القائمة
Skills في هذا المستودع
جمع SkillsMP عدد ٤٨٤ من skills من tomysh1337/openstarry-code. افتح أي skill لمراجعة مصدره وتفاصيله.
tomysh1337/openstarry-codeعرض ٤٠ من أصل ٤٨٤ skills مجمعة.
Authorized Azure Network Security Group (NSG) review for owned subscriptions: rule priority, Any/Any Allow, service tags, Application Security Groups (ASG), NSG flow logs, and effective security rules. Use when auditing Azure NSG inbound/outbound rules,…
لغة النص الأصلي: الإنجليزية
Backpressure for async/streaming: bounded buffers, pull flow control, drop/sample/shed, slow consumers. Use when backpressure, bounded channel, overflow, 背压, 反压, or producer outruns consumer. Complements bulkheads, circuit breakers, async concurrency, and…
لغة النص الأصلي: الإنجليزية
Design and implement MFA backup/recovery code generation, storage, display, redemption, and regeneration. Use when building or reviewing one-time backup codes, recovery codes, or offline second-factor fallbacks: entropy, hashing, single-use, rate limits,…
لغة النص الأصلي: الإنجليزية
Run and gate Bandit (PyCQA) on owned Python trees: config discovery, severity/confidence policy, excludes, JSON/SARIF outputs, CI fail-closed gates, and triage of B-rules into fixes or owned suppressions. Use when Bandit, bandit -r, pyproject.toml…
لغة النص الأصلي: الإنجليزية
Design and review Backend-for-Frontend (BFF) cookie sessions for SPAs: server-held tokens, HttpOnly session cookies, same-site edge layout, CSRF, and logout/revocation. Use when an SPA must avoid JS-readable access tokens, proxy OAuth/OIDC through a BFF, or…
لغة النص الأصلي: الإنجليزية
Use when you need to run a binary, trace execution, or observe runtime behavior. Runtime analysis via QEMU emulation, GDB debugging, and Frida hooking - syscall tracing (strace), breakpoints, memory inspection, function interception. Keywords - "run binary",…
لغة النص الأصلي: الإنجليزية
This skill should be used when analyzing binaries, executables, or bytecode to understand what they do or how they work. Triggers on "binary", "executable", "ELF", "what does this do", "reverse engineer", "disassemble", "decompile", "pyc file", "python…
لغة النص الأصلي: الإنجليزية
Use when analyzing binary structure, disassembling code, or decompiling functions. Deep static analysis via radare2 (r2) and Ghidra headless - function enumeration, cross-references (xrefs), decompilation, control flow graphs. Keywords - "disassemble",…
لغة النص الأصلي: الإنجليزية
Use when ready to document findings, generate a report, or summarize binary analysis results. Compiles analysis findings into structured reports - correlates facts from triage/static/dynamic phases, validates hypotheses, generates documentation with evidence…
لغة النص الأصلي: الإنجليزية
Use when reverse engineering tools are missing, not working, or need configuration. Installation guides for radare2 (r2), Ghidra, GDB, QEMU, Frida, binutils, and cross-compilation toolchains. Keywords - "install radare2", "setup ghidra", "r2 not found", "qemu…
لغة النص الأصلي: الإنجليزية
Use when first encountering an unknown binary, ELF file, executable, or firmware blob. Fast fingerprinting via rabin2 - architecture detection (ARM, x86, MIPS), ABI identification, dependency mapping, string extraction. Keywords - "what is this binary",…
لغة النص الأصلي: الإنجليزية
Design bot-management signal pipelines: signal taxonomy, collection points, risk scoring, action thresholds (allow / challenge / throttle / block), feedback loops, privacy, and false-positive controls. Use when bot score design, device or TLS fingerprints as…
لغة النص الأصلي: الإنجليزية
Run and triage Brakeman static analysis on Ruby on Rails apps you own: install/pin, repo config, confidence filters, JSON/SARIF reports, CI gates, ignore-file hygiene, and fix-then-rescan for SQLi, XSS, mass assignment, redirects, and related Rails sinks. Use…
لغة النص الأصلي: الإنجليزية
Configure and audit GitHub/GitLab branch protection: required status checks, block force-push and deletion, linear history, admin/owner enforcement, and CODEOWNERS-required reviews. Use when branch protection, protected branch, required checks, force-push…
لغة النص الأصلي: الإنجليزية
Use for authorized reverse engineering of browser extensions (Chrome/Firefox) including manifest analysis, background workers, and extension-based credential or traffic logic recovery.
