القائمة
Skills في هذا المستودع
جمع SkillsMP عدد ٤٨٤ من skills من tomysh1337/openstarry-code. افتح أي skill لمراجعة مصدره وتفاصيله.
tomysh1337/openstarry-codeعرض ٤٠ من أصل ٤٨٤ skills مجمعة.
Choose and configure HTML sanitizers (DOMPurify, bleach/nh3, sanitize-html, OWASP Java HTML Sanitizer) for untrusted markup: allowlists vs strip-all, SVG/MathML policy, HTML vs attribute vs URL context, and CSP as defense in depth. Use when picking or…
لغة النص الأصلي: الإنجليزية
High-level HTTP web cache poisoning methodology: unkeyed inputs, cache-key design, Host/X-Forwarded-* authority, fat GET, and second-client proofs. Use when shared caches (CDN, reverse proxy, gateway) may store attacker-influenced responses for other users…
لغة النص الأصلي: الإنجليزية
Assess HTTP method override / method spoofing risks: X-HTTP-Method-Override, X-HTTP-Method, X-Method-Override, body/query _method, and framework tunnels that change the effective verb after WAF or auth middleware. Use when authorized tests show ACL or CSRF…
لغة النص الأصلي: الإنجليزية
Edit prose to remove common AI-writing patterns while preserving every supplied fact and matching the intended voice. Use for humanize, natural rewrite, AI-sounding prose, 去除 AI 味, 降低机器感, 自然润色, or matching a provided writing sample. Do not use for code…
لغة النص الأصلي: الإنجليزية
Internationalization and localization patterns for apps: no hardcoded UI strings, message catalogs, ICU plurals/interpolation, locale negotiation, dates/numbers/currency, RTL, and pseudo-loc. Use when i18n, l10n, 国际化, 本地化, localization, react-i18next,…
لغة النص الأصلي: الإنجليزية
IDAPython scripting basics for authorized binary reverse engineering: batch idat/idat64 runs, function and xref enumeration, names/comments, Hex-Rays decompiler export when licensed, and reproducible IDB hygiene. Use when writing or debugging IDAPython,…
لغة النص الأصلي: الإنجليزية
IDA Pro 逆向分析辅助技能。当用户提到逆向、反编译、分析二进制/PE/ELF/APK/DLL/SO、破解、找密码、漏洞分析、病毒分析、firmware 固件分析，或需要分析 exe/dll/so/elf/macho/sys 等文件时，务必使用此技能。 Ensure to use this skill when the user wants to analyze any binary file, regardless of whether they explicitly mention "IDA" or…
لغة النص الأصلي: الصينية
Use for authorized assessment of federated identity systems including SAML, OIDC, OAuth2 flows, SSO misconfiguration, and token confusion issues.
لغة النص الأصلي: الصينية
GraphQL node/edge object-level authorization (BOLA/IDOR): Relay global IDs, nested resolvers, connections, mutations, and field-level leaks. Use when node(id), edges, or ID arguments appear under GraphQL and classic REST IDOR coverage is incomplete.…
لغة النص الأصلي: الإنجليزية
Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells,…
لغة النص الأصلي: الإنجليزية
Author and review operational incident runbooks: clear scope, severity, symptoms, diagnostics, mitigation steps, escalation, and communications. Use when runbook, incident response doc, 故障手册, on-call playbook, SEV ladder, incident procedure, pager runbook, or…
لغة النص الأصلي: الإنجليزية
Secure input validation at trust boundaries: allowlists, schemas, type and range checks, normalization, and fail-closed parsing. Use when input validation, 输入校验, request validation, allowlist, schema validation, boundary checks, sanitize vs validate, or…
لغة النص الأصلي: الإنجليزية
Decide when to write integration tests vs unit or e2e, and how to draw reliable boundaries. Use when integration tests, 集成测试, test pyramid, unit vs integration vs e2e, test boundaries, contract tests, or when suites are slow/flaky from wrong layer choice.…
لغة النص الأصلي: الإنجليزية
Authorized iOS Keychain access-control assessment: SecItem attributes, kSecAttrAccessible classes, access-control flags (biometry, device passcode, ThisDeviceOnly), access groups, and common storage mistakes. Use when reviewing how an owned or lab iOS app…
لغة النص الأصلي: الإنجليزية
Design and review Istio service-mesh authorization and peer mTLS: AuthorizationPolicy (ALLOW/DENY, principals, JWT, path/method), PeerAuthentication STRICT, deny-by-default, and common gaps. Use when hardening or assessing owned Istio meshes, drafting mesh…
لغة النص الأصلي: الإنجليزية
Recover, inspect, deobfuscate, rename, and verify Java JAR bytecode with local java-deobfuscator, Recaf, and Enigma-MCP. Use for obfuscated JARs, class-file triage, source recovery, mapping work, and IDEA-ready Java source exports.
