[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6J40DC752WKB575WGTPNAPP":3,"skill-same:01M6J40DC752WKB575WGTPNAPP":73},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":40,"linkOnly":41,"markdownContent":42,"markdownBody":43,"frontMatter":44,"refName":47,"commitSha":48,"skillDirectory":49,"forksCount":14,"repositoryHtmlUrl":50,"repositoryHomepageUrl":6,"ownerHtmlUrl":51,"ownerBlogUrl":6,"ownerDescription":52,"updatedAt":53,"install":54,"resources":66},"01M6J40DC752WKB575WGTPNAPP","security-strategy",null,"On-demand maintenance of the per-repo security memory: bootstrap an\ninitial threat model + add\u002Fappend incidents to docs\u002Fsecurity-strategy.md\nwith proper marker comments, then refresh the Supabase index. NEVER\ngates planning — \u002Fplan reads the resulting memory automatically via\nPhase 0.5b.\nTriggers on: \"security strategy\", \"add security incident\", \"draft\nincident\", \"\u002Fsecurity-strategy\", \"bootstrap security memory\".\nUsage:\n  \u002Fsecurity-strategy bootstrap         — interview to seed initial threat model + first incident\n  \u002Fsecurity-strategy add-incident      — interactive draft of one new incident entry\n  \u002Fsecurity-strategy add-incident from-commit \u003Csha>  — pre-fill from commit subject + changed files","Lbstrydom\u002Fclaude-engineering-skills","Lbstrydom","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F77991486?v=4","01M6J3X4N2T0FTZT1RKFXDVS0K","Louis Strydom","01M6J3X4SXV0BXWDMXPW90D8BK",0,"MIT","https:\u002F\u002Fgithub.com\u002FLbstrydom\u002Fclaude-engineering-skills\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fsecurity-strategy\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39],"security strategy","strategy","security","interview","new","true","usage","incidents","comments","triggers","incident","files","never","interactive","repo","model","supabase","planning","bootstrap","commit","memory","2026-11-10 10:12:30",false,"---\nname: security-strategy\ndescription: |\n  On-demand maintenance of the per-repo security memory: bootstrap an\n  initial threat model + add\u002Fappend incidents to docs\u002Fsecurity-strategy.md\n  with proper marker comments, then refresh the Supabase index. NEVER\n  gates planning — \u002Fplan reads the resulting memory automatically via\n  Phase 0.5b.\n  Triggers on: \"security strategy\", \"add security incident\", \"draft\n  incident\", \"\u002Fsecurity-strategy\", \"bootstrap security memory\".\n  Usage:\n    \u002Fsecurity-strategy bootstrap         — interview to seed initial threat model + first incident\n    \u002Fsecurity-strategy add-incident      — interactive draft of one new incident entry\n    \u002Fsecurity-strategy add-incident from-commit \u003Csha>  — pre-fill from commit subject + changed files\ndisable-model-invocation: true\n---\n\n# \u002Fsecurity-strategy — proactive security memory maintenance\n\n> **Explicit invocation only — host-neutral.** `disable-model-invocation: true`\n> enforces this in Claude Code and in VS Code Copilot, which reads\n> `.claude\u002Fskills\u002F` and honours that key (verified against VS Code Agent Skills\n> docs 2026-09-02). Hosts beyond those two are unverified, and a key cannot\n> carry the reasoning anyway, so the rule is stated here as well.\n>\n> Run this only when the user asked for it. It writes\n> `docs\u002Fsecurity-strategy.md` and publishes to the shared index, and an\n> incident drafted from a passing mention is a false record in a security\n> memory other people will later trust.\n\nThis skill maintains the **markdown source-of-truth** at\n`docs\u002Fsecurity-strategy.md`. After any edit, it runs\n`node scripts\u002Fsecurity-memory\u002Frefresh-incidents.mjs` so the Supabase embedding\nindex stays current.