لغة النص الأصلي: الصينية
Authorized browser extension security review: manifest permissions, content scripts, background/service workers, messaging, web_accessible_resources, update and store packaging risks. Use when assessing Chrome/Firefox/Edge extensions you own or are scoped to…
لغة النص الأصلي: الإنجليزية
End-to-end bug bounty workflow for authorized public or private programs only: program selection, scope discipline, recon handoff, testing prioritization, evidence quality, and professional reporting. Use when hunting on HackerOne, Bugcrowd, Intigriti,…
لغة النص الأصلي: الإنجليزية
Use when building, adapting, reviewing, or testing CDK/license-key activation and signed online updates in Windows desktop applications, especially Qt/QML, WPF/WinUI, or Electron projects.
لغة النص الأصلي: لغات متعددة
BuildKit secret and SSH mounts so build-time credentials never land in image layers, history, or ARG/ENV. Use when docker buildx --secret, RUN --mount=type=secret, type=ssh private git/npm/registry auth, Dockerfile secret mounts, or replacing ARG TOKEN / COPY…
لغة النص الأصلي: الإنجليزية
Isolate failure domains with bulkheads: separate pools, semaphores, queues, and resource budgets so one dependency or tenant cannot exhaust the process. Use when bulkhead, isolation, noisy neighbor, pool per dependency, 舱壁, 隔离舱, or cascading pool exhaustion.…
لغة النص الأصلي: الإنجليزية
Keep Bun installs reproducible: commit bun.lock (or migrate bun.lockb), frozen CI with bun ci / --frozen-lockfile, single package-manager story, workspace lock fidelity, and lock-diff review. Use when bun.lock, bun.lockb, bun install, bun ci, frozen-lockfile,…
لغة النص الأصلي: الإنجليزية
Design application and edge caches: key design, TTLs, invalidation, stampede protection, and consistency. Use when caching, cache invalidation, 缓存, Redis/Memcached, CDN cache keys, TTL, thundering herd, or cache-aside patterns. Not for web cache…
لغة النص الأصلي: الإنجليزية
Authorized CAPTCHA and bot-challenge control research: when challenges bind, client-trust gaps, reusable tokens, logic skips, accessibility/alternate paths, and rate-limit interplay. Use for labs, CTFs, and scoped assessments measuring control effectiveness —…
لغة النص الأصلي: الإنجليزية
Design and implement enterprise CAPTCHA / bot-challenge integration for owned applications: provider selection, sitekey and secret lifecycle, server-side token verification, action and hostname binding, score thresholds, fail-closed behavior, multi-client…
لغة النص الأصلي: الإنجليزية
Run and gate Rust dependency vulnerability checks with cargo-audit locally and in CI: RustSec advisory DB, Cargo.lock scans, JSON outputs, ignore policy, version pins, and actionable upgrade paths for owned crates. Use when cargo-audit, RustSec, RUSTSEC-*,…
لغة النص الأصلي: الإنجليزية
Design CDN/edge HTTP cache keys: scheme/host/path, Vary, cookie inclusion, query-string allowlists, unkeyed header poison defenses, and purge strategy. Use when configuring CloudFront/Fastly/Cloudflare/Akamai cache keys, Vary headers, qs whitelist, cookie…
لغة النص الأصلي: الإنجليزية
Authorized CDN/WAF bypass awareness: edge fingerprinting, origin exposure, alternate entrypoints, inspection gaps, cache/bot control boundaries, and residual-risk notes when CDN or WAF is the primary control. Use when reviewing whether…
لغة النص الأصلي: الإنجليزية
