@winspan/claude-forge 8.51.1 → 8.53.2

package/src/cli/commands/skills.ts

@@ -2,11 +2,24 @@ import fs from 'fs';
 import path from 'path';
 import { homedir } from 'os';
 import { fileURLToPath } from 'url';
+import { promises as fsPromises } from 'node:fs';
 import type { Command } from 'commander';
 import { loadOfficialSkills } from '../../skills/official-skills.js';
 import { SkillRegistry } from '../../skills/registry.js';
 import { skillInvoke } from '../../skills/tools/skill-invoke.js';
 import { skillList } from '../../skills/tools/skill-list.js';
+import {
+  pullCandidates,
+  matchToOfficial,
+  evaluateWithAI,
+  generateReport,
+  applyDecisions,
+  DEFAULT_SOURCES,
+} from '../../skills/upgrade-engine.js';
+import type { ReportEntry } from '../../skills/upgrade-engine.js';
+import { ConfigManager } from '../../core/config.js';
+import { ClaudeProvider } from '../../core/ai/provider.js';
+import { FORGE_PATHS } from '../../core/constants.js';
 
 const SKILLS_DIR = path.join(homedir(), '.claude', 'skills');
 
@@ -98,6 +111,126 @@ async function invokeSkill(skillId: string, options: InvokeOptions): Promise<voi
   }
 }
 
+interface UpgradeOptions {
+  apply?: boolean;
+  rollback?: string;
+  report?: string;
+}
+
+/**
+ * Coordinate the full skill upgrade pipeline.
+ * Default: dry-run — generates a report without writing to src/.
+ * --apply: read report and apply decisions.
+ * --rollback <ts>: restore official skills from a backup timestamp.
+ */
+async function upgradeSkills(options: UpgradeOptions): Promise<void> {
+  const reportPath = options.report ?? FORGE_PATHS.skillUpgradeReport();
+  const officialDir = resolveBuiltinDir();
+  const backupBaseDir = FORGE_PATHS.backups('skills');
+  const candidatesDir = FORGE_PATHS.skillCandidates();
+
+  // ── Rollback mode ────────────────────────────────────────────────────────
+  if (options.rollback) {
+    const backupPath = path.join(backupBaseDir, options.rollback);
+    try {
+      await fsPromises.access(backupPath);
+    } catch {
+      console.error(`Backup not found: ${backupPath}`);
+      process.exit(1);
+    }
+    const files = await fsPromises.readdir(backupPath);
+    for (const file of files) {
+      if (!file.endsWith('.md')) continue;
+      await fsPromises.copyFile(path.join(backupPath, file), path.join(officialDir, file));
+    }
+    console.log(`Rolled back ${files.filter(f => f.endsWith('.md')).length} files from ${backupPath}`);
+    console.log('Run `npm run build` to rebuild with restored skills.');
+    return;
+  }
+
+  // ── Apply mode ───────────────────────────────────────────────────────────
+  if (options.apply) {
+    try {
+      await fsPromises.access(reportPath);
+    } catch {
+      console.error(`Report not found: ${reportPath}`);
+      console.error('Run `cf skills upgrade` first to generate a report.');
+      process.exit(1);
+    }
+    console.log(`Applying decisions from ${reportPath}...`);
+    const result = await applyDecisions(reportPath, officialDir, backupBaseDir);
+    console.log(`\nApply complete:`);
+    console.log(`  Applied : ${result.applied}`);
+    console.log(`  Skipped : ${result.skipped}`);
+    console.log(`  Backup  : ${result.backupPath}`);
+    console.log('\nRun `npm run build` to rebuild with updated skills.');
+    return;
+  }
+
+  // ── Dry-run (report generation) mode ────────────────────────────────────
+  console.log('Fetching candidate skills...');
+  const candidates = await pullCandidates(DEFAULT_SOURCES, candidatesDir);
+  console.log(`  Found ${candidates.length} candidate skills`);
+
+  const officialSkills = loadOfficialSkills(officialDir);
+  console.log(`  Loaded ${officialSkills.length} official skills`);
+
+  // Set up AI provider
+  const config = new ConfigManager().get();
+  if (!config.ai.api_key) {
+    console.error('No AI API key configured. Run `cf menu` to set it up.');
+    process.exit(1);
+  }
+  const aiProvider = new ClaudeProvider(config.ai.api_key, config.ai.model, config.ai.base_url);
+
+  let matched = 0;
+  let unmatched = 0;
+  const entries: ReportEntry[] = [];
+
+  console.log('\nEvaluating candidates...');
+
+  for (const candidate of candidates) {
+    const matchResult = matchToOfficial(candidate, officialSkills);
+    if (!matchResult) {
+      unmatched++;
+      continue;
+    }
+
+    matched++;
+    const official = officialSkills.find((o) => o.name === matchResult.officialId);
+    if (!official) continue;
+
+    process.stdout.write(`  ${candidate.id} → ${official.name} (score ${matchResult.score})... `);
+
+    const decision = await evaluateWithAI(candidate, official, aiProvider);
+    const action = (decision as { needs_review?: boolean }).needs_review
+      ? 'needs_review'
+      : decision.action;
+
+    process.stdout.write(`${action}\n`);
+
+    entries.push({
+      officialId: official.name,
+      candidateId: candidate.id,
+      candidateSource: candidate.source,
+      action,
+      confidence: decision.confidence,
+      reasoning: decision.reasoning,
+      candidateFilePath: candidate.filePath,
+      merged_content: decision.merged_content,
+    });
+  }
+
+  const stats = { total: candidates.length, matched, unmatched };
+  await generateReport(entries, reportPath, stats);
+
+  console.log(`\nReport generated: ${reportPath}`);
+  console.log(`Summary: ${matched} matched, ${unmatched} unmatched (of ${candidates.length} total)`);
+  console.log('\nReview the report, then run:');
+  console.log('  cf skills upgrade --apply   (to apply decisions)');
+}
+
+
 function registerSkillSubcommands(skills: Command): void {
   skills
     .command('sync')
@@ -124,6 +257,16 @@ function registerSkillSubcommands(skills: Command): void {
     .action(async (skillId: string, options: InvokeOptions) => {
       await invokeSkill(skillId, options);
     });
+
+  skills
+    .command('upgrade')
+    .description('AI-assisted upgrade of official skills (dry-run by default)')
+    .option('--apply', 'Apply decisions from the last report')
+    .option('--rollback <timestamp>', 'Rollback to a backup (e.g. 20260518-1930)')
+    .option('--report <path>', 'Custom report path')
+    .action(async (options: UpgradeOptions) => {
+      await upgradeSkills(options);
+    });
 }
 
