القائمة
Skills في هذا المستودع
جمع SkillsMP عدد ٤٨٤ من skills من tomysh1337/openstarry-code. افتح أي skill لمراجعة مصدره وتفاصيله.
tomysh1337/openstarry-codeعرض ٤٠ من أصل ٤٨٤ skills مجمعة.
Authorized assessment of the OAuth 2.0 Device Authorization Grant (RFC 8628): device_code / user_code issuance, verification URI integrity, polling and rate limits, client binding, and token exchange abuse. Use when CLI tools, smart TVs, IoT, headless…
لغة النص الأصلي: الإنجليزية
Authorized assessment of OAuth 2.0 / OIDC implicit and hybrid token-in-browser flows: response_type=token/id_token leakage, fragment handling, migration to authorization code + PKCE. Use when SPA or legacy SSO still issues access or ID tokens at the authorize…
لغة النص الأصلي: الإنجليزية
Authorized assessment and hardening of OAuth 2.0 Pushed Authorization Requests (PAR, RFC 9126): back-channel request push, request_uri lifecycle, client auth at the PAR endpoint, and front-channel reduction. Use when AS discovery shows…
لغة النص الأصلي: الإنجليزية
Authorized assessment checklist for OAuth 2.0 PKCE (RFC 7636): code_challenge, code_verifier, S256 vs plain, public-client enforcement, and related code interception controls. Use when SPA, mobile, native, or public clients use authorization code + PKCE under…
لغة النص الأصلي: الإنجليزية
Authorized design and assessment of OAuth 2.0 Resource Indicators (RFC 8707): the resource request parameter, absolute resource URIs, multi-resource grants, and audience-restricted access tokens for the indicated protected resource(s). Use when clients or…
لغة النص الأصلي: الإنجليزية
Authorized design and assessment of OAuth Demonstrating Proof of Possession (DPoP) and sender-constrained access tokens in the RFC 9449 style: DPoP proofs, htm/htu binding, nonce challenges, cnf.jkt key thumbprints, and Bearer vs DPoP enforcement. Use when…
لغة النص الأصلي: الإنجليزية
Design and review metrics, logs, and traces as one observability system: RED/USE at a high level, correlation IDs, cardinality control, and safe telemetry. Use when observability, metrics, tracing, OpenTelemetry, APM, 可观测性, 指标, 链路追踪, Prometheus, span, SLI/SLO…
لغة النص الأصلي: الإنجليزية
Extract text from images using Tesseract.js OCR (100% local, no API key required). Supports Chinese (simplified/traditional) and English.
لغة النص الأصلي: الإنجليزية
Authorized design, implementation review, and assessment of OpenID Connect Back-Channel Logout: logout_token JWT validation, backchannel_logout_uri delivery, sid/sub session binding, events claim, and propagation to local sessions and refresh tokens. Use when…
لغة النص الأصلي: الإنجليزية
Authorized validation and assessment of OpenID Connect ID tokens: iss, aud, exp/nbf, nonce, signature via JWKS, and azp/at_hash checks. Use when an RP or API accepts id_token JWTs after OIDC login, hybrid flow, or token exchange and you must verify claim…
لغة النص الأصلي: الإنجليزية
OPA Gatekeeper policy-as-code for owned Kubernetes clusters: ConstraintTemplates (Rego + CRD schema), Constraints (match, parameters, enforcementAction), and audit vs deny behavior. Use when authoring or reviewing Gatekeeper templates and constraints, rolling…
لغة النص الأصلي: الإنجليزية
Advanced open-redirect testing: multi-parser gaps, allowlist failures, encoding and scheme tricks, and chains into OAuth/OIDC redirect_uri and token theft. Use when basic next/return checks exist but Location still leaves the trusted host, or when…
لغة النص الأصلي: الإنجليزية
Local speech-to-text with the Whisper CLI (no API key).
لغة النص الأصلي: الإنجليزية
Verify OpenAPI (and similar) contracts against real producers/consumers: request/response conformance, CI gates, consumer-driven checks, and drift detection. Use when OpenAPI contract tests, schema conformance, Pact/OpenAPI validation,…
لغة النص الأصلي: الإنجليزية
Authorized review of OpenID Connect discovery document hygiene: /.well-known/openid-configuration (and OAuth AS metadata), issuer exact-match, HTTPS-only endpoints, JWKS URI trust, advertised algorithms/grants, and cross-document consistency with live IdP…
لغة النص الأصلي: الإنجليزية
Generate or declare an OpenRouter video asset for AwesomeWebpageMetaSkill using a parent-leased Provider Settings connection and configured non-secret model/output values.
لغة النص الأصلي: الإنجليزية
Hide and keep hidden the real origin server IP behind a CDN/WAF edge for owned infrastructure: DNS hygiene, historical and cert leaks, origin firewall allowlists, authenticated origin pulls, and continuous exposure checks. Use when placing origins behind…
لغة النص الأصلي: الإنجليزية
Use for authorized OT/ICS security assessment covering Purdue model zoning, PLC/SCADA exposure, industrial protocol discovery, and safe passive-first evaluation.
