Skip to content

v2.7.0 — 47 skills, validator hardening, full content audit

Choose a tag to compare

View all tags
@int2t05 int2t05 released this 14 Aug 16:11
· 6 commits to main since this release
v2.7.0
af91fa0

v2.7.0 — 47 skills, validator hardening, full content audit

Covers all changes since v2.2.0 (tag flow was interrupted; v2.7.0 restores it).

New skills (45 → 47)

  • auth-implementation (04-develop) — correct auth implementation: session vs token, password hashing, JWT/refresh rotation, OAuth2/OIDC+PKCE, RBAC/ABAC. Builds what security-review audits. + token-patterns.md + oauth-flows.md
  • error-handling (04-develop) — error propagation strategy: classification, throw-vs-return, retry/circuit-breaker/fallback, error-to-user mapping. Implementation-level companion to architecture/error-resilience.md. + retry-patterns.md

Validator hardening (Tier A)

  • A1 security scan — scans all bundled files (not just SKILL.md) for reverse shell, obfuscated exec, hardcoded secrets, bare-IP, cloud cred paths, persistence, unofficial sources, system-path rm, prompt-injection phrases. Context-aware: POST-body exfil, global install, nohup, suspicious domains — 0 false positives on the clean pack.
  • A2 structural drift — frontmatter name == dir, kebab-case, description ≤1024 chars.
  • A3/A4 router — no-skill-hit fallback chain + anti-rationalization red-flag table.

Content audit fixes (Tier F, ~40 defects)

  • HIGH (10): OWASP 2017→2021, git push over-block comment, flyway undo paid-only, oss-polish hardcoded script scope, drift grep false-negatives, refactoring empty refs (new catalog), TTI→INP, RSC i18n (new ref), ADR format contradiction unified.
  • MEDIUM/LOW (~30): Chinese→English translations, CC BY-NC-SA→BY 4.0, X-Request-ID→Idempotency-Key, P95→P99, Cursor→real OSS cases, CONCURRENTLY INVALID warning, WCAG subset note, 400/422 disambiguation, k8s FinOps section, caching depth, platform rollback commands, + more.

Depth refs (Tier B, 6 new)

sql-optimization · design-system-audit · openapi-lifecycle · changelog-and-release-notes · slo-implementation · on-call-shift

Anatomy guidance (Tier D)

Reference depth (one level), on-demand load table, pressure-test scenario files, rationalization table, optional CREATION-LOG — written into skill-anatomy.md.

Behavioral eval harness (experimental / 待完善)

RED-GREEN harness built (Phase 2) with artifact persistence + partial-transcript recovery. Formal runs on GLM-5.2 do not yet discriminate (strong model passes without the skill). CI workflow deleted; tuning roadmap in docs/TODO.md A5. See the 8-system reference table (SWE-bench, skill-creator, obra, addyosmani, CR-Bench, OpenRCA, DashBench, c-CRAB).

Purity audit

Count sync (43→47 everywhere), dead fields removed (runs/fixture_setup), doc↔impl contradictions fixed (eval-tiers claims vs validator reality, performance Output declaration, grader schema), no residual artifacts.

Validator: 47 skills, 0 errors.

Assets 2
Loading