 export function register(program: Command): void {

package/src/core/constants.ts

@@ -28,6 +28,11 @@ export const FORGE_PATHS = {
   // ── Patchable targets ───────────────────────────────────
   routingYaml:  () => join(FORGE_HOME, 'routing.yaml'),
   backups:      (kind: 'skills' | 'routing') => join(FORGE_HOME, 'backups', kind),
+  skillCandidates: (source?: string) =>
+    source
+      ? join(FORGE_HOME, 'skill-candidates', source)
+      : join(FORGE_HOME, 'skill-candidates'),
+  skillUpgradeReport: () => join(FORGE_HOME, 'skill-upgrade-report.md'),
 } as const;
 
 /**

package/src/daemon/index.ts

@@ -35,6 +35,7 @@ import { UserPromptHandler } from './handlers/user-prompt.js';
 import { PostToolUseHandler } from './handlers/post-tool-use.js';
 import { StopHandler } from './handlers/stop.js';
 import { syncHooks } from './hook-sync.js';
+import { syncSkills } from './skill-sync.js';
 import { replayQueue } from '../core/queue/index.js';
 import { DEFAULTS } from '../core/constants.js';
 import type { ForgeEvent } from '../core/types.js';
@@ -84,6 +85,15 @@ export async function startDaemon(foreground: boolean = false, options: DaemonOp
     logger.warn(`[HookSync] unexpected error: ${err}`);
   }
 
+  // ── 3.6. Auto-sync official skills ─────────────────────────────────────
+  // npm upgrade 不会自动更新 ~/.claude/skills/，每次 daemon 启动
+  // 用 SHA-256 比对 dist/skills/official 与本地副本，不一致则覆盖。
+  try {
+    syncSkills();
+  } catch (err) {
+    logger.warn(`[SkillSync] unexpected error: ${err}`);
+  }
+
   // ── 4. AI Provider ─────────────────────────────────────────────────────────
   const apiKey = config.ai.api_key || process.env.ANTHROPIC_API_KEY || '';
   if (!apiKey) {
@@ -96,7 +106,7 @@ export async function startDaemon(foreground: boolean = false, options: DaemonOp
 
