007
무료Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
aibot88/sec_skill_store52026년 5월 27일 업데이트
무료GitHub에 공개
architecture-and-stack
Cloudflare-first platform selection. Decision trees for Workers, D1, R2, KV, DO, Queues, Vectorize, Containers, Sandboxes, Flagship, Agent Memory, Workflows v2. Default stack, override conditions, auth, data patterns, reliability.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
설치 방법 보기포함된 파일(2)
- SKILL.md11.2 KB
- source.json791 B
SKILL.md(원문)
설치하기 전에 에이전트에게 전달되는 지시 내용을 확인할 수 있습니다.
Submodules
| File | Description |
|---|---|
| api-design-and-documentation.md | Hono v4.12.x RPC mode, error envelope, rate limiting, pagination, OpenAPI, versioning. |
| shared-api-pool.md | Centralized API key pool. Auto-integrates PostHog, Sentry, Postiz, all services. |
| drizzle-orm-and-migrations.md | Drizzle ORM v1.0 for D1/Neon. RQBv2, schema-first, auto migrations, type-safe queries. |
| coolify-docker-proxmox.md | Self-hosted services on Proxmox via Coolify API. Docker containers, env vars. |
| mcp-and-cloud-integrations.md | All MCP servers, cloud APIs, SaaS integrations. Secret discovery, AI API usage. |
| ai-technology-integration.md | AI APIs/models: GPT-4o vision, Workers AI edge inference, embeddings for RAG. |
| auth-and-session-management.md | Clerk auth: middleware, webhook sync, RBAC, protected routes, session tokens. |
| background-jobs-and-workflows.md | Inngest durable jobs, CF Workflows v2, CF Cron Triggers, CF Queues, email drips, fan-out. |
| openapi-generation.md | @hono/zod-openapi auto-generated specs, Swagger UI, client SDK codegen, versioning. |
| cf-auto-provision.md | Single-function CF project bootstrap: D1+KV+R2+DNS+routes+wrangler.toml+integrations via cf CLI. |
| enterprise-multi-tenancy.md | DB-per-tenant D1, RBAC/ABAC, audit logging (R2 WORM), SSO/SCIM, data residency, rate limiting, white-labeling. |
| heartbeat-polling.md | CF Workflows heartbeat polling for long-running container jobs — avoids 25min step timeout. |
05 — Architecture and Stack
Default Stack
| Need | Default | Override When |
|---|---|---|
| Hosting | CF Workers + Static Assets | Never |
| Backend | Hono v4.12.x on Workers | Complex GraphQL → Yoga |
| Frontend (simple) | Vanilla HTML/CSS/JS | >3 interactive pages |
| Frontend (complex) | Angular 21 + Ionic + PrimeNG + Nx | Simple marketing site |
| DB (simple) | D1 (SQLite, global read replication) | Joins >3 tables |
| DB (complex) | Neon PostgreSQL | D1 sufficient |
| Cache | KV / Upstash Redis | Atomic ops → D1 |
| Storage | R2 | S3-specific SDK |
| Auth (SaaS) | Clerk | Custom auth requested |
| Auth (self-hosted) | Authentik | Clerk for customer-facing |
| Payments | Stripe + Stripe Link | Non-card/crypto |
| Email (transactional) | Resend / CF Email Service | Bulk → Listmonk |
| Email (marketing) | Listmonk on Coolify | Simple → Resend |
| Runtime | Bun | Node.js for incompatible |
| Package Manager | pnpm | Legacy npm |
| Linting (TS) | ESLint + Prettier | Never Biome |
| Linting (Python) | Ruff + mypy | Never black+isort separately |
| Testing | Playwright v1.59+ + Vitest | Never Jest/Cypress |
| Analytics | GA4 via GTM + PostHog | Privacy-first → PostHog only |
| Errors | Sentry | PostHog errors sufficient |
| Validation | Zod | — |
| Search | AI Search (fka AutoRAG) + Vectorize | Simple → D1 LIKE |
| Queues | CF Queues | — |
| Realtime | Durable Objects + WebSocket (32MiB msg) | Simple polling |
| Scheduling | CF Cron Triggers (250 paid) | — |
