tomysh1337/openstarry-code - الصفحة ٣

code-audit

Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.

لغة النص الأصلي: الصينية

code-quality-standards

Apply repository-aligned coding standards while adding features, fixing bugs, refactoring, or reviewing implementation changes. Use when writing or modifying production code and the task needs maintainability, clear boundaries, type and data-model discipline,…

لغة النص الأصلي: الإنجليزية

code-review-comments-style

Write clear, kind, actionable code review comments with appropriate severity, and decide request-changes vs nit vs approve. Use when code review comments, PR review feedback, 评审意见写法, review tone, blocking vs non-blocking notes, or drafting GitHub/GitLab…

لغة النص الأصلي: الإنجليزية

code-task

PREFERRED way to change code in a REAL repository: fix a GitHub issue, fix a bug, add/implement a function or feature, or make any edit to a project the user names by a filesystem path (e.g. /tmp/foo, ~/code/bar) or a git URL. Clones the repo, runs an…

لغة النص الأصلي: الإنجليزية

codeowners-review-routing

Design and maintain CODEOWNERS path ownership, required review rules, and monorepo routing that avoids single-owner bottlenecks. Use when CODEOWNERS syntax, path owners, required reviewers, branch protection review counts, monorepo package ownership, review…

لغة النص الأصلي: الإنجليزية

codeql-query-pack-basics

CodeQL packs: qlpack.yml layout, query vs library packs, dependencies, lock files, custom queries, suite selection, and analyze/CI wiring for org-owned codebases. Use when creating or packing CodeQL query packs, qlpack.yml / codeql-pack.yml, pack…

لغة النص الأصلي: الإنجليزية

command-injection-defenses

Defend applications against OS command injection by avoiding shells, using argv arrays, allowlisting inputs and binaries, and preferring library APIs over exec. Use when hardening process spawning, subprocess/ProcessBuilder/ child_process sinks, CLI wrappers…

لغة النص الأصلي: الإنجليزية

comment-writing-standards

Standards for when and why to write comments, what not to narrate, and how to document decisions, invariants, and non-obvious constraints in code. Use when writing comments, reviewing comment quality, documenting intent, 写注释, 注释规范, comment style, or deciding…

لغة النص الأصلي: الإنجليزية

commit-message-conventions

Write clear git commit messages using Conventional Commits (type, optional scope, subject/body/footer), emphasizing why the change exists rather than restating the diff. Use when drafting or reviewing a commit message, Conventional Commits, 提交信息, git commit…

لغة النص الأصلي: الإنجليزية

composer-security-audit

Run and gate PHP Composer dependency vulnerability checks with composer audit locally and in CI: Packagist/GitHub security advisories, composer.lock scans, JSON output, abandoneds, ignore policy, and upgrade paths for owned PHP apps. Use when composer audit,…

لغة النص الأصلي: الإنجليزية

composio-app-automation-catalog

Route Composio and Rube app-automation requests to a cached catalog of 810 canonical workflows derived from 832 source skills. Use when a user asks to automate or connect a SaaS or API through Composio/Rube MCP, needs an app-specific tool sequence, or…

لغة النص الأصلي: الإنجليزية

container-image-signing

Sign and verify container images with Cosign and Sigstore: keyless OIDC, long-lived keys, and admission or policy enforcement by digest. Use when cosign sign/verify, Fulcio/Rekor, keyless OIDC image signing, Kyverno or Gatekeeper or Sigstore policy-controller…

لغة النص الأصلي: الإنجليزية

content-security-policy-bypass

Authorized Content-Security-Policy (CSP) review and bypass research: parse policy directives, assess nonce/hash/'strict-dynamic' posture, source expressions, and XSS impact under CSP. Use when responses or meta tags set CSP, inline script is blocked, or a…

لغة النص الأصلي: الإنجليزية

content-strategy

When the user wants to plan a content strategy, decide what content to create, or figure out what topics to cover. Also use when the user mentions "content strategy," "what should I write about," "content ideas," "blog strategy," "topic clusters," "content…