   // ── 5. Initialize services ─────────────────────────────────────────────────
   const skillApiKey = config.skill_matching?.api_key || apiKey;
-  const skillRegistry = new SkillRegistry(skillApiKey);
+  const skillRegistry = new SkillRegistry(skillApiKey, config.ai.model, config.ai.base_url);
   const invocationGuard = new InvocationGuard();
   if (skillApiKey) {
     logger.info('[Skills] Registry loaded with semantic matching support');

package/src/daemon/skill-sync.ts

@@ -0,0 +1,88 @@
+import { existsSync, readFileSync, copyFileSync, mkdirSync, readdirSync } from 'node:fs';
+import { createHash } from 'node:crypto';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { homedir } from 'node:os';
+import { logger } from '../core/utils/logger.js';
+
+const USER_SKILLS_DIR = join(homedir(), '.claude', 'skills');
+
+function sha256(content: Buffer): string {
+  return createHash('sha256').update(content).digest('hex');
+}
+
+function getSourceSkillsDir(): string {
+  // Compiled: dist/daemon/skill-sync.js → dist/skills/official
+  // Dev (vitest): src/daemon/skill-sync.ts → src/skills/official
+  return join(dirname(fileURLToPath(import.meta.url)), '..', 'skills', 'official');
+}
+
+export interface SkillSyncResult {
+  copied: number;
+  checked: number;
+  skipped_userOwned: number; // user skills not in source list — untouched
+}
+
+/**
+ * Sync official skills from dist/skills/official to ~/.claude/skills/.
+ *
+ * Strategy:
+ * - Only files present in the source dir (dist/skills/official) are candidates
+ * - sha256 identical → skip; different → overwrite
+ * - User-only skills (not in source list) are never touched
+ * - Target dir is created if absent (first install)
+ *
+ * Failures are logged as warnings and never thrown — daemon startup must not be blocked.
+ */
+export function syncSkills(opts?: { sourceDir?: string; targetDir?: string }): SkillSyncResult {
+  const result: SkillSyncResult = { copied: 0, checked: 0, skipped_userOwned: 0 };
+  const sourceDir = opts?.sourceDir ?? getSourceSkillsDir();
+  const targetDir = opts?.targetDir ?? USER_SKILLS_DIR;
+
+  if (!existsSync(sourceDir)) {
+    logger.warn(`[SkillSync] source dir not found at ${sourceDir}, skipping`);
+    return result;
+  }
+
+  // Ensure target dir exists (first install may not have ~/.claude/skills/)
+  try {
+    mkdirSync(targetDir, { recursive: true });
+  } catch {
+    /* ignore — if it already exists mkdirSync is a no-op */
+  }
+
+  let sourceFiles: string[];
+  try {
+    sourceFiles = readdirSync(sourceDir).filter((f) => f.endsWith('.md'));
+  } catch (err) {
+    logger.warn(`[SkillSync] failed to list ${sourceDir}: ${err}`);
+    return result;
+  }
+
+  for (const file of sourceFiles) {
+    result.checked++;
+    const src = join(sourceDir, file);
+    const dest = join(targetDir, file);
+
+    try {
+      const srcContent = readFileSync(src);
+      if (existsSync(dest)) {
+        const destContent = readFileSync(dest);
+        if (sha256(srcContent) === sha256(destContent)) {
+          continue; // identical — no copy needed
+        }
+      }
+
+      copyFileSync(src, dest);
+      result.copied++;
+      logger.info(`[SkillSync] updated ${file}`);
+    } catch (err) {
+      logger.warn(`[SkillSync] failed to sync ${file}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+
+  if (result.copied > 0) {
+    logger.info(`[SkillSync] synced ${result.copied}/${result.checked} skill files`);
+  }
+  return result;
+}

package/src/hooks/notification.sh

@@ -18,7 +18,7 @@ SESSION_ID="${SESSION_ID:-${CLAUDE_CODE_SESSION_ID:-cli}}"
 # 构造事件 JSON（原始 INPUT 作为 tool_input，保留完整通知内容）
 TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%S.000Z")
 TOOL_INPUT=$(echo "$INPUT" | jq -c '.')
-EVENT=$(jq -n \
+EVENT=$(jq -nc \
   --arg hook_type "Notification" \
   --arg timestamp "$TIMESTAMP" \
   --arg session_id "$SESSION_ID" \

package/src/hooks/post-tool-use.sh

@@ -21,7 +21,7 @@ SESSION_ID="${SESSION_ID:-${CLAUDE_CODE_SESSION_ID:-cli}}"
 
