[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6J41FM46RBE5WHT28533PC1":3,"skill-same:01M6J41FM46RBE5WHT28533PC1":67},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":40,"linkOnly":41,"markdownContent":42,"markdownBody":43,"frontMatter":44,"refName":47,"commitSha":48,"skillDirectory":49,"forksCount":14,"repositoryHtmlUrl":50,"repositoryHomepageUrl":6,"ownerHtmlUrl":51,"ownerBlogUrl":6,"ownerDescription":52,"updatedAt":53,"install":54,"resources":66},"01M6J41FM46RBE5WHT28533PC1","security-strategy",null,"On-demand maintenance of the per-repo security memory: bootstrap an\ninitial threat model + add\u002Fappend incidents to docs\u002Fsecurity-strategy.md\nwith proper marker comments, then log the operation to the Postgres\nsecurity_incident_log audit table. NEVER gates planning — \u002Fplan reads\ndocs\u002Fsecurity-strategy.md directly via Phase 0.5b.\nTriggers on: \"security strategy\", \"add security incident\", \"draft\nincident\", \"\u002Fsecurity-strategy\", \"bootstrap security memory\".\nUsage:\n  \u002Fsecurity-strategy bootstrap         — interview to seed initial threat model + first incident\n  \u002Fsecurity-strategy add-incident      — interactive draft of one new incident entry\n  \u002Fsecurity-strategy add-incident from-commit \u003Csha>  — pre-fill from commit subject + changed files","Lbstrydom\u002Fclaude-engineering-skills","Lbstrydom","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F77991486?v=4","01M6J3X4N2T0FTZT1RKFXDVS0K","Louis Strydom","01M6J3X4SXV0BXWDMXPW90D8BK",0,"MIT","https:\u002F\u002Fgithub.com\u002FLbstrydom\u002Fclaude-engineering-skills\u002Fblob\u002Fmain\u002Fdocs\u002Fplans\u002Fsecurity\u002Ffiles\u002F.claude\u002Fskills\u002Fsecurity-strategy\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39],"security strategy","strategy","security","files","new","true","usage","incidents","comments","operation","triggers","incident","postgres","never","interview","interactive","repo","model","planning","commit","memory","2026-11-10 10:12:30",false,"---\nname: security-strategy\ndescription: |\n  On-demand maintenance of the per-repo security memory: bootstrap an\n  initial threat model + add\u002Fappend incidents to docs\u002Fsecurity-strategy.md\n  with proper marker comments, then log the operation to the Postgres\n  security_incident_log audit table. NEVER gates planning — \u002Fplan reads\n  docs\u002Fsecurity-strategy.md directly via Phase 0.5b.\n  Triggers on: \"security strategy\", \"add security incident\", \"draft\n  incident\", \"\u002Fsecurity-strategy\", \"bootstrap security memory\".\n  Usage:\n    \u002Fsecurity-strategy bootstrap         — interview to seed initial threat model + first incident\n    \u002Fsecurity-strategy add-incident      — interactive draft of one new incident entry\n    \u002Fsecurity-strategy add-incident from-commit \u003Csha>  — pre-fill from commit subject + changed files\ndisable-model-invocation: true\n---\n\n# \u002Fsecurity-strategy — proactive security memory maintenance\n\nThis skill maintains the **markdown source-of-truth** at\n`docs\u002Fsecurity-strategy.md`. After any edit, it logs the operation to the\nPostgres `security_incident_log` table for governance and audit trail.\n\nThe skill is **on-demand only** — it never blocks `\u002Fcycle`, `\u002Fplan`, or\n`\u002Fship`. The planner (Phase 0.5b) reads `docs\u002Fsecurity-strategy.md`\ndirectly — no vector index needed.