لغة النص الأصلي: الإنجليزية
Stateful orchestration for recovering readable, buildable, IDEA-ready Java source from obfuscated JAR and class files. Use for multi-round Java decompilation or deobfuscation, CFR/Vineflower/Procyon comparison, Recaf navigation, java-deobfuscator or custom…
لغة النص الأصلي: الإنجليزية
Plan and review JPMS boundaries: module-info.java, requires/exports/opens, automatic and unnamed modules, and classpath-to-module-path migration. Use when modularizing Java apps/libraries, fixing module graph errors (exports, requires transitive, split…
لغة النص الأصلي: الإنجليزية
Analyze, triage, decompile, and deobfuscate protected Java artifacts and mixed Java/native targets. Use for JAR, WAR, APK, AAB, .class, DEX, JNI .so/.dll/.dylib, Minecraft/plugin jars, Java malware, CTF reverse challenges, and protectors or symptoms such as…
لغة النص الأصلي: الإنجليزية
Build a staged Java/JAR reverse-engineering workspace with static inventory, Recaf inspection, enigma-mcp mappings, decompiler comparison, debugger checks, and reproducible verification. Use for Java projects, JARs, class files, shaded libraries, and…
لغة النص الأصلي: الإنجليزية
Run and gate SpotBugs (and FindSecBugs) for Java/JVM security static analysis: plugin setup, confidence/rank filters, Maven/Gradle/CI wiring, suppressions with owners, and triage of SECURITY-category bugs. Use when SpotBugs, FindBugs successor, FindSecBugs,…
لغة النص الأصلي: الإنجليزية
Apply Java naming, Google/Oracle-style layout conventions, and Javadoc discipline when writing or reviewing Java (and closely related Kotlin interop surfaces). Use when Java style, Javadoc, package/class naming, public API docs, Checkstyle/google-java-format…
لغة النص الأصلي: الإنجليزية
Jenkins credential storage, scoping, pipeline binding, masking, rotation, and leak hygiene for owned controllers: Credentials plugin types, folder vs global scope, withCredentials / credentials() usage, JCasC secrets, agent and log exposure. Use when Jenkins…
لغة النص الأصلي: الإنجليزية
Design and evolve JSON Schema (and OpenAPI-aligned schemas): types, required fields, formats, composition, versioning, and validation at boundaries. Use when JSON Schema, schema design, OpenAPI components/schemas, AJV/Zod/Pydantic contract alignment,…
لغة النص الأصلي: الإنجليزية
Authorized assessment of legacy JSONP endpoints: callback parameter injection, cross-origin data exfiltration via script tags with ambient cookies, content-type and padding pitfalls, and migration from JSONP to CORS or same-origin APIs. Use when responses…
لغة النص الأصلي: الإنجليزية
Authorized assessment and hardening of JWT issuer, audience, and authorized-party claims: missing, weak, multi-value, and cross-service acceptance of iss/aud/azp. Use when resource servers, API gateways, or OIDC relying parties verify Bearer or ID tokens and…
لغة النص الأصلي: الإنجليزية
Authorized design and assessment of JOSE JWE token encryption: compact five-part structure, key encryption (alg) vs content encryption (enc), CEK handling, nested JWT (JWS inside JWE), and decryption/key-management checks. Use when APIs or clients issue or…
لغة النص الأصلي: الإنجليزية
Authorized design and assessment of JWT access + refresh token patterns: rotation, reuse detection, revocation, and storage (cookie vs localStorage). Use when implementing or reviewing refresh endpoints, sliding sessions, or long-lived offline tokens under…