 # 构造事件 JSON
 TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%S.000Z")
-EVENT=$(jq -n \
+EVENT=$(jq -nc \
   --arg hook_type "PostToolUse" \
   --arg timestamp "$TIMESTAMP" \
   --arg session_id "$SESSION_ID" \

package/src/hooks/pre-tool-use.sh

@@ -19,7 +19,7 @@ SESSION_ID="${SESSION_ID:-${CLAUDE_CODE_SESSION_ID:-cli}}"
 
 # 构造事件 JSON（jq -n 替代 python3 heredoc）
 TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%S.000Z")
-EVENT=$(jq -n \
+EVENT=$(jq -nc \
   --arg hook_type "PreToolUse" \
   --arg timestamp "$TIMESTAMP" \
   --arg session_id "$SESSION_ID" \

package/src/hooks/stop.sh

@@ -17,7 +17,7 @@ SESSION_ID="${SESSION_ID:-${CLAUDE_CODE_SESSION_ID:-cli}}"
 
 # 构造事件 JSON
 TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%S.000Z")
-EVENT=$(jq -n \
+EVENT=$(jq -nc \
   --arg hook_type "Stop" \
   --arg timestamp "$TIMESTAMP" \
   --arg session_id "$SESSION_ID" \

package/src/hooks/user-prompt-submit.sh

@@ -24,7 +24,7 @@ fi
 
 # 构造事件 JSON（jq -n 替代 python3 heredoc）
 TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%S.000Z")
-EVENT=$(jq -n \
+EVENT=$(jq -nc \
   --arg hook_type "UserPromptSubmit" \
   --arg timestamp "$TIMESTAMP" \
   --arg session_id "$SESSION_ID" \

package/src/skills/official/code-simplifier.md

@@ -13,4 +13,40 @@ You will analyze recently modified code and apply refinements that:
 2. **Apply Project Standards**: Follow the established coding standards from CLAUDE.md including:
 
    - Use ES modules with proper import sorting and extensions
-   - Prefer `
+   - Prefer `function` keyword over arrow functions
+   - Use explicit return type annotations for top-level functions
+   - Follow proper React component patterns with explicit Props types
+   - Use proper error handling patterns (avoid try/catch when possible)
+   - Maintain consistent naming conventions
+
+3. **Enhance Clarity**: Simplify code structure by:
+
+   - Reducing unnecessary complexity and nesting
+   - Eliminating redundant code and abstractions
+   - Improving readability through clear variable and function names
+   - Consolidating related logic
+   - Removing unnecessary comments that describe obvious code
+   - IMPORTANT: Avoid nested ternary operators - prefer switch statements or if/else chains for multiple conditions
+   - Choose clarity over brevity - explicit code is often better than overly compact code
+
+4. **Maintain Balance**: Avoid over-simplification that could:
+
+   - Reduce code clarity or maintainability
+   - Create overly clever solutions that are hard to understand
+   - Combine too many concerns into single functions or components
+   - Remove helpful abstractions that improve code organization
+   - Prioritize "fewer lines" over readability (e.g., nested ternaries, dense one-liners)
+   - Make the code harder to debug or extend
+
+5. **Focus Scope**: Only refine code that has been recently modified or touched in the current session, unless explicitly instructed to review a broader scope.
+
+Your refinement process:
+
+1. Identify the recently modified code sections
+2. Analyze for opportunities to improve elegance and consistency
+3. Apply project-specific best practices and coding standards
+4. Ensure all functionality remains unchanged
+5. Verify the refined code is simpler and more maintainable
+6. Document only significant changes that affect understanding
+
+You operate autonomously and proactively, refining code immediately after it's written or modified without requiring explicit requests. Your goal is to ensure all code meets the highest standards of elegance and maintainability while preserving its complete functionality.