Kubernetes cert-manager basics for owned or authorized clusters: Issuer and ClusterIssuer design, ACME HTTP-01/DNS-01 challenges, Certificate CRDs, renewal and Secret delivery, and private CA issuers. Use when installing or reviewing cert-manager, debugging…
لغة النص الأصلي: الإنجليزية
Certificate Transparency (CT) logs and Signed Certificate Timestamps (SCTs) for authorized recon, mis-issuance detection, and TLS evidence. Use when querying CT logs for hostnames, verifying SCTs in certificates or TLS handshakes, monitoring org domains for…
لغة النص الأصلي: الإنجليزية
Maintain Keep a Changelog-style CHANGELOG entries and write user-facing release notes from commits, PRs, and version bumps. Use when changelog, release notes, 更新日志, CHANGELOG.md, GitHub/GitLab releases, version announcements, or mapping Conventional Commits…
لغة النص الأصلي: الإنجليزية
Plan authorized chaos and fault-injection experiments in lab or owned non-prod: hypothesis, blast radius, steady state, inject/observe/stop. Use when chaos engineering, 混沌工程, fault injection, GameDay, Litmus, Chaos Mesh, Gremlin, toxiproxy, or resilience…
لغة النص الأصلي: الإنجليزية
Design and review CI/CD pipelines for clear stages, secret hygiene, dependency and build caching, fail-fast feedback, and durable artifacts. Use when CI/CD, GitHub Actions, GitLab CI, pipeline, 持续集成, workflow YAML, deploy gates, OIDC to cloud, cache,…
لغة النص الأصلي: الإنجليزية
Design circuit breakers for dependency isolation: closed/open/half-open states, failure thresholds, probe recovery, and fallbacks. Use when circuit breaker, 熔断, bulkhead isolation, fail-fast dependency, open circuit, or cascading failure protection toward a…
لغة النص الأصلي: الإنجليزية
Defense-first clickjacking and frame-busting controls: X-Frame-Options, CSP frame-ancestors, SameSite cookie interaction, and authorized UI-redress validation. Use when hardening framable UI, reviewing anti-framing headers, replacing client-side…
لغة النص الأصلي: الإنجليزية
Advanced authorized clickjacking and UI redress: multi-step overlays, drag-drop and cursor-jack chains, SameSite/third-party cookie limits, nested-frame and CSP frame-ancestors bypasses, and high-impact framed actions. Use when basic framing checks are done…
لغة النص الأصلي: الإنجليزية
Cloud content audit bypass: output encoding, ZWSP insertion, Unicode homoglyph substitution, split delivery, code-block smuggling. Trigger: bypass audit, encode output, split deliver, cloud bypass, evade review, hide content.
لغة النص الأصلي: الإنجليزية
Use for authorized cloud, container, and Kubernetes security assessment including metadata SSRF, IAM misconfig, container escape paths, and cluster RBAC review.
لغة النص الأصلي: الصينية
Defend applications and workloads against SSRF that reaches cloud instance metadata (IMDS): block link-local targets, enforce IMDSv2/hop limits, harden URL fetchers, and reduce role blast radius. Use when hardening against 169.254.169.254,…
لغة النص الأصلي: الإنجليزية
Select the most specific installed skill for AWS, Azure, GCP, Kubernetes, containers, CI/CD, registries, networking, certificates, databases, observability, performance, and reliability. Use for cloud, Kubernetes, Docker, Terraform, deployment, DevOps, 云服务,…
لغة النص الأصلي: الإنجليزية
CloudFormation IAM guardrails for owned AWS accounts: roles and policies in templates, CAPABILITY_IAM / CAPABILITY_NAMED_IAM deploy gates, permissions boundaries, CloudFormation service roles, stack policies, and least-privilege policies. Use when hardening…
لغة النص الأصلي: الإنجليزية