[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6MZ3XFB30Q27TH7H3S0KA70":3,"skill-same:01M6MZ3XFB30Q27TH7H3S0KA70":71},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":43,"commitSha":44,"skillDirectory":45,"forksCount":46,"repositoryHtmlUrl":47,"repositoryHomepageUrl":6,"ownerHtmlUrl":48,"ownerBlogUrl":6,"ownerDescription":49,"updatedAt":50,"install":51,"resources":64},"01M6MZ3XFB30Q27TH7H3S0KA70","secops",null,"Security review, dependency audit and scanner choice: routes each artifact to its scanner (Ruff S for Python, gitleaks for secrets, pip-audit for the Python lock, osv-scanner for JS, R and other lockfiles, ShellCheck for shell), names each finding's rule and CWE, and sets the layer each check runs at (edit, commit, CI). Use when reviewing code or a file for security problems (load it before reading the code), auditing dependencies for known vulnerabilities, or choosing a repo's security checks.","snewhouse\u002Faa-ma-forge","snewhouse","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6317143?v=4","01M6MYYWF28C4KBQHHWB9SC6TS","Stephen J Newhouse","01M6MYYWJWQMDN2ZPFMJ584SSM",6,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fsnewhouse\u002Faa-ma-forge\u002Fblob\u002Fmain\u002Fclaude-code\u002Fskills\u002Fsecops\u002FSKILL.md",[],[5,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"check","for","load","pip","lock","ShellCheck","reviewing code","scanner","ruff","use","review","repo","choice","pip-audit","ci","file","code","commit","python","2026-11-10 10:12:30",false,"---\nname: secops\ndescription: \"Security review, dependency audit and scanner choice: routes each artifact to its scanner (Ruff S for Python, gitleaks for secrets, pip-audit for the Python lock, osv-scanner for JS, R and other lockfiles, ShellCheck for shell), names each finding's rule and CWE, and sets the layer each check runs at (edit, commit, CI). Use when reviewing code or a file for security problems (load it before reading the code), auditing dependencies for known vulnerabilities, or choosing a repo's security checks.\"\n---\n\n# SecOps router\n\nPick the check for the artifact, run it at the earliest layer that can block, and fail loud: a scanner that did not run reports UNKNOWN, never zero findings. This skill routes; the tools do the work.\n\n## Which scanner\n\n| Artifact | Scanner | How |\n|----------|---------|-----|\n| Python source | Ruff S rules (flake8-bandit) | `ruff check --select S \u003Cpaths>`; suppress only per site, `# noqa: Sxxx  # why: …` |\n| Secrets in any file or commit | gitleaks | `gitleaks detect --redact --exit-code 1 --log-opts=\"--all\"`; ignores are reviewed fingerprints in `.gitleaksignore`, never path or regex allowlists |\n| Python dependencies (uv \u002F pip lock) | pip-audit (`uv audit` once it is GA) | `uv export --frozen --no-emit-workspace --no-emit-project -o req.txt` then `pip-audit --disable-pip --require-hashes --strict -r req.txt`; each ignore carries an ID, a why and an expiry date |\n| Other lockfiles: JS (`package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`, `bun.lock`), R (`renv.lock`), Go (`go.mod`), Rust (`Cargo.lock`), Java (`pom.xml`, `gradle.lockfile`), Ruby (`Gemfile.lock`), PHP (`composer.lock`), .NET (`packages.lock.json`) | osv-scanner | `osv-scanner scan -L \u003Cfile>` |\n| Shell scripts | ShellCheck | `shellcheck --enable=check-set-e-suppressed \u003Cfiles>` |\n| GitHub Actions and the lock itself | Dependabot | `github-actions` + the package ecosystem, weekly, with a cooldown |\n\n## Reviewing a file\n\n1. Run each scanner the file's table row names, plus gitleaks. If one cannot run here, say so (UNKNOWN) and review by reading.