[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6C69RYKQDPM0C1QGJZ8B4ZV":3,"skill-same:01M6C69RYKQDPM0C1QGJZ8B4ZV":76},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":40,"linkOnly":41,"markdownContent":42,"markdownBody":43,"frontMatter":44,"refName":45,"commitSha":46,"skillDirectory":47,"forksCount":48,"repositoryHtmlUrl":49,"repositoryHomepageUrl":6,"ownerHtmlUrl":50,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":51,"install":52,"resources":65},"01M6C69RYKQDPM0C1QGJZ8B4ZV","security-and-hardening",null,"Hardens code against vulnerabilities. Use when handling user input, authentication, data storage, or external integrations. The non-negotiable security MUSTs live in `.agents\u002Frules\u002Fsecurity-baseline.md`; this skill shows how to apply them, with the project's surfacing and validation-response process.","dsj1984\u002Fmandrel","dsj1984","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F20933070?v=4","01M6C69AY3555XWE3QAXETZH6W","01M6C69B26E25DHM9NTPQ7TZQ9",7,"MIT","https:\u002F\u002Fgithub.com\u002Fdsj1984\u002Fmandrel\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fcore\u002Fsecurity-and-hardening\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39],"hardening","security","security and hardening","Rules","when","apply","with","how to","data storage","project","use","process","user","integrations","how","baseline","data","validation","authentication","code","storage","vulnerabilities","2026-11-10 10:12:30",false,"---\nname: security-and-hardening\ndescription:\n  Hardens code against vulnerabilities. Use when handling user input,\n  authentication, data storage, or external integrations. The non-negotiable\n  security MUSTs live in `.agents\u002Frules\u002Fsecurity-baseline.md`; this skill shows\n  how to apply them, with the project's surfacing and validation-response\n  process.\n---\n\n# Security and Hardening\n\n## Policy Capsule\n\n- The non-negotiable security MUSTs — input validation, authentication, authorization, output\u002Frendering, data-leakage & logging, transport & headers, secrets, dependency hygiene, and forbidden practices — live in [`.agents\u002Frules\u002Fsecurity-baseline.md`](..\u002F..\u002F..\u002Frules\u002Fsecurity-baseline.md); that rule is the SSOT and wins on conflict. Read it for the **what**; this skill is the **how** and the process.\n- Do **not** restate a baseline MUST here or work around one in code — open a PR against the rule instead. The baseline is inviolable ([`instructions.md` § 1.K](..\u002F..\u002F..\u002Finstructions.md)); no skill relaxes it.\n- Surface security-expanding changes — new auth flows, new PII categories, new external integrations, CORS \u002F rate-limit changes, file uploads, elevated permissions — under a \"Security surface\" section in the PR body and on the ticket, label the change `risk::high`, and link the relevant baseline MUST.\n- Surfacing **documents** the surface; it does **not** pause execution. `agent::blocked` is the only runtime pause label, reserved for unrecoverable blockers — never for \"this change is sensitive.\"\n- For validation-error responses (status code and envelope), cite [`.agents\u002Frules\u002Fapi-conventions.md`](..\u002F..\u002F..\u002Frules\u002Fapi-conventions.md) — validation failures return **400** `VALIDATION_ERROR` in the canonical envelope. Do not carry a divergent inline status here.\n- Open a `reference.md` section only when the task actually engages it (index below).\n\nThe MUSTs themselves are the SSOT in\n[`security-baseline.md`](..\u002F..\u002F..\u002Frules\u002Fsecurity-baseline.md). When the rule and\nthis skill diverge, the rule wins.\n\n## Long-form reference — read on demand\n\nThe capsule above is the contract and the whole always-read surface of this\nskill. The project-specific process material behind it lives in the on-demand\nsibling [`reference.md`](reference.md), matching the split the always-on rules\nuse ([`rules\u002Fgit-conventions.md`](..\u002F..\u002F..\u002Frules\u002Fgit-conventions.md) ⇄\n[`git-conventions-reference.md`](..\u002F..\u002F..\u002Frules\u002Fgit-conventions-reference.md)).\nActivating this skill costs the capsule; open a section below only when the\ntask engages it.\n\n- [Security Surfacing, Not Runtime Pause](reference.md#security-surfacing-not-runtime-pause)\n- [Validation-Error Responses](reference.md#validation-error-responses)\n","# Security and Hardening\n\n## Policy Capsule\n\n- The non-negotiable security MUSTs — input validation, authentication, authorization, output\u002Frendering, data-leakage & logging, transport & headers, secrets, dependency hygiene, and forbidden practices — live in [`.agents\u002Frules\u002Fsecurity-baseline.md`](..\u002F..\u002F..