\n\n---\n\n## Step 0 — Parse Mode\n\n| Input | Mode |\n|---|---|\n| `\u002Fsecurity-strategy bootstrap` | **BOOTSTRAP** — first-time seed of threat model + optional first incident |\n| `\u002Fsecurity-strategy add-incident` | **ADD** — interactive draft of one new incident |\n| `\u002Fsecurity-strategy add-incident from-commit \u003Csha>` | **ADD_FROM_COMMIT** — pre-fill from a security-relevant commit |\n\nIf no mode given → ask the user which one.\n\n---\n\n## Step 1a — BOOTSTRAP\n\nThe repo template at `docs\u002Fsecurity-strategy.md` is the canonical\nskeleton. Bootstrap fills in placeholders rather than emitting a\nparallel template — so changes to the template's structure (marker\nheadings, comment markers) only need to happen in one place and\nbootstrap stays automatically in sync.\n\nIf the file is already populated (the threat-model placeholder text\n\"_(no threat model recorded yet\" is absent), ask: \"File appears already\nbootstrapped — overwrite the threat-model section, or skip to add-incident?\"\nOn overwrite, take a `.bak` copy first.\n\nOtherwise interview the user briefly:\n- \"What does this app\u002Frepo handle? (1-2 sentences)\" → assets\n- \"Who is the realistic attacker model? (drive-by\u002Finsider\u002Fstate-level)\" → actors\n- \"Compliance regime that applies? (ISO-27001 \u002F GDPR \u002F NIS2 \u002F internal-only \u002F none)\"\n- \"Top 1-2 security concerns you currently have for this repo, in plain English\"\n\nThen **read the existing template** at `docs\u002Fsecurity-strategy.md`,\nreplace the body between `\u003C!-- threat-model:start -->` and\n`\u003C!-- threat-model:end -->` with a paragraph synthesising the user's\nanswers (Assets \u002F Actors \u002F Compliance \u002F Concerns), and write back:\n\n1. Read current file; locate the `\u003C!-- threat-model:start -->` … `\u003C!-- threat-model:end -->` span.\n2. Substitute the body, leave headings + markers untouched.\n3. Re-read the written file and verify the threat-model section contains\n   real content (placeholder text gone).\n4. Run:\n   ```\n   npm run security:log -- --incident-id bootstrap --mode bootstrap \\\n     --classification INTERNAL --compliance-tags org-security\n   ```\n\n---\n\n## Step 1b — ADD or ADD_FROM_COMMIT\n\nDetermine the incident's `id`: scan existing markdown for highest\n`INC-NNN`, increment by 1. Pad to 3 digits (`INC-001`, `INC-002`, …).\n\nFor ADD_FROM_COMMIT: pre-fill from `git show \u003Csha>`:\n- description: commit subject line (sanitised — no AI co-authoring trailers)\n- affected_paths: `git show --name-only \u003Csha>` filtered to source files\n- classification: infer from changed paths —\n  `scripts\u002Flib\u002Fdb\u002F`, auth, credentials → **CONFIDENTIAL**; else **INTERNAL**\n- compliance_tags: always include `org-security`; add `org-data`\n  if JSONB\u002FPII columns changed; add `org-access` if auth paths changed\n- commit_sha: `\u003Csha>` (full 40-char SHA — REQUIRED in this mode)\n- mitigation_ref: if commit added a Semgrep rule under `semgrep\u002F`,\n  reference it; else \"manual\"\n- lessons_learned: empty initially — prompt user to fill in\n\nFor interactive ADD, prompt the user for each field with examples.\n\n**Write protocol**:\n1. Read current `docs\u002Fsecurity-strategy.md`.\n2. Insert the new incident block at the END of the `## Incidents`\n   section, BEFORE `\u003C!-- incidents-list:end -->`.\n3. The block format:\n   ```markdown\n   \u003C!-- incident:start id=\"INC-NNN\" -->\n   **Description**: \u003Ctext>\n\n   **Affected paths**: `\u003Cpath1>`, `\u003Cpath2>`\n\n   **Classification**: INTERNAL | CONFIDENTIAL | RESTRICTED | PUBLIC\n\n   **Compliance tags**: `org-security` [, `org-data`, `org-access`]\n\n   **Mitigation**: `\u003Csemgrep:rule-id | scripts\u002Fpath | manual>`\n\n   **Commit**: `\u003Cfull-40-char-sha>` (required for from-commit; strongly recommended for add)\n\n   **Lessons learned**: \u003Ctext>\n   \u003C!