[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71HAN0DPNYWXS8DNW9J5NTP":3,"skill-same:01M71HAN0DPNYWXS8DNW9J5NTP":64},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":44,"commitSha":45,"skillDirectory":46,"forksCount":14,"repositoryHtmlUrl":47,"repositoryHomepageUrl":6,"ownerHtmlUrl":48,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":49,"install":50,"resources":63},"01M71HAN0DPNYWXS8DNW9J5NTP","security-check",null,"Smart Collection security audit workflow. Use when the user asks to run security checks, audit Ruby gems, audit JavaScript or Python dependencies, verify bundler-audit, run OWASP ZAP against the Rails app, investigate vulnerable dependencies, fix security issues, or improve project security posture in this Rails\u002FMongoid\u002FPython\u002FDocker project.","ZeroIsOnFire\u002Fsmart-collection","ZeroIsOnFire","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1202472?v=4","01M71HA5N01RTYGNY2NJT0GYX4","Eli Fachin Junior","01M71HA5NPBDGJYY84WSQ20YCP",0,"AGPL-3.0","https:\u002F\u002Fgithub.com\u002FZeroIsOnFire\u002Fsmart-collection\u002Fblob\u002Fmain\u002F.skills\u002Fsecurity-check\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"security check","security","check","javascript","audit workflow","project security","collection","workflow","when","use","ruby","improve","python","issues","fix","docker","project","security audit","owasp zap","app","2026-11-10 10:12:30",false,"---\nname: security-check\ndescription: Smart Collection security audit workflow. Use when the user asks to run security checks, audit Ruby gems, audit JavaScript or Python dependencies, verify bundler-audit, run OWASP ZAP against the Rails app, investigate vulnerable dependencies, fix security issues, or improve project security posture in this Rails\u002FMongoid\u002FPython\u002FDocker project.\n---\n\n# Security Check\n\nAssume the Smart Collection security role. Audit dependency vulnerabilities across the dependency ecosystems that are present in the repository, run OWASP ZAP against the main Rails application when no equivalent ZAP\u002FOWASP dynamic scan is already covered by the active QA workflow, then fix reported issues conservatively.\n\n## Core Workflow\n\n1. Run Bundler Audit from the project root inside the Rails container:\n\n```bash\ndocker compose exec web bundle exec bundler-audit check --update\n```\n\n2. If JavaScript dependencies are present, audit them:\n- Run this only when `package.json` exists with a matching lockfile.\n- Use `npm audit` for `package-lock.json`, `pnpm audit` for `pnpm-lock.yaml`, or the appropriate Yarn audit command for `yarn.lock`.\n- Do not create a JavaScript manifest or lockfile just to run an audit.\n\n3. If Python dependency files are present, audit them with `pip-audit`:\n\n```bash\ndocker compose run --rm --entrypoint sh -v .:\u002Fworkspace upscale-service -c \"python -m pip install --no-cache-dir pip-audit && python -m pip_audit -r \u002Fworkspace\u002Fupscale\u002Frequirements.txt\"\ndocker compose run --rm --entrypoint sh -v .:\u002Fworkspace yolo-service -c \"python -m pip install --no-cache-dir pip-audit && python -m pip_audit -r \u002Fworkspace\u002Fyolo\u002Frequirements.txt\"\n```\n\nRun the command only for services that exist and have `requirements.txt`.\n\n4. Run OWASP ZAP Baseline only against the main Rails application:\n- Before running ZAP, check the active QA\u002Fsecurity workflow for an equivalent OWASP ZAP or OWASP dynamic application security scan that already targets the Rails app. If an equivalent scan has already run in this task, record it and skip the duplicate ZAP command.\n- Do not run ZAP against the Python microservices.\n- Ensure the Rails app is running on the host at `http:\u002F\u002Flocalhost:3000`.\n- Store generated ZAP reports under `tmp\u002Fzap\u002F`, which is ignored by Git.