[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6G2P6GXSJAFSD0ZD94BM177":3,"skill-same:01M6G2P6GXSJAFSD0ZD94BM177":66},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":37,"linkOnly":38,"markdownContent":39,"markdownBody":40,"frontMatter":41,"refName":43,"commitSha":44,"skillDirectory":45,"forksCount":46,"repositoryHtmlUrl":47,"repositoryHomepageUrl":6,"ownerHtmlUrl":48,"ownerBlogUrl":49,"ownerDescription":50,"updatedAt":51,"install":52,"resources":65},"01M6G2P6GXSJAFSD0ZD94BM177","springboot-security",null,"Spring Security best practices for authn\u002Fauthz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.","oabdelmaksoud\u002FAgention","oabdelmaksoud","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F50699149?v=4","01M6D5CVVN778ZCDP1WHS816SP","Omar Abdelmaksoud","01M6D8A4TE76V3DCSH3D94VG1V",2,"MIT","https:\u002F\u002Fgithub.com\u002Foabdelmaksoud\u002FAgention\u002Fblob\u002Fmain\u002Fupstream-sync\u002Fwork\u002Fecc\u002Fskills\u002Fspringboot-security\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36],"springboot security","security","secrets","headers","spring security","dependency security","rate limiting","java spring","dependency","spring","csrf","services","spring boot","java","security best practices","validation","best practices","boot","2026-11-10 10:12:30",false,"---\nname: springboot-security\ndescription: Spring Security best practices for authn\u002Fauthz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.\norigin: ECC\n---\n\n# Spring Boot Security Review\n\nUse when adding auth, handling input, creating endpoints, or dealing with secrets.\n\n## When to Activate\n\n- Adding authentication (JWT, OAuth2, session-based)\n- Implementing authorization (@PreAuthorize, role-based access)\n- Validating user input (Bean Validation, custom validators)\n- Configuring CORS, CSRF, or security headers\n- Managing secrets (Vault, environment variables)\n- Adding rate limiting or brute-force protection\n- Scanning dependencies for CVEs\n\n## Authentication\n\n- Prefer stateless JWT or opaque tokens with revocation list\n- Use `httpOnly`, `Secure`, `SameSite=Strict` cookies for sessions\n- Validate tokens with `OncePerRequestFilter` or resource server\n\n```java\n@Component\npublic class JwtAuthFilter extends OncePerRequestFilter {\n  private final JwtService jwtService;\n\n  public JwtAuthFilter(JwtService jwtService) {\n    this.jwtService = jwtService;\n  }\n\n  @Override\n  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,\n      FilterChain chain) throws ServletException, IOException {\n    String header = request.getHeader(HttpHeaders.AUTHORIZATION);\n    if (header != null && header.startsWith(\"Bearer \")) {\n      String token = header.substring(7);\n      Authentication auth = jwtService.authenticate(token);\n      SecurityContextHolder.getContext().setAuthentication(auth);\n    }\n    chain.doFilter(request, response);\n  }\n}\n```\n\n## Authorization\n\n- Enable method security: `@EnableMethodSecurity`\n- Use `@PreAuthorize(\"hasRole('ADMIN')\")` or `@PreAuthorize(\"@authz.canEdit(#id)\")`\n- Deny by default; expose only required scopes\n\n```java\n@RestController\n@RequestMapping(\"\u002Fapi\u002Fadmin\")\npublic class AdminController {\n\n  @PreAuthorize(\"hasRole('ADMIN')\")\n  @GetMapping(\"\u002Fusers\")\n  public List\u003CUserDto> listUsers() {\n    return userService.findAll();\n  }\n\n  @PreAuthorize(\"@authz.isOwner(#id, authentication)\")\n  @DeleteMapping(\"\u002Fusers\u002F{id}\")\n  public ResponseEntity\u003CVoid> deleteUser(@PathVariable Long id) {\n    userService.delete(id);\n    return ResponseEntity.noContent().build();\n  }\n}\n```\n\n## Input Validation\n\n- Use Bean Validation with `@Valid` on controllers\n- Apply constraints on DTOs: `@NotBlank`, `@Email`, `@Size`, custom validators\n- Sanitize any HTML with a whitelist before rendering\n\n```java\n\u002F\u002F BAD: No validation\n@PostMapping(\"\u002Fusers\")\npublic