\n   For code you did not write (a branch, a PR, a fetched repo), run this skill's `scripts\u002Fscan-untrusted.sh --base \u003Ctrusted ref> [--head \u003Cref>] \u003Crepo>` instead, on a full (not shallow) clone; it needs git, jq, python3 and the scanners on PATH. The repo controls its scanner config, ignore files, inline suppressions, file names, attributes and history; the script keeps each from hiding a finding in `base..head`. Exit 0 is clean, 1 findings or suppressors, 2 an error, 3 a scanner could not run; read every UNKNOWN line, since exit 1 does not show them. Exit 0 covers Python, shell, the lockfiles above and secrets in every file; JS\u002FTS, workflow YAML, build files (Dockerfile, Makefile, justfile, Procfile, Gemfile, Rakefile, Vagrantfile, Jenkinsfile) and other languages are not scanned, so read those, and any file a changed script runs whose name has an extension no scanner reads or is allowlisted data (the script's header lists the names). Judge each SUPPRESSOR line as a finding, send a Python lockfile it marks UNKNOWN to pip-audit as above, and read each commit (`git log -p \u003Cbase>..\u003Chead>`) for what no scanner sees.\n2. Report each finding with its rule and CWE, the line, and the fix at the source. For example, `subprocess.run(cmd, shell=True)` with interpolated input is Ruff S602 (CWE-78, command injection); the fix is an argv list without a shell, not an escape.\n3. Then check what scanners miss: validation at trust boundaries (`Skill(defense-in-depth)`), secret handling (`Skill(secrets-management)`) and model output used as input (`Skill(llm-output-safety)`).\n\n## Which layer\n\n| Layer | What runs | Blocks? |\n|-------|-----------|---------|\n| Edit | the language formatter\u002Flinter hook (findings reach the model) | no — advisory |\n| Commit | a staged-file check: high-signal Ruff S rules + a secret-literal regex; `gitleaks protect --staged` | yes — exit 2, with an auditable bypass marker; a best-effort guardrail, not a boundary |\n| CI | full Ruff S over the gated paths, gitleaks over full history, the hashed dependency audit | yes — the merge gate |\n| Weekly | the same CI jobs on a schedule, plus Dependabot | surfaces new advisories without a push |\n\nPin every scanner (version and checksum, or a commit SHA), take it from the project's locked environment, and never run a binary the scanned repo ships.\n\n## Standards to cite\n\nCite by name and edition, not by guessed IDs: OWASP ASVS 5.0 for verification requirements, OWASP Top 10:2025 for risk classes, NIST SSDF (SP 800-218) for the practice areas. Do not cite SSDF 1.2 practice IDs: 1.2 was still a draft when this was written (2026-10), so its IDs may change before it is final.\n\n## Related\n\n- `Skill(secrets-management)` — storing, injecting and rotating secrets; secret scanning set-up.\n- `Skill(defense-in-depth)` — validation at trust boundaries.\n- `Skill(llm-output-safety)` — model output is untrusted input.\n","# SecOps router\n\nPick the check for the artifact, run it at the earliest layer that can block, and fail loud: a scanner that did not run reports UNKNOWN, never zero findings. This skill routes; the tools do the work.\n\n## Which scanner\n\n| Artifact | Scanner | How |\n|----------|---------|-----|\n| Python source | Ruff S rules (flake8-bandit) | `ruff check --select S \u003Cpaths>`; suppress only per site, `# noqa: Sxxx  # why: …` |\n| Secrets in any file or commit | gitleaks | `gitleaks detect --redact --exit-code 1 --log-opts=\"--all\"`; ignores are reviewed fingerprints in `.gitleaksignore`, never path or regex allowlists |\n| Python dependencies (uv \u002F pip lock) | pip-audit (`uv audit` once it is GA) | `uv export --frozen --no-emit-workspace --no-emit-project -o req.txt` then `pip-audit --disable-pip --require-hashes --strict -r req.txt`; each ignore carries an ID, a why and an expiry date |\n| Other lockfiles: JS (`package-lock.json`, `pnpm-lock.yaml`, `yarn.lock`, `bun.lock`), R (`renv.lock`), Go (`go.mod`), Rust (`Cargo.lock`), Java (`pom.xml`, `gradle.lockfile`), Ruby (`Gemfile.lock`), PHP (`composer.lock`), .NET (`packages.lock.json`) | osv-scanner | `osv-scanner scan -L \u003Cfile>` |\n| Shell scripts | ShellCheck | `shellcheck --enable=check-set-e-suppressed \u003Cfiles>` |\n| GitHub Actions and the lock itself | Dependabot | `github-actions` + the package ecosystem, weekly, with a cooldown |\n\n## Reviewing a file\n\n1. Run each scanner the file's table row names, plus gitleaks. If one cannot run here, say so (UNKNOWN) and review by reading.\n   For code you did not write (a branch, a PR, a fetched repo), run this skill's `scripts\u002Fscan-untrusted.sh --base \u003Ctrusted ref> [--head \u003Cref>] \u003Crepo>` instead, on a full (not shallow) clone; it needs git, jq, python3 and the scanners on PATH. The repo controls its scanner config, ignore files, inline suppressions, file names, attributes and history; the script keeps each from hiding a finding in `base..head`. Exit 0 is clean, 1 findings or suppressors, 2 an error, 3 a scanner could not run; read every UNKNOWN line, since exit 1 does not show them. Exit 0 covers Python, shell, the lockfiles above and secrets in every file; JS\u002FTS, workflow YAML, build files (Dockerfile, Makefile, justfile, Procfile, Gemfile, Rakefile, Vagrantfile, Jenkinsfile) and other languages are not scanned, so read those, and any file a changed script runs whose name has an extension no scanner reads or is allowlisted data (the script's header lists the names). Judge each SUPPRESSOR line as a finding, send a Python lockfile it marks UNKNOWN to pip-audit as above, and read each commit (`git log -p \u003Cbase>..\u003Chead>`) for what no scanner sees.\n2. Report each finding with its rule and CWE, the line, and the fix at the source. For example, `subprocess.run(cmd, shell=True)` with interpolated input is Ruff S602 (CWE-78, command injection); the fix is an argv list without a shell, not an escape.\n3. Then check what scanners miss: validation at trust boundaries (`Skill(defense-in-depth)`), secret handling (`Skill(secrets-management)`) and model output used as input (`Skill(llm-output-safety)`).\n\n## Which layer\n\n| Layer | What runs | Blocks? |\n|-------|-----------|---------|\n| Edit | the language formatter\u002Flinter hook (findings reach the model) | no — advisory |\n| Commit | a staged-file check: high-signal Ruff S rules + a secret-literal regex; `gitleaks protect --staged` | yes — exit 2, with an auditable bypass marker; a best-effort guardrail, not a boundary |\n| CI | full Ruff S over the gated paths, gitleaks over full history, the hashed dependency audit | yes — the merge gate |\n| Weekly | the same CI jobs on a schedule, plus Dependabot | surfaces new advisories without a push |\n\nPin every scanner (version and checksum, or a commit SHA), take it from the project's locked environment, and never run a binary the scanned repo ships.\n\n## Standards to cite\n\nCite by name and edition, not by guessed IDs: OWASP ASVS 5.0 for verification requirements, OWASP Top 10:2025 for risk classes, NIST SSDF (SP 800-218) for the practice areas. Do not cite SSDF 1.2 practice IDs: 1.2 was still a draft when this was written (2026-10), so its IDs may change before it is final.\n\n## Related\n\n- `Skill(secrets-management)` — storing, injecting and rotating secrets; secret scanning set-up.\n- `Skill(defense-in-depth)` — validation at trust boundaries.\n- `Skill(llm-output-safety)` — model output is untrusted input.