القائمة
Skills في هذا المستودع
جمع SkillsMP عدد ٤٨٤ من skills من tomysh1337/openstarry-code. افتح أي skill لمراجعة مصدره وتفاصيله.
tomysh1337/openstarry-codeعرض ٤٠ من أصل ٤٨٤ skills مجمعة.
Write and review Bash/POSIX shell scripts with safe defaults: set -euo pipefail where appropriate, correct quoting, array-safe iteration, ShellCheck-clean patterns, and predictable error handling. Use when shell script style, bash style, shellcheck, quoting…
لغة النص الأصلي: الإنجليزية
Configure and verify Git commit signing with GPG or SSH keys so hosts show a Verified badge and branch protection can require signed commits. Use when signed commits, commit signing, GPG sign, SSH signing key, git commit -S, Verified badge, required signed…
لغة النص الأصلي: الإنجليزية
Route tasks across installed and source-cached Codex skills, then delegate to one of nine bilingual domain routers before loading a concrete workflow. Use when several skills could match, the user asks which skill should handle a task, or a complex request…
لغة النص الأصلي: الإنجليزية
Inventory, refresh, audit, and selectively stage external Codex skill sources without bulk-registering them. Use when downloading skill repositories, updating skill-sources, checking provenance or duplicates, validating frontmatter and scripts, generating a…
لغة النص الأصلي: الإنجليزية
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.
لغة النص الأصلي: الإنجليزية
Design and harden SMS one-time password (OTP) risk controls: send/resend budgets, verify attempt limits, code entropy and TTL, purpose binding, and abuse-resistant UX. Use when login, signup, step-up, or recovery relies on SMS OTP and you need send-flood,…
لغة النص الأصلي: الإنجليزية
Install, authenticate, and run the Snyk CLI for open-source SCA, Snyk Code, container images, and IaC on owned repositories and CI. Use when snyk test, snyk code test, snyk container test, snyk iac test, snyk monitor, SNYK_TOKEN, .snyk policy, severity…
لغة النص الأصلي: الإنجليزية
Select the most specific installed skill for implementation, debugging, testing, code review, API/schema design, Git, packaging, language conventions, concurrency, and architecture. Use for coding, refactor, debug, unit tests, API design, Python, TypeScript,…
لغة النص الأصلي: الإنجليزية
Configure and enforce SonarQube / SonarCloud Quality Gates in CI: gate conditions (coverage, duplications, ratings, new-code issues), waitForQualityGate / CE task polling, PR decoration, and fail-closed merge or release when the gate is red. Use when…
لغة النص الأصلي: الإنجليزية
Authorized Spring Boot Actuator hardening: endpoint exposure, separate management port, Spring Security on /actuator, health details, and high-risk endpoints (env, heapdump, threaddump, loggers, shutdown, jolokia). Use when reviewing…
لغة النص الأصلي: الإنجليزية
Spring Security config checklist: SecurityFilterChain, CSRF, sessions, method security, CORS, password encoding, actuators, JWT resource server. Use when reviewing Spring Boot Security, permitAll mistakes, or hardening org-owned Java/Kotlin apps — authorized…
لغة النص الأصلي: الإنجليزية
Defend against SQL injection with parameterized queries and safe ORM patterns: bind values (never concatenate), allowlist ORDER BY/identifiers, avoid unsafe raw SQL APIs, and correct Sequelize/Prisma/SQLAlchemy/EF usage. Use when hardening data access,…
لغة النص الأصلي: الإنجليزية
Format and structure SQL for readability and safe evolution: consistent keyword casing, clear table/column naming, explicit joins, migration hygiene, and review-friendly diffs. Use when SQL style, SQL 规范, schema naming, migration readability, query…
لغة النص الأصلي: الإنجليزية
SSH key hygiene for org-owned hosts and workstations: modern key types, ssh-agent practices, authorized_keys review, permissions, rotation, and host-key trust. Use when hardening SSH keys, cleaning authorized_keys, agent-forwarding risk, or post-incident key…
لغة النص الأصلي: الإنجليزية
Authorized assessment of SSO single logout (SLO) and cross-app session propagation: IdP/SP logout, front- vs back-channel termination, RP-initiated logout, refresh-token and cookie invalidation, and residual sessions after “logout everywhere.” Use when SSO…
لغة النص الأصلي: الإنجليزية
Design SSRF defenses for server-side URL fetchers: hostname allowlists, scheme allowlists, metadata and private-IP blocks, DNS-rebinding-safe resolve-then- connect checks, and URL parser pitfalls. Use when hardening webhooks, previews, importers, unfurl,…
لغة النص الأصلي: الإنجليزية
Systematic SSRF filter and URL-parser bypass catalog for authorized assessments: IP encoding, DNS/TOCTOU, redirect and scheme tricks, allowlist confusion, and cloud metadata edge cases. Use when a server-side fetch is confirmed but deny-lists, allowlists, or…
لغة النص الأصلي: الإنجليزية
Choose and structure application state: client UI state vs server/cache state, and when to use React Context, Zustand, Redux, or URL state. Use when state management, Redux, Zustand, React Query, server state, client state, 状态管理, 全局状态, or when deciding where…
لغة النص الأصلي: الإنجليزية
Design content-hashed static asset filenames, long-lived Cache-Control immutable headers, atomic deploy order, and safe HTML/manifest updates so browsers never pair new markup with missing or stale bundles. Use when bundler content hashes, fingerprinted…
لغة النص الأصلي: الإنجليزية
Guided statistical analysis for research data - test selection, assumption checking, effect sizes, power analysis, Bayesian alternatives, and APA-formatted reporting. Use whenever a user wants to compare groups, test a hypothesis, analyze experimental or…