User createUser(@RequestBody UserDto dto) {\n  return userService.create(dto);\n}\n\n\u002F\u002F GOOD: Validated DTO\npublic record CreateUserDto(\n    @NotBlank @Size(max = 100) String name,\n    @NotBlank @Email String email,\n    @NotNull @Min(0) @Max(150) Integer age\n) {}\n\n@PostMapping(\"\u002Fusers\")\npublic ResponseEntity\u003CUserDto> createUser(@Valid @RequestBody CreateUserDto dto) {\n  return ResponseEntity.status(HttpStatus.CREATED)\n      .body(userService.create(dto));\n}\n```\n\n## SQL Injection Prevention\n\n- Use Spring Data repositories or parameterized queries\n- For native queries, use `:param` bindings; never concatenate strings\n\n```java\n\u002F\u002F BAD: String concatenation in native query\n@Query(value = \"SELECT * FROM users WHERE name = '\" + name + \"'\", nativeQuery = true)\n\n\u002F\u002F GOOD: Parameterized native query\n@Query(value = \"SELECT * FROM users WHERE name = :name\", nativeQuery = true)\nList\u003CUser> findByName(@Param(\"name\") String name);\n\n\u002F\u002F GOOD: Spring Data derived query (auto-parameterized)\nList\u003CUser> findByEmailAndActiveTrue(String email);\n```\n\n## Password Encoding\n\n- Always hash passwords with BCrypt or Argon2 — never store plaintext\n- Use `PasswordEncoder` bean, not manual hashing\n\n```java\n@Bean\npublic PasswordEncoder passwordEncoder() {\n  return new BCryptPasswordEncoder(12); \u002F\u002F cost factor 12\n}\n\n\u002F\u002F In service\npublic User register(CreateUserDto dto) {\n  String hashedPassword = passwordEncoder.encode(dto.password());\n  return userRepository.save(new User(dto.email(), hashedPassword));\n}\n```\n\n## CSRF Protection\n\n- For browser session apps, keep CSRF enabled; include token in forms\u002Fheaders\n- For pure APIs with Bearer tokens, disable CSRF and rely on stateless auth\n\n```java\nhttp\n  .csrf(csrf -> csrf.disable())\n  .sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS));\n```\n\n## Secrets Management\n\n- No secrets in source; load from env or vault\n- Keep `application.yml` free of credentials; use placeholders\n- Rotate tokens and DB credentials regularly\n\n```yaml\n# BAD: Hardcoded in application.yml\nspring:\n  datasource:\n    password: mySecretPassword123\n\n# GOOD: Environment variable placeholder\nspring:\n  datasource:\n    password: ${DB_PASSWORD}\n\n# GOOD: Spring Cloud Vault integration\nspring:\n  cloud:\n    vault:\n      uri: https:\u002F\u002Fvault.example.com\n      token: ${VAULT_TOKEN}\n```\n\n## Security Headers\n\n```java\nhttp\n  .headers(headers -> headers\n    .contentSecurityPolicy(csp -> csp\n      .policyDirectives(\"default-src 'self'\"))\n    .frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin)\n    .xssProtection(Customizer.withDefaults())\n    .referrerPolicy(rp -> rp.policy(ReferrerPolicyHeaderWriter.ReferrerPolicy.NO_REFERRER)));\n```\n\n## CORS Configuration\n\n- Configure CORS at the security filter level, not per-controller\n- Restrict allowed origins — never use `*` in production\n\n```java\n@Bean\npublic CorsConfigurationSource corsConfigurationSource() {\n  CorsConfiguration config = new CorsConfiguration();\n  config.setAllowedOrigins(List.of(\"https:\u002F\u002Fapp.example.com\"));\n  config.setAllowedMethods(List.of(\"GET\", \"POST\", \"PUT\", \"DELETE\"));\n  config.setAllowedHeaders(List.of(\"Authorization\", \"Content-Type\"));\n  config.setAllowCredentials(true);\n  config.setMaxAge(3600L);\n\n  UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();\n  source.registerCorsConfiguration(\"\u002Fapi\u002F**\", config);\n  return source;\n}\n\n\u002F\u002F In SecurityFilterChain:\nhttp.cors(cors -> cors.configurationSource(corsConfigurationSource()));\n```\n\n## Rate Limiting\n\n- Apply Bucket4j or gateway-level limits on expensive endpoints\n- Log and alert on bursts; return 429 with retry hints\n\n```java\n\u002F\u002F Using Bucket4j for per-endpoint rate