e0853bdc570ae9d89c02d2a53bed82",".claude\u002Fskills\u002Fdjango-security","https:\u002F\u002Fgithub.com\u002Fmatheusnorjosa\u002Faprender_sistema","https:\u002F\u002Fgithub.com\u002Fmatheusnorjosa","Dev Python | IA | Automation | HTML | CSS | Data | Process | Projects","2026-11-11 08:34:26",{"source":8,"skillName":5,"commands":62,"prompt":72,"zipAvailable":73},[63,66,69],{"tool":64,"command":65},"npx","npx skills add matheusnorjosa\u002Faprender_sistema --skill django-security",{"tool":67,"command":68},"bunx","bunx skills add matheusnorjosa\u002Faprender_sistema --skill django-security",{"tool":70,"command":71},"pnpm","pnpm dlx skills add matheusnorjosa\u002Faprender_sistema --skill django-security","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmatheusnorjosa\u002Faprender_sistema\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdjango-security\u002FSKILL.md",true,[75,81,85],{"path":76,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":79,"sourceHtmlUrl":80},"reference\u002Frbac-idor.md","REFERENCE","参考文档",3918,"https:\u002F\u002Fgithub.com\u002Fmatheusnorjosa\u002Faprender_sistema\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fdjango-security\u002Freference\u002Frbac-idor.md",{"path":82,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":83,"sourceHtmlUrl":84},"references\u002Fdetailed-guide.md",4220,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-elon-musk\u002Freferences\u002Fdetailed-guide.md",{"path":86,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":87,"sourceHtmlUrl":88},"references\u002Ftechnical.md",3237,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-elon-musk\u002Freferences\u002Ftechnical.md",[90,126,149,170,182,209],{"skillNo":91,"name":92,"nameZh":6,"description":93,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":94,"categories":95,"keywords":106,"publishedAt":49},"01M6C0WHSP7S2QMJGGMQRXJ6PD","writing-standards","Apply AS v2 technical-writing standards (clarity, brevity, active voice, Python\u002FDjango conventions). Use when writing a README, a docstring (PEP 257), a commit message, a PR description, an error message, or any technical doc.","https:\u002F\u002Fgithub.com\u002Fmatheusnorjosa\u002Faprender_sistema\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fwriting-standards\u002FSKILL.md",[96,101],{"categoryNo":97,"categoryName":98,"taxonomyType":99,"taxonomyTypeDesc":100},"01JBSEEDCAT000000000000018","写作与文案","SCENARIO","使用场景",{"categoryNo":102,"categoryName":103,"taxonomyType":104,"taxonomyTypeDesc":105},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",[107,108,109,110,111,112,113,114,115,116,117,21,118,119,120,121,27,122,123,124,125,23],"writing","writing standards","standards","python","commit","pr","pr description","commit message","doc","voice","clarity","technical","README","message","active","error","technical-writing","brevity","docstring",{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":132,"publishedAt":49},"01M6C0WG2SBP9PJG1YQFGGVJAR","verification-gate","Verify before claiming success. Use when about to say something works\u002Fis done, after implementing a feature, after a bugfix, or before pushing — run the proof command and confirm output first.","https:\u002F\u002Fgithub.com\u002Fmatheusnorjosa\u002Faprender_sistema\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fverification-gate\u002FSKILL.md",[],[133,134,135,136,137,138,139,31,140,141,142,143,144,145,146,147,148,23],"verification","verification gate","gate","run","first","verify","command","verify before claiming","say","done","feature","proof","bugfix","output","about","implementing",{"skillNo":150,"name":151,"nameZh":6,"description":152,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":153,"categories":154,"keywords":158,"publishedAt":49},"01M6C0WE010G12KH45YZW6M7K5","test-driven-development","Write the failing test before the implementation in AS v2 (pytest + Django\u002FDRF). Use when implementing a feature or fixing a bug, before any production code is written.","https:\u002F\u002Fgithub.com\u002Fmatheusnorjosa\u002Faprender_sistema\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Ftest-driven-development\u002FSKILL.md",[155],{"categoryNo":156,"categoryName":157,"taxonomyType":99,"taxonomyTypeDesc":100},"01JBSEEDCAT000000000000008","测试与质量",[159,160,161,162,42,163,21,164,31,165,166,167,143,27,168,148,23,169],"test","test driven development","development","driven","Production","write","bug","implementation","pytest","drf","failing",{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":174,"categories":175,"keywords":176,"publishedAt":49},"01M6C0WC6Y81XRVBJQSTKA96XQ","subagent-development","Orquestra subagents no AS v2 — decompõe a tarefa em domínios independentes, paraleliza e revisa em 2 estágios. Use ao delegar exploração, implementação ou validação cross-arquivo para acelerar o trabalho e poupar o contexto principal.","https:\u002F\u002Fgithub.com\u002Fmatheusnorjosa\u002Faprender_sistema\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fsubagent-development\u002FSKILL.md",[],[161,177,178,179,180,31,181,27],"subagent","subagent development","para","subagents","ao",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":188,"publishedAt":49},"01M6C0W9W8D6JJWXW28Q7ZHAC9","security-scan","Automated security scanning for AS v2. Use before commits or when reviewing changes for vulnerabilities. Runs dependency audit (pip-audit, npm audit), secret detection (grep patterns), and code pattern scanning (SQL injection, XSS, eval, pickle, hardcoded secrets). Integrates with project hooks system.","https:\u002F\u002Fgithub.com\u002Fmatheusnorjosa\u002Faprender_sistema\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fsecurity-scan\u002FSKILL.md",[],[19,189,190,47,191,42,192,193,194,195,22,196,34,197,198,199,200,201,31,202,203,204,27,205,206,207,24,208,23],"security scan","scan","sql","npm","audit","dependency audit","detection","xss","pip-audit","commits","system","grep","eval","hooks","security scanning","project","with","true","pip","changes",{"skillNo":210,"name":211,"nameZh":6,"description":212,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":213,"categories":214,"keywords":218,"publishedAt":49},"01M6C0W7RE3G3C2852YXQKR5J9","resume-handoff","Resume work from a saved handoff document, validating its state against the current codebase before continuing. Use when resuming work from a saved handoff after a context clear or in a new session (path, session name, or GitHub issue).","https:\u002F\u002Fgithub.com\u002Fmatheusnorjosa\u002Faprender_sistema\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fresume-handoff\u002FSKILL.md",[215],{"categoryNo":216,"categoryName":217,"taxonomyType":104,"taxonomyTypeDesc":105},"01JBSEEDCAT000000000000038","人力资源",[219,220,221,222,223,224,225,226,32,31,227,228,229,230,231,232,233,234,23,235],"handoff","resume handoff","resume","github","state","new session","work","context","github issue","issue","document","clear","name","saved","codebase","resuming","new"]