[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6QJ41WW50WPB45PQ00EWJ3E":3,"skill-same:01M6QJ41WW50WPB45PQ00EWJ3E":100},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":30,"publishedAt":50,"linkOnly":51,"markdownContent":52,"markdownBody":53,"frontMatter":54,"refName":38,"commitSha":60,"skillDirectory":61,"forksCount":13,"repositoryHtmlUrl":62,"repositoryHomepageUrl":6,"ownerHtmlUrl":63,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":64,"install":65,"resources":77},"01M6QJ41WW50WPB45PQ00EWJ3E","security-review",null,"AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when asked to scan code for security vulnerabilities, find bugs, check for SQL injection, XSS, command injection, exposed API keys, hardcoded secrets, insecure dependencies, access control issues, or any request like \"is my code secure?\", \"review for security issues\", \"audit this codebase\", or \"check for vulnerabilities\". Covers injection flaws, authentication and access control bugs, secrets exposure, weak cryptography, insecure dependencies, and business logic issues across JavaScript, TypeScript, Python, Java, PHP, Go, Ruby, and Rust.","ImaginerLabs\u002Fskill-manager","ImaginerLabs","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F214277308?v=4","01M6QGGDPNF15RMMT1RCFDH9FN","01M6QGGDTH5BY64DQ123NR8M33",0,"MIT","https:\u002F\u002Fgithub.com\u002FImaginerLabs\u002Fskill-manager\u002Fblob\u002Fmain\u002Fskills\u002Fcoding\u002Fsecurity-review\u002FSKILL.md",[17,22,25],{"categoryNo":18,"categoryName":19,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":26,"categoryName":27,"taxonomyType":28,"taxonomyTypeDesc":29},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[31,32,33,34,35,36,37,38,39,40,41,42,5,43,44,45,46,47,48,49],"security","security review","review","xss","api keys","flows","across","main","scanner","access","ruby","api","issues","authentication","code","scan code","copilot","rust","security scanner","2026-11-10 10:12:30",false,"---\nname: security-review\ndescription: >-\n  AI-powered codebase security scanner that reasons about code like a security\n  researcher — tracing data flows, understanding component interactions, and\n  catching vulnerabilities that pattern-matching tools miss. Use this skill when\n  asked to scan code for security vulnerabilities, find bugs, check for SQL\n  injection, XSS, command injection, exposed API keys, hardcoded secrets,\n  insecure dependencies, access control issues, or any request like \"is my code\n  secure?\", \"review for security issues\", \"audit this codebase\", or \"check for\n  vulnerabilities\". Covers injection flaws, authentication and access control\n  bugs, secrets exposure, weak cryptography, insecure dependencies, and business\n  logic issues across JavaScript, TypeScript, Python, Java, PHP, Go, Ruby, and\n  Rust.\nsource: awesome-copilot\nsourceUrl: \"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Ftree\u002Fmain\u002Fskills\u002Fsecurity-review\"\nsourceRepo: \"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\"\nreadonly: true\ncategory: coding\n---\n\n# Security Review\n\nAn AI-powered security scanner that reasons about your codebase the way a human security\nresearcher would — tracing data flows, understanding component interactions, and catching\nvulnerabilities that pattern-matching tools miss.\n\n## When to Use This Skill\n\nUse this skill when the request involves:\n\n- Scanning a codebase or file for security vulnerabilities\n- Running a security review or vulnerability check\n- Checking for SQL injection, XSS, command injection, or other injection flaws\n- Finding exposed API keys, hardcoded secrets, or credentials in code\n- Auditing dependencies for known CVEs\n- Reviewing authentication, authorization, or access control logic\n- Detecting insecure cryptography or weak randomness\n- Performing a data flow analysis to trace user input to dangerous sinks\n- Any request phrasing like \"is my code secure?