\n",{"name":5,"description":7},"main","cd9a2962c9a7e0797fe440f7b1ba4ceccc16ae0d","claude-code\u002Fskills\u002Fsecops",1,"https:\u002F\u002Fgithub.com\u002Fsnewhouse\u002Faa-ma-forge","https:\u002F\u002Fgithub.com\u002Fsnewhouse","Data Scientist, Bioinformatician, Dad, Husband, MS warrior","2026-11-12 06:45:42",{"source":8,"skillName":5,"commands":52,"prompt":62,"zipAvailable":63},[53,56,59],{"tool":54,"command":55},"npx","npx skills add snewhouse\u002Faa-ma-forge --skill secops",{"tool":57,"command":58},"bunx","bunx skills add snewhouse\u002Faa-ma-forge --skill secops",{"tool":60,"command":61},"pnpm","pnpm dlx skills add snewhouse\u002Faa-ma-forge --skill secops","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fsnewhouse\u002Faa-ma-forge\u002Fblob\u002Fmain\u002Fclaude-code\u002Fskills\u002Fsecops\u002FSKILL.md",true,[65],{"path":66,"resourceType":67,"resourceTypeDesc":68,"sizeBytes":69,"sourceHtmlUrl":70},"scripts\u002Fscan-untrusted.sh","SCRIPT","脚本",25510,"https:\u002F\u002Fgithub.com\u002Fsnewhouse\u002Faa-ma-forge\u002Fblob\u002Fmain\u002Fclaude-code\u002Fskills\u002Fsecops\u002Fscripts\u002Fscan-untrusted.sh",[72,96,123,144,167,196],{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":83,"publishedAt":38},"01M6MZ588SD5DDH59H18PRNWEV","deploy-helper","You can use this to help with deploy stuff, deploying, deployments, releases, shipping, pushing to prod, going live, rollouts.","https:\u002F\u002Fgithub.com\u002Fsnewhouse\u002Faa-ma-forge\u002Fblob\u002Fmain\u002Ftests\u002Ffixtures\u002Fevals\u002Fskill-draft\u002Fdraft\u002FSKILL.md",[78],{"categoryNo":79,"categoryName":80,"taxonomyType":81,"taxonomyTypeDesc":82},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[84,85,86,87,88,89,90,91,92,28,93,94,95],"deploy","deploy helper","helper","you","live","with","can","rollouts","shipping","deployments","releases","help",{"skillNo":97,"name":98,"nameZh":6,"description":99,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":100,"licenseFileUrl":101,"sourceHtmlUrl":102,"categories":103,"keywords":115,"publishedAt":38},"01M6MZ54NEKRYXGMJ1KJWYMKM7","writing-for-agents","Writing documents for agents. Use when creating or editing skills, or modifying AGENTS.md or CLAUDE.md.","MIT","https:\u002F\u002Fgithub.com\u002Fsnewhouse\u002Faa-ma-forge\u002Fblob\u002Fmain\u002Fclaude-code\u002Fskills\u002Fwriting-for-agents\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fsnewhouse\u002Faa-ma-forge\u002Fblob\u002Fmain\u002Fclaude-code\u002Fskills\u002Fwriting-for-agents\u002FSKILL.md",[104,107,110],{"categoryNo":105,"categoryName":106,"taxonomyType":81,"taxonomyTypeDesc":82},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":108,"categoryName":109,"taxonomyType":81,"taxonomyTypeDesc":82},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":111,"categoryName":112,"taxonomyType":113,"taxonomyTypeDesc":114},"01JBSEEDCAT000000000000036","内容创作者","PROFESSION","适用职业",[116,117,20,118,28,119,120,121,122],"writing","writing for agents","line","instructions","read","editing","documents",{"skillNo":124,"name":125,"nameZh":6,"description":126,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":127,"categories":128,"keywords":129,"publishedAt":38},"01M6MZ500T0FH1G8TBSQV7G5G2","verify-plan","Slash entry for plan verification: runs plan-verification on an existing AA-MA plan, writes [task]-verification.md, and with --iterate loops until the plan converges. Use when the user types \u002Fverify-plan or wants the verification report saved.","https:\u002F\u002Fgithub.com\u002Fsnewhouse\u002Faa-ma-forge\u002Fblob\u002Fmain\u002Fclaude-code\u002Fskills\u002Fverify-plan\u002FSKILL.md",[],[130,131,132,133,134,28,135,89,136,137,138,139,140,141,142,20,143],"verify","plan","verify plan","loops","task","user","verification","report","types","plan verification","entry","iterate","Existing","saved",{"skillNo":145,"name":146,"nameZh":6,"description":147,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":148,"categories":149,"keywords":150,"publishedAt":38},"01M6MZ4V9ST4K54NT1SRBGCE7P","verify-impl","Post-impl