لغة النص الأصلي: الإنجليزية

content-type-sniffing-defense

Defend against MIME / content-type sniffing: enforce X-Content-Type-Options nosniff, accurate Content-Type, safe user-upload serve paths, and polyglot body risks that browsers re-interpret as HTML/script. Use when hardening or auditing response headers for…

لغة النص الأصلي: الإنجليزية

contract-testing-pact

Consumer-driven contract testing (Pact-style): consumer expectations, provider verification, broker publish, and CI compatibility gates. Use when Pact, CDC, consumer-driven contracts, provider verification, pact broker, can-i-deploy, or API shape drift…

لغة النص الأصلي: الإنجليزية

cookie-security-flags

Assess and harden HTTP cookie flags: Secure, HttpOnly, SameSite, Domain, Path, Prefixes (__Host-/__Secure-), and Max-Age/Expires. Use when reviewing session or auth cookies for missing flags, overly broad scope, CSRF exposure, or XSS cookie theft risk on…

لغة النص الأصلي: الإنجليزية

coop-coep-isolation

Design, audit, and remediate Cross-Origin-Opener-Policy (COOP) and Cross-Origin-Embedder-Policy (COEP) for browser cross-origin isolation (crossOriginIsolated, SharedArrayBuffer, Spectre mitigations). Use when enabling or debugging COOP/COEP/CORP, SAB…

لغة النص الأصلي: الإنجليزية

copywriting

When the user wants to write, rewrite, or improve marketing copy for any page — including homepage, landing pages, pricing pages, feature pages, about pages, or product pages. Also use when the user says "write copy for," "improve this copy," "rewrite this…

لغة النص الأصلي: الإنجليزية

cordova-webview-risks

Authorized Cordova/PhoneGap hybrid app security review: config.xml navigation allowlists, file:// origin and content access, JS↔native bridge injection, and outdated/vulnerable plugins. Use when assessing Cordova, PhoneGap, Ionic Cordova, or…

لغة النص الأصلي: الإنجليزية

cors-credentialed-requests

Authorized assessment of credentialed CORS: Access-Control-Allow-Credentials with cookies or client certs, forbidden ACAO *, origin reflection, null origin, preflight vs simple requests, and browser PoC requirements. Use when ACAC true, credentialed…

لغة النص الأصلي: الإنجليزية

cors-preflight-cache

Authorized assessment of CORS preflight caching (Access-Control-Max-Age), browser OPTIONS cache behavior, ACAO reflection under credentials, and preflight/CDN cache-poison risks. Use when debugging CORS failures, tuning Max-Age, or validating that cached…

لغة النص الأصلي: الإنجليزية

cosign-keyless-verify

Verify Cosign keyless (Sigstore/Fulcio/Rekor) signatures on images and artifacts with tight identity and OIDC issuer allowlists. Use when cosign verify, --certificate-identity, --certificate-oidc-issuer, keyless Sigstore check, Rekor transparency, signed…

لغة النص الأصلي: الإنجليزية

crack-keygen

Software authorization analysis: key generation, license bypass, binary patching, DRM removal. Trigger: crack, keygen, patch, license, serial, bypass auth, activate, unlock.

لغة النص الأصلي: الإنجليزية

cro

When the user wants to optimize, improve, or increase conversions on any marketing page or form — including homepage, landing pages, pricing pages, feature pages, lead capture forms, or contact forms. Also use when the user says 'CRO,' 'conversion rate…

لغة النص الأصلي: الإنجليزية

cross-origin-opener-policy

Assess and implement Cross-Origin-Opener-Policy (COOP) for browsing-context isolation: same-origin, same-origin-allow-popups, unsafe-none, pairing with COEP for crossOriginIsolated / SharedArrayBuffer, and popup/OAuth breakage. Use when hardening…