limiting\n@Component\npublic class RateLimitFilter extends OncePerRequestFilter {\n  private final Map\u003CString, Bucket> buckets = new ConcurrentHashMap\u003C>();\n\n  private Bucket createBucket() {\n    return Bucket.builder()\n        .addLimit(Bandwidth.classic(100, Refill.intervally(100, Duration.ofMinutes(1))))\n        .build();\n  }\n\n  @Override\n  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,\n      FilterChain chain) throws ServletException, IOException {\n    String clientIp = request.getRemoteAddr();\n    Bucket bucket = buckets.computeIfAbsent(clientIp, k -> createBucket());\n\n    if (bucket.tryConsume(1)) {\n      chain.doFilter(request, response);\n    } else {\n      response.setStatus(HttpStatus.TOO_MANY_REQUESTS.value());\n      response.getWriter().write(\"{\\\"error\\\": \\\"Rate limit exceeded\\\"}\");\n    }\n  }\n}\n```\n\n## Dependency Security\n\n- Run OWASP Dependency Check \u002F Snyk in CI\n- Keep Spring Boot and Spring Security on supported versions\n- Fail builds on known CVEs\n\n## Logging and PII\n\n- Never log secrets, tokens, passwords, or full PAN data\n- Redact sensitive fields; use structured JSON logging\n\n## File Uploads\n\n- Validate size, content type, and extension\n- Store outside web root; scan if required\n\n## Checklist Before Release\n\n- [ ] Auth tokens validated and expired correctly\n- [ ] Authorization guards on every sensitive path\n- [ ] All inputs validated and sanitized\n- [ ] No string-concatenated SQL\n- [ ] CSRF posture correct for app type\n- [ ] Secrets externalized; none committed\n- [ ] Security headers configured\n- [ ] Rate limiting on APIs\n- [ ] Dependencies scanned and up to date\n- [ ] Logs free of sensitive data\n\n**Remember**: Deny by default, validate inputs, least privilege, and secure-by-configuration first.\n","# Spring Boot Security Review\n\nUse when adding auth, handling input, creating endpoints, or dealing with secrets.\n\n## When to Activate\n\n- Adding authentication (JWT, OAuth2, session-based)\n- Implementing authorization (@PreAuthorize, role-based access)\n- Validating user input (Bean Validation, custom validators)\n- Configuring CORS, CSRF, or security headers\n- Managing secrets (Vault, environment variables)\n- Adding rate limiting or brute-force protection\n- Scanning dependencies for CVEs\n\n## Authentication\n\n- Prefer stateless JWT or opaque tokens with revocation list\n- Use `httpOnly`, `Secure`, `SameSite=Strict` cookies for sessions\n- Validate tokens with `OncePerRequestFilter` or resource server\n\n```java\n@Component\npublic class JwtAuthFilter extends OncePerRequestFilter {\n  private final JwtService jwtService;\n\n  public JwtAuthFilter(JwtService jwtService) {\n    this.jwtService = jwtService;\n  }\n\n  @Override\n  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,\n      FilterChain chain) throws ServletException, IOException {\n    String header = request.getHeader(HttpHeaders.AUTHORIZATION);\n    if (header != null && header.startsWith(\"Bearer \")) {\n      String token = header.substring(7);\n      Authentication auth = jwtService.authenticate(token);\n      SecurityContextHolder.getContext().setAuthentication(auth);\n    }\n    chain.doFilter(request, response);\n  }\n}\n```\n\n## Authorization\n\n- Enable method security: `@EnableMethodSecurity`\n- Use `@PreAuthorize(\"hasRole('ADMIN')\")` or `@PreAuthorize(\"@authz.canEdit(#id)\")`\n- Deny by default; expose only required scopes\n\n```java\n@RestController\n@RequestMapping(\"\u002Fapi\u002Fadmin\")\npublic class AdminController {\n\n  @PreAuthorize(\"hasRole('ADMIN')\")\n  @GetMapping(\"\u002Fusers\")\n  public List\u003CUserDto> listUsers() {\n    return userService.findAll();\n  }\n\n  @PreAuthorize(\"@authz.isOwner(#id, authentication)\")\n  @DeleteMapping(\"\u002Fusers\u002F{id}\")\n  public ResponseEntity\u003CVoid> deleteUser(@PathVariable Long id) {\n    userService.delete(id);\n    return