لغة النص الأصلي: الإنجليزية
Design and authorized assessment of step-up (re-authentication) patterns: sensitive-action challenges, short-lived elevation claims, binding to purpose and session, and server-side enforcement. Use when password change, payments, MFA disable, OAuth grants,…
لغة النص الأصلي: الإنجليزية
Authorized malware sample strings and IOC triage: extract ASCII/UTF-16 strings, classify URLs/IPs/paths/mutexes/registry keys, score confidence, and export a minimal IOC set for IR/YARA handoff. Use when doing first-pass static clues on PE/ELF/dumps/scripts —…
لغة النص الأصلي: الإنجليزية
Assess and implement Subresource Integrity (SRI) for script and link tags: sha384 digests, crossorigin, CDN trust, hash rotation, integrity mismatches, and service-worker edge cases. Use when reviewing third-party CDN scripts, missing integrity attributes,…
لغة النص الأصلي: الإنجليزية
Brief Svelte/SvelteKit security notes: {@html} sinks, CSP, SSR XSS, client store secret hygiene, and hooks.server auth patterns. Use when reviewing or hardening SvelteKit apps, {@html} rich text, handle/hooks session guards, PUBLIC_ env leakage, or Svelte SSR…
لغة النص الأصلي: الإنجليزية
Harden SVG handling against XSS and related active-content risks: script, event handlers, foreignObject, animation/set attributes, javascript:/data: URLs, external resource loads, and unsafe serve headers. Use when apps accept, sanitize, inline, or serve…
لغة النص الأصلي: الإنجليزية
Generate Software Bills of Materials with Anchore Syft from source trees, container images, archives, and OCI digests: output formats (CycloneDX, SPDX, Syft JSON), scope and cataloger selection, reproducible CI-equivalent scans, and named hashed artifacts.…
لغة النص الأصلي: الإنجليزية
Reverse tabnabbing and window.opener hardening for target=_blank links and window.open popups: rel=noopener noreferrer, Cross-Origin-Opener-Policy, and audits of user-generated or untrusted outbound links. Use when pages open third-party or UGC URLs in new…
لغة النص الأصلي: الإنجليزية
Harden Tekton Pipelines on owned or authorized clusters: Task/Pipeline definitions, PipelineRun isolation, ServiceAccount RBAC, workspace and secret mounts, step image trust, Triggers EventListeners, and Chains provenance. Use when reviewing Tekton YAML,…
لغة النص الأصلي: الإنجليزية
Pin Terraform/OpenTofu providers for reproducible init and plan: required_providers version constraints, .terraform.lock.hcl, terraform providers lock, registry source addresses, and CI lock-aware init. Use when provider versions float, lockfile is missing or…
لغة النص الأصلي: الإنجليزية
Terraform security basics for authorized/org-owned infra: remote state and secrets hygiene, IAM least privilege, public S3 and open security groups, provider credential patterns, and safe plan/apply. Use when Terraform security, tfstate secrets, public…
لغة النص الأصلي: الإنجليزية
Configure and review Terraform/OpenTofu remote state locking and encryption: S3 + DynamoDB (or native S3 lock), azurerm, and gcs backends; force-unlock risks; who may unlock; and least-privilege lock/state IAM. Use when state lock, DynamoDB lock table,…
لغة النص الأصلي: الإنجليزية
Use for authorized security testing of desktop thick clients including local storage, update channels, IPC, traffic, and client-side trust boundaries.
لغة النص الأصلي: الصينية
Use for blue-team threat hunting, detection engineering with Sigma/YARA, SIEM query design, and incident detection validation.
لغة النص الأصلي: الصينية
STRIDE threat modeling workshop workflow for authorized product and system reviews: scope and DFDs, per-element STRIDE analysis, risk ranking, mitigations, and living model updates. Use when threat model, STRIDE, 威胁建模, DFD, attack surface workshop, security…
لغة النص الأصلي: الإنجليزية
Own the TLS certificate lifecycle for systems you control: key generation, CSR, issuance (public CA, private CA, ACME), chain assembly, deployment, renewal, revocation, inventory, and expiry monitoring. Use when designing or reviewing cert…
لغة النص الأصلي: الإنجليزية
Select and validate the least invasive method for obtaining TLS plaintext from owned or explicitly authorized applications. Use when proxy capture is empty, certificate trust fails, SSL pinning is suspected, the app uses native BoringSSL/OpenSSL, mTLS is…
لغة النص الأصلي: الإنجليزية
Award-winning web design framework inspired by elite agencies (Locomotive, Studio Freight, AREA 17). Use when you need to: (1) build premium portfolio sites and brand websites, (2) create immersive web experiences with custom animations, (3) implement…
لغة النص الأصلي: الإنجليزية
Implement and harden RFC 6238 TOTP multi-factor authentication: secret generation, otpauth enrollment, verify windows, attempt limits, backup codes, and session elevation. Use when building or reviewing authenticator-app 2FA (enroll QR, verify code,…
لغة النص الأصلي: الإنجليزية
Design and review Traefik security middlewares: Headers (HSTS/CSP/XFO), IPAllowList, BasicAuth/DigestAuth/ForwardAuth, RateLimit, InFlightReq, RedirectScheme, CORS, and middleware chains on routers/services. Use when hardening Traefik static/dynamic config or…
لغة النص الأصلي: الإنجليزية
Wire Trivy container image scans into CI with severity exit gates, ignore policy, DB freshness, and SARIF upload to code scanning. Use when Trivy image CI, trivy image --severity, --exit-code, SARIF upload, GitHub code scanning container CVE gate,…
لغة النص الأصلي: الإنجليزية