\n\n**Always by path, never via an `npm run` alias.** The sync never merges npm\nscripts into a consumer's `package.json`, so a `security:refresh` alias exists\nin the source repo only. The earlier workaround appended `--if-present` to that\nalias, which made the `Missing script` error disappear by exiting **0 without\nrunning anything** — so a consumer's index silently never refreshed. The\nrefresher is itself synced, so the path always resolves.\n\nThe skill is **on-demand only** — it never blocks `\u002Fcycle`, `\u002Fplan`, or\n`\u002Fship`. The planner (Phase 0.5b) consults the memory via the cross-skill\nbridge regardless of whether this skill has run recently.\n\n> **Worktree preflight** — in a linked git worktree the synced tooling tree\n> `scripts\u002F.claude-skills\u002F` is absent — it is gitignored, so `git worktree add`\n> does not populate it, and every command below that uses it dies on a bare\n> `MODULE_NOT_FOUND`. Run `npm run skills:hydrate` first. If this repo defines\n> no such script, `references\u002Fworktree-preflight.md` holds the entry to add — ask\n> the user first, since it edits their `package.json`.\n\n---\n\n## Step 0 — Parse Mode\n\n| Input | Mode |\n|---|---|\n| `\u002Fsecurity-strategy bootstrap` | **BOOTSTRAP** — first-time seed of threat model + optional first incident |\n| `\u002Fsecurity-strategy add-incident` | **ADD** — interactive draft of one new incident |\n| `\u002Fsecurity-strategy add-incident from-commit \u003Csha>` | **ADD_FROM_COMMIT** — pre-fill from a security-relevant commit |\n\nIf no mode given → ask the user which one.\n\n---\n\n## Step 1a — BOOTSTRAP\n\nThe repo template at `docs\u002Fsecurity-strategy.md` is the canonical\nskeleton. Bootstrap fills in placeholders rather than emitting a\nparallel template — so changes to the template's structure (parser\nsections, comment markers, header text) only need to happen in one\nplace and bootstrap stays automatically in sync.\n\nIf the file is already populated (the threat-model placeholder text\n\"_(no threat model recorded yet\" is absent), ask: \"File appears already\nbootstrapped — overwrite the threat-model section, or skip to add-incident?\"\nOn overwrite, take a `.bak` copy first.\n\nOtherwise interview the user briefly:\n- \"What does this app\u002Frepo handle? (1-2 sentences)\" → assets\n- \"Who is the realistic attacker model? (drive-by\u002Finsider\u002Fstate-level)\" → actors\n- \"Compliance regime that applies, if any? (PCI \u002F GDPR \u002F SOC2 \u002F HIPAA \u002F none)\"\n- \"Top 1-2 security concerns you currently have for this repo, in plain English\"\n\nThen **read the existing checked-in template** at\n`docs\u002Fsecurity-strategy.md`, replace the `## Threat model` body\nbetween the heading and `## Incidents` with a paragraph synthesising\nthe user's answers (Assets \u002F Actors \u002F Compliance \u002F Concerns), and\nwrite back via the round-trip parse + atomicWriteFileSync protocol\n(R3-M4):\n1. Read current file; locate `## Threat model` … `## Incidents` span.\n2. Substitute the body, leave headings + the `## Incidents` placeholder\n   comments untouched.\n3. Pass full new content through `parseSecurityStrategy()` — assert no\n   parse warnings; if any, fail loudly and don't write.\n4. Call `atomicWriteFileSync('docs\u002Fsecurity-strategy.md', content)`.\n\nThen run `node scripts\u002Fsecurity-memory\u002Frefresh-incidents.mjs` and surface its summary line.\n\n---\n\n## Step 1b — ADD or ADD_FROM_COMMIT\n\nDetermine the incident's `id`: scan existing markdown for highest\n`INC-NNN`, increment by 1. Pad to 3 digits (`INC-001`, `INC-002`, …).