[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6CXCM000K3VHS6H5BVPYF63":3,"skill-same:01M6CXCM000K3VHS6H5BVPYF63":89},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":55,"commitSha":56,"skillDirectory":57,"forksCount":58,"repositoryHtmlUrl":59,"repositoryHomepageUrl":60,"ownerHtmlUrl":61,"ownerBlogUrl":62,"ownerDescription":63,"updatedAt":64,"install":65,"resources":78},"01M6CXCM000K3VHS6H5BVPYF63","security-audit",null,"Audit codebases and infrastructure for security issues. Use when scanning dependencies for vulnerabilities, detecting hardcoded secrets, checking OWASP top 10 issues, verifying SSL\u002FTLS, auditing file permissions, or reviewing code for injection and auth flaws.","albertdobmeyer\u002Fopentrapp","albertdobmeyer","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F116975874?v=4","01M6CXARYAZ30V12S7PSG93R84","Albert Dobmeyer","01M6CXAS2FG5GCXZYN3XBFJQV6",2,"MIT","https:\u002F\u002Fgithub.com\u002Falbertdobmeyer\u002Fopentrapp\u002Fblob\u002Fmain\u002Fworkloads\u002Fskills\u002Fskills\u002Fsecurity-audit\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"security","security audit","audit","ssl","scanning","use","secrets","linux","injection","tls","openssl","owasp","infrastructure","auth","issues","permissions","win32","git","code","owasp top 10","2026-11-10 10:12:30",false,"---\nname: security-audit\nversion: 1.0.0\ndescription: Audit codebases and infrastructure for security issues. Use when scanning dependencies for vulnerabilities, detecting hardcoded secrets, checking OWASP top 10 issues, verifying SSL\u002FTLS, auditing file permissions, or reviewing code for injection and auth flaws.\nmetadata: {\"clawdbot\":{\"emoji\":\"?\",\"requires\":{\"anyBins\":[\"npm\",\"pip\",\"git\",\"openssl\",\"curl\"]},\"os\":[\"linux\",\"darwin\",\"win32\"]}}\n---\n\n# Security Audit\n\nScan, detect, and fix security issues in codebases and infrastructure. Covers dependency vulnerabilities, secret detection, OWASP top 10, SSL\u002FTLS verification, file permissions, and secure coding patterns.\n\n## When to Use\n\n- Scanning project dependencies for known vulnerabilities\n- Detecting hardcoded secrets, API keys, or credentials in source code\n- Reviewing code for OWASP top 10 vulnerabilities (injection, XSS, CSRF, etc.)\n- Verifying SSL\u002FTLS configuration for endpoints\n- Auditing file and directory permissions\n- Checking authentication and authorization patterns\n- Preparing for a security review or compliance audit\n\n## Dependency Vulnerability Scanning\n\n### Node.js\n\n```bash\n# Built-in npm audit\nnpm audit\nnpm audit --json | jq '.vulnerabilities | to_entries[] | {name: .key, severity: .value.severity, via: .value.via[0]}'\n\n# Fix automatically where possible\nnpm audit fix\n\n# Show only high and critical\nnpm audit --audit-level=high\n\n# Check a specific package\nnpm audit --package-lock-only\n\n# Alternative: use npx to scan without installing\nnpx audit-ci --high\n```\n\n### Python\n\n```bash\n# pip-audit (recommended)\npip install pip-audit\npip-audit\npip-audit -r requirements.txt\npip-audit --format=json\n\n# safety (alternative)\npip install safety\nsafety check\nsafety check -r requirements.txt --json\n\n# Check a specific package\npip-audit --requirement=- \u003C\u003C\u003C \"requests==2.25.0\"\n```\n\n### Go\n\n```bash\n# Built-in vuln checker\ngo install golang.org\u002Fx\u002Fvuln\u002Fcmd\u002Fgovulncheck@latest\ngovulncheck .\u002F...\n\n# Check specific binary\ngovulncheck -mode=binary .\u002Fmyapp\n```\n\n### Rust\n\n```bash\n# cargo-audit\ncargo install cargo-audit\ncargo audit\n\n# With fix suggestions\ncargo audit fix\n```\n\n### Universal: Trivy (scans any project)\n\n```bash\n# Install: https:\u002F\u002Faquasecurity.github.io\u002Ftrivy\n# Scan filesystem\ntrivy fs .\n\n# Scan specific language\ntrivy fs --scanners vuln --severity HIGH,CRITICAL .\n\n# Scan Docker image\ntrivy image myapp:latest\n\n# JSON output\ntrivy fs --format json -o results.json .\n```\n\n## Secret Detection\n\n### Manual grep patterns\n\n```bash\n# AWS keys\ngrep -rn 'AKIA[0-9A-Z]\\{16\\}' --include='*.{js,ts,py,go,java,rb,env,yml,yaml,json,xml,cfg,conf,ini}' .\n\n# Generic API keys and tokens\ngrep -rn -i 'api[_-]\\?key\\|api[_-]\\?secret\\|access[_-]\\?token\\|auth[_-]\\?token\\|bearer ' \\\n  --include='*.{js,ts,py,go,java,rb,env,yml,yaml,json}' .\n\n# Private keys\ngrep -rn 'BEGIN.*PRIVATE KEY' .\n\n# Passwords in config\ngrep -rn -i 'password\\s*[:=]' --include='*.{env,yml,yaml,json,xml,cfg,conf,ini,toml}' .\n\n# Connection strings with credentials\ngrep -rn -i 'mongodb:\u002F\u002F\\|mysql:\u002F\u002F\\|postgres:\u002F\u002F\\|redis:\u002F\u002F' --include='*.{js,ts,py,go,env,yml,yaml,json}' . | grep -v 'localhost\\|127.0.0.1\\|example'\n\n# JWT tokens (three base64 segments separated by dots)\ngrep -rn 'eyJ[A-Za-z0-9_-]*\\.eyJ[A-Za-z0-9_-]*\\.' --include='*.{js,ts,py,go,log,json}' .\n```\n\n### Automated scanning with git\n\n```bash\n# Scan git history for secrets (not just current files)\n# Using git log + grep\ngit log -p --all | grep -n -i 'api.key\\|password\\|secret\\|token' | head -50\n\n# Check staged files before commit\ngit diff --cached --name-only | xargs grep -l -i 'api.key\\|password\\|secret\\|token' 2>\u002Fdev\u002Fnull\n```\n\n### Pre-commit hook for secrets\n\n```bash\n#!