\", \"scan this file\", or \"check my repo for vulnerabilities\"\n- Running `\u002Fsecurity-review` or `\u002Fsecurity-review \u003Cpath>`\n\n## How This Skill Works\n\nUnlike traditional static analysis tools that match patterns, this skill:\n\n1. **Reads code like a security researcher** — understanding context, intent, and data flow\n2. **Traces across files** — following how user input moves through your application\n3. **Self-verifies findings** — re-examines each result to filter false positives\n4. **Assigns severity ratings** — CRITICAL \u002F HIGH \u002F MEDIUM \u002F LOW \u002F INFO\n5. **Proposes targeted patches** — every finding includes a concrete fix\n6. **Requires human approval** — nothing is auto-applied; you always review first\n\n## Execution Workflow\n\nFollow these steps **in order** every time:\n\n### Step 1 — Scope Resolution\n\nDetermine what to scan:\n\n- If a path was provided (`\u002Fsecurity-review src\u002Fauth\u002F`), scan only that scope\n- If no path given, scan the **entire project** starting from the root\n- Identify the language(s) and framework(s) in use (check package.json, requirements.txt,\n  go.mod, Cargo.toml, pom.xml, Gemfile, composer.json, etc.)\n- Read `references\u002Flanguage-patterns.md` to load language-specific vulnerability patterns\n\n### Step 2 — Dependency Audit\n\nBefore scanning source code, audit dependencies first (fast wins):\n\n- **Node.js**: Check `package.json` + `package-lock.json` for known vulnerable packages\n- **Python**: Check `requirements.txt` \u002F `pyproject.toml` \u002F `Pipfile`\n- **Java**: Check `pom.xml` \u002F `build.gradle`\n- **Ruby**: Check `Gemfile.lock`\n- **Rust**: Check `Cargo.toml`\n- **Go**: Check `go.sum`\n- Flag packages with known CVEs, deprecated crypto libs, or suspiciously old pinned versions\n- Read `references\u002Fvulnerable-packages.md` for a curated watchlist\n\n### Step 3 — Secrets & Exposure Scan\n\nScan ALL files (including config, env, CI\u002FCD, Dockerfiles, IaC) for:\n\n- Hardcoded API keys, tokens, passwords, private keys\n- `.env` files accidentally committed\n- Secrets in comments or debug logs\n- Cloud credentials (AWS, GCP, Azure, Stripe, Twilio, etc.)\n- Database connection strings with credentials embedded\n- Read `references\u002Fsecret-patterns.md` for regex patterns and entropy heuristics to apply\n\n### Step 4 — Vulnerability Deep Scan\n\nThis is the core scan. Reason about the code — don't just pattern-match.\nRead `references\u002Fvuln-categories.md` for full details on each category.\n\n**Injection Flaws**\n\n- SQL Injection: raw queries with string interpolation, ORM misuse, second-order SQLi\n- XSS: unescaped output, dangerouslySetInnerHTML, innerHTML, template injection\n- Command Injection: exec\u002Fspawn\u002Fsystem with user input\n- LDAP, XPath, Header, Log injection\n\n**Authentication & Access Control**\n\n- Missing authentication on sensitive endpoints\n- Broken object-level authorization (BOLA\u002FIDOR)\n- JWT weaknesses (alg:none, weak secrets, no expiry validation)\n- Session fixation, missing CSRF protection\n- Privilege escalation paths\n- Mass assignment \u002F parameter pollution\n\n**Data Handling**\n\n- Sensitive data in logs, error messages, or API responses\n- Missing encryption at rest or in transit\n- Insecure deserialization\n- Path traversal \u002F directory traversal\n- XXE (XML External Entity) processing\n- SSRF (Server-Side Request Forgery)\n\n**Cryptography**\n\n- Use of MD5, SHA1, DES for security purposes\n- Hardcoded IVs or salts\n- Weak random number generation (Math.random() for tokens)\n- Missing TLS certificate validation\n\n**Business Logic**\n\n- Race conditions (TOCTOU)\n- Integer overflow in financial calculations\n- Missing rate limiting on sensitive endpoints\n- Predictable resource identifiers\n\n### Step 5 — Cross-File Data Flow Analysis\n\nAfter the per-file scan, perform a **holistic review**:\n\n- Trace user-controlled input from entry points (HTTP params, headers, body, file uploads)\n  all the way to sinks (DB queries, exec calls, HTML output, file writes)\n- Identify vulnerabilities that only appear when looking at multiple files together\n- Check for insecure trust boundaries between services or modules\n\n### Step 6 — Self-Verification Pass\n\nFor EACH finding:\n\n1. Re-read the relevant code with fresh eyes\n2. Ask: \"Is this actually exploitable, or is there sanitization I missed?