\n\nFor ADD_FROM_COMMIT: pre-fill from `git show \u003Csha>`:\n- description: commit subject line (sanitised — no AI co-authoring trailers)\n- affected_paths: `git show --name-only \u003Csha>` filtered to source files\n- mitigation_ref: try to detect: if commit added a Semgrep rule under\n  `semgrep\u002F`, reference it; else \"manual\"\n- lessons_learned: empty initially — prompt user to fill in\n\nFor interactive ADD, prompt the user for each field with examples.\n\n**Write protocol** (R3-M4):\n1. Read current `docs\u002Fsecurity-strategy.md`.\n2. Insert the new incident block at the END of the `## Incidents`\n   section, BEFORE any `## Historical incidents` heading if present.\n3. The block format:\n   ```markdown\n   \u003C!-- incident:start id=\"INC-NNN\" -->\n   **Description**: \u003Ctext>\n\n   **Affected paths**: `\u003Cpath1>`, `\u003Cpath2>`\n\n   **Mitigation**: `\u003Csemgrep:rule-id | scripts\u002Fpath | manual>`\n\n   **Lessons learned**: \u003Ctext>\n   \u003C!-- incident:end -->\n   ```\n4. **Round-trip parse** the new full file content via\n   `parseSecurityStrategy()` — assert the new entry appears in\n   `incidents[]` with non-null `description` AND no parse warnings\n   reference the new ID.\n5. Only on round-trip success → `atomicWriteFileSync()`.\n6. Run `node scripts\u002Fsecurity-memory\u002Frefresh-incidents.mjs` and surface result summary.\n7. If round-trip fails → output the parsed warnings, do NOT write,\n   ask the user to revise.\n\n---\n\n## Step 2 — Surface results\n\n```\n═══════════════════════════════════════\n  \u002Fsecurity-strategy — DONE\n  Mode: \u003CBOOTSTRAP | ADD | ADD_FROM_COMMIT>\n  File: docs\u002Fsecurity-strategy.md (\u003CN> incidents total)\n  Refresh: \u003Cupserted N, swept M, on-default-branch=Y\u002FN>\n═══════════════════════════════════════\n```\n\nIf on a feature branch and the user added an incident, gently note:\n\"Incidents from feature branches UPSERT but don't trigger sweep — the\ncanonical retired-set updates when the default branch refreshes.\"\n\n---\n\n## Hard rules\n\n- **Never write `docs\u002Fsecurity-strategy.md` without round-trip parse first.** A malformed entry that the parser silently skips is worse than a noisy warning.\n- **Never include real secrets** (API keys, passwords, payment data) in the markdown — even though `redactSecrets()` runs before egress, the markdown itself goes to PR review and git history.\n- **Never inflate the threat model**. Real assets + realistic actors only. A false threat model misleads \u002Fplan worse than no threat model.\n- **One incident per security-relevant fix** — not per CVE in a third-party dep, not per Dependabot bump. Genuine post-incident learning material.\n\n---\n\n## Reference files\n\n| File | Summary | Read when |\n|---|---|---|\n| `references\u002Fworktree-preflight.md` | Worktree preflight remedy — the skills:hydrate npm script to add when a linked worktree lacks the tooling tree. | A command dies with `MODULE_NOT_FOUND` in a linked worktree AND this repo has no `skills:hydrate` script. |\n","# \u002Fsecurity-strategy — proactive security memory maintenance\n\n> **Explicit invocation only — host-neutral.** `disable-model-invocation: true`\n> enforces this in Claude Code and in VS Code Copilot, which reads\n> `.claude\u002Fskills\u002F` and honours that key (verified against VS Code Agent Skills\n> docs 2026-09-02). Hosts beyond those two are unverified, and a key cannot\n> carry the reasoning anyway, so the rule is stated here as well.\n>\n> Run this only when the user asked for it. It writes\n> `docs\u002Fsecurity-strategy.md` and publishes to the shared index, and an\n> incident drafted from a passing mention is a false record in a security\n> memory other people will later trust.