| AI/ML | Workers AI (Unweight 22% compression) | Specific model → OpenAI/Anthropic via AI Gateway |
| Workflows | Inngest / CF Workflows v2 | Simple cron → Cron Triggers |
| AI Agents | CF Agents SDK (Project Think on DO) | No agent needed |
| Agent Memory | CF Agent Memory (managed) | Custom → DO+SQLite |
| Sandboxes | CF Sandboxes (GA) | Simple → Dynamic Workers |
| Containers | CF Containers (GA) | Simple → Workers |
| Feature Flags | Flagship (sub-ms eval) | PostHog flags sufficient |
| IaC | cf CLI (3000 ops) + wrangler.jsonc | Multi-cloud → Pulumi |
| CI/CD | Workers Builds / GitHub Actions | Complex → GH Actions |
Key reasoning: Hono over NestJS (native CF Workers, 12KB). Angular over React (Brian's background, signals stable). Neon over Supabase (multi-DB, lower cost). Drizzle over Prisma (5KB vs 40KB, edge-native, passed Prisma in downloads). ESLint over Biome (angular-eslint, typescript-eslint, massive plugin library).
CF-Only Assumption (DEFAULT)
Every feature MUST try CF-native first. Never reach for external services when CF has an equivalent. Template: megabytespace/saas-starter has stubs for all CF primitives. AI→Workers AI (not OpenAI). Cache→KV/Cache API (not Redis). DB→D1 (not Postgres). Storage→R2 (not S3). Queue→CF Queues (not SQS). Realtime→DO+WebSocket (not Pusher). Schedule→Cron Triggers (not external cron). Search→AI Search+Vectorize (not Algolia). Email→CF Email Service (not SES). Feature flags→Flagship (not LaunchDarkly). Sandbox→CF Sandboxes (not Docker). Only escape to external when CF primitive insufficient (complex joins→Neon, specific model→OpenAI/Anthropic via AI Gateway).
CF Platform Decision Trees
Run code: Static→Workers Static Assets. API→Workers(Hono). Long-running→Workers+Queues/Workflows v2. Stateful→DO. Container workload→CF Containers(GA). Scheduled→Cron Triggers. Browser→Browser Run(Live View+HitL). Sandboxed exec→Dynamic Workers(100x faster than containers). Full isolation→CF Sandboxes(GA, persistent shell+fs).
Store data: Config→KV. Relational simple→D1(global read replication, 1TB). Relational complex→Neon. Files→R2. Session→DO/KV. Search→AI Search(hybrid retrieval). Vectors→Vectorize. Messages→Queues. Cache→KV(CACHE binding, TTL). Versioned objects→Artifacts(git-compatible). Agent state→Agent Memory(managed).
Security: Bots→Turnstile. DDoS→always-on free. WAF→CF WAF. Auth→Clerk. Agent auth→Managed OAuth(RFC 9728). Rate limit→KV counters. Secrets→wrangler secret put. Admin→CF Access. Private networking→CF Mesh.
Feature management: Flags→Flagship(sub-ms eval). Rollout→percentage+cohort+property. Kill switch→instant disable.
Architecture Patterns
Marketing Site: Worker(Hono) → Static Assets + R2 images + KV config + GA4+GTM + Turnstile + Resend
SaaS App: Workers Static Assets(Angular 21+Ionic) → Workers API(Hono) → D1(global replicas)/Neon + R2 + KV + Queues + DO + Clerk + Stripe + Resend + Listmonk + Flagship + PostHog+Sentry+GA4 + Playwright+Vitest
API Service: Worker(Hono) → D1/Neon + KV(rate limit/cache) + R2 + Queues + Workers AI + Sentry + PostHog
AI Agent Service: Worker(Hono) → Agents SDK(Project Think) + Agent Memory + Dynamic Workers + Browser Run + AI Search + DO(stateful sessions)
Service Boundaries
Start monolith. Split when: different scaling needs, different deploy cadence, Worker size exceeded (10MB compressed paid), isolation required. Angular frontend = separate Worker. Webhook handlers = separate. Cron = shared via scheduled handler. Service bindings for zero-cost Worker-to-Worker RPC.