\"\n3. Check if a framework or middleware already handles this upstream\n4. Downgrade or discard findings that aren't genuine vulnerabilities\n5. Assign final severity: CRITICAL \u002F HIGH \u002F MEDIUM \u002F LOW \u002F INFO\n\n### Step 7 — Generate Security Report\n\nOutput the full report in the format defined in `references\u002Freport-format.md`.\n\n### Step 8 — Propose Patches\n\nFor every CRITICAL and HIGH finding, generate a concrete patch:\n\n- Show the vulnerable code (before)\n- Show the fixed code (after)\n- Explain what changed and why\n- Preserve the original code style, variable names, and structure\n- Add a comment explaining the fix inline\n\nExplicitly state: **\"Review each patch before applying. Nothing has been changed yet.\"**\n\n## Severity Guide\n\n| Severity    | Meaning                                         | Example                          |\n| ----------- | ----------------------------------------------- | -------------------------------- |\n| ? CRITICAL | Immediate exploitation risk, data breach likely | SQLi, RCE, auth bypass           |\n| ? HIGH     | Serious vulnerability, exploit path exists      | XSS, IDOR, hardcoded secrets     |\n| ? MEDIUM   | Exploitable with conditions or chaining         | CSRF, open redirect, weak crypto |\n| ? LOW      | Best practice violation, low direct risk        | Verbose errors, missing headers  |\n| ⚪ INFO     | Observation worth noting, not a vulnerability   | Outdated dependency (no CVE)     |\n\n## Output Rules\n\n- **Always** produce a findings summary table first (counts by severity)\n- **Never** auto-apply any patch — present patches for human review only\n- **Always** include a confidence rating per finding (High \u002F Medium \u002F Low)\n- **Group findings** by category, not by file\n- **Be specific** — include file path, line number, and the exact vulnerable code snippet\n- **Explain the risk** in plain English — what could an attacker do with this?\n- If the codebase is clean, say so clearly: \"No vulnerabilities found\" with what was scanned\n\n## Reference Files\n\nFor detailed detection guidance, load the following reference files as needed:\n\n- `references\u002Fvuln-categories.md` — Deep reference for every vulnerability category with detection signals, safe patterns, and escalation checkers\n  - Search patterns: `SQL injection`, `XSS`, `command injection`, `SSRF`, `BOLA`, `IDOR`, `JWT`, `CSRF`, `secrets`, `cryptography`, `race condition`, `path traversal`\n- `references\u002Fsecret-patterns.md` — Regex patterns, entropy-based detection, and CI\u002FCD secret risks\n  - Search patterns: `API key`, `token`, `private key`, `connection string`, `entropy`, `.env`, `GitHub Actions`, `Docker`, `Terraform`\n- `references\u002Flanguage-patterns.md` — Framework-specific vulnerability patterns for JavaScript, Python, Java, PHP, Go, Ruby, and Rust\n  - Search patterns: `Express`, `React`, `Next.js`, `Django`, `Flask`, `FastAPI`, `Spring Boot`, `PHP`, `Go`, `Rails`, `Rust`\n- `references\u002Fvulnerable-packages.md` — Curated CVE watchlist for npm, pip, Maven, Rubygems, Cargo, and Go modules\n  - Search patterns: `lodash`, `axios`, `jsonwebtoken`, `Pillow`, `log4j`, `nokogiri`, `CVE`\n- `references\u002Freport-format.md` — Structured output template for security reports with finding cards, dependency audit, secrets scan, and patch proposal formatting\n  - Search patterns: `report`, `format`, `template`, `finding`, `patch`, `summary`, `confidence`\n","# Security Review\n\nAn AI-powered security scanner that reasons about your codebase the way a human security\nresearcher would — tracing data flows, understanding component interactions, and catching\nvulnerabilities that pattern-matching tools miss.\n\n## When to Use This Skill\n\nUse this skill when the request involves:\n\n- Scanning a codebase or file for security vulnerabilities\n- Running a security review or vulnerability check\n- Checking for SQL injection, XSS, command injection, or other injection flaws\n- Finding exposed API keys, hardcoded secrets, or credentials in code\n- Auditing dependencies for known CVEs\n- Reviewing authentication, authorization, or access control logic\n- Detecting insecure cryptography or weak randomness\n- Performing a data flow analysis to trace user input to dangerous sinks\n- Any request phrasing like \"is my code secure?