لغة النص الأصلي: الإنجليزية
Kafka ACL and auth hardening for owned or authorized clusters: SASL/SSL, super.users, authorizer config, least-privilege topic and consumer-group ACLs, and ZooKeeper vs KRaft metadata-auth notes. Use when reviewing server.properties / kraft configs,…
لغة النص الأصلي: الإنجليزية
Authorized basics for Kerberos Service Principal Names (SPNs): registration, format, ticket targeting, missing/duplicate SPNs, and service identity hygiene on owned Active Directory or lab domains. Use when apps fail negotiate/Kerberos SSO, setspn/AD…
لغة النص الأصلي: الإنجليزية
Design, review, and harden Kubernetes admission webhooks: MutatingWebhookConfiguration, ValidatingWebhookConfiguration, AdmissionReview, failurePolicy, sideEffects, selectors, TLS/caBundle, and availability. Use when implementing or auditing…
لغة النص الأصلي: الإنجليزية
Kubernetes etcd encryption at rest for owned or authorized clusters: API server EncryptionConfiguration, resource selection (Secrets and more), aescbc/aesgcm/ secretbox/kms providers, identity fallback, key rotation, and re-encrypt verification. Use when…
لغة النص الأصلي: الإنجليزية
Harden Kubernetes workloads with Pod Security Standards (baseline/restricted), PSA labels, securityContext (runAsNonRoot, capabilities, privileged, hostPath), and PodSecurityPolicy migration. Use when reviewing Deployments/Pods for PSS violations, enforcing…
لغة النص الأصلي: الإنجليزية
Kubernetes RBAC least-privilege review for owned clusters: ServiceAccounts, Roles/ClusterRoles, RoleBindings/ClusterRoleBindings, verb/resource scoping, and bind-escalation footguns. Use when hardening default SA usage, trimming cluster-admin, splitting…
لغة النص الأصلي: الإنجليزية
Harden Kubernetes Secrets handling on owned clusters: base64 is not encryption, etcd encryption at rest, RBAC least privilege, mount vs env injection, and safe inventory without dumping Secret data into pods or logs. Use when reviewing Secret objects,…
لغة النص الأصلي: الإنجليزية
Laravel security basics: APP_KEY, session/cookies, CSRF, mass assignment, policies, validation, rate limits, files, Sanctum/Passport. Use when reviewing Laravel config, $fillable/$guarded, Blade XSS, or hardening org-owned PHP apps — authorized only.
لغة النص الأصلي: الإنجليزية
Harden and assess LDAP/AD directory binds for owned systems: disable anonymous and unauthenticated binds, prefer LDAPS or StartTLS, least-privilege service accounts, simple vs SASL bind choices, AD LDAP signing/channel binding, lockout- safe auth, and secret…
لغة النص الأصلي: الإنجليزية
Detect and safely test LDAP injection in directory search filters and bind DNs, including filter syntax metacharacters, boolean result differentials, and blind extraction discipline. Use when apps query Active Directory, OpenLDAP, or other LDAP directories…
لغة النص الأصلي: الإنجليزية
Scan third-party OSS licenses against org allow/deny lists, flag copyleft and dual-license ambiguity, verify NOTICE/attribution artifacts, and wire CI license gates. Use when reviewing dependency license compliance, SPDX identifiers, forbidden licenses…
لغة النص الأصلي: الإنجليزية
Authorized Linux host hardening checklist: accounts and SSH, firewall and listening services, package/update hygiene, filesystem and kernel sysctl, audit/logging, and service least privilege. Use when hardening org-owned Linux servers, lab VMs, or reviewing…
لغة النص الأصلي: الإنجليزية