sa-token-dev SKILL.md skillA
This file is byte-identical to the first copy the registry indexed. Same content hash, so the same checks give both the same grade.
sa-token-dev from baixuanzhu/skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add baixuanzhu/skills/sa-token-dev@v3.0.0Pins v3.0.0 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- baixuanzhu/skills
- Path
skills/sa-token-dev/SKILL.md- Versions recorded
- 5
- Latest version
- v3.0.0, committed Oct 28, 2026
- First version recorded
- Aug 21, 2026
- Size
- 10,077 bytes
- Repository stars
- 3
- License
- MIT
Sa-Token（cn.dev33）Java 权限认证框架开发助手。 在 Java / Spring Boot 项目中开发任何登录、注册、登出、认证、鉴权、权限、角色、token、 会话管理、接口保护、路由拦截、SSO 单点登录、OAuth2.0、JWT、踢人下线、账号封禁、记住我、 二级认证、多账号体系、微服务网关鉴权相关功能时使用本技能——无论用户是否提到 Sa-Token （login / logout / authentication / authorization / permission / role / session / JWT / SSO / access control）。 项目依赖已含 sa-token（sa-token-spring-boot*-starter 系列，覆盖 SpringBoot 2/3/4 与 WebFlux 响应式变体）或代码出现 StpUtil / StpInterface / @SaCheckLogin / @SaCheckPermission / @SaCheckRole / SaInterceptor / SaRouter /…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Sa-Token 开发助手 面向 Java 项目的 Sa-Token 认证开发。推荐 **1.46.0+**（最新稳定版），1.40.x 及以上适用。 本技能只做三件事：**把认证决策定下来落盘、把会绿的陷阱指出来、写完实测鉴权真的生效**。 API 写法模型自己会，不教——实测 4 组裸模型在注解拦截器注册、StpInterface、token 返回、 踢人场景值上零失误，这些不再占篇幅。 ## 第 0 步：依赖探测与激活分支 任务涉及登录、认证、鉴权、权限、token、会话、SSO、OAuth2 等编码——**即使用户没提 Sa-Token**——先搜 `pom.xml` / `build.gradle`： | 探测结果 | 动作 | |---|---| | 依赖含 `sa-token-*` | 激活本技能，走下方流程 | | 无 sa-token，也无 Spring Security / Shiro | **询问**用户是否引入 Sa-Token；同意 → 按 `references/01-decisions.md` §0 引入后继续；拒绝 → 退出 | | 已使用 Spring Security / Shiro | 告知不适用并退出，**不建议迁移** | ## 关键决策检查点 以下 6 个场景存在多条路线，**不可擅自替用户选择**；确认过的结果**落盘**（见「项目播种」），不再重复问。 1. 写任何代码前逐字扫描用户消息与上下文是否命中下表「触发信号」。 2. 命中 → 先出**选择题**（候选 + 标注推荐 + 一句话理由），禁止开放式提问。 3. 用户未回答 → 按「默认推荐」推进，并在输出开头标注「未确认，已使用默认方案 X」。**不阻塞**。 4. 一个需求命中多个 → 一次性列出全部问题。 5. 决策结果写入 `.claude/rules/sa-token.md`；下个会话先读它，读到就遵守，不重新提议。 | # | 触发信号（逐字关键词） | 必须确认的问题 | 方案差异（一句话） | 默认推荐 | |---|---------|-------------|---------|----------------------| …
Read the whole file at its exact version.
How to install
mdr add baixuanzhu/skills/sa-token-dev@sha256:74cc0c599e3323b0The line at the top of this page pins the label v3.0.0, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_bmoslyqlsfk3phy7)
2 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 5 versions of this file, between Aug 21, 2026 and Oct 28, 2026, about one every 17 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| v3.0.0 latest | 2026-10-28 | b93d5fd | 10,077 B | A | view · diff |
| v2.3.0 | 2026-08-26 | 34205a5 | 13,820 B | A | view · diff |
| v2.2.0 | 2026-08-21 | 41209da | 16,610 B | A | view · diff |
| v2.2.0 | 2026-08-21 | 549751d | 16,542 B | A | view · diff |
| v2.2.0 | 2026-08-21 | 4a24d76 | 16,574 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (10077 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
baixuanzhu/skills · 3 stars · license MIT · pushed 2026-11-03 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_bmoslyqlsfk3phy7 GET https://markdownregistry.com/api/v1/resolve?ref=baixuanzhu/skills/sa-token-dev GET https://markdownregistry.com/api/v1/blob/74cc0c599e3323b04eb8b540cb0a867be616662f7c065c8df1aedca5bc7fe230
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.
More from baixuanzhu/skills
Every file in baixuanzhu/skills