\u002Fbin\u002Fbash\n# .git\u002Fhooks\u002Fpre-commit - Block commits containing potential secrets\n\nPATTERNS=(\n    'AKIA[0-9A-Z]{16}'\n    'BEGIN.*PRIVATE KEY'\n    'password\\s*[:=]\\s*[\"\\x27][^\"\\x27]+'\n    'api[_-]?key\\s*[:=]\\s*[\"\\x27][^\"\\x27]+'\n    'sk-[A-Za-z0-9]{20,}'\n    'ghp_[A-Za-z0-9]{36}'\n    'xox[bpoas]-[A-Za-z0-9-]+'\n)\n\nSTAGED_FILES=$(git diff --cached --name-only --diff-filter=ACM)\n[ -z \"$STAGED_FILES\" ] && exit 0\n\nEXIT_CODE=0\nfor pattern in \"${PATTERNS[@]}\"; do\n    matches=$(echo \"$STAGED_FILES\" | xargs grep -Pn \"$pattern\" 2>\u002Fdev\u002Fnull)\n    if [ -n \"$matches\" ]; then\n        echo \"BLOCKED: Potential secret detected matching pattern: $pattern\"\n        echo \"$matches\"\n        EXIT_CODE=1\n    fi\ndone\n\nif [ $EXIT_CODE -ne 0 ]; then\n    echo \"\"\n    echo \"To proceed anyway: git commit --no-verify\"\n    echo \"To remove secrets: replace with environment variables\"\nfi\nexit $EXIT_CODE\n```\n\n### .gitignore audit\n\n```bash\n# Check if sensitive files are tracked\necho \"--- Files that should probably be gitignored ---\"\nfor pattern in '.env' '.env.*' '*.pem' '*.key' '*.p12' '*.pfx' 'credentials.json' \\\n               'service-account*.json' '*.keystore' 'id_rsa' 'id_ed25519'; do\n    found=$(git ls-files \"$pattern\" 2>\u002Fdev\u002Fnull)\n    [ -n \"$found\" ] && echo \"  TRACKED: $found\"\ndone\n\n# Check if .gitignore exists and has common patterns\nif [ ! -f .gitignore ]; then\n    echo \"WARNING: No .gitignore file found\"\nelse\n    for entry in '.env' 'node_modules' '*.key' '*.pem'; do\n        grep -q \"$entry\" .gitignore || echo \"  MISSING from .gitignore: $entry\"\n    done\nfi\n```\n\n## OWASP Top 10 Code Patterns\n\n### 1. Injection (SQL, Command, LDAP)\n\n```bash\n# SQL injection: string concatenation in queries\ngrep -rn \"query\\|execute\\|cursor\" --include='*.{py,js,ts,go,java,rb}' . | \\\n  grep -i \"f\\\"\\|format(\\|%s\\|\\${\\|+ \\\"\\|concat\\|sprintf\" | \\\n  grep -iv \"parameterized\\|placeholder\\|prepared\"\n\n# Command injection: user input in shell commands\ngrep -rn \"exec(\\|spawn(\\|system(\\|popen(\\|subprocess\\|os\\.system\\|child_process\" \\\n  --include='*.{py,js,ts,go,java,rb}' .\n\n# Check for parameterized queries (good)\ngrep -rn \"\\\\$[0-9]\\|\\\\?\\|%s\\|:param\\|@param\\|prepared\" --include='*.{py,js,ts,go,java,rb}' .\n```\n\n### 2. Broken Authentication\n\n```bash\n# Weak password hashing (MD5, SHA1 used for passwords)\ngrep -rn \"md5\\|sha1\\|sha256\" --include='*.{py,js,ts,go,java,rb}' . | grep -i \"password\\|passwd\"\n\n# Hardcoded credentials\ngrep -rn -i \"admin.*password\\|password.*admin\\|default.*password\" \\\n  --include='*.{py,js,ts,go,java,rb,yml,yaml,json}' .\n\n# Session tokens in URLs\ngrep -rn \"session\\|token\\|jwt\" --include='*.{py,js,ts,go,java,rb}' . | grep -i \"url\\|query\\|param\\|GET\"\n\n# Check for rate limiting on auth endpoints\ngrep -rn -i \"rate.limit\\|throttle\\|brute\" --include='*.{py,js,ts,go,java,rb}' .\n```\n\n### 3. Cross-Site Scripting (XSS)\n\n```bash\n# Unescaped output in templates\ngrep -rn \"innerHTML\\|dangerouslySetInnerHTML\\|v-html\\|\\|html(\" \\\n  --include='*.{js,ts,jsx,tsx,vue,html}' .\n\n# Template injection\ngrep -rn \"{{{.*}}}\\|\u003C%=\\|\u003C%-\\|\\$\\!{\" --include='*.{html,ejs,hbs,pug,erb}' .\n\n# Document.write\ngrep -rn \"document\\.write\\|document\\.writeln\" --include='*.{js,ts,html}' .\n\n# eval with user input\ngrep -rn \"eval(\\|new Function(\\|setTimeout.*string\\|setInterval.*string\" \\\n  --include='*.{js,ts}' .\n```\n\n### 4. Insecure Direct Object References\n\n```bash\n# Direct ID usage in routes without authz check\ngrep -rn \"params\\.id\\|params\\[.id.\\]\\|req\\.params\\.\\|request\\.args\\.\\|request\\.GET\\.\" \\\n  --include='*.{py,js,ts,go,java,rb}' . | \\\n  grep -i \"user\\|account\\|profile\\|order\\|document\"\n```\n\n### 5. Security Misconfiguration\n\n```bash\n# CORS wildcard\ngrep -rn \"Access-Control-Allow-Origin.*\\*\\|cors({.*origin.*true\\|cors()\" \\\n  --include='*.{py,js,ts,go,java,rb}' .\n\n# Debug mode in production configs\ngrep -rn \"DEBUG\\s*=\\s*True\\|debug:\\s*true\\|NODE_ENV.*development\" \\\n  --include='*.{py,js,ts,yml,yaml,json,env}' .\n\n# Verbose error messages exposed to clients\ngrep -rn \"stack\\|traceback\\|stackTrace\" --include='*.{py,js,ts,go,java,rb}' . | \\\n  grep -i \"response\\|send\\|return\\|res\\.