\u002Frules\u002Fsecurity-baseline.md); that rule is the SSOT and wins on conflict. Read it for the **what**; this skill is the **how** and the process.\n- Do **not** restate a baseline MUST here or work around one in code — open a PR against the rule instead. The baseline is inviolable ([`instructions.md` § 1.K](..\u002F..\u002F..\u002Finstructions.md)); no skill relaxes it.\n- Surface security-expanding changes — new auth flows, new PII categories, new external integrations, CORS \u002F rate-limit changes, file uploads, elevated permissions — under a \"Security surface\" section in the PR body and on the ticket, label the change `risk::high`, and link the relevant baseline MUST.\n- Surfacing **documents** the surface; it does **not** pause execution. `agent::blocked` is the only runtime pause label, reserved for unrecoverable blockers — never for \"this change is sensitive.\"\n- For validation-error responses (status code and envelope), cite [`.agents\u002Frules\u002Fapi-conventions.md`](..\u002F..\u002F..\u002Frules\u002Fapi-conventions.md) — validation failures return **400** `VALIDATION_ERROR` in the canonical envelope. Do not carry a divergent inline status here.\n- Open a `reference.md` section only when the task actually engages it (index below).\n\nThe MUSTs themselves are the SSOT in\n[`security-baseline.md`](..\u002F..\u002F..\u002Frules\u002Fsecurity-baseline.md). When the rule and\nthis skill diverge, the rule wins.\n\n## Long-form reference — read on demand\n\nThe capsule above is the contract and the whole always-read surface of this\nskill. The project-specific process material behind it lives in the on-demand\nsibling [`reference.md`](reference.md), matching the split the always-on rules\nuse ([`rules\u002Fgit-conventions.md`](..\u002F..\u002F..\u002Frules\u002Fgit-conventions.md) ⇄\n[`git-conventions-reference.md`](..\u002F..\u002F..\u002Frules\u002Fgit-conventions-reference.md)).\nActivating this skill costs the capsule; open a section below only when the\ntask engages it.\n\n- [Security Surfacing, Not Runtime Pause](reference.md#security-surfacing-not-runtime-pause)\n- [Validation-Error Responses](reference.md#validation-error-responses)\n",{"name":5,"description":7},"main","1ebd42c768218cb54c92d3dfd25b42c9ec41c85c",".agents\u002Fskills\u002Fcore\u002Fsecurity-and-hardening",1,"https:\u002F\u002Fgithub.com\u002Fdsj1984\u002Fmandrel","https:\u002F\u002Fgithub.com\u002Fdsj1984","2026-11-13 20:41:44",{"source":8,"skillName":5,"commands":53,"prompt":63,"zipAvailable":64},[54,57,60],{"tool":55,"command":56},"npx","npx skills add dsj1984\u002Fmandrel --skill security-and-hardening",{"tool":58,"command":59},"bunx","bunx skills add dsj1984\u002Fmandrel --skill security-and-hardening",{"tool":61,"command":62},"pnpm","pnpm dlx skills add dsj1984\u002Fmandrel --skill security-and-hardening","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fdsj1984\u002Fmandrel\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fcore\u002Fsecurity-and-hardening\u002FSKILL.md",true,[66,72],{"path":67,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":70,"sourceHtmlUrl":71},"reference.md","REFERENCE","参考文档",2373,"https:\u002F\u002Fgithub.com\u002Fdsj1984\u002Fmandrel\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fcore\u002Fsecurity-and-hardening\u002Freference.md",{"path":73,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":74,"sourceHtmlUrl":75},"resources\u002Fimplementation-playbook.md",19020,"https:\u002F\u002Fgithub.com\u002Fboisenoise\u002Fskills-collections\u002Fblob\u002Fmain\u002Fskills\u002Fantigravity-team-collaboration-issue\u002Fresources\u002Fimplementation-playbook.md",[77,93,130,164,185,202],{"skillNo":78,"name":79,"nameZh":6,"description":80,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":81,"categories":82,"keywords":88,"publishedAt":40},"01M6C6A5QVWE0AEWJYC362G9BY","no-capsule-skill","Fixture without a Policy Capsule section.","https:\u002F\u002Fgithub.com\u002Fdsj1984\u002Fmandrel\u002Fblob\u002Fmain\u002Ftests\u002Forchestration\u002Ffixtures\u002Fskill-capsule\u002Fno-capsule-skill\u002FSKILL.md",[83],{"categoryNo":84,"categoryName":85,"taxonomyType":86,"taxonomyTypeDesc":87},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[89,90,91,92],"no capsule skill","policy","fixture","section",{"skillNo":94,"name":95,"nameZh":6,"description":96,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":97,"categories":98,"keywords":103,"publishedAt":40},"01M6C6A2VK7QVY7H5NC6SG89DT","qa-harness","Conventions for agent-driven QA driving — the one driving-conventions reference behind both `\u002Fqa-run` (the known-scenario sweep through a real browser) and `\u002Fqa-explore` (agent-led exploratory driving). Use when instrumenting a live surface — covers navigation-first execution, per-surface console and network capture, design-token