\", \"scan this file\", or \"check my repo for vulnerabilities\"\n- Running `\u002Fsecurity-review` or `\u002Fsecurity-review \u003Cpath>`\n\n## How This Skill Works\n\nUnlike traditional static analysis tools that match patterns, this skill:\n\n1. **Reads code like a security researcher** — understanding context, intent, and data flow\n2. **Traces across files** — following how user input moves through your application\n3. **Self-verifies findings** — re-examines each result to filter false positives\n4. **Assigns severity ratings** — CRITICAL \u002F HIGH \u002F MEDIUM \u002F LOW \u002F INFO\n5. **Proposes targeted patches** — every finding includes a concrete fix\n6. **Requires human approval** — nothing is auto-applied; you always review first\n\n## Execution Workflow\n\nFollow these steps **in order** every time:\n\n### Step 1 — Scope Resolution\n\nDetermine what to scan:\n\n- If a path was provided (`\u002Fsecurity-review src\u002Fauth\u002F`), scan only that scope\n- If no path given, scan the **entire project** starting from the root\n- Identify the language(s) and framework(s) in use (check package.json, requirements.txt,\n  go.mod, Cargo.toml, pom.xml, Gemfile, composer.json, etc.)\n- Read `references\u002Flanguage-patterns.md` to load language-specific vulnerability patterns\n\n### Step 2 — Dependency Audit\n\nBefore scanning source code, audit dependencies first (fast wins):\n\n- **Node.js**: Check `package.json` + `package-lock.json` for known vulnerable packages\n- **Python**: Check `requirements.txt` \u002F `pyproject.toml` \u002F `Pipfile`\n- **Java**: Check `pom.xml` \u002F `build.gradle`\n- **Ruby**: Check `Gemfile.lock`\n- **Rust**: Check `Cargo.toml`\n- **Go**: Check `go.sum`\n- Flag packages with known CVEs, deprecated crypto libs, or suspiciously old pinned versions\n- Read `references\u002Fvulnerable-packages.md` for a curated watchlist\n\n### Step 3 — Secrets & Exposure Scan\n\nScan ALL files (including config, env, CI\u002FCD, Dockerfiles, IaC) for:\n\n- Hardcoded API keys, tokens, passwords, private keys\n- `.env` files accidentally committed\n- Secrets in comments or debug logs\n- Cloud credentials (AWS, GCP, Azure, Stripe, Twilio, etc.)\n- Database connection strings with credentials embedded\n- Read `references\u002Fsecret-patterns.md` for regex patterns and entropy heuristics to apply\n\n### Step 4 — Vulnerability Deep Scan\n\nThis is the core scan. Reason about the code — don't just pattern-match.\nRead `references\u002Fvuln-categories.md` for full details on each category.\n\n**Injection Flaws**\n\n- SQL Injection: raw queries with string interpolation, ORM misuse, second-order SQLi\n- XSS: unescaped output, dangerouslySetInnerHTML, innerHTML, template injection\n- Command Injection: exec\u002Fspawn\u002Fsystem with user input\n- LDAP, XPath, Header, Log injection\n\n**Authentication & Access Control**\n\n- Missing authentication on sensitive endpoints\n- Broken object-level authorization (BOLA\u002FIDOR)\n- JWT weaknesses (alg:none, weak secrets, no expiry validation)\n- Session fixation, missing CSRF protection\n- Privilege escalation paths\n- Mass assignment \u002F parameter pollution\n\n**Data Handling**\n\n- Sensitive data in logs, error messages, or API responses\n- Missing encryption at rest or in transit\n- Insecure deserialization\n- Path traversal \u002F directory traversal\n- XXE (XML External Entity) processing\n- SSRF (Server-Side Request Forgery)\n\n**Cryptography**\n\n- Use of MD5, SHA1, DES for security purposes\n- Hardcoded IVs or salts\n- Weak random number generation (Math.random() for tokens)\n- Missing TLS certificate validation\n\n**Business Logic**\n\n- Race conditions (TOCTOU)\n- Integer overflow in financial calculations\n- Missing rate limiting on sensitive endpoints\n- Predictable resource identifiers\n\n### Step 5 — Cross-File Data Flow Analysis\n\nAfter the per-file scan, perform a **holistic review**:\n\n- Trace user-controlled input from entry points (HTTP params, headers, body, file uploads)\n  all the way to sinks (DB queries, exec calls, HTML output, file writes)\n- Identify vulnerabilities that only appear when looking at multiple files together\n- Check for insecure trust boundaries between services or modules\n\n### Step 6 — Self-Verification Pass\n\nFor EACH finding:\n\n1. Re-read the relevant code with fresh eyes\n2. Ask: \"Is this actually exploitable, or is there sanitization I missed?