菜单
Apply djb's trusted-code minimization when adding features, dependencies, APIs, or config options to wings. Use when designing new packages, public APIs, build steps, or when reviewing a diff that grows the codebase.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
Use WINGS's built-in widgets instead of hand-rolling them — button (w-button), text input (w-input), rich-text editor (w-text), tabbed containers (w-tabs/w-tabbutton/w-tab), dialogs (w-dialog), multi-select combobox (w-combobox), record navbar (w-navbar), and the skin picker (skin-switcher). Use when an app needs any of these controls.
Security peculiarities of Go-to-WASM in the browser, for apps you build with WINGS — the syscall/js trust boundary, panic = whole-app death, the innerHTML/XSS invariant, secrets in browser memory, single-thread concurrency, GOOS=js tooling gaps. Use when writing or reviewing any component (GOOS=js code), DOM interop via syscall/js, fetch, or browser-delivered features in your app.
Write a WINGS component (custom element in Go→WASM) — module file trio, wings.Register, the PranaMod lifecycle (InitData/Render), template binding syntax ({{expr}}, ?cond, *arr/**arr, &attr, @event), and parent-child events. Use when creating or editing a WINGS module, template, custom element, PranaMod, or any template binding.
Internationalize a WINGS app — author plain text that the gen_i18n build step extracts into per-language catalogs, runtime lookup via wi18n, translatable attributes, opting out, plurals/gender flexion ({{@g %n ~word}}), locale-aware formatting ({{%price}}), and runtime locale switching (SetLang). Use when adding translatable text, plurals/gender, number/currency/date formatting, or a language switcher.
Theme a WINGS app with --wings-* skin tokens — consume tokens in component CSS via var() with fallbacks, apply/compose built-in skins (ApplySkin), the ten disjoint skin categories and multi-skin composition, register your own skin, bundles (composed skins), and private categories. Use when styling components to be theme-aware, applying or composing skins, or building a theme.
Apollo AGC fail-operational design (priority shedding, bounded everything, restart protection, NASA Power of 10) applied to YOUR WINGS app — loops, goroutines, timers, fetch error paths, recovery. Use when writing component effects, background goroutines, polling/retry, or any code that must keep the app rendering when one part fails.
基于 SOC 职业分类
| name | sec-minimal-trusted-code |
| description | Apply djb's trusted-code minimization when adding features, dependencies, APIs, or config options to wings. Use when designing new packages, public APIs, build steps, or when reviewing a diff that grows the codebase. |
Source philosophy: D. J. Bernstein, "Some thoughts on security after ten years of qmail 1.0". Security holes are bugs; the bug rate scales with the amount of code that must be correct for security to hold. Three levers, in order of power:
gen_i18n does all
HTML/flex parsing at build time; the wasm runtime consumes pre-indexed JSON.
Keep parsing OUT of the runtime. Any feature that tempts you to parse rich
syntax inside the browser belongs in cmd/gen_i18n or cmd/build instead.wi18n.SetCatalogPublicKey (one call → all-or-nothing signature
enforcement), ApplySkin returning typed errors instead of panicking.
A new API should have no "insecure but convenient" mode.go mod graph), could 50 lines of our
own code do it? (See sec-supply-chain.)WINGS_* env var or wings.json
key doubles the test matrix. Prefer one good default over a knob.error instead of panicking
(input validation contract of this repo)?interface{}/js.Value and "figures it out" — that is
a parser in disguise; type it at the boundary.