\n\nThis skill maintains the **markdown source-of-truth** at\n`docs\u002Fsecurity-strategy.md`. After any edit, it runs\n`node scripts\u002Fsecurity-memory\u002Frefresh-incidents.mjs` so the Supabase embedding\nindex stays current.\n\n**Always by path, never via an `npm run` alias.** The sync never merges npm\nscripts into a consumer's `package.json`, so a `security:refresh` alias exists\nin the source repo only. The earlier workaround appended `--if-present` to that\nalias, which made the `Missing script` error disappear by exiting **0 without\nrunning anything** — so a consumer's index silently never refreshed. The\nrefresher is itself synced, so the path always resolves.\n\nThe skill is **on-demand only** — it never blocks `\u002Fcycle`, `\u002Fplan`, or\n`\u002Fship`. The planner (Phase 0.5b) consults the memory via the cross-skill\nbridge regardless of whether this skill has run recently.\n\n> **Worktree preflight** — in a linked git worktree the synced tooling tree\n> `scripts\u002F.claude-skills\u002F` is absent — it is gitignored, so `git worktree add`\n> does not populate it, and every command below that uses it dies on a bare\n> `MODULE_NOT_FOUND`. Run `npm run skills:hydrate` first. If this repo defines\n> no such script, `references\u002Fworktree-preflight.md` holds the entry to add — ask\n> the user first, since it edits their `package.json`.\n\n---\n\n## Step 0 — Parse Mode\n\n| Input | Mode |\n|---|---|\n| `\u002Fsecurity-strategy bootstrap` | **BOOTSTRAP** — first-time seed of threat model + optional first incident |\n| `\u002Fsecurity-strategy add-incident` | **ADD** — interactive draft of one new incident |\n| `\u002Fsecurity-strategy add-incident from-commit \u003Csha>` | **ADD_FROM_COMMIT** — pre-fill from a security-relevant commit |\n\nIf no mode given → ask the user which one.\n\n---\n\n## Step 1a — BOOTSTRAP\n\nThe repo template at `docs\u002Fsecurity-strategy.md` is the canonical\nskeleton. Bootstrap fills in placeholders rather than emitting a\nparallel template — so changes to the template's structure (parser\nsections, comment markers, header text) only need to happen in one\nplace and bootstrap stays automatically in sync.\n\nIf the file is already populated (the threat-model placeholder text\n\"_(no threat model recorded yet\" is absent), ask: \"File appears already\nbootstrapped — overwrite the threat-model section, or skip to add-incident?\"\nOn overwrite, take a `.bak` copy first.\n\nOtherwise interview the user briefly:\n- \"What does this app\u002Frepo handle? (1-2 sentences)\" → assets\n- \"Who is the realistic attacker model? (drive-by\u002Finsider\u002Fstate-level)\" → actors\n- \"Compliance regime that applies, if any? (PCI \u002F GDPR \u002F SOC2 \u002F HIPAA \u002F none)\"\n- \"Top 1-2 security concerns you currently have for this repo, in plain English\"\n\nThen **read the existing checked-in template** at\n`docs\u002Fsecurity-strategy.md`, replace the `## Threat model` body\nbetween the heading and `## Incidents` with a paragraph synthesising\nthe user's answers (Assets \u002F Actors \u002F Compliance \u002F Concerns), and\nwrite back via the round-trip parse + atomicWriteFileSync protocol\n(R3-M4):\n1. Read current file; locate `## Threat model` … `## Incidents` span.\n2. Substitute the body, leave headings + the `## Incidents` placeholder\n   comments untouched.\n3. Pass full new content through `parseSecurityStrategy()` — assert no\n   parse warnings; if any, fail loudly and don't write.\n4. Call `atomicWriteFileSync('docs\u002Fsecurity-strategy.md', content)`.\n\nThen run `node scripts\u002Fsecurity-memory\u002Frefresh-incidents.mjs` and surface its summary line.\n\n---\n\n## Step 1b — ADD or ADD_FROM_COMMIT\n\nDetermine the incident's `id`: scan existing markdown for highest\n`INC-NNN`, increment by 1. Pad to 3 digits (`INC-001`, `INC-002`, …).