菜单
Dependency and artifact integrity for wings — adding/updating Go modules, auditing transitive deps, govulncheck, reproducible builds, SRI, catalog signing, Docker base images. Use whenever go.mod/go.sum changes, a release is prepared, or fetched/served artifacts are touched.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use WINGS's built-in widgets instead of hand-rolling them — button (w-button), text input (w-input), rich-text editor (w-text), tabbed containers (w-tabs/w-tabbutton/w-tab), dialogs (w-dialog), multi-select combobox (w-combobox), record navbar (w-navbar), and the skin picker (skin-switcher). Use when an app needs any of these controls.
Security peculiarities of Go-to-WASM in the browser, for apps you build with WINGS — the syscall/js trust boundary, panic = whole-app death, the innerHTML/XSS invariant, secrets in browser memory, single-thread concurrency, GOOS=js tooling gaps. Use when writing or reviewing any component (GOOS=js code), DOM interop via syscall/js, fetch, or browser-delivered features in your app.
Write a WINGS component (custom element in Go→WASM) — module file trio, wings.Register, the PranaMod lifecycle (InitData/Render), template binding syntax ({{expr}}, ?cond, *arr/**arr, &attr, @event), and parent-child events. Use when creating or editing a WINGS module, template, custom element, PranaMod, or any template binding.
Internationalize a WINGS app — author plain text that the gen_i18n build step extracts into per-language catalogs, runtime lookup via wi18n, translatable attributes, opting out, plurals/gender flexion ({{@g %n ~word}}), locale-aware formatting ({{%price}}), and runtime locale switching (SetLang). Use when adding translatable text, plurals/gender, number/currency/date formatting, or a language switcher.
Theme a WINGS app with --wings-* skin tokens — consume tokens in component CSS via var() with fallbacks, apply/compose built-in skins (ApplySkin), the ten disjoint skin categories and multi-skin composition, register your own skin, bundles (composed skins), and private categories. Use when styling components to be theme-aware, applying or composing skins, or building a theme.
Apollo AGC fail-operational design (priority shedding, bounded everything, restart protection, NASA Power of 10) applied to YOUR WINGS app — loops, goroutines, timers, fetch error paths, recovery. Use when writing component effects, background goroutines, polling/retry, or any code that must keep the app rendering when one part fails.
| name | sec-supply-chain |
| description | Dependency and artifact integrity for wings — adding/updating Go modules, auditing transitive deps, govulncheck, reproducible builds, SRI, catalog signing, Docker base images. Use whenever go.mod/go.sum changes, a release is prepared, or fetched/served artifacts are touched. |
Neither djb nor Apollo had go.mod — but the philosophy transfers directly:
a dependency is trusted code you didn't write and don't review on update.
This skill covers the gap.
go mod graph | grep <dep> for what it drags in, maintenance pulse,
whether we need 1% of its API.go mod tidy && go mod graph and skim what appeared. go mod why -m X
answers "who brought this". Indirect modules you can't explain are a
finding.GOFLAGS=-mod=mod in
CI, GONOSUMCHECK, GONOSUMDB, GOPRIVATE wildcards). Builds should run
-mod=readonly (Go's default) so a build never silently rewrites deps.go run ./cmd/build vulncheck before each
release. It runs govulncheck over every module in the repo, twice each: a
native call-graph pass (low noise) and a GOOS=js imports pass — js-only
packages are excluded from the native pass by build constraints, so without
the second pass the wasm side would never be scanned. Any finding fails the
run; fix or explicitly triage before tagging. Implementation:
cmd/build/vulncheck.go.go install pkg@vX.Y.Z (the Dockerfile already
pins via WINGS_VERSION) — never @latest in anything reproducible.
Toolchain updates are deliberate, reviewed events (see
project_crypto_update_decision: no auto-upgrade magic in builds).cmd/build parity
(re-running leaves git status docs/ dist/ empty, byte-identical wasm) is
effectively a reproducibility check — treat a parity break as a security
signal, not an annoyance. Don't add timestamps/nondeterminism to outputs.<script> we emit (prana_helper.js, wasm_exec.js):
maintained by the build, idempotent. New scripts in served HTML must get
integrity= the same way.SetCatalogPublicKey, a missing/invalid .sig is a refusal.
Backlog: extend enforcement to inflections.json/fmt.json (rule: an
optional file that exists must verify; its absence is fine). Any NEW
runtime-fetched artifact must join this scheme from day one.retract in
go.mod (done for v0.16.3/0.16.4-alpha) — don't delete tags.WINGS_DICT_LANGS is a build
ARG by design); never bake private keys into images — the live-demo embeds
only the public key, the private key + passphrase are demo-only dogfood.go mod tidy clean; no unexplained new indirect modulesgovulncheck ./... (native + js imports mode) clean or triagedgo run ./cmd/build all, git status empty