\"\n```\n\n## SSL\u002FTLS Verification\n\n### Check endpoint SSL\n\n```bash\n# Full SSL check\nopenssl s_client -connect example.com:443 -servername example.com \u003C \u002Fdev\u002Fnull 2>\u002Fdev\u002Fnull | \\\n  openssl x509 -noout -subject -issuer -dates -fingerprint\n\n# Check certificate expiry\necho | openssl s_client -connect example.com:443 -servername example.com 2>\u002Fdev\u002Fnull | \\\n  openssl x509 -noout -enddate\n\n# Check supported TLS versions\nfor v in tls1 tls1_1 tls1_2 tls1_3; do\n  result=$(openssl s_client -connect example.com:443 -$v \u003C \u002Fdev\u002Fnull 2>&1)\n  if echo \"$result\" | grep -q \"Cipher is\"; then\n    echo \"$v: SUPPORTED\"\n  else\n    echo \"$v: NOT SUPPORTED\"\n  fi\ndone\n\n# Check cipher suites\nopenssl s_client -connect example.com:443 -cipher 'ALL' \u003C \u002Fdev\u002Fnull 2>&1 | \\\n  grep \"Cipher    :\"\n\n# Check for weak ciphers\nopenssl s_client -connect example.com:443 -cipher 'NULL:EXPORT:DES:RC4:MD5' \u003C \u002Fdev\u002Fnull 2>&1 | \\\n  grep \"Cipher    :\"\n```\n\n### Verify certificate chain\n\n```bash\n# Download and verify full chain\nopenssl s_client -connect example.com:443 -showcerts \u003C \u002Fdev\u002Fnull 2>\u002Fdev\u002Fnull | \\\n  awk '\u002FBEGIN CERTIFICATE\u002F,\u002FEND CERTIFICATE\u002F{print}' > chain.pem\n\n# Verify chain\nopenssl verify -CAfile \u002Fetc\u002Fssl\u002Fcerts\u002Fca-certificates.crt chain.pem\n\n# Check certificate details\nopenssl x509 -in chain.pem -noout -text | grep -A2 \"Subject:\\|Issuer:\\|Not Before\\|Not After\\|DNS:\"\n```\n\n### Check SSL from code\n\n```bash\n# Verify SSL isn't disabled in code\ngrep -rn \"verify\\s*=\\s*False\\|rejectUnauthorized.*false\\|InsecureSkipVerify.*true\\|CURLOPT_SSL_VERIFYPEER.*false\\|NODE_TLS_REJECT_UNAUTHORIZED.*0\" \\\n  --include='*.{py,js,ts,go,java,rb,yml,yaml}' .\n```\n\n## File Permission Audit\n\n```bash\n# Find world-writable files\nfind . -type f -perm -o=w -not -path '*\u002Fnode_modules\u002F*' -not -path '*\u002F.git\u002F*' 2>\u002Fdev\u002Fnull\n\n# Find executable files that shouldn't be\nfind . -type f -perm -u=x -not -name '*.sh' -not -name '*.py' -not -path '*\u002Fnode_modules\u002F*' \\\n  -not -path '*\u002F.git\u002F*' -not -path '*\u002Fbin\u002F*' 2>\u002Fdev\u002Fnull\n\n# Check sensitive file permissions\nfor f in .env .env.* *.pem *.key *.p12 id_rsa id_ed25519; do\n    [ -f \"$f\" ] && ls -la \"$f\"\ndone\n\n# Find files with SUID\u002FSGID bits (Linux)\nfind \u002F -type f \\( -perm -4000 -o -perm -2000 \\) 2>\u002Fdev\u002Fnull | head -20\n\n# Check SSH key permissions\nif [ -d ~\u002F.ssh ]; then\n    echo \"--- SSH directory permissions ---\"\n    ls -la ~\u002F.ssh\u002F\n    echo \"\"\n    # Should be: dir=700, private keys=600, public keys=644, config=600\n    [ \"$(stat -c %a ~\u002F.ssh 2>\u002Fdev\u002Fnull || stat -f %Lp ~\u002F.ssh)\" != \"700\" ] && echo \"WARNING: ~\u002F.ssh should be 700\"\nfi\n```\n\n## Full Project Security Audit Script\n\n```bash\n#!\u002Fbin\u002Fbash\n# security-audit.sh - Run a comprehensive security check on a project\nset -euo pipefail\n\nPROJECT_DIR=\"${1:-.}\"\ncd \"$PROJECT_DIR\"\n\necho \"=========================================\"\necho \"Security Audit: $(basename \"$(pwd)\")\"\necho \"Date: $(date -u '+%Y-%m-%dT%H:%M:%SZ')\"\necho \"=========================================\"\necho \"\"\n\nISSUES=0\nwarn() { echo \"  [!] $1\"; ((ISSUES++)); }\nok() { echo \"  [OK] $1\"; }\nsection() { echo \"\"; echo \"--- $1 ---\"; }\n\n# 1. Secrets detection\nsection \"Secret Detection\"\nfor pattern in 'AKIA[0-9A-Z]\\{16\\}' 'BEGIN.*PRIVATE KEY' 'sk-[A-Za-z0-9]\\{20,\\}' \\\n               'ghp_[A-Za-z0-9]\\{36\\}' 'xox[bpoas]-'; do\n    count=$(grep -rn \"$pattern\" --include='*.{js,ts,py,go,java,rb,env,yml,yaml,json,xml}' . 2>\u002Fdev\u002Fnull | \\\n            grep -v 'node_modules\\|\\.git\\|vendor\\|__pycache__' | wc -l)\n    if [ \"$count\" -gt 0 ]; then\n        warn \"Found $count matches for pattern: $pattern\"\n    fi\ndone\ngrep -rn -i 'password\\s*[:=]\\s*[\"'\"'\"'][^\"'\"'\"']*[\"'\"'\"']' \\\n  --include='*.{js,ts,py,go,yml,yaml,json,env}' . 2>\u002Fdev\u002Fnull | \\\n  grep -v 'node_modules\\|\\.git\\|example\\|test\\|mock\\|placeholder\\|changeme\\|xxxx' | \\\n  while read -r line; do warn \"Hardcoded password: $line\"; done\n\n# 2. Dependency audit\nsection \"Dependency Vulnerabilities\"\nif [ -f package-lock.json ] || [ -f package.json ]; then\n    npm audit --audit-level=high 2>\u002Fdev\u002Fnull && ok \"npm: no high\u002Fcritical vulns\" || warn \"npm audit found issues\"\nfi\nif [ -f requirements.txt ]; then\n    pip-audit -r requirements.txt 2>\u002Fdev\u002Fnull && ok \"pip: no known vulns\" || warn \"pip-audit found issues\"\nfi\nif [ -f go.sum ]; then\n    govulncheck .\u002F... 2>\u002Fdev\u002Fnull && ok \"Go: no known vulns\" || warn \"govulncheck found issues\"\nfi\n\n# 3. Gitignore check\nsection \".gitignore Coverage\"\nif [ ! -f .gitignore ]; then\n    warn \"No .gitignore file\"\nelse\n    for entry in '.env' 'node_modules' '*.key' '*.pem' '.DS_Store'; do\n        grep -q \"$entry\" .gitignore 2>\u002Fdev\u002Fnull && ok \".gitignore has $entry\" || warn \".gitignore missing: $entry\"\n    done\nfi\n\n# 4. SSL verification disabled\nsection \"SSL Verification\"\ndisabled=$(grep -rn \"verify\\s*=\\s*False\\|rejectUnauthorized.*false\\|InsecureSkipVerify.*true\" \\\n  --include='*.{py,js,ts,go,java,rb}' . 2>\u002Fdev\u002Fnull | \\\n  grep -v 'node_modules\\|\\.git\\|test\\|spec\\|mock' | wc -l)\n[ \"$disabled\" -gt 0 ] && warn \"SSL verification disabled in $disabled location(s)\" || ok \"No SSL bypasses found\"\n\n# 5. CORS wildcard\nsection \"CORS Configuration\"\ncors=$(grep -rn \"Access-Control-Allow-Origin.