\n\nFor ADD_FROM_COMMIT: pre-fill from `git show \u003Csha>`:\n- description: commit subject line (sanitised — no AI co-authoring trailers)\n- affected_paths: `git show --name-only \u003Csha>` filtered to source files\n- mitigation_ref: try to detect: if commit added a Semgrep rule under\n  `semgrep\u002F`, reference it; else \"manual\"\n- lessons_learned: empty initially — prompt user to fill in\n\nFor interactive ADD, prompt the user for each field with examples.\n\n**Write protocol** (R3-M4):\n1. Read current `docs\u002Fsecurity-strategy.md`.\n2. Insert the new incident block at the END of the `## Incidents`\n   section, BEFORE any `## Historical incidents` heading if present.\n3. The block format:\n   ```markdown\n   \u003C!-- incident:start id=\"INC-NNN\" -->\n   **Description**: \u003Ctext>\n\n   **Affected paths**: `\u003Cpath1>`, `\u003Cpath2>`\n\n   **Mitigation**: `\u003Csemgrep:rule-id | scripts\u002Fpath | manual>`\n\n   **Lessons learned**: \u003Ctext>\n   \u003C!-- incident:end -->\n   ```\n4. **Round-trip parse** the new full file content via\n   `parseSecurityStrategy()` — assert the new entry appears in\n   `incidents[]` with non-null `description` AND no parse warnings\n   reference the new ID.\n5. Only on round-trip success → `atomicWriteFileSync()`.\n6. Run `node scripts\u002Fsecurity-memory\u002Frefresh-incidents.mjs` and surface result summary.\n7. If round-trip fails → output the parsed warnings, do NOT write,\n   ask the user to revise.\n\n---\n\n## Step 2 — Surface results\n\n```\n═══════════════════════════════════════\n  \u002Fsecurity-strategy — DONE\n  Mode: \u003CBOOTSTRAP | ADD | ADD_FROM_COMMIT>\n  File: docs\u002Fsecurity-strategy.md (\u003CN> incidents total)\n  Refresh: \u003Cupserted N, swept M, on-default-branch=Y\u002FN>\n═══════════════════════════════════════\n```\n\nIf on a feature branch and the user added an incident, gently note:\n\"Incidents from feature branches UPSERT but don't trigger sweep — the\ncanonical retired-set updates when the default branch refreshes.\"\n\n---\n\n## Hard rules\n\n- **Never write `docs\u002Fsecurity-strategy.md` without round-trip parse first.** A malformed entry that the parser silently skips is worse than a noisy warning.\n- **Never include real secrets** (API keys, passwords, payment data) in the markdown — even though `redactSecrets()` runs before egress, the markdown itself goes to PR review and git history.\n- **Never inflate the threat model**. Real assets + realistic actors only. A false threat model misleads \u002Fplan worse than no threat model.\n- **One incident per security-relevant fix** — not per CVE in a third-party dep, not per Dependabot bump. Genuine post-incident learning material.\n\n---\n\n## Reference files\n\n| File | Summary | Read when |\n|---|---|---|\n| `references\u002Fworktree-preflight.md` | Worktree preflight remedy — the skills:hydrate npm script to add when a linked worktree lacks the tooling tree. | A command dies with `MODULE_NOT_FOUND` in a linked worktree AND this repo has no `skills:hydrate` script. |\n",{"name":5,"description":45,"disable-model-invocation":46},"On-demand maintenance of the per-repo security memory: bootstrap an\ninitial threat model + add\u002Fappend incidents to docs\u002Fsecurity-strategy.md\nwith proper marker comments, then refresh the Supabase index. NEVER\ngates planning — \u002Fplan reads the resulting memory automatically via\nPhase 0.5b.\nTriggers on: \"security strategy\", \"add security incident\", \"draft\nincident\", \"\u002Fsecurity-strategy\", \"bootstrap security memory\".