-- incident:end -->\n   ```\n4. **Round-trip verify**: re-read the written file and confirm\n   `\u003C!-- incident:start id=\"INC-NNN\" -->` is present with non-empty\n   Description and a valid Classification value. If check fails → do NOT\n   proceed to step 5; output what is wrong and ask the user to revise.\n5. Run:\n   ```\n   npm run security:log -- --incident-id INC-NNN \\\n     --mode \u003Cadd|add-from-commit> \\\n     --classification \u003Cvalue> \\\n     --compliance-tags org-security \\\n     --commit-sha \u003Csha-or-omit>\n   ```\n6. Check current branch — if NOT main\u002Fmaster, surface the branch-gate\n   notice below.\n\n**Branch-gate notice** (non-main branches):\n> Draft branch: INC-NNN is recorded in the markdown but the Postgres audit\n> trail marks branch=`\u003Cname>`. The incident becomes canonical once merged to main.\n\n---\n\n## Step 2 — Surface results\n\n```\n═══════════════════════════════════════\n  \u002Fsecurity-strategy — DONE\n  Mode: \u003CBOOTSTRAP | ADD | ADD_FROM_COMMIT>\n  File: docs\u002Fsecurity-strategy.md (\u003CN> incidents total)\n  Classification: \u003Cvalue>  |  Tags: \u003Ccompliance_tags>\n  Audit trail: Postgres security_incident_log — branch=\u003Cname>, on-main=\u003CY\u002FN>\n═══════════════════════════════════════\n```\n\n---\n\n## Hard rules\n\n- **Never write `docs\u002Fsecurity-strategy.md` without round-trip verify first.** A malformed entry that the verify step silently misses is worse than a noisy warning.\n- **Never include real secrets** (API keys, passwords, credentials) in the markdown — the file is committed to git and visible in PR reviews and history.\n- **Never inflate the threat model**. Real assets + realistic actors only. A false threat model misleads \u002Fplan worse than no threat model.\n- **One incident per security-relevant fix** — not per CVE in a third-party dep, not per Dependabot bump. Genuine post-incident learning material.\n- **Classification defaults to INTERNAL**. Never set PUBLIC for this repo without explicit user confirmation — this is a corporate environment.\n- **`commit_sha` is mandatory** for `add-from-commit` mode. For interactive `add`, prompt for it — omit only when there is genuinely no associated commit.\n- **`org-security` tag is always required** in compliance_tags. Add additional tags only when clearly applicable.\n- **Postgres audit trail is hard-fail on DB-unavailable**: `npm run security:log` exits non-zero (exit 1) when Postgres is unreachable — a compliance audit trail must not silently report success. The markdown write itself is the source of truth; if logging fails, surface the error and retry once Postgres is reachable. Do NOT treat a logging failure as success.\n","# \u002Fsecurity-strategy — proactive security memory maintenance\n\nThis skill maintains the **markdown source-of-truth** at\n`docs\u002Fsecurity-strategy.md`. After any edit, it logs the operation to the\nPostgres `security_incident_log` table for governance and audit trail.\n\nThe skill is **on-demand only** — it never blocks `\u002Fcycle`, `\u002Fplan`, or\n`\u002Fship`. The planner (Phase 0.5b) reads `docs\u002Fsecurity-strategy.md`\ndirectly — no vector index needed.\n\n---\n\n## Step 0 — Parse Mode\n\n| Input | Mode |\n|---|---|\n| `\u002Fsecurity-strategy bootstrap` | **BOOTSTRAP** — first-time seed of threat model + optional first incident |\n| `\u002Fsecurity-strategy add-incident` | **ADD** — interactive draft of one new incident |\n| `\u002Fsecurity-strategy add-incident from-commit \u003Csha>` | **ADD_FROM_COMMIT** — pre-fill from a security-relevant commit |\n\nIf no mode given → ask the user which one.