Auth: Clerk
User → Clerk widget → JWT → Worker middleware verifies → proceed. Metadata in D1 (Clerk ID as FK). Roles in D1, not Clerk metadata. Not needed for: public marketing, OSS docs, public APIs with rate limiting only.
Data: Drizzle ORM v1.0
Schema in TypeScript, type-safe queries, auto migrations. RQBv2 (363 commits, 9K+ tests). 10x faster introspection. D1 conventions: id=TEXT(ULID), created_at/updated_at=TEXT(ISO8601), deleted_at=TEXT(soft delete), explicit FKs, indexes on FKs+frequent columns. D1 batch API for transactions (no BEGIN support).
Neon when D1 isn't enough: >3 table joins, full-text search, jsonb, complex aggregations, RLS, >1TB. D1 global read replication eliminates most Neon arguments for read-heavy apps.
API Keys
All keys: project .env.local or get-secret KEY (chezmoi+age encrypted)
GCP: ~/.config/emdash/gcp-service-account.json
CF: get-secret CLOUDFLARE_EMAIL / get-secret CLOUDFLARE_API_TOKEN / get-secret CLOUDFLARE_ACCOUNT_ID
| Service | Env Var | Free Tier | |---------|---------|-----------|| | Cloudflare | CLOUDFLARE_API_TOKEN | Yes | | Stripe | STRIPE_API_KEY | Test free | | Resend | RESEND_API_KEY | 100/day | | PostHog | POSTHOG_API_KEY | 1M events/mo | | Sentry | SENTRY_AUTH_TOKEN | 5K errors/mo | | OpenAI | OPENAI_API_KEY | Pay-per-use | | Anthropic | ANTHROPIC_API_KEY | Pay-per-use | | Ideogram | IDEOGRAM_API_KEY | Pay-per-use | | Unsplash | UNSPLASH_ACCESS_KEY | 50 req/hr | | Pexels | PEXELS_API_KEY | 200 req/hr | | GA4 | GCP service account | Free | | Clerk | CLERK_SECRET_KEY | 10K MAU |
Reliability
Error handler: app.onError() → log + Sentry + JSON envelope. Retry: idempotent 3x exponential backoff, non-idempotent no retry. Health: GET /health (version+timestamp), /health/db, /health/services. D1 Time Travel: 30-day PIT recovery (paid), 7-day (free). D1→R2 daily backup workflow for 90+ day retention.
CF Infrastructure
Zone (megabyte.space): get-secret CLOUDFLARE_ZONE_ID. Deploy+purge always together (see CONVENTIONS.md).
| Product | Free Limit | Paid Limit |
|---|---|---|
| Workers | 100K req/day, 10ms CPU | Unlimited, 5min CPU |
| Static Assets | 20K files/version | 100K files/version |
| D1 | 5M rows read, 5GB | 25B rows, 1TB |
| R2 | 10GB, 10M req/mo | Zero egress |
| KV | 100K reads/day | 10M reads/day |
| Queues | 1M msg/mo | Pay-per-use |
| DO | 100K req/day | Pay-per-use |
| Vectorize | 5M vectors | Pay-per-use |
| Workers AI | 10K neurons/day | Pay-per-use |
| WebSocket msg | 32 MiB | 32 MiB |
| Worker size | 3MB compressed | 10MB compressed |
| Cron Triggers | 5 | 250 |
| Containers | — | GA (DO-based) |
Security headers, Turnstile, rate limiting, DNS management, wrangler.jsonc template — see CONVENTIONS.md.
