ๅฝ agent ้่ฆ้่ฟๅทฒๅฎ่ฃ ็ `sau` CLI ๅฎๆๆ้ณ็ปๅฝใcookie ๆ ก้ชใ่ง้ขไธไผ ๆๅพๆๅๅธๆถไฝฟ็จ่ฟไธช skillใ่ฏฅ skill ้็จไบๅทฒ็ปๅฎ่ฃ `social-auto-upload` ไธๅฏ่ฐ็จ `sau` ๅฝไปค็็ฏๅขใไผๅ ไฝฟ็จ่ฟไธช skill ่ฟ่ก็จณๅฎ็ๅฝไปคๅผๆ้ณๅทฅไฝๆต๏ผ่ไธๆฏไธๅผๅงๅฐฑ้ ่ฏป uploader ๆบ็ ใ
Implement credential storage, API connection testing, secure field handling, history tracking, and full CRUD for Unopim third-party connector modules. Covers Credential model with HistoryTrait and extras JSON, Contract interface, CredentialRepository, CredentialController with JsonResponse, FormRequest validation, DataGrid, and migration with DB_PREFIX. Use this skill when building the credentials section of any Unopim connector (WooCommerce, Shopify, Shopware, module, etc.).
Propose and implement a new generic gosec rule from a Go security issue description.
Scan agent skills for security issues. Use when asked to "scan a skill", "audit a skill", "review skill security", "check skill for injection", "validate SKILL.md", or assess whether an agent skill is safe to install. Checks for prompt injection, malicious scripts, excessive permissions, secret exposure, and supply chain risks.
Use when implementing authentication/authorization, securing user input, or preventing OWASP Top 10 vulnerabilities โ including custom security implementations such as hashing passwords with bcrypt/argon2, sanitizing SQL queries with parameterized statements, configuring CORS/CSP headers, validating input with Zod, and setting up JWT tokens. Invoke for authentication, authorization, input validation, encryption, OWASP Top 10 prevention, secure session management, and security hardening. For pre-built OAuth/SSO integrations or standalone security audits, consider a more specialized skill.
Admin-side permission UI registration and DI-backed permission checking. Use this skill when adding permission controls to the admin UI โ schema-based auto-generated forms, injectable permissions via createPermissionsAbstraction/ createPermissionsFeature, typed hooks (createUsePermissions), the HasPermission component (createHasPermission), and the Security.Permissions component props. Covers both simple apps and complex multi-entity permission schemas.
Configuring Auth0 as an identity provider (IDP) for Webiny projects. Use this skill when the developer asks about Auth0 authentication, Auth0 SSO, replacing Cognito with Auth0, setting up external identity providers, configuring OIDC authentication, mapping JWT claims to Webiny identities, or customizing the Auth0 login flow. Also relevant when asking about AUTH0_ISSUER, AUTH0_CLIENT_ID environment variables, Auth0IdpConfig, or the MyAuth0Extension pattern.
Configuring Okta as an identity provider (IDP) for Webiny projects. Use this skill when the developer asks about Okta authentication, Okta SSO, replacing Cognito with Okta, setting up external identity providers, configuring OIDC authentication, mapping JWT claims to Webiny identities, or customizing the Okta login flow. Also relevant when asking about OKTA_ISSUER, OKTA_CLIENT_ID environment variables, OktaIdpConfig, or the MyOktaExtension pattern.
API โ Security & Auth โ 53 abstractions. Authentication, API keys, roles, users, teams event handlers and use cases.
python ocr uackend integration
Configure OAuth providers (Google, Apple, Microsoft, Facebook, GitHub, etc.) to work with portless local dev URLs. Use when setting up OAuth redirect URIs, fixing "redirect_uri_mismatch" or "invalid redirect" errors, configuring sign-in providers for local development, or when a provider rejects .localhost subdomains. Triggers include "OAuth not working with portless", "redirect URI mismatch", "Google/Apple/Microsoft sign-in fails locally", "configure OAuth for local dev", or any task involving OAuth callback URLs with portless domains.
Manages OAuth social authentication with Laravel Socialite. Activate when adding social login providers; configuring OAuth redirect/callback flows; retrieving authenticated user details; customizing scopes or parameters; setting up community providers; testing with Socialite fakes; or when the user mentions social login, OAuth, Socialite, or third-party authentication.
ๅฎๅ จๆ ก้ชๅ ณๅกใ่ชๅจๆซๆไปฃ็ ๅฎๅ จๆผๆด๏ผๆฃๆตๅฑ้ฉๆจกๅผ๏ผ็กฎไฟๅฎๅ จๅณ็ญๆๆๆกฃ่ฎฐๅฝใๅฝ็จๆทๆๅฐๅฎๅ จๆซๆใๆผๆดๆฃๆตใๅฎๅ จๅฎก่ฎกใไปฃ็ ๅฎๅ จใOWASPใๆณจๅ ฅๆฃๆตใๆๆไฟกๆฏๆณ้ฒๆถไฝฟ็จใๅจๆฐๅปบๆจกๅใๅฎๅ จ็ธๅ ณๅๆดใๆป้ฒไปปๅกใ้ๆๅฎๆๆถ่ชๅจ่งฆๅใ
Upgrade Megatron-Core in AReaL by auditing affected APIs, cross-referencing upstream sources, and updating call sites.
Upgrade vLLM in AReaL by auditing affected APIs, cross-referencing upstream sources, and updating call sites.
Security-first skill vetting protocol for AI agents. Use before installing any skill from the platform skill market, skillhub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns to determine whether a skill is safe to install.
Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.
Configure rate limiting, manage auth secrets, set up CSRF protection, define trusted origins, secure sessions and cookies, encrypt OAuth tokens, track IP addresses, and implement audit logging for Better Auth. Use when users need to secure their auth setup, prevent brute force attacks, or harden a Better Auth deployment.
