“authorization”的搜索结果

Guideline for designing, implementing, and verifying secure APIs following OWASP API Security Top 10 (2023) best practices. Use when the user wants to: (1) review API code or design for security vulnerabilities, (2) design a secure REST, GraphQL, or gRPC API architecture, (3) implement API authentication and authorization (OAuth2, JWT, API keys, mTLS), (4) configure rate limiting, input validation, or CORS, (5) audit API endpoints for BOLA, BFLA, or mass assignment vulnerabilities, (6) create API security checklists or verification plans, (7) fix API security bugs or harden existing APIs, (8) set up API security testing (OWASP ZAP, Schemathesis, Burp Suite), or (9) handle any API security concern including SSRF prevention, resource consumption limits, business flow protection, API inventory management, and secure third-party API consumption.

中文简介正在准备中。当前显示原文说明。

Diagnoses Workload Identity Federation for GKE authentication failures for Pods (403 "iam.serviceAccounts.getAccessToken" / permission denied, "could not find default credentials", or GKE metadata server unreachable) by verifying cluster and node-pool Workload Identity configuration, the Kubernetes ServiceAccount (KSA) to IAM binding (direct principal binding and legacy Google ServiceAccount impersonation), target-resource IAM roles, and gke-metadata-server health. Use when a Pod cannot authenticate to Google Cloud APIs even though Workload Identity is expected to be in effect. Don't use for in-cluster Kubernetes RBAC errors (API-server authorization), general workload crashes (use gke-workload-troubleshooting), or Workload Identity setup and hardening (use gke-workload-security).

中文简介正在准备中。当前显示原文说明。

Plans, configures, and hardens platform-level Google Kubernetes Engine (GKE) cluster security. Covers cluster add-ons (Secret Manager enablement), RBAC hardening (disabling insecure bindings, audit tools), Binary Authorization, enabling Shielded Nodes, GKE Sandbox cluster enablement, GKE IAM roles, and cross-service authentication IAM patterns. Use when securing cluster control planes, hardening GKE RBAC, enabling Shielded Nodes, enabling GKE Sandbox runtime, enabling cluster-wide security add-ons, or managing GKE IAM roles. Don't use for workload-level security (Workload Identity, SecretProviderClass, PSS, NetPol, gVisor pod runtimeClassName; use gke-workload-security instead).

中文简介正在准备中。当前显示原文说明。

Audits, configures, and hardens workload-level security controls for Google Kubernetes Engine (GKE) applications and namespaces. Covers running cluster security audits (`audit_cluster.sh`), configuring Workload Identity Federation (impersonation, KSA/GSA binding, and pod setup), enforcing Network Policies (default-deny and Dataplane V2 logging), isolating high-risk pods inside GKE Sandbox (`gVisor`), enforcing Pod Security Standards (`restricted` labeling), and mounting Secret Manager secrets via CSI (`SecretProviderClass`). Use when auditing cluster security posture, isolating namespaces, applying pod security standards, setting up Workload Identity, or configuring network policies and secret volume mounts. Don't use for cluster-wide control plane security, RBAC hardening, Binary Authorization, Shielded Nodes, or enabling platform-level GKE add-ons (use gke-platform-security instead).

中文简介正在准备中。当前显示原文说明。

Implement and debug OAuth 2.0 DPoP (RFC 9449) refresh token sender-constraining for WebCrypto, Node.js ES6, and browser runtimes integrating with Google's OAuth platform. Use when configuring non-extractable asymmetric key pairs (P-256), generating DPoP Proof JWTs for authorization code exchange and token refresh, or handling 400 use_dpop_nonce challenge retry loops at oauth2.googleapis.com/token. Don't use for unconstrained OAuth 2.0 flows (where refresh tokens are not bound to a client key pair), or for Google Cloud IAM / service account authentication.

中文简介正在准备中。当前显示原文说明。

Spring Security 7 implementation for Spring Boot 4. Use when configuring authentication, authorization, OAuth2/JWT resource servers, method security, or CORS/CSRF. Covers the mandatory Lambda DSL migration, SecurityFilterChain patterns, @PreAuthorize, and password encoding. For testing secured endpoints, see spring-boot-testing skill.

中文简介正在准备中。当前显示原文说明。

Use when managing Connected Apps for integration purposes — configuring OAuth policies, IP restrictions, refresh token expiry, pre-authorization assignment via profile or permission set, and monitoring connected app usage via EventLogFile. Also covers the running-integration operations: revoking a grant, rotating the consumer key or secret, pairing the app to an integration user's permission set, and the periodic review. Trigger keywords: 'revoke OAuth token', 'DeleteToken', 'OauthToken query returns nothing', 'ipRelaxation ENFORCE', 'permissionSetName', 'PermissionSetAssignment ExpirationDate', 'LoginHistory Application', 'connected app quarterly review', 'rotate consumer secret'. NOT for choosing which OAuth grant flow to implement — use integration/oauth-flows-and-connected-apps. NOT for decoding a specific OAuth error such as invalid_grant — use admin/connected-app-troubleshooting. NOT for authoring the full connectedApp / External Client App / Named Credential file or choosing the auth artefact — use admin/connected-apps-and-auth.