\nUsage:\n  \u002Fsecurity-strategy bootstrap         — interview to seed initial threat model + first incident\n  \u002Fsecurity-strategy add-incident      — interactive draft of one new incident entry\n  \u002Fsecurity-strategy add-incident from-commit \u003Csha>  — pre-fill from commit subject + changed files\n",true,"main","938efbef34b7c76f0d112f336d1ac4018224d186",".claude\u002Fskills\u002Fsecurity-strategy","https:\u002F\u002Fgithub.com\u002FLbstrydom\u002Fclaude-engineering-skills","https:\u002F\u002Fgithub.com\u002FLbstrydom","Studying M.Sc Computer Science at Heriot Watt","2026-11-10 15:13:10",{"source":8,"skillName":5,"commands":55,"prompt":65,"zipAvailable":46},[56,59,62],{"tool":57,"command":58},"npx","npx skills add Lbstrydom\u002Fclaude-engineering-skills --skill security-strategy",{"tool":60,"command":61},"bunx","bunx skills add Lbstrydom\u002Fclaude-engineering-skills --skill security-strategy",{"tool":63,"command":64},"pnpm","pnpm dlx skills add Lbstrydom\u002Fclaude-engineering-skills --skill security-strategy","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FLbstrydom\u002Fclaude-engineering-skills\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fsecurity-strategy\u002FSKILL.md",[67],{"path":68,"resourceType":69,"resourceTypeDesc":70,"sizeBytes":71,"sourceHtmlUrl":72},"references\u002Fworktree-preflight.md","REFERENCE","参考文档",3413,"https:\u002F\u002Fgithub.com\u002FLbstrydom\u002Fclaude-engineering-skills\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fsecurity-strategy\u002Freferences\u002Fworktree-preflight.md",[74,91,102,122,136,171],{"skillNo":75,"name":76,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":78,"categories":79,"keywords":85,"publishedAt":40},"01M6J45X4FDB2AD5BGS4R4QY8X","stated-absent","Negative fixture — the contract's stated string never appears in this file.","https:\u002F\u002Fgithub.com\u002FLbstrydom\u002Fclaude-engineering-skills\u002Fblob\u002Fmain\u002Ftests\u002Ffixtures\u002Fgate-honesty\u002Fnegative\u002Fstated-absent\u002Fskills\u002Fstated-absent\u002FSKILL.md",[80],{"categoryNo":81,"categoryName":82,"taxonomyType":83,"taxonomyTypeDesc":84},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[86,87,88,89,31,90],"stated absent","STRING","contract","fixture","file",{"skillNo":92,"name":93,"nameZh":6,"description":94,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":95,"categories":96,"keywords":98,"publishedAt":40},"01M6J45TAX2PPHETZ5TJZG20QQ","nonexistent-implementation","Negative fixture — contract references an implementation file that does not exist.","https:\u002F\u002Fgithub.com\u002FLbstrydom\u002Fclaude-engineering-skills\u002Fblob\u002Fmain\u002Ftests\u002Ffixtures\u002Fgate-honesty\u002Fnegative\u002Fnonexistent-implementation\u002Fskills\u002Fnonexistent-implementation\u002FSKILL.md",[97],{"categoryNo":81,"categoryName":82,"taxonomyType":83,"taxonomyTypeDesc":84},[99,100,101,88,89,90],"implementation","nonexistent implementation","references",{"skillNo":103,"name":104,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":113,"publishedAt":40},"01M6J45P5GN52YFMZ81T7NN1VF","document-only-with-params","Negative fixture — a document-only gate illegally carries params (schema must refuse this fake-check pattern).","https:\u002F\u002Fgithub.com\u002FLbstrydom\u002Fclaude-engineering-skills\u002Fblob\u002Fmain\u002Ftests\u002Ffixtures\u002Fgate-honesty\u002Fnegative\u002Fdocument-only-with-params\u002Fskills\u002Fdocument-only-with-params\u002FSKILL.md",[108],{"categoryNo":109,"categoryName":110,"taxonomyType":111,"taxonomyTypeDesc":112},"01JBSEEDCAT000000000000002","文档处理","SCENARIO","使用场景",[114,115,116,117,118,119,120,121,89],"only","document","with","document only with params","check","schema","gate","pattern",{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":131,"publishedAt":40},"01M6J45J1CCZ7AXDGQKBA9VC8M","lying-skill","Fixture skill for the gate-honesty