AI Agent Patterns (CF Agents SDK + Project Think, April 2026)
Think class on DO: addressable entity with SQLite, zero compute when hibernated. Durable execution via Fibers (survives crashes). Dynamic Workers for sandboxed V8 isolates (100x faster, 100x more memory-efficient than containers). Execution ladder: Workspace → Dynamic Worker → npm resolution → headless browser → CF Sandbox(GA). Sub-agent coordination via Facets (colocated, typed RPC).
Agent Memory: managed persistent memory service — recall what matters, forget what doesn't. Browser Run: enhanced browser rendering with Live View, Human-in-the-Loop, CDP access, 4x concurrency. CF Email Service (public beta): native send/receive/process from agents. Managed OAuth: RFC 9728 agent authentication. CF Mesh: secure private networking for agents+Workers with scoped DB/API access. AI Search: dynamic instances with hybrid retrieval + relevance boosting (fka AutoRAG).
Code Mode MCP: 2 tools + <1K tokens (81% reduction vs traditional MCP). cf CLI: unified CLI covering ~3000 API operations.
Traffic reality: agentic actors = ~10% CF network (up 60% YoY). Design every API for human+agent consumers.
리뷰
아직 리뷰가 없습니다. 사용해 본 소감을 남겨 주세요.
댓글
로그인 없이 쓸 수 있습니다. 사용 후기, 질문, 작동하지 않은 환경 등을 편하게 남겨 주세요.
아직 댓글이 없습니다. 첫 댓글을 남겨 보세요.
같은 저장소의 스킬
Guides the creation of agile user stories and Gherkin feature files. Use when the user wants to create a user story, write acceptance criteria, define Gherkin scenarios, or author BDD feature files. This should trigger for requests such as Create a user story; Write a user story; I need to write a user story. Part of cursor-rules-java project
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
aibot88/sec_skill_store52026년 5월 27일 업데이트
Facilitates conversational discovery to create Architectural Decision Records (ADRs) for non-functional requirements using the ISO/IEC 25010:2023 quality model. Use when the user wants to document quality attributes, NFR decisions, security/performance/scalability architecture, or design systems with measurable quality criteria. This should trigger for requests such as Create ADR for Non-functional requirements; Document Non-functional requirements; Capture Non-functional requirements; Generate Non-functional requirements in an ADR. Part of cursor-rules-java project
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
aibot88/sec_skill_store52026년 5월 27일 업데이트
Run a health check on an existing project: dependency audit, security scan, test runner detection, CI/CD evaluation, and missing configuration analysis. Maps the three execution gates (pre/in/post) from /10x-bootstrapper to an assessment framework for existing codebases. Reads optional context/foundation/stack-assessment.md from /10x-stack-assess to focus checks on identified gaps. Writes context/foundation/health-check.md with findings, prioritized fixes, and an agent-readiness verdict. Use when the user has an existing project and wants to verify its health before working with an agent. Trigger phrases: "health check", "check my project", "audit my project", "is my project healthy", "sprawdź projekt", "audyt projektu", "health-check", "project health". Use AFTER /10x-stack-assess (brownfield chain), BEFORE agent onboarding (m1-l4).
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
aibot88/sec_skill_store52026년 5월 27일 업데이트
10x-team
무료You MUST use this when building projects end-to-end. Orchestrates all 12 team roles — automatically switches between CTO, architect, PM, engineers, SRE, security, DBA, QA, and EM based on the current phase of work. Starts with brainstorming before any implementation.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
aibot88/sec_skill_store52026년 5월 27일 업데이트
Use when you need to add or configure Maven plugins in your pom.xml — including quality tools (enforcer, surefire, failsafe, jacoco, pitest, spotbugs, pmd), security scanning (OWASP), code formatting (Spotless), version management, container image build (Jib), build information tracking, and benchmarking (JMH) — through a consultative, modular step-by-step approach that only adds what you actually need. This should trigger for requests such as Add Maven plugins in pom.xml; Improve Maven plugins in pom.xml. Part of cursor-rules-java project
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
aibot88/sec_skill_store52026년 5월 27일 업데이트