package/src/skills/official/find-skills.md

@@ -20,4 +20,123 @@ Use this skill when the user:
 
 ## What is the Skills CLI?
 
-The Skills CLI (`
+The Skills CLI (`npx skills`) is the package manager for the open agent skills ecosystem. Skills are modular packages that extend agent capabilities with specialized knowledge, workflows, and tools.
+
+**Key commands:**
+
+- `npx skills find [query]` - Search for skills interactively or by keyword
+- `npx skills add <package>` - Install a skill from GitHub or other sources
+- `npx skills check` - Check for skill updates
+- `npx skills update` - Update all installed skills
+
+**Browse skills at:** https://skills.sh/
+
+## How to Help Users Find Skills
+
+### Step 1: Understand What They Need
+
+When a user asks for help with something, identify:
+
+1. The domain (e.g., React, testing, design, deployment)
+2. The specific task (e.g., writing tests, creating animations, reviewing PRs)
+3. Whether this is a common enough task that a skill likely exists
+
+### Step 2: Check the Leaderboard First
+
+Before running a CLI search, check the [skills.sh leaderboard](https://skills.sh/) to see if a well-known skill already exists for the domain. The leaderboard ranks skills by total installs, surfacing the most popular and battle-tested options.
+
+For example, top skills for web development include:
+- `vercel-labs/agent-skills` — React, Next.js, web design (100K+ installs each)
+- `anthropics/skills` — Frontend design, document processing (100K+ installs)
+
+### Step 3: Search for Skills
+
+If the leaderboard doesn't cover the user's need, run the find command:
+
+```bash
+npx skills find [query]
+```
+
+For example:
+
+- User asks "how do I make my React app faster?" → `npx skills find react performance`
+- User asks "can you help me with PR reviews?" → `npx skills find pr review`
+- User asks "I need to create a changelog" → `npx skills find changelog`
+
+### Step 4: Verify Quality Before Recommending
+
+**Do not recommend a skill based solely on search results.** Always verify:
+
+1. **Install count** — Prefer skills with 1K+ installs. Be cautious with anything under 100.
+2. **Source reputation** — Official sources (`vercel-labs`, `anthropics`, `microsoft`) are more trustworthy than unknown authors.
+3. **GitHub stars** — Check the source repository. A skill from a repo with <100 stars should be treated with skepticism.
+
+### Step 5: Present Options to the User
+
+When you find relevant skills, present them to the user with:
+
+1. The skill name and what it does
+2. The install count and source
+3. The install command they can run
+4. A link to learn more at skills.sh
+
+Example response:
+
+```
+I found a skill that might help! The "react-best-practices" skill provides
+React and Next.js performance optimization guidelines from Vercel Engineering.
+(185K installs)
+
+To install it:
+npx skills add vercel-labs/agent-skills@react-best-practices
+
+Learn more: https://skills.sh/vercel-labs/agent-skills/react-best-practices
+```
+
+### Step 6: Offer to Install
+
+If the user wants to proceed, you can install the skill for them:
+
+```bash
+npx skills add <owner/repo@skill> -g -y
+```
+
+The `-g` flag installs globally (user-level) and `-y` skips confirmation prompts.
+
+## Common Skill Categories
+
+When searching, consider these common categories:
+
+| Category        | Example Queries                          |
+| --------------- | ---------------------------------------- |
+| Web Development | react, nextjs, typescript, css, tailwind |
+| Testing         | testing, jest, playwright, e2e           |
+| DevOps          | deploy, docker, kubernetes, ci-cd        |
+| Documentation   | docs, readme, changelog, api-docs        |
+| Code Quality    | review, lint, refactor, best-practices   |
+| Design          | ui, ux, design-system, accessibility     |
+| Productivity    | workflow, automation, git                |
+
+## Tips for Effective Searches
+
+1. **Use specific keywords**: "react testing" is better than just "testing"
+2. **Try alternative terms**: If "deploy" doesn't work, try "deployment" or "ci-cd"
+3. **Check popular sources**: Many skills come from `vercel-labs/agent-skills` or `ComposioHQ/awesome-claude-skills`
+
+## When No Skills Are Found
+
+If no relevant skills exist:
+
+1. Acknowledge that no existing skill was found
+2. Offer to help with the task directly using your general capabilities
+3. Suggest the user could create their own skill with `npx skills init`
+
+Example:
+
+```
+I searched for skills related to "xyz" but didn't find any matches.
+I can still help you with this task directly! Would you like me to proceed?
+
+If this is something you do often, you could create your own skill:
+npx skills init my-xyz-skill
+```