\n\n---\n\n## Step 1a — BOOTSTRAP\n\nThe repo template at `docs\u002Fsecurity-strategy.md` is the canonical\nskeleton. Bootstrap fills in placeholders rather than emitting a\nparallel template — so changes to the template's structure (marker\nheadings, comment markers) only need to happen in one place and\nbootstrap stays automatically in sync.\n\nIf the file is already populated (the threat-model placeholder text\n\"_(no threat model recorded yet\" is absent), ask: \"File appears already\nbootstrapped — overwrite the threat-model section, or skip to add-incident?\"\nOn overwrite, take a `.bak` copy first.\n\nOtherwise interview the user briefly:\n- \"What does this app\u002Frepo handle? (1-2 sentences)\" → assets\n- \"Who is the realistic attacker model? (drive-by\u002Finsider\u002Fstate-level)\" → actors\n- \"Compliance regime that applies? (ISO-27001 \u002F GDPR \u002F NIS2 \u002F internal-only \u002F none)\"\n- \"Top 1-2 security concerns you currently have for this repo, in plain English\"\n\nThen **read the existing template** at `docs\u002Fsecurity-strategy.md`,\nreplace the body between `\u003C!-- threat-model:start -->` and\n`\u003C!-- threat-model:end -->` with a paragraph synthesising the user's\nanswers (Assets \u002F Actors \u002F Compliance \u002F Concerns), and write back:\n\n1. Read current file; locate the `\u003C!-- threat-model:start -->` … `\u003C!-- threat-model:end -->` span.\n2. Substitute the body, leave headings + markers untouched.\n3. Re-read the written file and verify the threat-model section contains\n   real content (placeholder text gone).\n4. Run:\n   ```\n   npm run security:log -- --incident-id bootstrap --mode bootstrap \\\n     --classification INTERNAL --compliance-tags org-security\n   ```\n\n---\n\n## Step 1b — ADD or ADD_FROM_COMMIT\n\nDetermine the incident's `id`: scan existing markdown for highest\n`INC-NNN`, increment by 1. Pad to 3 digits (`INC-001`, `INC-002`, …).\n\nFor ADD_FROM_COMMIT: pre-fill from `git show \u003Csha>`:\n- description: commit subject line (sanitised — no AI co-authoring trailers)\n- affected_paths: `git show --name-only \u003Csha>` filtered to source files\n- classification: infer from changed paths —\n  `scripts\u002Flib\u002Fdb\u002F`, auth, credentials → **CONFIDENTIAL**; else **INTERNAL**\n- compliance_tags: always include `org-security`; add `org-data`\n  if JSONB\u002FPII columns changed; add `org-access` if auth paths changed\n- commit_sha: `\u003Csha>` (full 40-char SHA — REQUIRED in this mode)\n- mitigation_ref: if commit added a Semgrep rule under `semgrep\u002F`,\n  reference it; else \"manual\"\n- lessons_learned: empty initially — prompt user to fill in\n\nFor interactive ADD, prompt the user for each field with examples.\n\n**Write protocol**:\n1. Read current `docs\u002Fsecurity-strategy.md`.\n2. Insert the new incident block at the END of the `## Incidents`\n   section, BEFORE `\u003C!-- incidents-list:end -->`.\n3. The block format:\n   ```markdown\n   \u003C!-- incident:start id=\"INC-NNN\" -->\n   **Description**: \u003Ctext>\n\n   **Affected paths**: `\u003Cpath1>`, `\u003Cpath2>`\n\n   **Classification**: INTERNAL | CONFIDENTIAL | RESTRICTED | PUBLIC\n\n   **Compliance tags**: `org-security` [, `org-data`, `org-access`]\n\n   **Mitigation**: `\u003Csemgrep:rule-id | scripts\u002Fpath | manual>`\n\n   **Commit**: `\u003Cfull-40-char-sha>` (required for from-commit; strongly recommended for add)\n\n   **Lessons learned**: \u003Ctext>\n   \u003C!