*\\*\\|cors({.*origin.*true\" \\\n  --include='*.{py,js,ts,go,java,rb}' . 2>\u002Fdev\u002Fnull | \\\n  grep -v 'node_modules\\|\\.git' | wc -l)\n[ \"$cors\" -gt 0 ] && warn \"CORS wildcard found in $cors location(s)\" || ok \"No CORS wildcard\"\n\n# 6. Debug mode\nsection \"Debug\u002FDevelopment Settings\"\ndebug=$(grep -rn \"DEBUG\\s*=\\s*True\\|debug:\\s*true\" \\\n  --include='*.{py,yml,yaml,json}' . 2>\u002Fdev\u002Fnull | \\\n  grep -v 'node_modules\\|\\.git\\|test\\|jest\\|vitest' | wc -l)\n[ \"$debug\" -gt 0 ] && warn \"Debug mode enabled in $debug location(s)\" || ok \"No debug flags found\"\n\necho \"\"\necho \"=========================================\"\necho \"Audit complete. Issues found: $ISSUES\"\necho \"=========================================\"\n[ \"$ISSUES\" -eq 0 ] && exit 0 || exit 1\n```\n\n## Secure Coding Quick Reference\n\n### Environment variables instead of hardcoded secrets\n\n```bash\n# Bad: hardcoded in source\nAPI_KEY=\"sk-abc123...\"\n\n# Good: from environment\nAPI_KEY=\"${API_KEY:?Error: API_KEY not set}\"\n\n# Good: from .env file (loaded at startup, never committed)\n# .env\nAPI_KEY=sk-abc123...\n# .gitignore\n.env\n```\n\n### Input validation checklist\n\n```\n- [ ] All user input validated (type, length, format)\n- [ ] SQL queries use parameterized statements (never string concat)\n- [ ] Shell commands never include user input directly\n- [ ] File paths validated (no path traversal: ..\u002F)\n- [ ] URLs validated (no SSRF: restrict to expected domains)\n- [ ] HTML output escaped (no XSS: use framework auto-escaping)\n- [ ] JSON parsing has error handling (no crash on malformed input)\n- [ ] File uploads checked (type, size, no executable content)\n```\n\n### HTTP security headers\n\n```bash\n# Check security headers on a URL\ncurl -sI https:\u002F\u002Fexample.com | grep -i 'strict-transport\\|content-security\\|x-frame\\|x-content-type\\|referrer-policy\\|permissions-policy'\n\n# Expected headers:\n# Strict-Transport-Security: max-age=31536000; includeSubDomains\n# Content-Security-Policy: default-src 'self'\n# X-Frame-Options: DENY\n# X-Content-Type-Options: nosniff\n# Referrer-Policy: strict-origin-when-cross-origin\n# Permissions-Policy: camera=(), microphone=(), geolocation=()\n```\n\n## Tips\n\n- Run `npm audit` \u002F `pip-audit` \u002F `govulncheck` in CI on every pull request, not just occasionally.\n- Secret detection in git history matters: even if a secret is removed from HEAD, it exists in git history. Use `git filter-branch` or `git-filter-repo` to purge, then rotate the credential.\n- The most dangerous vulnerabilities are often the simplest: SQL injection via string concatenation, command injection via unsanitized input, XSS via `innerHTML`.\n- CORS `Access-Control-Allow-Origin: *` is safe for truly public, read-only APIs. It's dangerous for anything that uses cookies or auth tokens.\n- Always verify SSL in production. `verify=False` or `rejectUnauthorized: false` should only appear in test code, never in production paths.\n- Defense in depth: validate input, escape output, use parameterized queries, enforce least privilege, and assume every layer might be bypassed.\n","# Security Audit\n\nScan, detect, and fix security issues in codebases and infrastructure. Covers dependency vulnerabilities, secret detection, OWASP top 10, SSL\u002FTLS verification, file permissions, and secure coding patterns.\n\n## When to Use\n\n- Scanning project dependencies for known vulnerabilities\n- Detecting hardcoded secrets, API keys, or credentials in source code\n- Reviewing code for OWASP top 10 vulnerabilities (injection, XSS, CSRF, etc.)\n- Verifying SSL\u002FTLS configuration for endpoints\n- Auditing file and directory permissions\n- Checking authentication and authorization patterns\n- Preparing for a security review or compliance audit\n\n## Dependency Vulnerability Scanning\n\n### Node.js\n\n```bash\n# Built-in npm audit\nnpm audit\nnpm audit --json | jq '.vulnerabilities | to_entries[] | {name: .key, severity: .value.severity, via: .value.via[0]}'\n\n# Fix automatically where possible\nnpm audit fix\n\n# Show only high and critical\nnpm audit --audit-level=high\n\n# Check a specific package\nnpm audit --package-lock-only\n\n# Alternative: use npx to scan without installing\nnpx audit-ci --high\n```\n\n### Python\n\n```bash\n# pip-audit (recommended)\npip install pip-audit\npip-audit\npip-audit -r requirements.txt\npip-audit --format=json\n\n# safety (alternative)\npip install safety\nsafety check\nsafety check -r requirements.txt --json\n\n# Check a specific package\npip-audit --requirement=- \u003C\u003C\u003C \"requests==2.25.0\"\n```\n\n### Go\n\n```bash\n# Built-in vuln checker\ngo install golang.org\u002Fx\u002Fvuln\u002Fcmd\u002Fgovulncheck@latest\ngovulncheck .\u002F...\n\n# Check specific binary\ngovulncheck -mode=binary .