菜单
Validate Nook hosted extension origins, identity, archives, redirects, injection exclusions, and isolated browser profiles before release.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | browser-extension-release-security |
| description | Validate Nook hosted extension origins, identity, archives, redirects, injection exclusions, and isolated browser profiles before release. |
Read and follow the canonical project skill at
.cortex/dynamic-skills/browser-extension-release-security.md.
Use when addressing human, Codex, or automated PR review comments in Nook. Inspect submitted reviews, inline review threads, and PR comments; build a checklist from actionable items; verify each finding; fix or explain it; validate, push, reply on GitHub, and resolve conversations only after the agent's targeted reply is visible. Never request or wait for external reviews or checks.
Default agent workflow for every coding task in this repository: fetch repo, branch from origin/main, implement, always host-apply task format (and the UI demo contract when UI paths change), commit and push/open the PR, then monitor applicable repository-owned PR checks on GitHub Actions (no required local task check / ci:pr); on failure fix from CI logs, format, and push again until Nook's PR checks are green, resolve every actionable comment already present without waiting for reviewers, then squash merge; afterward publish and analyze the PR statistics in a separate check-free stats-only PR. Always follow this pipeline for implementation work unless the user explicitly asks for a read-only or question-only answer.
Captures user-explained codebase lessons as durable project skills in the canonical .cortex/dynamic-skills registry and applies them to refactors. Use when the user invokes /dynamic-skill, asks to create or update dynamic skills, explains what is wrong with a recurring code pattern, or wants to refactor code using accumulated skill guidance.
Ship Nook PRs efficiently with preflight/readiness audits, format-then-push, GitHub Actions-only product validation, and repository-only event watching without waiting for external review.
Format locally with task format; run every product gate on GitHub Actions. Do not require local task check or ci:pr for merge.
Always host-apply task format and pass the UI demo contract before every Nook PR push. Use when committing, pushing, fixing CI format/demo failures, or when sealed-image Prettier/rustfmt lag would otherwise burn a Verify cycle.