-- incident:end -->\n   ```\n4. **Round-trip verify**: re-read the written file and confirm\n   `\u003C!-- incident:start id=\"INC-NNN\" -->` is present with non-empty\n   Description and a valid Classification value. If check fails → do NOT\n   proceed to step 5; output what is wrong and ask the user to revise.\n5. Run:\n   ```\n   npm run security:log -- --incident-id INC-NNN \\\n     --mode \u003Cadd|add-from-commit> \\\n     --classification \u003Cvalue> \\\n     --compliance-tags org-security \\\n     --commit-sha \u003Csha-or-omit>\n   ```\n6. Check current branch — if NOT main\u002Fmaster, surface the branch-gate\n   notice below.\n\n**Branch-gate notice** (non-main branches):\n> Draft branch: INC-NNN is recorded in the markdown but the Postgres audit\n> trail marks branch=`\u003Cname>`. The incident becomes canonical once merged to main.\n\n---\n\n## Step 2 — Surface results\n\n```\n═══════════════════════════════════════\n  \u002Fsecurity-strategy — DONE\n  Mode: \u003CBOOTSTRAP | ADD | ADD_FROM_COMMIT>\n  File: docs\u002Fsecurity-strategy.md (\u003CN> incidents total)\n  Classification: \u003Cvalue>  |  Tags: \u003Ccompliance_tags>\n  Audit trail: Postgres security_incident_log — branch=\u003Cname>, on-main=\u003CY\u002FN>\n═══════════════════════════════════════\n```\n\n---\n\n## Hard rules\n\n- **Never write `docs\u002Fsecurity-strategy.md` without round-trip verify first.** A malformed entry that the verify step silently misses is worse than a noisy warning.\n- **Never include real secrets** (API keys, passwords, credentials) in the markdown — the file is committed to git and visible in PR reviews and history.\n- **Never inflate the threat model**. Real assets + realistic actors only. A false threat model misleads \u002Fplan worse than no threat model.\n- **One incident per security-relevant fix** — not per CVE in a third-party dep, not per Dependabot bump. Genuine post-incident learning material.\n- **Classification defaults to INTERNAL**. Never set PUBLIC for this repo without explicit user confirmation — this is a corporate environment.\n- **`commit_sha` is mandatory** for `add-from-commit` mode. For interactive `add`, prompt for it — omit only when there is genuinely no associated commit.\n- **`org-security` tag is always required** in compliance_tags. Add additional tags only when clearly applicable.\n- **Postgres audit trail is hard-fail on DB-unavailable**: `npm run security:log` exits non-zero (exit 1) when Postgres is unreachable — a compliance audit trail must not silently report success. The markdown write itself is the source of truth; if logging fails, surface the error and retry once Postgres is reachable. Do NOT treat a logging failure as success.\n",{"name":5,"description":45,"disable-model-invocation":46},"On-demand maintenance of the per-repo security memory: bootstrap an\ninitial threat model + add\u002Fappend incidents to docs\u002Fsecurity-strategy.md\nwith proper marker comments, then log the operation to the Postgres\nsecurity_incident_log audit table. NEVER gates planning — \u002Fplan reads\ndocs\u002Fsecurity-strategy.md directly via Phase 0.5b.\nTriggers on: \"security strategy\", \"add security incident\", \"draft\nincident\", \"\u002Fsecurity-strategy\", \"bootstrap security memory\".