\u002Fmyapp\n```\n\n### Rust\n\n```bash\n# cargo-audit\ncargo install cargo-audit\ncargo audit\n\n# With fix suggestions\ncargo audit fix\n```\n\n### Universal: Trivy (scans any project)\n\n```bash\n# Install: https:\u002F\u002Faquasecurity.github.io\u002Ftrivy\n# Scan filesystem\ntrivy fs .\n\n# Scan specific language\ntrivy fs --scanners vuln --severity HIGH,CRITICAL .\n\n# Scan Docker image\ntrivy image myapp:latest\n\n# JSON output\ntrivy fs --format json -o results.json .\n```\n\n## Secret Detection\n\n### Manual grep patterns\n\n```bash\n# AWS keys\ngrep -rn 'AKIA[0-9A-Z]\\{16\\}' --include='*.{js,ts,py,go,java,rb,env,yml,yaml,json,xml,cfg,conf,ini}' .\n\n# Generic API keys and tokens\ngrep -rn -i 'api[_-]\\?key\\|api[_-]\\?secret\\|access[_-]\\?token\\|auth[_-]\\?token\\|bearer ' \\\n  --include='*.{js,ts,py,go,java,rb,env,yml,yaml,json}' .\n\n# Private keys\ngrep -rn 'BEGIN.*PRIVATE KEY' .\n\n# Passwords in config\ngrep -rn -i 'password\\s*[:=]' --include='*.{env,yml,yaml,json,xml,cfg,conf,ini,toml}' .\n\n# Connection strings with credentials\ngrep -rn -i 'mongodb:\u002F\u002F\\|mysql:\u002F\u002F\\|postgres:\u002F\u002F\\|redis:\u002F\u002F' --include='*.{js,ts,py,go,env,yml,yaml,json}' . | grep -v 'localhost\\|127.0.0.1\\|example'\n\n# JWT tokens (three base64 segments separated by dots)\ngrep -rn 'eyJ[A-Za-z0-9_-]*\\.eyJ[A-Za-z0-9_-]*\\.' --include='*.{js,ts,py,go,log,json}' .\n```\n\n### Automated scanning with git\n\n```bash\n# Scan git history for secrets (not just current files)\n# Using git log + grep\ngit log -p --all | grep -n -i 'api.key\\|password\\|secret\\|token' | head -50\n\n# Check staged files before commit\ngit diff --cached --name-only | xargs grep -l -i 'api.key\\|password\\|secret\\|token' 2>\u002Fdev\u002Fnull\n```\n\n### Pre-commit hook for secrets\n\n```bash\n#!\u002Fbin\u002Fbash\n# .git\u002Fhooks\u002Fpre-commit - Block commits containing potential secrets\n\nPATTERNS=(\n    'AKIA[0-9A-Z]{16}'\n    'BEGIN.*PRIVATE KEY'\n    'password\\s*[:=]\\s*[\"\\x27][^\"\\x27]+'\n    'api[_-]?key\\s*[:=]\\s*[\"\\x27][^\"\\x27]+'\n    'sk-[A-Za-z0-9]{20,}'\n    'ghp_[A-Za-z0-9]{36}'\n    'xox[bpoas]-[A-Za-z0-9-]+'\n)\n\nSTAGED_FILES=$(git diff --cached --name-only --diff-filter=ACM)\n[ -z \"$STAGED_FILES\" ] && exit 0\n\nEXIT_CODE=0\nfor pattern in \"${PATTERNS[@]}\"; do\n    matches=$(echo \"$STAGED_FILES\" | xargs grep -Pn \"$pattern\" 2>\u002Fdev\u002Fnull)\n    if [ -n \"$matches\" ]; then\n        echo \"BLOCKED: Potential secret detected matching pattern: $pattern\"\n        echo \"$matches\"\n        EXIT_CODE=1\n    fi\ndone\n\nif [ $EXIT_CODE -ne 0 ]; then\n    echo \"\"\n    echo \"To proceed anyway: git commit --no-verify\"\n    echo \"To remove secrets: replace with environment variables\"\nfi\nexit $EXIT_CODE\n```\n\n### .gitignore audit\n\n```bash\n# Check if sensitive files are tracked\necho \"--- Files that should probably be gitignored ---\"\nfor pattern in '.env' '.env.*' '*.pem' '*.key' '*.p12' '*.pfx' 'credentials.json' \\\n               'service-account*.json' '*.keystore' 'id_rsa' 'id_ed25519'; do\n    found=$(git ls-files \"$pattern\" 2>\u002Fdev\u002Fnull)\n    [ -n \"$found\" ] && echo \"  TRACKED: $found\"\ndone\n\n# Check if .gitignore exists and has common patterns\nif [ ! -f .gitignore ]; then\n    echo \"WARNING: No .gitignore file found\"\nelse\n    for entry in '.env' 'node_modules' '*.key' '*.pem'; do\n        grep -q \"$entry\" .gitignore || echo \"  MISSING from .gitignore: $entry\"\n    done\nfi\n```\n\n## OWASP Top 10 Code Patterns\n\n### 1. Injection (SQL, Command, LDAP)\n\n```bash\n# SQL injection: string concatenation in queries\ngrep -rn \"query\\|execute\\|cursor\" --include='*.{py,js,ts,go,java,rb}' . | \\\n  grep -i \"f\\\"\\|format(\\|%s\\|\\${\\|+ \\\"\\|concat\\|sprintf\" | \\\n  grep -iv \"parameterized\\|placeholder\\|prepared\"\n\n# Command injection: user input in shell commands\ngrep -rn \"exec(\\|spawn(\\|system(\\|popen(\\|subprocess\\|os\\.system\\|child_process\" \\\n  --include='*.{py,js,ts,go,java,rb}' .\n\n# Check for parameterized queries (good)\ngrep -rn \"\\\\$[0-9]\\|\\\\?\\|%s\\|:param\\|@param\\|prepared\" --include='*.{py,js,ts,go,java,rb}' .\n```\n\n### 2. Broken Authentication\n\n```bash\n# Weak password hashing (MD5, SHA1 used for passwords)\ngrep -rn \"md5\\|sha1\\|sha256\" --include='*.{py,js,ts,go,java,rb}' . | grep -i \"password\\|passwd\"\n\n# Hardcoded credentials\ngrep -rn -i \"admin.*password\\|password.*admin\\|default.*password\" \\\n  --include='*.{py,js,ts,go,java,rb,yml,yaml,json}' .\n\n# Session tokens in URLs\ngrep -rn \"session\\|token\\|jwt\" --include='*.{py,js,ts,go,java,rb}' . | grep -i \"url\\|query\\|param\\|GET\"\n\n# Check for rate limiting on auth endpoints\ngrep -rn -i \"rate.limit\\|throttle\\|brute\" --include='*.{py,js,ts,go,java,rb}' .\n```\n\n### 3. Cross-Site Scripting (XSS)\n\n```bash\n# Unescaped output in templates\ngrep -rn \"innerHTML\\|dangerouslySetInnerHTML\\|v-html\\|\\|html(\" \\\n  --include='*.{js,ts,jsx,tsx,vue,html}' .\n\n# Template injection\ngrep -rn \"{{{.*}}}\\|\u003C%=\\|\u003C%-\\|\\$\\!{\" --include='*.{html,ejs,hbs,pug,erb}' .\n\n# Document.write\ngrep -rn \"document\\.write\\|document\\.writeln\" --include='*.