self-check — every gate here is deliberately dishonest.","https:\u002F\u002Fgithub.com\u002FLbstrydom\u002Fclaude-engineering-skills\u002Fblob\u002Fmain\u002Ftests\u002Ffixtures\u002Fgate-honesty\u002Flying-skill\u002Fskills\u002Flying-skill\u002FSKILL.md",[128],{"categoryNo":129,"categoryName":130,"taxonomyType":111,"taxonomyTypeDesc":112},"01JBSEEDCAT000000000000023","Skill与智能体开发",[132,118,120,133,134,89,135],"lying skill","fixture skill","self","for",{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":151,"publishedAt":40},"01M6J45CW0DNN7K2W39E3PQHEY","visual-audit","Math-first, deterministic visual\u002Fpaint inspection — the 4th UX lens, complementing\npersona-test (journey), click-test (page), and nav-audit (system). Drives Playwright +\ncomputed styles + bounding boxes + CDP forced-pseudo-state to audit declared-token\nconformance, light\u002Fdark theme parity, layout physics, and affordance signifiers. A VLM\nis advisory-only and never gates. CI gate is drift-only on the changed contracted surface.\nTriggers on: \"visual audit\", \"check styling consistency\", \"theme parity\", \"dark mode parity\",\n\"design token drift\", \"paint audit\", \"button\u002Fcard consistency\", \"focus ring audit\",\n\"\u002Fvisual-audit\".","https:\u002F\u002Fgithub.com\u002FLbstrydom\u002Fclaude-engineering-skills\u002Fblob\u002Fmain\u002Fskills\u002Fvisual-audit\u002FSKILL.md",[142,145,148],{"categoryNo":143,"categoryName":144,"taxonomyType":111,"taxonomyTypeDesc":112},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":146,"categoryName":147,"taxonomyType":111,"taxonomyTypeDesc":112},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":149,"categoryName":150,"taxonomyType":83,"taxonomyTypeDesc":84},"01JBSEEDCAT000000000000032","设计师",[152,153,154,155,156,157,158,159,160,161,162,163,31,114,164,165,166,167,168,169,170],"visual audit","visual","audit","mode","design token","click","inspection","lens","design","ci","persona","math","cdp","journey","drift","focus","physics","layout","card",{"skillNo":172,"name":173,"nameZh":6,"description":174,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":175,"categories":176,"keywords":183,"publishedAt":40},"01M6J4569S40ZASFWW698CHBKP","ux-lock","Generate Playwright e2e specs. Two modes:\n  1. LOCK mode — pin a fix's DOM contract so it doesn't regress (default).\n  2. VERIFY mode — check that a \u002Fplan plan was actually implemented\n     by parsing its Acceptance Criteria section and driving the live URL.\nVERIFY mode grades a plan against a RUNNING app. To judge the plan document\nitself, before anything is built, that is \u002Faudit-plan.\nTriggers on: \"ux lock\", \"lock ux\", \"lock in the fix\", \"write regression spec\",\n\"generate e2e test for\", \"regression test for commit\", \"lock this fix\",\n\"verify the plan\", \"verify plan implementation\", \"check the plan was built\",\n\"audit frontend implementation\", \"did we ship the plan\".\nFull command syntax: see the Usage section in this skill.","https:\u002F\u002Fgithub.com\u002FLbstrydom\u002Fclaude-engineering-skills\u002Fblob\u002Fmain\u002Fskills\u002Fux-lock\u002FSKILL.md",[177,178,181,182],{"categoryNo":143,"categoryName":144,"taxonomyType":111,"taxonomyTypeDesc":112},{"categoryNo":179,"categoryName":180,"taxonomyType":111,"taxonomyTypeDesc":112},"01JBSEEDCAT000000000000009","前端开发",{"categoryNo":149,"categoryName":150,"taxonomyType":83,"taxonomyTypeDesc":84},{"categoryNo":81,"categoryName":82,"taxonomyType":83,"taxonomyTypeDesc":84},[184,185,186,155,38,187,188,154,189,190,191,192,193,194,195,196,197,198,199,200,201],"ux lock","lock","ux","generate","acceptance","plan","regression","syntax","command","write","fix","e2e test","default","app","judge","URL","verify plan","frontend"]