ResponseEntity.noContent().build();\n  }\n}\n```\n\n## Input Validation\n\n- Use Bean Validation with `@Valid` on controllers\n- Apply constraints on DTOs: `@NotBlank`, `@Email`, `@Size`, custom validators\n- Sanitize any HTML with a whitelist before rendering\n\n```java\n\u002F\u002F BAD: No validation\n@PostMapping(\"\u002Fusers\")\npublic User createUser(@RequestBody UserDto dto) {\n  return userService.create(dto);\n}\n\n\u002F\u002F GOOD: Validated DTO\npublic record CreateUserDto(\n    @NotBlank @Size(max = 100) String name,\n    @NotBlank @Email String email,\n    @NotNull @Min(0) @Max(150) Integer age\n) {}\n\n@PostMapping(\"\u002Fusers\")\npublic ResponseEntity\u003CUserDto> createUser(@Valid @RequestBody CreateUserDto dto) {\n  return ResponseEntity.status(HttpStatus.CREATED)\n      .body(userService.create(dto));\n}\n```\n\n## SQL Injection Prevention\n\n- Use Spring Data repositories or parameterized queries\n- For native queries, use `:param` bindings; never concatenate strings\n\n```java\n\u002F\u002F BAD: String concatenation in native query\n@Query(value = \"SELECT * FROM users WHERE name = '\" + name + \"'\", nativeQuery = true)\n\n\u002F\u002F GOOD: Parameterized native query\n@Query(value = \"SELECT * FROM users WHERE name = :name\", nativeQuery = true)\nList\u003CUser> findByName(@Param(\"name\") String name);\n\n\u002F\u002F GOOD: Spring Data derived query (auto-parameterized)\nList\u003CUser> findByEmailAndActiveTrue(String email);\n```\n\n## Password Encoding\n\n- Always hash passwords with BCrypt or Argon2 — never store plaintext\n- Use `PasswordEncoder` bean, not manual hashing\n\n```java\n@Bean\npublic PasswordEncoder passwordEncoder() {\n  return new BCryptPasswordEncoder(12); \u002F\u002F cost factor 12\n}\n\n\u002F\u002F In service\npublic User register(CreateUserDto dto) {\n  String hashedPassword = passwordEncoder.encode(dto.password());\n  return userRepository.save(new User(dto.email(), hashedPassword));\n}\n```\n\n## CSRF Protection\n\n- For browser session apps, keep CSRF enabled; include token in forms\u002Fheaders\n- For pure APIs with Bearer tokens, disable CSRF and rely on stateless auth\n\n```java\nhttp\n  .csrf(csrf -> csrf.disable())\n  .sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS));\n```\n\n## Secrets Management\n\n- No secrets in source; load from env or vault\n- Keep `application.yml` free of credentials; use placeholders\n- Rotate tokens and DB credentials regularly\n\n```yaml\n# BAD: Hardcoded in application.yml\nspring:\n  datasource:\n    password: mySecretPassword123\n\n# GOOD: Environment variable placeholder\nspring:\n  datasource:\n    password: ${DB_PASSWORD}\n\n# GOOD: Spring Cloud Vault integration\nspring:\n  cloud:\n    vault:\n      uri: https:\u002F\u002Fvault.example.com\n      token: ${VAULT_TOKEN}\n```\n\n## Security Headers\n\n```java\nhttp\n  .headers(headers -> headers\n    .contentSecurityPolicy(csp -> csp\n      .policyDirectives(\"default-src 'self'\"))\n    .frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin)\n    .xssProtection(Customizer.withDefaults())\n    .referrerPolicy(rp -> rp.policy(ReferrerPolicyHeaderWriter.ReferrerPolicy.NO_REFERRER)));\n```\n\n## CORS Configuration\n\n- Configure CORS at the security filter level, not per-controller\n- Restrict allowed origins — never use `*` in production\n\n```java\n@Bean\npublic CorsConfigurationSource corsConfigurationSource() {\n  CorsConfiguration config = new CorsConfiguration();\n  config.setAllowedOrigins(List.of(\"https:\u002F\u002Fapp.example.com\"));\n  config.setAllowedMethods(List.of(\"GET\", \"POST\", \"PUT\", \"DELETE\"));\n  config.setAllowedHeaders(List.of(\"Authorization\", \"Content-Type\"));\n  config.setAllowCredentials(true);\n  config.setMaxAge(3600L);\n\n  UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();\n  source.registerCorsConfiguration(\"\u002Fapi\u002F**\", config);\n  return source;\n}\n\n\u002F\u002F