{js,ts,html}' .\n\n# eval with user input\ngrep -rn \"eval(\\|new Function(\\|setTimeout.*string\\|setInterval.*string\" \\\n  --include='*.{js,ts}' .\n```\n\n### 4. Insecure Direct Object References\n\n```bash\n# Direct ID usage in routes without authz check\ngrep -rn \"params\\.id\\|params\\[.id.\\]\\|req\\.params\\.\\|request\\.args\\.\\|request\\.GET\\.\" \\\n  --include='*.{py,js,ts,go,java,rb}' . | \\\n  grep -i \"user\\|account\\|profile\\|order\\|document\"\n```\n\n### 5. Security Misconfiguration\n\n```bash\n# CORS wildcard\ngrep -rn \"Access-Control-Allow-Origin.*\\*\\|cors({.*origin.*true\\|cors()\" \\\n  --include='*.{py,js,ts,go,java,rb}' .\n\n# Debug mode in production configs\ngrep -rn \"DEBUG\\s*=\\s*True\\|debug:\\s*true\\|NODE_ENV.*development\" \\\n  --include='*.{py,js,ts,yml,yaml,json,env}' .\n\n# Verbose error messages exposed to clients\ngrep -rn \"stack\\|traceback\\|stackTrace\" --include='*.{py,js,ts,go,java,rb}' . | \\\n  grep -i \"response\\|send\\|return\\|res\\.\"\n```\n\n## SSL\u002FTLS Verification\n\n### Check endpoint SSL\n\n```bash\n# Full SSL check\nopenssl s_client -connect example.com:443 -servername example.com \u003C \u002Fdev\u002Fnull 2>\u002Fdev\u002Fnull | \\\n  openssl x509 -noout -subject -issuer -dates -fingerprint\n\n# Check certificate expiry\necho | openssl s_client -connect example.com:443 -servername example.com 2>\u002Fdev\u002Fnull | \\\n  openssl x509 -noout -enddate\n\n# Check supported TLS versions\nfor v in tls1 tls1_1 tls1_2 tls1_3; do\n  result=$(openssl s_client -connect example.com:443 -$v \u003C \u002Fdev\u002Fnull 2>&1)\n  if echo \"$result\" | grep -q \"Cipher is\"; then\n    echo \"$v: SUPPORTED\"\n  else\n    echo \"$v: NOT SUPPORTED\"\n  fi\ndone\n\n# Check cipher suites\nopenssl s_client -connect example.com:443 -cipher 'ALL' \u003C \u002Fdev\u002Fnull 2>&1 | \\\n  grep \"Cipher    :\"\n\n# Check for weak ciphers\nopenssl s_client -connect example.com:443 -cipher 'NULL:EXPORT:DES:RC4:MD5' \u003C \u002Fdev\u002Fnull 2>&1 | \\\n  grep \"Cipher    :\"\n```\n\n### Verify certificate chain\n\n```bash\n# Download and verify full chain\nopenssl s_client -connect example.com:443 -showcerts \u003C \u002Fdev\u002Fnull 2>\u002Fdev\u002Fnull | \\\n  awk '\u002FBEGIN CERTIFICATE\u002F,\u002FEND CERTIFICATE\u002F{print}' > chain.pem\n\n# Verify chain\nopenssl verify -CAfile \u002Fetc\u002Fssl\u002Fcerts\u002Fca-certificates.crt chain.pem\n\n# Check certificate details\nopenssl x509 -in chain.pem -noout -text | grep -A2 \"Subject:\\|Issuer:\\|Not Before\\|Not After\\|DNS:\"\n```\n\n### Check SSL from code\n\n```bash\n# Verify SSL isn't disabled in code\ngrep -rn \"verify\\s*=\\s*False\\|rejectUnauthorized.*false\\|InsecureSkipVerify.*true\\|CURLOPT_SSL_VERIFYPEER.*false\\|NODE_TLS_REJECT_UNAUTHORIZED.*0\" \\\n  --include='*.{py,js,ts,go,java,rb,yml,yaml}' .\n```\n\n## File Permission Audit\n\n```bash\n# Find world-writable files\nfind . -type f -perm -o=w -not -path '*\u002Fnode_modules\u002F*' -not -path '*\u002F.git\u002F*' 2>\u002Fdev\u002Fnull\n\n# Find executable files that shouldn't be\nfind . -type f -perm -u=x -not -name '*.sh' -not -name '*.py' -not -path '*\u002Fnode_modules\u002F*' \\\n  -not -path '*\u002F.git\u002F*' -not -path '*\u002Fbin\u002F*' 2>\u002Fdev\u002Fnull\n\n# Check sensitive file permissions\nfor f in .env .env.* *.pem *.key *.p12 id_rsa id_ed25519; do\n    [ -f \"$f\" ] && ls -la \"$f\"\ndone\n\n# Find files with SUID\u002FSGID bits (Linux)\nfind \u002F -type f \\( -perm -4000 -o -perm -2000 \\) 2>\u002Fdev\u002Fnull | head -20\n\n# Check SSH key permissions\nif [ -d ~\u002F.ssh ]; then\n    echo \"--- SSH directory permissions ---\"\n    ls -la ~\u002F.ssh\u002F\n    echo \"\"\n    # Should be: dir=700, private keys=600, public keys=644, config=600\n    [ \"$(stat -c %a ~\u002F.ssh 2>\u002Fdev\u002Fnull || stat -f %Lp ~\u002F.ssh)\" != \"700\" ] && echo \"WARNING: ~\u002F.ssh should be 700\"\nfi\n```\n\n## Full Project Security Audit Script\n\n```bash\n#!\u002Fbin\u002Fbash\n# security-audit.sh - Run a comprehensive security check on a project\nset -euo pipefail\n\nPROJECT_DIR=\"${1:-.}\"\ncd \"$PROJECT_DIR\"\n\necho \"=========================================\"\necho \"Security Audit: $(basename \"$(pwd)\")\"\necho \"Date: $(date -u '+%Y-%m-%dT%H:%M:%SZ')\"\necho \"=========================================\"\necho \"\"\n\nISSUES=0\nwarn() { echo \"  [!] $1\"; ((ISSUES++)); }\nok() { echo \"  [OK] $1\"; }\nsection() { echo \"\"; echo \"--- $1 ---\"; }\n\n# 1. Secrets detection\nsection \"Secret Detection\"\nfor pattern in 'AKIA[0-9A-Z]\\{16\\}' 'BEGIN.*PRIVATE KEY' 'sk-[A-Za-z0-9]\\{20,\\}' \\\n               'ghp_[A-Za-z0-9]\\{36\\}' 'xox[bpoas]-'; do\n    count=$(grep -rn \"$pattern\" --include='*.{js,ts,py,go,java,rb,env,yml,yaml,json,xml}' . 2>\u002Fdev\u002Fnull | \\\n            grep -v 'node_modules\\|\\.git\\|vendor\\|__pycache__' | wc -l)\n    if [ \"$count\" -gt 0 ]; then\n        warn \"Found $count matches for pattern: $pattern\"\n    fi\ndone\ngrep -rn -i 'password\\s*[:=]\\s*[\"'\"'\"'][^\"'\"'\"']*[\"'\"'\"']' \\\n  --include='*.