adversarial review symmetric to \u002Fverify-plan. Dispatches up to 5 parallel audit agents (code-reviewer, security-auditor, tdd-sequence-auditor, context7-evidence-auditor, future-proofing-auditor) based on the milestone's plan-declared Audit-Profile. CRITICAL findings surface via AskUserQuestion accept\u002Fdispute\u002Fdefer panel before §7.3 user authorization. Introduced in v0.8.0 per ADR-0005. Invoked by Phase 6.8 of \u002Fexecute-aa-ma-milestone.","https:\u002F\u002Fgithub.com\u002Fsnewhouse\u002Faa-ma-forge\u002Fblob\u002Fmain\u002Fclaude-code\u002Fskills\u002Fverify-impl\u002FSKILL.md",[],[151,152,130,153,154,155,156,157,29,158,159,160,161,162,163,131,164,35,165,166],"impl","verify impl","adversarial","post","panel","via","critical","context7","up","evidence","reviewer","parallel","adr","audit","tdd","milestone",{"skillNo":168,"name":169,"nameZh":6,"description":170,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":171,"categories":172,"keywords":177,"publishedAt":38},"01M6MZ4K7CC9PMJ1KEY3F53RS1","understand-codebase","Onboard to a new, inherited, or shared codebase. Read it, understand it, map it, and learn its conventions, versioning, tests, tech stack, rules (AGENTS.md \u002F CLAUDE.md \u002F .cursorrules \u002F etc.), build\u002Frun\u002FCI, integrations, security posture, and repo health — then produce an honest pros\u002Fcons verdict, a \"contribute safely\" playbook, and an \"add a feature\" playbook, written to ONBOARDING.md at the repo root plus a .claude\u002Fonboarding\u002F set of deep-dives — and optionally author an AGENTS.md if one is missing, or review and propose improvements to an existing one. Tiered (Quick \u002F Standard \u002F Deep). Reuses codemem (index + diagrams), gsd-map-codebase, system-mapping, code-intelligence, impact-analysis rather than re-implementing them; Deep tier runs a TeamCreate agent-team. Keywords: new codebase, shared codebase, inherited code, onboard, understand this repo, how do I contribute, how do I add a feature, ramp up, get oriented, ONBOARDING.md, AGENTS.md, codebase walkthrough, joining a project.","https:\u002F\u002Fgithub.com\u002Fsnewhouse\u002Faa-ma-forge\u002Fblob\u002Fmain\u002Fclaude-code\u002Fskills\u002Funderstand-codebase\u002FSKILL.md",[173,174],{"categoryNo":108,"categoryName":109,"taxonomyType":81,"taxonomyTypeDesc":82},{"categoryNo":175,"categoryName":176,"taxonomyType":113,"taxonomyTypeDesc":114},"01JBSEEDCAT000000000000038","人力资源",[178,179,180,159,181,182,183,33,184,185,186,187,188,189,190,191,192,193,194,195],"understand codebase","codebase","understand","walkthrough","analysis","SET","learn","diagrams","repo health","implementing","re","quick","impact","get","project","deep","shared","map",{"skillNo":197,"name":198,"nameZh":6,"description":199,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":200,"categories":201,"keywords":202,"publishedAt":38},"01M6MZ4D1ZC8MTW064QXY6WC76","token-compression","Output token compression for AA-MA workflows. Reduces response tokens by 40-75% while preserving full technical accuracy. Three intensity levels mapped to execution modes: lite (HITL), full (general), ultra (AFK). Auto-activates during AA-MA execution based on task Mode field. Manual activation via \u002Fcompress lite|full|ultra.","https:\u002F\u002Fgithub.com\u002Fsnewhouse\u002Faa-ma-forge\u002Fblob\u002Fmain\u002Fclaude-code\u002Fskills\u002Ftoken-compression\u002FSKILL.md",[],[203,204,205,206,207,208,209,20,210,211,156,212,213,214,215,134,216,217,218,219],"compression","token compression","token","workflows","output","modes","accuracy","mode","manual","intensity","tokens","hitl","three","general","auto","technical","execution"]