In SecurityFilterChain:\nhttp.cors(cors -> cors.configurationSource(corsConfigurationSource()));\n```\n\n## Rate Limiting\n\n- Apply Bucket4j or gateway-level limits on expensive endpoints\n- Log and alert on bursts; return 429 with retry hints\n\n```java\n\u002F\u002F Using Bucket4j for per-endpoint rate limiting\n@Component\npublic class RateLimitFilter extends OncePerRequestFilter {\n  private final Map\u003CString, Bucket> buckets = new ConcurrentHashMap\u003C>();\n\n  private Bucket createBucket() {\n    return Bucket.builder()\n        .addLimit(Bandwidth.classic(100, Refill.intervally(100, Duration.ofMinutes(1))))\n        .build();\n  }\n\n  @Override\n  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,\n      FilterChain chain) throws ServletException, IOException {\n    String clientIp = request.getRemoteAddr();\n    Bucket bucket = buckets.computeIfAbsent(clientIp, k -> createBucket());\n\n    if (bucket.tryConsume(1)) {\n      chain.doFilter(request, response);\n    } else {\n      response.setStatus(HttpStatus.TOO_MANY_REQUESTS.value());\n      response.getWriter().write(\"{\\\"error\\\": \\\"Rate limit exceeded\\\"}\");\n    }\n  }\n}\n```\n\n## Dependency Security\n\n- Run OWASP Dependency Check \u002F Snyk in CI\n- Keep Spring Boot and Spring Security on supported versions\n- Fail builds on known CVEs\n\n## Logging and PII\n\n- Never log secrets, tokens, passwords, or full PAN data\n- Redact sensitive fields; use structured JSON logging\n\n## File Uploads\n\n- Validate size, content type, and extension\n- Store outside web root; scan if required\n\n## Checklist Before Release\n\n- [ ] Auth tokens validated and expired correctly\n- [ ] Authorization guards on every sensitive path\n- [ ] All inputs validated and sanitized\n- [ ] No string-concatenated SQL\n- [ ] CSRF posture correct for app type\n- [ ] Secrets externalized; none committed\n- [ ] Security headers configured\n- [ ] Rate limiting on APIs\n- [ ] Dependencies scanned and up to date\n- [ ] Logs free of sensitive data\n\n**Remember**: Deny by default, validate inputs, least privilege, and secure-by-configuration first.\n",{"name":5,"origin":42,"description":7},"ECC","main","a318f48de3c5718e8ea2e9f6fae7790e8a759e85","upstream-sync\u002Fwork\u002Fecc\u002Fskills\u002Fspringboot-security",0,"https:\u002F\u002Fgithub.com\u002Foabdelmaksoud\u002FAgention","https:\u002F\u002Fgithub.com\u002Foabdelmaksoud","https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Fo-abdelmaksoud\u002F","Full-Stack Engineer | AI Systems Architect | Building autonomous multi-agent systems","2026-03-08 21:23:03",{"source":8,"skillName":5,"commands":53,"prompt":63,"zipAvailable":64},[54,57,60],{"tool":55,"command":56},"npx","npx skills add oabdelmaksoud\u002FAgention --skill springboot-security",{"tool":58,"command":59},"bunx","bunx skills add oabdelmaksoud\u002FAgention --skill springboot-security",{"tool":61,"command":62},"pnpm","pnpm dlx skills add oabdelmaksoud\u002FAgention --skill springboot-security","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Foabdelmaksoud\u002FAgention\u002Fblob\u002Fmain\u002Fupstream-sync\u002Fwork\u002Fecc\u002Fskills\u002Fspringboot-security\u002FSKILL.md",true,[],[67,91,105,138,163,182],{"skillNo":68,"name":69,"nameZh":6,"description":70,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":71,"categories":72,"keywords":78,"publishedAt":37},"01M6G2QFCBNBYAJF2KTK85G9A6","visa-doc-translate","Translate visa application documents (images) to English and create a bilingual PDF with original and translation","https:\u002F\u002Fgithub.com\u002Foabdelmaksoud\u002FAgention\u002Fblob\u002Fmain\u002Fupstream-sync\u002Fwork\u002Fecc\u002Fskills\u002Fvisa-doc-translate\u002FSKILL.md",[73],{"categoryNo":74,"categoryName":75,"taxonomyType":76,"taxonomyTypeDesc":77},"01JBSEEDCAT000000000000002","文档处理","SCENARIO","使用场景",[79,80,81,82,83,84,85,86,87,88,89,90],"translate","doc","visa doc