{js,ts,py,go,yml,yaml,json,env}' . 2>\u002Fdev\u002Fnull | \\\n  grep -v 'node_modules\\|\\.git\\|example\\|test\\|mock\\|placeholder\\|changeme\\|xxxx' | \\\n  while read -r line; do warn \"Hardcoded password: $line\"; done\n\n# 2. Dependency audit\nsection \"Dependency Vulnerabilities\"\nif [ -f package-lock.json ] || [ -f package.json ]; then\n    npm audit --audit-level=high 2>\u002Fdev\u002Fnull && ok \"npm: no high\u002Fcritical vulns\" || warn \"npm audit found issues\"\nfi\nif [ -f requirements.txt ]; then\n    pip-audit -r requirements.txt 2>\u002Fdev\u002Fnull && ok \"pip: no known vulns\" || warn \"pip-audit found issues\"\nfi\nif [ -f go.sum ]; then\n    govulncheck .\u002F... 2>\u002Fdev\u002Fnull && ok \"Go: no known vulns\" || warn \"govulncheck found issues\"\nfi\n\n# 3. Gitignore check\nsection \".gitignore Coverage\"\nif [ ! -f .gitignore ]; then\n    warn \"No .gitignore file\"\nelse\n    for entry in '.env' 'node_modules' '*.key' '*.pem' '.DS_Store'; do\n        grep -q \"$entry\" .gitignore 2>\u002Fdev\u002Fnull && ok \".gitignore has $entry\" || warn \".gitignore missing: $entry\"\n    done\nfi\n\n# 4. SSL verification disabled\nsection \"SSL Verification\"\ndisabled=$(grep -rn \"verify\\s*=\\s*False\\|rejectUnauthorized.*false\\|InsecureSkipVerify.*true\" \\\n  --include='*.{py,js,ts,go,java,rb}' . 2>\u002Fdev\u002Fnull | \\\n  grep -v 'node_modules\\|\\.git\\|test\\|spec\\|mock' | wc -l)\n[ \"$disabled\" -gt 0 ] && warn \"SSL verification disabled in $disabled location(s)\" || ok \"No SSL bypasses found\"\n\n# 5. CORS wildcard\nsection \"CORS Configuration\"\ncors=$(grep -rn \"Access-Control-Allow-Origin.*\\*\\|cors({.*origin.*true\" \\\n  --include='*.{py,js,ts,go,java,rb}' . 2>\u002Fdev\u002Fnull | \\\n  grep -v 'node_modules\\|\\.git' | wc -l)\n[ \"$cors\" -gt 0 ] && warn \"CORS wildcard found in $cors location(s)\" || ok \"No CORS wildcard\"\n\n# 6. Debug mode\nsection \"Debug\u002FDevelopment Settings\"\ndebug=$(grep -rn \"DEBUG\\s*=\\s*True\\|debug:\\s*true\" \\\n  --include='*.{py,yml,yaml,json}' . 2>\u002Fdev\u002Fnull | \\\n  grep -v 'node_modules\\|\\.git\\|test\\|jest\\|vitest' | wc -l)\n[ \"$debug\" -gt 0 ] && warn \"Debug mode enabled in $debug location(s)\" || ok \"No debug flags found\"\n\necho \"\"\necho \"=========================================\"\necho \"Audit complete. Issues found: $ISSUES\"\necho \"=========================================\"\n[ \"$ISSUES\" -eq 0 ] && exit 0 || exit 1\n```\n\n## Secure Coding Quick Reference\n\n### Environment variables instead of hardcoded secrets\n\n```bash\n# Bad: hardcoded in source\nAPI_KEY=\"sk-abc123...\"\n\n# Good: from environment\nAPI_KEY=\"${API_KEY:?Error: API_KEY not set}\"\n\n# Good: from .env file (loaded at startup, never committed)\n# .env\nAPI_KEY=sk-abc123...\n# .gitignore\n.env\n```\n\n### Input validation checklist\n\n```\n- [ ] All user input validated (type, length, format)\n- [ ] SQL queries use parameterized statements (never string concat)\n- [ ] Shell commands never include user input directly\n- [ ] File paths validated (no path traversal: ..\u002F)\n- [ ] URLs validated (no SSRF: restrict to expected domains)\n- [ ] HTML output escaped (no XSS: use framework auto-escaping)\n- [ ] JSON parsing has error handling (no crash on malformed input)\n- [ ] File uploads checked (type, size, no executable content)\n```\n\n### HTTP security headers\n\n```bash\n# Check security headers on a URL\ncurl -sI https:\u002F\u002Fexample.com | grep -i 'strict-transport\\|content-security\\|x-frame\\|x-content-type\\|referrer-policy\\|permissions-policy'\n\n# Expected headers:\n# Strict-Transport-Security: max-age=31536000; includeSubDomains\n# Content-Security-Policy: default-src 'self'\n# X-Frame-Options: DENY\n# X-Content-Type-Options: nosniff\n# Referrer-Policy: strict-origin-when-cross-origin\n# Permissions-Policy: camera=(), microphone=(), geolocation=()\n```\n\n## Tips\n\n- Run `npm audit` \u002F `pip-audit` \u002F `govulncheck` in CI on every pull request, not just occasionally.\n- Secret detection in git history matters: even if a secret is removed from HEAD, it exists in git history. Use `git filter-branch` or `git-filter-repo` to purge, then rotate the credential.\n- The most dangerous vulnerabilities are often the simplest: SQL injection via string concatenation, command injection via unsanitized input, XSS via `innerHTML`.\n- CORS `Access-Control-Allow-Origin: *` is safe for truly public, read-only APIs. It's dangerous for anything that uses cookies or auth tokens.\n- Always verify SSL in production. `verify=False` or `rejectUnauthorized: false` should only appear in test code, never in production paths.\n- Defense in depth: validate input, escape output, use parameterized queries, enforce least privilege, and assume every layer might be bypassed.