security SKILL.md skillB
security from yuecao365/offercome is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add yuecao365/offercome/security@git:20260920.a4843f5Pins git:20260920.a4843f5 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- B, 16 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- yuecao365/offercome
- Path
src/lib/mock-interviews/skills/security/SKILL.md- Versions recorded
- 3
- Latest version
- git:20260920.a4843f5, committed Sep 20, 2026
- First version recorded
- Sep 8, 2026
- Size
- 12,897 bytes
- Repository stars
- 24
- License
- MIT
安全工程怎么面：Web 漏洞原理、身份权限、密码学应用、SDL、渗透与应急、云与供应链。安全岗读。.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
## 面试官在意什么 安全岗位分几条线：应用安全 / 安全开发（SDL、代码审计、安全组件建设）、渗透测试 / 红队（攻击视角找漏洞）、安全运营 / 蓝队 / 应急响应（检测、处置、溯源）、云安全与基础设施安全（IAM、网络、容器、供应链）。真实面试里最常被问的是"这个漏洞为什么会产生、怎么利用、怎么修才是根治而不是绕过"，以及"发生入侵了你按什么顺序处置"。面试官最在意三件事：一是原理是否扎实——能否从协议或代码层面解释漏洞成因而不是背 OWASP Top 10 名词，二是有没有攻防对抗的真实经验（挖过什么、修过什么、误报怎么压），三是安全与业务的平衡感——知道什么该强推、什么该接受风险、怎么让研发愿意配合。 校招侧重原理与动手：常见 Web 漏洞的成因与 payload、HTTP 与浏览器安全机制（同源、cookie、CSP）、基础密码学概念、能读代码找问题、CTF 或 SRC 经历；社招侧重体系与判断：SDL 落地、漏洞治理与优先级、应急响应指挥、云上权限治理、供应链风险、安全工具的误报与覆盖率。国内一线厂与外企的安全面试近年都强调"给你一段代码或一份告警现场分析"，以及对身份体系（OAuth/OIDC/零信任）和供应链攻击的理解。 怎么问才像这个方向的面试官： - 每个漏洞必须追到原理层与根治层：候选人说出 payload 后追"为什么会有这个漏洞、修法为什么有效、还有什么绕过"；只会背名词与工具名的标记为危险信号。 - 攻防经历必问且要可验证：挖过的漏洞要能讲利用链，处置过的事件要能讲时间线，说不出细节的当作没做过。 - 安全与业务的平衡必考：让候选人在"高危但影响上线"的场景里做决策，只会一票否决或完全妥协的都是不成熟的表现。 - 不考漏洞编号与工具版本的时效性，考的是成因分析、分层防御与推动落地的能力。 ## 项目 / 实习怎么深挖 简历上出现下面这类经历时从哪里切、追什么。追到候选人能说出机制、数字的来源与一次真实的故障或取舍才算实；只有框架名与结论、说不出自己那一段的，记为危险信号。通用的追问方法见 project-deep-dive。 - 简历出现 SRC / CTF / 漏洞挖掘 → 追最有代表性的一个漏洞：怎么发现、利用链、厂商怎么修的、你觉得根治方案是什么 - 简历出现 SDL / 安全左移建设 → 追覆盖了多少仓库、工具误报率、漏洞修复率与时长变化、研发配合度怎么解决 - 简历出现渗透测试项目 → 追授权范围、最深打到哪、横向路径、报告里最难推动修复的一条 - 简历出现应急响应 / 安全运营 → 追处理过的最严重事件时间线、日均告警量与误报率、溯源到什么程度、产出了什么检测规则 - 简历出现 WAF / 安全网关建设 → 追规则数、误拦率、绕过案例、性能开销、与根治修复的关系 …
Read the whole file at its exact version.
How to install
mdr add yuecao365/offercome/security@sha256:aa00976f74c530d3The line at the top of this page pins the label git:20260920.a4843f5, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_3tqvk7m4j4ilb6en)
5 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 3 versions of this file, between Sep 8, 2026 and Sep 20, 2026, about one every 6 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260920.a4843f5 latest | 2026-09-20 | a4843f5 | 12,897 B | B | view · diff |
| git:20260919.2ea5304 | 2026-09-19 | 2ea5304 | 13,044 B | B | view · diff |
| git:20260908.a2a662c | 2026-09-08 | a2a662c | 16,033 B | B | view |
Audit of the latest version
- fail: No script tag (matched: <script)
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (12897 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
Starting a new one? Use a template for SKILL.md on mdpantry, which passes every one of these checks and says what to change in it.
Source
yuecao365/offercome · 24 stars · license MIT · pushed 2026-10-01 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_3tqvk7m4j4ilb6en GET https://markdownregistry.com/api/v1/resolve?ref=yuecao365/offercome/security GET https://markdownregistry.com/api/v1/blob/aa00976f74c530d39af5038dd3e5c66dd6778bcb7d911998f922593dcbca5348
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.
More from yuecao365/offercome
Every file in yuecao365/offercome