\n\n```bash\ndocker run --rm -v \"${PWD}\u002Ftmp\u002Fzap:\u002Fzap\u002Fwrk\u002F:rw\" ghcr.io\u002Fzaproxy\u002Fzaproxy:stable zap-baseline.py -t http:\u002F\u002Fhost.docker.internal:3000 -r zap-baseline.html -J zap-baseline.json -z \"-config replacer.full_list(0).description=rails-host -config replacer.full_list(0).enabled=true -config replacer.full_list(0).matchtype=REQ_HEADER -config replacer.full_list(0).matchstr=Host -config replacer.full_list(0).replacement=localhost:3000\"\n```\n\n5. Read the full output and identify each advisory:\n- vulnerable gem\n- vulnerable JavaScript package, when applicable\n- vulnerable Python package, when applicable\n- OWASP ZAP alert, when applicable\n- installed version\n- advisory ID \u002F CVE\n- patched versions\n- affected dependency constraints\n\n6. Fix reported vulnerabilities conservatively:\n- Prefer updating only the vulnerable existing dependency and its required transitive dependencies.\n- Do not add new gems, npm packages, Python packages, or libraries without explicit user authorization.\n- Preserve existing constraints unless the advisory requires a constraint change.\n- If a constraint must change, keep the smallest compatible version range that satisfies the advisory and the affected service.\n- If an advisory has no patched version available, do not suppress it silently. Report it as residual upstream risk and explain why it could not be fixed.\n\n7. After dependency changes, rerun the relevant security audits and quality agents:\n\n```bash\ndocker compose exec web bundle exec bundler-audit check --update\ndocker compose exec web bash bin\u002Fqa\n```\n\nFor JavaScript dependency changes, also rerun the JavaScript audit command from step 2. For Python dependency or Python code changes, also run `$quality-check-python`.\n\n8. If no audit reports vulnerabilities, do not change dependency files.\n\n## Safety Rules\n\n- Never expose secrets, API keys, passwords, tokens, or credential values in logs, commits, or summaries.\n- Never remove authentication, authorization, `current_user` scoping, or share-token protections to make tests pass.\n- Never run destructive database or Docker volume commands as part of security cleanup.\n- Treat security fixes as narrow changes; avoid unrelated refactors.\n- Do not commit transient audit\u002Flinter tools installed inside containers.\n\n## Final Report\n\nReport:\n- The security audit commands that were run.\n- Vulnerabilities found, if any.\n- Dependency or code changes applied.\n- Final security audit, OWASP ZAP, `$quality-check-rails`, and `$quality-check-python` status when applicable.\n","# Security Check\n\nAssume the Smart Collection security role. Audit dependency vulnerabilities across the dependency ecosystems that are present in the repository, run OWASP ZAP against the main Rails application when no equivalent ZAP\u002FOWASP dynamic scan is already covered by the active QA workflow, then fix reported issues conservatively.\n\n## Core Workflow\n\n1. Run Bundler Audit from the project root inside the Rails container:\n\n```bash\ndocker compose exec web bundle exec bundler-audit check --update\n```\n\n2. If JavaScript dependencies are present, audit them:\n- Run this only when `package.json` exists with a matching lockfile.\n- Use `npm audit` for `package-lock.json`, `pnpm audit` for `pnpm-lock.yaml`, or the appropriate Yarn audit command for `yarn.lock`.\n- Do not create a JavaScript manifest or lockfile just to run an audit.\n\n3. If Python dependency files are present, audit them with `pip-audit`:\n\n```bash\ndocker compose run --rm --entrypoint sh -v .:\u002Fworkspace upscale-service -c \"python -m pip install --no-cache-dir pip-audit && python -m pip_audit -r \u002Fworkspace\u002Fupscale\u002Frequirements.txt\"\ndocker compose run --rm --entrypoint sh -v .:\u002Fworkspace yolo-service -c \"python -m pip install --no-cache-dir pip-audit && python -m pip_audit -r \u002Fworkspace\u002Fyolo\u002Frequirements.txt\"\n```\n\nRun the command only for services that exist and have `requirements.txt`.