translate","bilingual","with","english","application","PDF","translation","documents","create","images",{"skillNo":92,"name":93,"nameZh":6,"description":94,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":95,"categories":96,"keywords":97,"publishedAt":37},"01M6G2QB09TSK6BY4ME5X20EVQ","verification-loop","A comprehensive verification system for Claude Code sessions.","https:\u002F\u002Fgithub.com\u002Foabdelmaksoud\u002FAgention\u002Fblob\u002Fmain\u002Fupstream-sync\u002Fwork\u002Fecc\u002Fskills\u002Fverification-loop\u002FSKILL.md",[],[98,99,100,101,102,103,104],"verification","loop","verification loop","sessions","code","claude code sessions","system",{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":109,"categories":110,"keywords":122,"publishedAt":37},"01M6G2Q6V2F7G03VAAF27FXPJR","tdd-workflow","Use this skill when writing new features, fixing bugs, or refactoring code. Enforces test-driven development with 80%+ coverage including unit, integration, and E2E tests.","https:\u002F\u002Fgithub.com\u002Foabdelmaksoud\u002FAgention\u002Fblob\u002Fmain\u002Fupstream-sync\u002Fwork\u002Fecc\u002Fskills\u002Ftdd-workflow\u002FSKILL.md",[111,114,117],{"categoryNo":112,"categoryName":113,"taxonomyType":76,"taxonomyTypeDesc":77},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":115,"categoryName":116,"taxonomyType":76,"taxonomyTypeDesc":77},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":118,"categoryName":119,"taxonomyType":120,"taxonomyTypeDesc":121},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[123,124,125,126,127,128,129,130,131,102,132,133,134,135,83,136,137],"workflow","tdd","tdd workflow","use","unit","coverage","refactoring","e2e","integration","development","e2e tests","tests","driven","test","writing",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":144,"publishedAt":37},"01M6G2Q359YJRWAR2PFCEQAXF3","swiftui-patterns","SwiftUI architecture patterns, state management with @Observable, view composition, navigation, performance optimization, and modern iOS\u002FmacOS UI best practices.","https:\u002F\u002Fgithub.com\u002Foabdelmaksoud\u002FAgention\u002Fblob\u002Fmain\u002Fupstream-sync\u002Fwork\u002Fecc\u002Fskills\u002Fswiftui-patterns\u002FSKILL.md",[],[145,146,147,148,149,150,151,35,152,153,154,155,156,157,158,159,160,161,162,83],"patterns","swiftui","swiftui patterns","architecture","macos","performance","state management","state","ui","Optimization","ios","architecture patterns","Composition","performance optimization","view","management","swiftui architecture","navigation",{"skillNo":164,"name":165,"nameZh":6,"description":166,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":170,"publishedAt":37},"01M6G2PY8B2FWZTWPZ84H83Y7C","swift-protocol-di-testing","Protocol-based dependency injection for testable Swift code — mock file system, network, and external APIs using focused protocols and Swift Testing.","https:\u002F\u002Fgithub.com\u002Foabdelmaksoud\u002FAgention\u002Fblob\u002Fmain\u002Fupstream-sync\u002Fwork\u002Fecc\u002Fskills\u002Fswift-protocol-di-testing\u002FSKILL.md",[169],{"categoryNo":112,"categoryName":113,"taxonomyType":76,"taxonomyTypeDesc":77},[171,172,173,174,102,175,176,177,178,104,27,179,180,181],"swift protocol di testing","protocol","swift","testing","protocols","file","network","injection","swift testing","dependency injection","mock",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":188,"publishedAt":37},"01M6G2PSCN2GXV9FFZDRRRWVB6","swift-concurrency-6-2","Swift 6.2 Approachable Concurrency — single-threaded by default, @concurrent for explicit background offloading, isolated conformances for main actor types.","https:\u002F\u002Fgithub.com\u002Foabdelmaksoud\u002FAgention\u002Fblob\u002Fmain\u002Fupstream-sync\u002Fwork\u002Fecc\u002Fskills\u002Fswift-concurrency-6-2\u002FSKILL.md",[],[189,190,191,173,192,43,193],"concurrency","swift concurrency","swift concurrency 6 2","default","types"]