visual checks, the `F#` finding shape, per-environment resolution, and static driving as the documented interim. The run procedures live in `.agents\u002Fworkflows\u002Fqa-run.md` and `.agents\u002Fworkflows\u002Fqa-explore.md`; this skill is the conventions reference they lean on.","https:\u002F\u002Fgithub.com\u002Fdsj1984\u002Fmandrel\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fstack\u002Fqa\u002Fqa-harness\u002FSKILL.md",[99,102],{"categoryNo":100,"categoryName":101,"taxonomyType":86,"taxonomyTypeDesc":87},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":84,"categoryName":85,"taxonomyType":86,"taxonomyTypeDesc":87},[104,105,106,107,108,109,110,111,112,113,114,115,116,117,118,119,28,120,121,122,123,124,125,126,127,128,129,22],"qa","harness","qa harness","design","workflows","run","console","browser","network","execution","first","explore","sweep","capture","environment","lean","shape","reference","navigation","real browser","token","live","scenario","as","for","static",{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":144,"publishedAt":40},"01M6C6A01GDNYJWG3647322JR3","playwright","Robust E2E browser testing with Playwright. Use when writing browser-driven tests — leverage auto-waiting (no `waitForTimeout`), prefer user-visible locators (`getByRole`, `getByText`, `getByLabel`) over CSS\u002FXPath, reuse `storageState` for auth, and enable trace-on-first-retry for CI debugging. Also carries the `data-testid` contract a UI change states in its acceptance criteria.","https:\u002F\u002Fgithub.com\u002Fdsj1984\u002Fmandrel\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fstack\u002Fqa\u002Fplaywright\u002FSKILL.md",[136,139],{"categoryNo":137,"categoryName":138,"taxonomyType":86,"taxonomyTypeDesc":87},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":140,"categoryName":141,"taxonomyType":142,"taxonomyTypeDesc":143},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[132,145,146,147,148,149,150,151,111,152,153,154,34,155,114,156,30,28,157,158,159,160,161,162,163,128,22],"testing","writing","css","change","auth","debugging","acceptance","browser testing","ui","ci","e2e","trace","auto","contract","tests","leverage","reuse","states","retry",{"skillNo":165,"name":166,"nameZh":6,"description":167,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":168,"categories":169,"keywords":171,"publishedAt":40},"01M6C69Y3SR8BJ8XRT0E0S6Z4S","playwright-bdd","Wires Gherkin `.feature` files to Playwright via the `playwright-bdd` library. Use when running BDD scenarios on a Playwright runtime — pairs with the `gherkin-authoring` skill (scenario prose) and the `playwright` skill (browser conventions). Drives execution by tag expression with trace-first debugging and Playwright-native sharding.","https:\u002F\u002Fgithub.com\u002Fdsj1984\u002Fmandrel\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fstack\u002Fqa\u002Fplaywright-bdd\u002FSKILL.md",[170],{"categoryNo":137,"categoryName":138,"taxonomyType":86,"taxonomyTypeDesc":87},[132,172,173,150,111,174,113,114,156,28,175,176,177,178,179,180,181,182,24,183,22,184],"bdd","playwright bdd","library","bdd scenarios","files","runtime","feature","authoring","expression","via","native","Sharding","running",{"skillNo":186,"name":187,"nameZh":6,"description":188,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":189,"categories":190,"keywords":191,"publishedAt":40},"01M6C69VESMZC07ACCXGJ1MQ8W","gherkin-authoring","Authors `.feature` files that stay business-readable, translate cleanly from PRD acceptance criteria, and reuse a shared step-definition library. Use when writing or editing scenarios — the SSOT enforcement rules live in `.agents\u002Frules\u002Fgherkin-standards.md`; this skill shows authors how to apply them.","https:\u002F\u002Fgithub.com\u002Fdsj1984\u002Fmandrel\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fstack\u002Fqa\u002Fgherkin-authoring\u002FSKILL.md",[],[192,179,146,193,151,174,194,32,21,195,196,28,197,198,176,199,200,178,25,161,201,23,22],"gherkin authoring","translate","prd","editing","business","standards","enforcement","acceptance criteria","shared","definition",{"skillNo":203,"name":204,"nameZh":6,"description":205,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":206,"categories":207,"keywords":208,"publishedAt":40},"01M6C69Q97BQRDAV6RZ3K05K2H","idea-refinement","Refines ideas iteratively. Refine ideas through structured divergent and convergent thinking. Use \"idea-refine\" or \"ideate\" to trigger.","https:\u002F\u002Fgithub.com\u002Fdsj1984\u002Fmandrel\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fcore\u002Fidea-refinement\u002FSKILL.md",[],[209,210,211,212,28,213,214,215,216,217],"idea refinement","idea","refinement","ideate","thinking","refine","ideas","structured","trigger"]