\nUsage:\n  \u002Fsecurity-strategy bootstrap         — interview to seed initial threat model + first incident\n  \u002Fsecurity-strategy add-incident      — interactive draft of one new incident entry\n  \u002Fsecurity-strategy add-incident from-commit \u003Csha>  — pre-fill from commit subject + changed files\n",true,"main","938efbef34b7c76f0d112f336d1ac4018224d186","docs\u002Fplans\u002Fsecurity\u002Ffiles\u002F.claude\u002Fskills\u002Fsecurity-strategy","https:\u002F\u002Fgithub.com\u002FLbstrydom\u002Fclaude-engineering-skills","https:\u002F\u002Fgithub.com\u002FLbstrydom","Studying M.Sc Computer Science at Heriot Watt","2026-11-10 15:13:10",{"source":8,"skillName":5,"commands":55,"prompt":65,"zipAvailable":46},[56,59,62],{"tool":57,"command":58},"npx","npx skills add Lbstrydom\u002Fclaude-engineering-skills --skill security-strategy",{"tool":60,"command":61},"bunx","bunx skills add Lbstrydom\u002Fclaude-engineering-skills --skill security-strategy",{"tool":63,"command":64},"pnpm","pnpm dlx skills add Lbstrydom\u002Fclaude-engineering-skills --skill security-strategy","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FLbstrydom\u002Fclaude-engineering-skills\u002Fblob\u002Fmain\u002Fdocs\u002Fplans\u002Fsecurity\u002Ffiles\u002F.claude\u002Fskills\u002Fsecurity-strategy\u002FSKILL.md",[],[68,85,96,116,130,165],{"skillNo":69,"name":70,"nameZh":6,"description":71,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":72,"categories":73,"keywords":79,"publishedAt":40},"01M6J45X4FDB2AD5BGS4R4QY8X","stated-absent","Negative fixture — the contract's stated string never appears in this file.","https:\u002F\u002Fgithub.com\u002FLbstrydom\u002Fclaude-engineering-skills\u002Fblob\u002Fmain\u002Ftests\u002Ffixtures\u002Fgate-honesty\u002Fnegative\u002Fstated-absent\u002Fskills\u002Fstated-absent\u002FSKILL.md",[74],{"categoryNo":75,"categoryName":76,"taxonomyType":77,"taxonomyTypeDesc":78},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[80,81,82,83,32,84],"stated absent","STRING","contract","fixture","file",{"skillNo":86,"name":87,"nameZh":6,"description":88,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":89,"categories":90,"keywords":92,"publishedAt":40},"01M6J45TAX2PPHETZ5TJZG20QQ","nonexistent-implementation","Negative fixture — contract references an implementation file that does not exist.","https:\u002F\u002Fgithub.com\u002FLbstrydom\u002Fclaude-engineering-skills\u002Fblob\u002Fmain\u002Ftests\u002Ffixtures\u002Fgate-honesty\u002Fnegative\u002Fnonexistent-implementation\u002Fskills\u002Fnonexistent-implementation\u002FSKILL.md",[91],{"categoryNo":75,"categoryName":76,"taxonomyType":77,"taxonomyTypeDesc":78},[93,94,95,82,83,84],"implementation","nonexistent implementation","references",{"skillNo":97,"name":98,"nameZh":6,"description":99,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":100,"categories":101,"keywords":107,"publishedAt":40},"01M6J45P5GN52YFMZ81T7NN1VF","document-only-with-params","Negative fixture — a document-only gate illegally carries params (schema must refuse this fake-check pattern).","https:\u002F\u002Fgithub.com\u002FLbstrydom\u002Fclaude-engineering-skills\u002Fblob\u002Fmain\u002Ftests\u002Ffixtures\u002Fgate-honesty\u002Fnegative\u002Fdocument-only-with-params\u002Fskills\u002Fdocument-only-with-params\u002FSKILL.md",[102],{"categoryNo":103,"categoryName":104,"taxonomyType":105,"taxonomyTypeDesc":106},"01JBSEEDCAT000000000000002","文档处理","SCENARIO","使用场景",[108,109,110,111,112,113,114,115,83],"only","document","with","document only with params","check","schema","gate","pattern",{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":125,"publishedAt":40},"01M6J45J1CCZ7AXDGQKBA9VC8M","lying-skill","Fixture skill for the gate-honesty self-check — every gate here is deliberately