\"\n3. Check if a framework or middleware already handles this upstream\n4. Downgrade or discard findings that aren't genuine vulnerabilities\n5. Assign final severity: CRITICAL \u002F HIGH \u002F MEDIUM \u002F LOW \u002F INFO\n\n### Step 7 — Generate Security Report\n\nOutput the full report in the format defined in `references\u002Freport-format.md`.\n\n### Step 8 — Propose Patches\n\nFor every CRITICAL and HIGH finding, generate a concrete patch:\n\n- Show the vulnerable code (before)\n- Show the fixed code (after)\n- Explain what changed and why\n- Preserve the original code style, variable names, and structure\n- Add a comment explaining the fix inline\n\nExplicitly state: **\"Review each patch before applying. Nothing has been changed yet.\"**\n\n## Severity Guide\n\n| Severity    | Meaning                                         | Example                          |\n| ----------- | ----------------------------------------------- | -------------------------------- |\n| ? CRITICAL | Immediate exploitation risk, data breach likely | SQLi, RCE, auth bypass           |\n| ? HIGH     | Serious vulnerability, exploit path exists      | XSS, IDOR, hardcoded secrets     |\n| ? MEDIUM   | Exploitable with conditions or chaining         | CSRF, open redirect, weak crypto |\n| ? LOW      | Best practice violation, low direct risk        | Verbose errors, missing headers  |\n| ⚪ INFO     | Observation worth noting, not a vulnerability   | Outdated dependency (no CVE)     |\n\n## Output Rules\n\n- **Always** produce a findings summary table first (counts by severity)\n- **Never** auto-apply any patch — present patches for human review only\n- **Always** include a confidence rating per finding (High \u002F Medium \u002F Low)\n- **Group findings** by category, not by file\n- **Be specific** — include file path, line number, and the exact vulnerable code snippet\n- **Explain the risk** in plain English — what could an attacker do with this?\n- If the codebase is clean, say so clearly: \"No vulnerabilities found\" with what was scanned\n\n## Reference Files\n\nFor detailed detection guidance, load the following reference files as needed:\n\n- `references\u002Fvuln-categories.md` — Deep reference for every vulnerability category with detection signals, safe patterns, and escalation checkers\n  - Search patterns: `SQL injection`, `XSS`, `command injection`, `SSRF`, `BOLA`, `IDOR`, `JWT`, `CSRF`, `secrets`, `cryptography`, `race condition`, `path traversal`\n- `references\u002Fsecret-patterns.md` — Regex patterns, entropy-based detection, and CI\u002FCD secret risks\n  - Search patterns: `API key`, `token`, `private key`, `connection string`, `entropy`, `.env`, `GitHub Actions`, `Docker`, `Terraform`\n- `references\u002Flanguage-patterns.md` — Framework-specific vulnerability patterns for JavaScript, Python, Java, PHP, Go, Ruby, and Rust\n  - Search patterns: `Express`, `React`, `Next.js`, `Django`, `Flask`, `FastAPI`, `Spring Boot`, `PHP`, `Go`, `Rails`, `Rust`\n- `references\u002Fvulnerable-packages.md` — Curated CVE watchlist for npm, pip, Maven, Rubygems, Cargo, and Go modules\n  - Search patterns: `lodash`, `axios`, `jsonwebtoken`, `Pillow`, `log4j`, `nokogiri`, `CVE`\n- `references\u002Freport-format.md` — Structured output template for security reports with finding cards, dependency audit, secrets scan, and patch proposal formatting\n  - Search patterns: `report`, `format`, `template`, `finding`, `patch`, `summary`, `confidence`\n",{"name":5,"source":55,"category":56,"readonly":57,"sourceUrl":58,"sourceRepo":59,"description":7},"awesome-copilot","coding",true,"https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot\u002Ftree\u002Fmain\u002Fskills\u002Fsecurity-review","https:\u002F\u002Fgithub.com\u002Fgithub\u002Fawesome-copilot","b9a52d8e27455bdad953d64928696d028223ea1b","skills\u002Fcoding\u002Fsecurity-review","https:\u002F\u002Fgithub.com\u002FImaginerLabs\u002Fskill-manager","https:\u002F\u002Fgithub.com\u002FImaginerLabs","2026-04-18 