中文简介正在准备中。当前显示原文说明。

Use when configuring or troubleshooting email deliverability for Marketing Cloud or Salesforce orgs: sender authentication (SPF, DKIM, DMARC), private sending domain setup, dedicated IP warm-up, list hygiene practices, and sender reputation monitoring. NOT for building a Marketing Cloud email — use admin/email-studio-administration. NOT for unsubscribe and consent — use admin/consent-management-marketing. Also covers the Salesforce Core deliverability surface: EmailAdministrationSettings, EmailAuthorizationSettings, EmailDomainKey (DKIM), EmailRelay, EmailDomainFilter, OrgWideEmailAddress verification, bounce management, and the 5,000-a-day outbound email cap.

中文简介正在准备中。当前显示原文说明。

Audit a rehabilitation scheduling system -- evaluate therapist productivity and utilization rates, PTA/COTA supervision compliance, patient flow and no-show management, equipment and treatment room allocation, insurance authorization tracking with expiration alerts.

中文简介正在准备中。当前显示原文说明。

Map a cloud system against NIST SP 800-53 Rev. 5 + FedRAMP baselines to produce the documentation an authorization needs — System Security Plan (SSP), Control Implementation Summary (CIS), Plan of Action and Milestones (POA&M), Continuous Monitoring (ConMon) Plan..

中文简介正在准备中。当前显示原文说明。

Drafts motions to use cash collateral under 11 U.S.C. § 363. Use when a debtor-in-possession needs court authorization to use cash collateral, typically as a first-day pleading.

中文简介正在准备中。当前显示原文说明。

Drafts a board resolution authorizing voluntary corporate dissolution via unanimous written consent of directors. Covers Plan of Complete Liquidation adoption, shareholder approval directive, officer authorizations, and execution provisions. Use when initiating voluntary dissolution, preparing corporate wind-down records, or drafting pre-shareholder dissolution authority under state corporation law.

中文简介正在准备中。当前显示原文说明。

Drafts U.S. corporate board resolutions authorizing bank account opening, signatory designation, transaction limits, and related banking documents with ratification, supersession, and secretary certification language. Use when preparing board resolutions, written consents, bank account opening packets, signatory authority letters, or banking authorization documents. Trigger keywords: bank account resolution, banking resolution, board consent, signatory authority, account opening, ACH, wire, signature card.

中文简介正在准备中。当前显示原文说明。

阿拉丁·AI短剧数字人肖像权合规工坊把「AI 演员/数字人/换脸/声音克隆做完却因肖像权没授权被投诉下架、数字人授权到期还在用、授权只买了一个平台却全网发、AI 形象神似明星惹官司、被举报时拿不出授权链举证」升级成一条纯本地零依赖的上架前置授权链自查工具链：多源导入(drama-cast 角色卡 _cast.json 双契约兼容/人物资产类型声明 assets.json/授权凭证登记 CSV 或 JSON/drama-publish 发行计划 _publish_plan.json 抽平台)→人物资产五分类(AI原创 ai_original/真人出演 real_actor/第三方数字人 digital_human/换脸 face_swap/声音克隆 voice_clone)逐类判定所需授权→10 条确定性授权链规则(A1缺授权凭证 A2要素缺失 A3已过期 A4即将到期 A5平台越界 A6用途越界 A7撞脸公众人物 A8声音克隆缺授权 A9转授瑕疵 A10平台报备缺失)→门禁评分(P0=25/P1=8/P2=3 扣分，100分制 A-D 档，READY可提审/REVIEW建议整改/BLOCK禁止上架)→自包含 HTML 授权链看板(门禁灯+逐条命中+整改建议)+Markdown 整改清单(可直接交制片执行)+feedback 回灌契约(缺证角色回灌 drama-cast 补授权、越界平台回灌 drama-publish 调发行、续签观察名单、报备提醒)。与 aladin-drama 系列闭环衔接(cast/publish 进，整改反馈回灌 cast 补授权、publish 调发行矩阵)。区别于内容合规工具只扫违禁词与画面红线：本款专管「人」的授权链(肖像权/声音权/数字人许可/换脸源授权)，确定性规则可复算、命中带人物名与整改方向、纯本地零依赖零API、授权信息不出本机(法务资产敏感)。触发词：短剧肖像权、数字人授权、换脸授权、声音克隆授权、AI演员合规、肖像授权到期、授权链自查、撞脸明星、数字人合规、AI形象报备、肖像权侵权、portrait rights、digital human license、face swap consent、voice clone authorization、AI短剧、阿拉丁短剧、短剧创作闭环。

中文简介正在准备中。当前显示原文说明。

Migrate API controller scope checks to framework-enforced authorization policies while preserving ownership checks.