dishonest.","https:\u002F\u002Fgithub.com\u002FLbstrydom\u002Fclaude-engineering-skills\u002Fblob\u002Fmain\u002Ftests\u002Ffixtures\u002Fgate-honesty\u002Flying-skill\u002Fskills\u002Flying-skill\u002FSKILL.md",[122],{"categoryNo":123,"categoryName":124,"taxonomyType":105,"taxonomyTypeDesc":106},"01JBSEEDCAT000000000000023","Skill与智能体开发",[126,112,114,127,128,83,129],"lying skill","fixture skill","self","for",{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":145,"publishedAt":40},"01M6J45CW0DNN7K2W39E3PQHEY","visual-audit","Math-first, deterministic visual\u002Fpaint inspection — the 4th UX lens, complementing\npersona-test (journey), click-test (page), and nav-audit (system). Drives Playwright +\ncomputed styles + bounding boxes + CDP forced-pseudo-state to audit declared-token\nconformance, light\u002Fdark theme parity, layout physics, and affordance signifiers. A VLM\nis advisory-only and never gates. CI gate is drift-only on the changed contracted surface.\nTriggers on: \"visual audit\", \"check styling consistency\", \"theme parity\", \"dark mode parity\",\n\"design token drift\", \"paint audit\", \"button\u002Fcard consistency\", \"focus ring audit\",\n\"\u002Fvisual-audit\".","https:\u002F\u002Fgithub.com\u002FLbstrydom\u002Fclaude-engineering-skills\u002Fblob\u002Fmain\u002Fskills\u002Fvisual-audit\u002FSKILL.md",[136,139,142],{"categoryNo":137,"categoryName":138,"taxonomyType":105,"taxonomyTypeDesc":106},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":140,"categoryName":141,"taxonomyType":105,"taxonomyTypeDesc":106},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":143,"categoryName":144,"taxonomyType":77,"taxonomyTypeDesc":78},"01JBSEEDCAT000000000000032","设计师",[146,147,148,149,150,151,152,153,154,155,156,157,32,108,158,159,160,161,162,163,164],"visual audit","visual","audit","mode","design token","click","inspection","lens","design","ci","persona","math","cdp","journey","drift","focus","physics","layout","card",{"skillNo":166,"name":167,"nameZh":6,"description":168,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":169,"categories":170,"keywords":177,"publishedAt":40},"01M6J4569S40ZASFWW698CHBKP","ux-lock","Generate Playwright e2e specs. Two modes:\n  1. LOCK mode — pin a fix's DOM contract so it doesn't regress (default).\n  2. VERIFY mode — check that a \u002Fplan plan was actually implemented\n     by parsing its Acceptance Criteria section and driving the live URL.\nVERIFY mode grades a plan against a RUNNING app. To judge the plan document\nitself, before anything is built, that is \u002Faudit-plan.\nTriggers on: \"ux lock\", \"lock ux\", \"lock in the fix\", \"write regression spec\",\n\"generate e2e test for\", \"regression test for commit\", \"lock this fix\",\n\"verify the plan\", \"verify plan implementation\", \"check the plan was built\",\n\"audit frontend implementation\", \"did we ship the plan\".\nFull command syntax: see the Usage section in this skill.","https:\u002F\u002Fgithub.com\u002FLbstrydom\u002Fclaude-engineering-skills\u002Fblob\u002Fmain\u002Fskills\u002Fux-lock\u002FSKILL.md",[171,172,175,176],{"categoryNo":137,"categoryName":138,"taxonomyType":105,"taxonomyTypeDesc":106},{"categoryNo":173,"categoryName":174,"taxonomyType":105,"taxonomyTypeDesc":106},"01JBSEEDCAT000000000000009","前端开发",{"categoryNo":143,"categoryName":144,"taxonomyType":77,"taxonomyTypeDesc":78},{"categoryNo":75,"categoryName":76,"taxonomyType":77,"taxonomyTypeDesc":78},[178,179,180,149,38,181,182,148,183,184,185,186,187,188,189,190,191,192,193,194,195],"ux lock","lock","ux","generate","acceptance","plan","regression","syntax","command","write","fix","e2e test","default","app","judge","URL","verify plan","frontend"]