16:27:13",{"source":8,"skillName":5,"commands":66,"prompt":76,"zipAvailable":57},[67,70,73],{"tool":68,"command":69},"npx","npx skills add ImaginerLabs\u002Fskill-manager --skill security-review",{"tool":71,"command":72},"bunx","bunx skills add ImaginerLabs\u002Fskill-manager --skill security-review",{"tool":74,"command":75},"pnpm","pnpm dlx skills add ImaginerLabs\u002Fskill-manager --skill security-review","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FImaginerLabs\u002Fskill-manager\u002Fblob\u002Fmain\u002Fskills\u002Fcoding\u002Fsecurity-review\u002FSKILL.md",[78,84,88,92,96],{"path":79,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":82,"sourceHtmlUrl":83},"references\u002Flanguage-patterns.md","REFERENCE","参考文档",5308,"https:\u002F\u002Fgithub.com\u002FImaginerLabs\u002Fskill-manager\u002Fblob\u002Fmain\u002Fskills\u002Fcoding\u002Fsecurity-review\u002Freferences\u002Flanguage-patterns.md",{"path":85,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":86,"sourceHtmlUrl":87},"references\u002Freport-format.md",7047,"https:\u002F\u002Fgithub.com\u002FImaginerLabs\u002Fskill-manager\u002Fblob\u002Fmain\u002Fskills\u002Fcoding\u002Fsecurity-review\u002Freferences\u002Freport-format.md",{"path":89,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":90,"sourceHtmlUrl":91},"references\u002Fsecret-patterns.md",3534,"https:\u002F\u002Fgithub.com\u002FImaginerLabs\u002Fskill-manager\u002Fblob\u002Fmain\u002Fskills\u002Fcoding\u002Fsecurity-review\u002Freferences\u002Fsecret-patterns.md",{"path":93,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":94,"sourceHtmlUrl":95},"references\u002Fvuln-categories.md",8106,"https:\u002F\u002Fgithub.com\u002FImaginerLabs\u002Fskill-manager\u002Fblob\u002Fmain\u002Fskills\u002Fcoding\u002Fsecurity-review\u002Freferences\u002Fvuln-categories.md",{"path":97,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":98,"sourceHtmlUrl":99},"references\u002Fvulnerable-packages.md",6174,"https:\u002F\u002Fgithub.com\u002FImaginerLabs\u002Fskill-manager\u002Fblob\u002Fmain\u002Fskills\u002Fcoding\u002Fsecurity-review\u002Freferences\u002Fvulnerable-packages.md",[101,129,150,178,212,237],{"skillNo":102,"name":103,"nameZh":6,"description":104,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":105,"categories":106,"keywords":111,"publishedAt":50},"01M6QJCB2SD5KHC41ZDQC0GA1T","meeting-minutes","Generate concise, actionable meeting minutes for internal meetings. Includes metadata, attendees, agenda, decisions, action items (owner + due date), and follow-up steps.","https:\u002F\u002Fgithub.com\u002FImaginerLabs\u002Fskill-manager\u002Fblob\u002Fmain\u002Fskills\u002Fwriting\u002Fmeeting-minutes\u002FSKILL.md",[107,108],{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":109,"categoryName":110,"taxonomyType":28,"taxonomyTypeDesc":29},"01JBSEEDCAT000000000000034","行政与办公人员",[112,113,114,115,116,47,117,118,119,120,103,38,121,122,123,124,125,126,127,128],"meeting minutes","meeting","minutes","writing","github","generate","decisions","meetings","up","agenda","actionable","concise","follow-up","tree","true","action","for",{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":135,"publishedAt":50},"01M6QJC71RRGTGNNFEHJG6S20G","documentation-writer","Diátaxis Documentation Expert. An expert technical writer specializing in creating high-quality software documentation, guided by the principles and structure of the Diátaxis technical documentation authoring framework.","https:\u002F\u002Fgithub.com\u002FImaginerLabs\u002Fskill-manager\u002Fblob\u002Fmain\u002Fskills\u002Fwriting\u002Fdocumentation-writer\u002FSKILL.md",[],[136,137,138,115,116,47,139,140,141,142,143,144,38,145,146,147,148,125,126,149],"documentation","documentation writer","writer","https","quality","technical","technical writer","expert","documentation expert","structure","authoring","software","principles","high",{"skillNo":151,"name":152,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":163,"publishedAt":50},"01M6QJC0V3C7C4R9768J1AJYWY","doc-coauthoring","Guide users through a structured workflow for co-authoring documentation. Use when user wants to write documentation, proposals, technical specs, decision docs, or similar structured content. This workflow helps users efficiently transfer context, refine content through