package/src/skills/official/official-api-design.md

@@ -14,4 +14,17 @@ tags: [api, rest, design, backend]
 4. 再实现
 
 ## RESTful 规范
-- URL 用名词复数：`
+- URL 用名词复数：`/users`，不用动词 `/getUser`
+- 用 HTTP 动词表达操作：GET/POST/PUT/PATCH/DELETE
+- 错误返回统一结构：`{ code, message, data }`
+- 分页用 `?page=1&size=20`，返回 `total`
+
+## 版本管理
+- URL 版本：`/api/v1/users`（推荐）
+- 破坏性变更必须升版本
+
+## 通用原则
+- 幂等性：PUT/DELETE 必须幂等
+- 认证统一走 Authorization header
+- 敏感字段不出现在 URL（用 body）
+- 响应时间 P99 < 200ms，超时统一 30s

package/src/skills/official/official-architecture-decision.md

@@ -17,4 +17,25 @@ tags: [architecture, adr, design, decision]
 
 ## ADR 模板
 
-`
+```markdown
+# ADR-{编号}: {标题}
+
+## 状态
+Proposed / Accepted / Deprecated
+
+## 背景
+为什么需要做这个决策？当前面临什么问题？
+
+## 决策
+我们选择做什么？
+
+## 备选方案
+考虑过哪些其他方案？为什么没选？
+
+## 后果
+这个决策带来什么好处？有什么代价或风险？
+```
+
+## 规则
+- ADR 一旦 Accepted 不得修改，只能新建 ADR 来废弃或替代
+- 存放在项目 `docs/adr/` 目录

package/src/skills/official/official-db-schema-design.md

@@ -13,4 +13,22 @@ tags: [database, schema, sql, migration]
 - 外键约束在数据库层面强制
 
 ## 命名规范
-- 表名：snake_case 复数（`
+- 表名：snake_case 复数（`user_profiles`）
+- 主键：`id`（自增或 UUID）
+- 时间戳：`created_at`、`updated_at`（每张表必有）
+- 软删除：`deleted_at` nullable
+
+## 索引策略
+- 外键列必须建索引
+- 高频查询的 WHERE 条件列建索引
+- 复合索引遵循最左前缀原则
+
+## 迁移规范
+- 每次变更写迁移文件，不手动改生产库
+- 迁移必须可回滚（写 down migration）
+- 破坏性变更分三步：加新列 → 双写 → 删旧列
+
+## 常见陷阱
+- 不用 `ENUM` 类型，用关联表或字符串
+- JSON 列只存真正非结构化数据
+- 避免 EAV 模式（Entity-Attribute-Value）

package/src/skills/official/official-debug.md

@@ -14,4 +14,12 @@ tags: [debug, troubleshooting]
 
 2. **隔离** — 缩小根因范围
    - 二分法排查代码路径
-   - 检查近期变更（`
+   - 检查近期变更（`git bisect`）
+   - 加日志，不要靠猜
+
+3. **假设** — 清晰陈述假设再验证，每次只验证一个
+
+4. **修复** — 最小化修复，解决根本原因
+   - 修复前先写一个能复现 bug 的测试
+
+5. **验证** — 原始 bug 消失 + 无回归 + 测试通过

package/src/skills/official/official-pr-review.md

@@ -32,4 +32,4 @@ tags: [review, pr, quality]
 - [ ] 边界条件有测试覆盖
 
 ## 输出格式
-**[BLOCKER|MAJOR|MINOR]** `
+**[BLOCKER|MAJOR|MINOR]** `文件:行号` — 问题 → 建议

package/src/skills/official/official-security-hardening.md

@@ -23,4 +23,10 @@ tags: [security, owasp, hardening]
 - 密钥走环境变量，不进代码库
 
 ## 依赖安全
-- 定期运行 `
+- 定期运行 `npm audit` / `pip audit` / `govulncheck`
+- lockfile 提交到仓库
+
+## 常见漏洞速查
+- XSS：输出时转义，CSP header
+- CSRF：SameSite cookie + CSRF token
+- SSRF：白名单限制外部请求目标