\n\n4. Run OWASP ZAP Baseline only against the main Rails application:\n- Before running ZAP, check the active QA\u002Fsecurity workflow for an equivalent OWASP ZAP or OWASP dynamic application security scan that already targets the Rails app. If an equivalent scan has already run in this task, record it and skip the duplicate ZAP command.\n- Do not run ZAP against the Python microservices.\n- Ensure the Rails app is running on the host at `http:\u002F\u002Flocalhost:3000`.\n- Store generated ZAP reports under `tmp\u002Fzap\u002F`, which is ignored by Git.\n\n```bash\ndocker run --rm -v \"${PWD}\u002Ftmp\u002Fzap:\u002Fzap\u002Fwrk\u002F:rw\" ghcr.io\u002Fzaproxy\u002Fzaproxy:stable zap-baseline.py -t http:\u002F\u002Fhost.docker.internal:3000 -r zap-baseline.html -J zap-baseline.json -z \"-config replacer.full_list(0).description=rails-host -config replacer.full_list(0).enabled=true -config replacer.full_list(0).matchtype=REQ_HEADER -config replacer.full_list(0).matchstr=Host -config replacer.full_list(0).replacement=localhost:3000\"\n```\n\n5. Read the full output and identify each advisory:\n- vulnerable gem\n- vulnerable JavaScript package, when applicable\n- vulnerable Python package, when applicable\n- OWASP ZAP alert, when applicable\n- installed version\n- advisory ID \u002F CVE\n- patched versions\n- affected dependency constraints\n\n6. Fix reported vulnerabilities conservatively:\n- Prefer updating only the vulnerable existing dependency and its required transitive dependencies.\n- Do not add new gems, npm packages, Python packages, or libraries without explicit user authorization.\n- Preserve existing constraints unless the advisory requires a constraint change.\n- If a constraint must change, keep the smallest compatible version range that satisfies the advisory and the affected service.\n- If an advisory has no patched version available, do not suppress it silently. Report it as residual upstream risk and explain why it could not be fixed.\n\n7. After dependency changes, rerun the relevant security audits and quality agents:\n\n```bash\ndocker compose exec web bundle exec bundler-audit check --update\ndocker compose exec web bash bin\u002Fqa\n```\n\nFor JavaScript dependency changes, also rerun the JavaScript audit command from step 2. For Python dependency or Python code changes, also run `$quality-check-python`.\n\n8. If no audit reports vulnerabilities, do not change dependency files.\n\n## Safety Rules\n\n- Never expose secrets, API keys, passwords, tokens, or credential values in logs, commits, or summaries.\n- Never remove authentication, authorization, `current_user` scoping, or share-token protections to make tests pass.\n- Never run destructive database or Docker volume commands as part of security cleanup.\n- Treat security fixes as narrow changes; avoid unrelated refactors.\n- Do not commit transient audit\u002Flinter tools installed inside containers.\n\n## Final Report\n\nReport:\n- The security audit commands that were run.\n- Vulnerabilities found, if any.\n- Dependency or code changes applied.\n- Final security audit, OWASP ZAP, `$quality-check-rails`, and `$quality-check-python` status when applicable.