中文简介正在准备中。当前显示原文说明。

Complete MCP engineering work on the live path: build or repair servers and Apps, debug stdio or Streamable HTTP, migrate protocol/SDK/transport versions, reconcile source with package and activated runtime, inspect capability/effect authorization, and verify named-host claims without promoting weaker evidence. Use for real Model Context Protocol implementation, review, migration, runtime, or host-integration tasks. Do not use for ordinary non-MCP APIs, generic frontend work, or incidental product copy.

中文简介正在准备中。当前显示原文说明。

Django security best practices, authentication, authorization, CSRF protection, SQL injection prevention, XSS prevention, and secure deployment configurations.

中文简介正在准备中。当前显示原文说明。

Design and configure Microsoft Entra app registrations for secure authentication and authorization. Use this skill when users need OAuth, OpenID Connect, API permissions, app roles, or multi-tenant identity. Covers auth flows, credentials, API permissions, consent models, and zero-trust patterns.

中文简介正在准备中。当前显示原文说明。

Cryptographic security for agentic systems — zero-trust agent networking, signed message envelopes (JWS/JWE), capability-based security (ocaps), Merkle tree audit trails, WASM sandboxing, and formal verification. Covers CLI dev tool security, mTLS between agents, permission boundaries (least privilege for AI agents), and supply chain security for skills/plugins. Activate on: "agent security", "zero trust agents", "secure agent communication", "capability-based security", "ocap", "signed messages between agents", "agent audit trail", "sandbox agent execution", "agent permissions", "mTLS agents", "cryptographic verification", "agent supply chain", "OWASP agentic", "prove agent did X", "tamper-proof agent logs". NOT for: application-level SAST scanning (use security-auditor), network firewall rules (use infrastructure), SOC2/HIPAA compliance (organizational), or prompt injection defense (use prompt-engineer).

中文简介正在准备中。当前显示原文说明。

方案到交付 Workflow：当用户显式调用 `$solution-to-delivery`，或明确要求运行“方案到交付”完整流程时使用。 把已确认产品方案转成经过独立 Review 的 PRD、适用的 UI/HTML/截图、版本拆分和 Product Delivery Package；当前 Agent Runtime 只做 Package 发布 dry-run，真实写入保持 authorization_required。

中文简介正在准备中。当前显示原文说明。

Perform comprehensive technical reviews of Ruby on Rails applications. Runs automated analysis tools (RubyCritic, Brakeman, bundler-audit, Gitleaks, Debride, linters, SimpleCov, Rails stats, Rails ERD), analyzes code for architecture, security, authorization (Pundit/CanCanCan), dead code, and design issues, and produces a structured markdown report with prioritized findings and a 0-10 score. Use when the user requests a tech review, code audit, project assessment, or quality analysis of a Rails application.

中文简介正在准备中。当前显示原文说明。

Expert guide for Backend.AI distributed computing platform. Automatically activates when users ask about: - Backend.AI architecture, components (Manager, Agent, Storage Proxy, Webserver, App Proxy) - Features (session scheduling, Sokovan orchestrator, multi-tenancy, resource allocation) - APIs (REST, GraphQL), authentication, RBAC authorization - Container runtime (kernels, jail sandbox, hook library, virtual folders) - Accelerator support (CUDA, ROCm, TPU, NPU, Graphcore IPU) - Client SDKs (Python, Java, JavaScript, PHP) - Setup, requirements (Python 3.13+, Docker, PostgreSQL, Redis, etcd) - How WebUI connects to/interacts with Backend.AI backend - Plugin interfaces, development setup, infrastructure Use when user mentions "Backend.AI", "backend.ai", "Sokovan", component names, or asks about the backend platform this WebUI connects to. allowed-tools: WebFetch, Read

中文简介正在准备中。当前显示原文说明。

Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.

中文简介正在准备中。当前显示原文说明。

Safely develop, verify, and document proof-of-concept exploits and payloads for authorized targets inside isolated Workspace Containers. Use when a Hypothesis is well-founded, target authorization covers scope, and each active step will carry a durable approval — for minimal PoCs, impact verification, or reproducible exploit Evidence.

中文简介正在准备中。当前显示原文说明。