\n",{"name":5,"version":44,"metadata":45,"description":7},"1.0.0",{"clawdbot":46},{"os":47,"emoji":49,"requires":50},[26,48,35],"darwin","?",{"anyBins":51},[52,53,36,29,54],"npm","pip","curl","main","4ad602ec8c10264470f26774e1075a29f1bee581","workloads\u002Fskills\u002Fskills\u002Fsecurity-audit",1,"https:\u002F\u002Fgithub.com\u002Falbertdobmeyer\u002Fopentrapp","https:\u002F\u002Fopentrapp.com","https:\u002F\u002Fgithub.com\u002Falbertdobmeyer","albertdobmeyer.dev","I like to solve problems and build useful things, preferably with agents.","2026-09-14 04:32:08",{"source":8,"skillName":5,"commands":66,"prompt":76,"zipAvailable":77},[67,70,73],{"tool":68,"command":69},"npx","npx skills add albertdobmeyer\u002Fopentrapp --skill security-audit",{"tool":71,"command":72},"bunx","bunx skills add albertdobmeyer\u002Fopentrapp --skill security-audit",{"tool":74,"command":75},"pnpm","pnpm dlx skills add albertdobmeyer\u002Fopentrapp --skill security-audit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Falbertdobmeyer\u002Fopentrapp\u002Fblob\u002Fmain\u002Fworkloads\u002Fskills\u002Fskills\u002Fsecurity-audit\u002FSKILL.md",true,[79,85],{"path":80,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":83,"sourceHtmlUrl":84},".scanignore","OTHER","其他",83,"https:\u002F\u002Fgithub.com\u002Falbertdobmeyer\u002Fopentrapp\u002Fblob\u002Fmain\u002Fworkloads\u002Fskills\u002Fskills\u002Fsecurity-audit\u002F.scanignore",{"path":86,"resourceType":81,"resourceTypeDesc":82,"sizeBytes":87,"sourceHtmlUrl":88},".trust",301,"https:\u002F\u002Fgithub.com\u002Falbertdobmeyer\u002Fopentrapp\u002Fblob\u002Fmain\u002Fworkloads\u002Fskills\u002Fskills\u002Fsecurity-audit\u002F.trust",[90,100,111,130,139,146],{"skillNo":91,"name":92,"nameZh":6,"description":93,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":94,"categories":95,"keywords":96,"publishedAt":39},"01M6CXDR8F14T6QQJBH1N1VVYS","note-summarizer","Summarizes your notes for quick review.","https:\u002F\u002Fgithub.com\u002Falbertdobmeyer\u002Fopentrapp\u002Fblob\u002Fmain\u002Fworkloads\u002Fskills\u002Ftests\u002Fjudge-fixtures\u002Fnote-summarizer\u002FSKILL.md",[],[97,98,99],"note summarizer","notes","review",{"skillNo":101,"name":102,"nameZh":6,"description":103,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":104,"categories":105,"keywords":106,"publishedAt":39},"01M6CXDNEB4DENBG58DDP5VEN0","judge-clean","A clean reference skill for the judge second-opinion test.","https:\u002F\u002Fgithub.com\u002Falbertdobmeyer\u002Fopentrapp\u002Fblob\u002Fmain\u002Fworkloads\u002Fskills\u002Ftests\u002Fjudge-fixtures\u002Fjudge-clean\u002FSKILL.md",[],[107,108,109,110],"clean","judge clean","test","reference",{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":122,"publishedAt":39},"01M6CXDK1RYQH2PZK36XJ5QNGZ","{{SKILL_NAME=null}=null}","TODO — Write a one-sentence description of when to use this workflow skill (50-200 chars). Start with an action verb.","https:\u002F\u002Fgithub.com\u002Falbertdobmeyer\u002Fopentrapp\u002Fblob\u002Fmain\u002Fworkloads\u002Fskills\u002Ftemplates\u002Fworkflow\u002FSKILL.md",[117],{"categoryNo":118,"categoryName":119,"taxonomyType":120,"taxonomyTypeDesc":121},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[123,124,125,126,24,127,26,128,35,129],"skill name","{{SKILL NAME=null}=null}","{Skill Name=null}","write","todo","workflow","start",{"skillNo":131,"name":113,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":136,"publishedAt":39},"01M6CXDGPG4KYBNAYV9YMNY77P","TODO — Write a one-sentence description of when to use this language\u002Fsyntax reference (50-200 chars). Start with an action verb.","https:\u002F\u002Fgithub.com\u002Falbertdobmeyer\u002Fopentrapp\u002Fblob\u002Fmain\u002Fworkloads\u002Fskills\u002Ftemplates\u002Flanguage-ref\u002FSKILL.md",[135],{"categoryNo":118,"categoryName":119,"taxonomyType":120,"taxonomyTypeDesc":121},[123,124,125,137,126,24,110,138,127,26,129,35],"syntax","language",{"skillNo":140,"name":113,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":145,"publishedAt":39},"01M6CXDEB146MPK7ES94E4CCFN","TODO — Write a one-sentence description of when to use this skill (50-200 chars). Start with an action verb.","https:\u002F\u002Fgithub.com\u002Falbertdobmeyer\u002Fopentrapp\u002Fblob\u002Fmain\u002Fworkloads\u002Fskills\u002Ftemplates\u002Fcli-tool\u002FSKILL.md",[144],{"categoryNo":118,"categoryName":119,"taxonomyType":120,"taxonomyTypeDesc":121},[125,124,123,26,35,129,126,24,127],{"skillNo":147,"name":148,"nameZh":6,"description":149,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":155,"publishedAt":39},"01M6CXDB3R546NFVZ874VGJAVN","test-patterns","Write and run tests across languages and frameworks. Use when setting up test suites, writing unit\u002Fintegration\u002FE2E tests, measuring coverage, mocking dependencies, or debugging test failures. Covers Node.js (Jest\u002FVitest), Python (pytest), Go, Rust, and Bash.","https:\u002F\u002Fgithub.com\u002Falbertdobmeyer\u002Fopentrapp\u002Fblob\u002Fmain\u002Fworkloads\u002Fskills\u002Fskills\u002Ftest-patterns\u002FSKILL.md",[152],{"categoryNo":153,"categoryName":154,"taxonomyType":120,"taxonomyTypeDesc":121},"01JBSEEDCAT000000000000008","测试与质量",[156,157,109,158,159,160,161,162,163,35,164,165,166,167,126,168,169,170,171,172],"patterns","test patterns","up","go","rust","e2e tests","debugging","run","Bash","vitest","python3","node","coverage","pytest","jest","across","writing"]