لغة النص الأصلي: الإنجليزية

csdn-skill-distiller

Convert Chinese technical research from CSDN or similar blogs into concise, validated Codex skills. Use when the user asks Codex to learn from CSDN, summarize Chinese developer articles into reusable workflows, create or update a skill from blog research, or…

لغة النص الأصلي: الإنجليزية

csharp-style-conventions

Apply C# and .NET naming conventions, XML documentation comments, and nullable reference type style when writing or reviewing C# code. Use when C# style, .NET naming, XML docs, nullable reference types, EditorConfig/StyleCop alignment, or public API…

لغة النص الأصلي: الإنجليزية

csp-report-only-rollout

Roll out Content-Security-Policy-Report-Only safely: report-uri/report-to, owned collectors, violation triage, noise filtering, gradual directive tightening, canary then enforce. Use when staging CSP without blocking production, cutting report floods,…

لغة النص الأصلي: الإنجليزية

css-injection-exfiltration

Authorized CSS injection and style-based data exfiltration awareness: map untrusted input into style contexts, assess attribute-selector and url()/@import channels, and document impact under CSP style-src without treating CSS as full script XSS. Use when…

لغة النص الأصلي: الإنجليزية

database-migration-safety

Plan and review safe database migrations: expand/contract, backward-compatible deploys, locking/index risks, backfills, and zero-downtime notes. Use when DB migration, 数据库迁移, schema change, online DDL, expand/contract, dual-write, backfill, or shipping…

لغة النص الأصلي: الإنجليزية

database-security

Use for authorized database security assessment covering PostgreSQL/MySQL/MSSQL/Mongo/Redis exposure, authz, UDF/command paths, and misconfiguration review.

لغة النص الأصلي: الصينية

debugger-integration

Advanced debugging integration for vulnerability research

لغة النص الأصلي: الإنجليزية

dependabot-config-hardening

Harden GitHub Dependabot: complete .github/dependabot.yml coverage, safe schedules and groups, PR limits, private registries, ignore expiry, monorepo directories, Actions and Docker updates, and review/CI gates without blind auto-merge. Use when…

لغة النص الأصلي: الإنجليزية

dependency-pinning-strategies

Choose and enforce dependency pins: committed lockfiles, exact vs range versions, CI frozen installs, and Dependabot/Renovate update policy with supply-chain tradeoffs. Use when lockfiles, package-lock, yarn.lock, pnpm-lock, poetry.lock, go.sum, Cargo.lock,…

لغة النص الأصلي: الإنجليزية

deserialization-safe-formats

Defensive guidance for safe interchange formats and deserializers: prefer JSON, Protobuf, and schema-bound codecs over pickle, native Java serialization, BinaryFormatter-class APIs, and unrestricted YAML load. Use when choosing or hardening serializers,…

لغة النص الأصلي: الإنجليزية

device-binding-tokens

High-level design and authorized assessment of device-bound and proof-of-possession tokens (DPoP-style, mTLS/cnf, sender-constrained access tokens). Use when APIs, mobile apps, or SPAs claim tokens are bound to a key, device, or TLS client cert, or when…

لغة النص الأصلي: الإنجليزية

digital-forensics

Use for authorized digital forensics including memory dumps, disk timelines, PCAP investigation, artifact triage, and IR evidence preservation.

لغة النص الأصلي: الصينية

distroless-image-adoption

Adopt and migrate application runtimes to distroless (or equivalent minimal non-shell) container images: multi-stage copy-in, language base choice (static/base/cc/java/nodejs/python), nonroot UIDs, CA/tzdata, and debug without a package manager. Use when…

لغة النص الأصلي: الإنجليزية

django-csrf-middleware-tuning

Tune and review Django CsrfViewMiddleware and CSRF-related settings: CSRF_TRUSTED_ORIGINS, cookie flags, header names, exemptions, and middleware order for cookie-authenticated browser apps. Use when Django CSRF 403s after deploy, SPA/API Origin mismatches,…

لغة النص الأصلي: الإنجليزية