\n",{"name":5,"description":7},"main","f7cc6be75df2db15c57ea513592ccf6680ba5b7f",".skills\u002Fsecurity-check","https:\u002F\u002Fgithub.com\u002FZeroIsOnFire\u002Fsmart-collection","https:\u002F\u002Fgithub.com\u002FZeroIsOnFire","2026-10-22 06:59:18",{"source":8,"skillName":5,"commands":51,"prompt":61,"zipAvailable":62},[52,55,58],{"tool":53,"command":54},"npx","npx skills add ZeroIsOnFire\u002Fsmart-collection --skill security-check",{"tool":56,"command":57},"bunx","bunx skills add ZeroIsOnFire\u002Fsmart-collection --skill security-check",{"tool":59,"command":60},"pnpm","pnpm dlx skills add ZeroIsOnFire\u002Fsmart-collection --skill security-check","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FZeroIsOnFire\u002Fsmart-collection\u002Fblob\u002Fmain\u002F.skills\u002Fsecurity-check\u002FSKILL.md",true,[],[65,88,106,119,124,129],{"skillNo":66,"name":67,"nameZh":6,"description":68,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":69,"categories":70,"keywords":76,"publishedAt":39},"01M71HAKB5K11SGMC6Z9CMCBJR","quality-check-rails","Smart Collection Rails quality assurance workflow. Use when the user asks to run Rails QA, verify project quality, check RuboCop\u002FRSpec, validate Rails CI readiness, or fix quality issues in the Rails\u002FMongoid\u002FDocker application.","https:\u002F\u002Fgithub.com\u002FZeroIsOnFire\u002Fsmart-collection\u002Fblob\u002Fmain\u002F.skills\u002Fquality-check-rails\u002FSKILL.md",[71],{"categoryNo":72,"categoryName":73,"taxonomyType":74,"taxonomyTypeDesc":75},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[77,78,21,79,80,32,81,27,82,34,26,83,33,84,85,35,25,86,87,28],"quality check rails","quality check","quality","rails","rspec","readiness","run","qa","ci","verify","quality assurance",{"skillNo":89,"name":90,"nameZh":6,"description":91,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":92,"categories":93,"keywords":94,"publishedAt":39},"01M71HAHPNJ2P9KQCCHRRJA99P","quality-check-python","Smart Collection Python microservice quality workflow. Use when the user asks to run Python QA, lint Python code, test Python microservices, validate yolo\u002Fupscale changes, or when files under yolo\u002F or upscale\u002F change.","https:\u002F\u002Fgithub.com\u002FZeroIsOnFire\u002Fsmart-collection\u002Fblob\u002Fmain\u002F.skills\u002Fquality-check-python\u002FSKILL.md",[],[95,78,21,79,31,96,97,98,27,99,26,100,101,102,103,84,104,25,28,105],"quality check python","test python","yolo","python code","files","test","change","lint","code","microservice","lint python",{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":112,"publishedAt":39},"01M71HAFPFZ2XMH6D1PRV5V7HX","quality-check-javascript","Smart Collection JavaScript quality workflow. Use when the user asks to run JavaScript QA, validate esbuild\u002Fjsbundling-rails, check npm dependencies, verify Stimulus\u002FTurbo controllers, or when files under app\u002Fjavascript, package.json, package-lock.json, or JavaScript-related Rails layout\u002Fbuild configuration change.","https:\u002F\u002Fgithub.com\u002FZeroIsOnFire\u002Fsmart-collection\u002Fblob\u002Fmain\u002F.skills\u002Fquality-check-javascript\u002FSKILL.md",[],[113,78,21,79,22,114,84,115,25,86,80,26,28,99,116,117,38,118,27,101],"quality check javascript","lock","package","build","layout","turbo",{"skillNo":120,"name":5,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":121,"categories":122,"keywords":123,"publishedAt":39},"01M71HAF09H16G82Z4SY5V9TG7","https:\u002F\u002Fgithub.com\u002FZeroIsOnFire\u002Fsmart-collection\u002Fblob\u002Fmain\u002F.gemini\u002Fskills\u002Fsecurity-check\u002FSKILL.md",[],[20,21,19],{"skillNo":125,"name":67,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":128,"publishedAt":39},"01M71HAE8XDNTWWXP66S13JTTS","https:\u002F\u002Fgithub.com\u002FZeroIsOnFire\u002Fsmart-collection\u002Fblob\u002Fmain\u002F.gemini\u002Fskills\u002Fquality-check-rails\u002FSKILL.md",[],[21,78,77,79,80],{"skillNo":130,"name":90,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":133,"publishedAt":39},"01M71HADJG1CRZMNDQ7SPF77XB","https:\u002F\u002Fgithub.com\u002FZeroIsOnFire\u002Fsmart-collection\u002Fblob\u002Fmain\u002F.gemini\u002Fskills\u002Fquality-check-python\u002FSKILL.md",[],[79,31,95,78,21]]