iteration, and verify the doc works for readers. Trigger when user mentions writing docs, creating proposals, drafting specs, or similar documentation tasks.","https:\u002F\u002Fgithub.com\u002FImaginerLabs\u002Fskill-manager\u002Fblob\u002Fmain\u002Fskills\u002Fwriting\u002Fdoc-coauthoring\u002FSKILL.md",[156,159,160],{"categoryNo":157,"categoryName":158,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":161,"categoryName":162,"taxonomyType":28,"taxonomyTypeDesc":29},"01JBSEEDCAT000000000000036","内容创作者",[164,165,115,166,167,136,168,169,170,171,172,173,38,174,175,146,176,177,125,128],"doc coauthoring","doc","workflow","official","tasks","decision","write","context","proposals","guide","refine","iteration","trigger","co",{"skillNo":179,"name":180,"nameZh":6,"description":181,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":182,"categories":183,"keywords":194,"publishedAt":50},"01M6QJBJ0YPVEWGEXZH3PJRRTT","code-review-workflow","Executes comprehensive 4-phase code review: basic review, quality check, bundle analysis, and test coverage. Should be used when the user mentions comprehensive code review, checking code quality, or reviewing staged changes with multi-phase analysis. This is the comprehensive review workflow, distinct from focused skills like frontend-code-review, staged-code-review, or code-change-test-designer.","https:\u002F\u002Fgithub.com\u002FImaginerLabs\u002Fskill-manager\u002Fblob\u002Fmain\u002Fskills\u002Ftesting\u002Fcode-review-workflow\u002FSKILL.md",[184,187,190,191],{"categoryNo":185,"categoryName":186,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000007","代码审查",{"categoryNo":188,"categoryName":189,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":192,"categoryName":193,"taxonomyType":28,"taxonomyTypeDesc":29},"01JBSEEDCAT000000000000030","开发工程师",[195,33,166,45,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211],"code review","code review workflow","testing","frontend","test","change","code quality","code-review","analysis","check","coverage","quality check","basic","multi","comprehensive code review","with","phase",{"skillNo":213,"name":214,"nameZh":6,"description":215,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":216,"categories":217,"keywords":227,"publishedAt":50},"01M6QJB7XNHV3VEEQF4W7FMWF6","code-change-test-designer","Analyzes code changes and designs comprehensive test cases. Reads diffs, summarizes capability changes, and designs test cases covering main flows and edge cases. Should be used when the user mentions test coverage, designing tests for code changes, or analyzing diff\u002Fcommit for testing purposes. Distinguished from code-review-workflow which provides comprehensive review, this skill focuses on test case design for code changes.","https:\u002F\u002Fgithub.com\u002FImaginerLabs\u002Fskill-manager\u002Fblob\u002Fmain\u002Fskills\u002Ftesting\u002Fcode-change-test-designer\u002FSKILL.md",[218,219,222,223,224],{"categoryNo":188,"categoryName":189,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":220,"categoryName":221,"taxonomyType":20,"taxonomyTypeDesc":21},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},{"categoryNo":192,"categoryName":193,"taxonomyType":28,"taxonomyTypeDesc":29},{"categoryNo":225,"categoryName":226,"taxonomyType":28,"taxonomyTypeDesc":29},"01JBSEEDCAT000000000000032","设计师",[199,200,45,228,229,197,230,231,166,232,202,233,205,234,38,235,36,236,128,211],"designer","code change test designer","design","diffs","commit","edge","diff","tests","which",{"skillNo":238,"name":239,"nameZh":6,"description":240,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":241,"categories":242,"keywords":244,"publishedAt":50},"01M6QJB195WD7DCJWDMKWKB29S","skill-creator","Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.","https:\u002F\u002Fgithub.com\u002FImaginerLabs\u002Fskill-manager\u002Fblob\u002Fmain\u002Fskills\u002Fmeta-skills\u002Fskill-creator\u002FSKILL.md",[243],{"categoryNo":23,"categoryName":24,"taxonomyType":20,"taxonomyTypeDesc":21},[245,246,247,248,167,249,250,251,252,253,203,254,255,256,38,257,258,125,128,239],"skill creator","creator","performance","run evals","variance analysis","create","run","benchmark","Meta","improve","edit","evals","optimize","existing skill"]