لغة النص الأصلي: الصينية
Context-aware output encoding and safe sinks to prevent XSS, SQL injection, and related injection via string composition: HTML/XML, attributes, JS, URL, CSS, SQL/NoSQL parameters, shell argv, and log encoding. Use when output encoding, 输出编码, contextual…
لغة النص الأصلي: الإنجليزية
Run and gate OWASP Dependency-Check (ODC) for multi-ecosystem SCA: CLI and build plugins, NVD data updates, suppression files, CVSS fail thresholds, and HTML/JSON/SARIF reports in local and CI pipelines. Use when dependency-check, OWASP Dependency-Check, ODC,…
لغة النص الأصلي: الإنجليزية
Implement and review Passkeys / WebAuthn (W3C Web Authentication) registration and assertion flows: RP ID, origin, challenge binding, credential store, user verification, and safe fallbacks. Use when adding or hardening passwordless/passkey login, WebAuthn…
لغة النص الأصلي: الإنجليزية
Design NIST-oriented password policies: length, deny/breach lists, no composition theater or forced rotation, modern hashing, and manager-friendly UX. Use when defining or reviewing password requirements, signup/change validation, breached-password checks, or…
لغة النص الأصلي: الإنجليزية
Authorized testing of password-reset and magic-link poisoning: Host / X-Forwarded-Host influence on reset URLs, token leakage via attacker host, open-redirect and cache chains, and token handling flaws. Use when reset, invite, or verify emails embed absolute…
لغة النص الأصلي: الإنجليزية
Defend filesystem path sinks against traversal and escape: canonicalize (resolve) then prefix-check under a fixed root, prefer openat/O_NOFOLLOW, chroot-like jail roots, and reject ".." segments and null bytes. Use when hardening download, include, template,…
لغة النص الأصلي: الإنجليزية
主动渗透测试工具链。覆盖信息收集、端口扫描、漏洞扫描、Web 渗透、SQL 注入、目录爆破、密码破解等场景。 通过 MCP server（pentestMCP / mcp-security-hub）将 20+ 安全工具暴露给 AI agent。 触发关键词：渗透测试、端口扫描、Nmap、漏洞扫描、Nuclei、SQL 注入、SQLMap、目录爆破、FFUF、密码破解、Hashcat、信息收集、子域名、Web 渗透、ZAP、Burp。
لغة النص الأصلي: الصينية
实战 SRC / 众测 / Bug bounty 漏洞挖掘工作流 skill。包含：5 阶段方法论（intake → recon → enum → hunt → report）、19 个攻击类 playbook（SQLi/XSS/RCE/SSRF/IDOR/CSRF/Path Traversal/File Upload/SSTI/XXE/Race/HTTP Smuggling/OAuth/JWT/SAML/GraphQL/Mobile/LLM/DoS）、305 个结构化 payload、263 个 WAF/EDR…
لغة النص الأصلي: الصينية
Plan and review basic performance and load tests: goals, SLIs, scenarios, workloads, and high-level tools. Use when performance testing, 性能测试, load test, stress test, soak test, latency percentiles, k6, JMeter, Gatling, Locust, or capacity checks. Complements…
لغة النص الأصلي: الإنجليزية
Assess and harden the Permissions-Policy (formerly Feature-Policy) HTTP response header: powerful browser features, allowlists, iframe delegation, and missing or over-permissive policies. Use when reviewing camera/mic/geo geolocation payment USB sensors…
لغة النص الأصلي: الإنجليزية
Audit Python dependencies with pip-audit and enforce install integrity via constraints files and hash-checking mode (pip --require-hashes, hashed requirements). Use when Python CVE/SCA findings, pip-audit CI failures, requirements.txt/constraints.txt drift,…
لغة النص الأصلي: الإنجليزية
Authorized design and assessment checklist for OAuth 2.0 PKCE on public clients (SPA, mobile, native, desktop): mandatory S256 code_challenge, code_verifier lifecycle, no embedded client secrets, and token-endpoint binding. Use when public clients run…
لغة النص الأصلي: الإنجليزية
Select the most specific installed skill for project planning, task decomposition, persistent progress tracking, product requirements, PRDs, roadmaps, user stories, discovery, and prioritization. Use for project plan, task plan, roadmap, PRD, requirements,…
لغة النص الأصلي: الإنجليزية
Use persistent task_plan.md, findings.md, and progress.md files to organize complex multi-step work and resume it across context changes. Use for project plans, task decomposition, research workflows, more than five expected tool calls, 任务规划, 项目计划, 拆解任务,…
لغة النص الأصلي: الإنجليزية
Assess and reduce pnpm shamefully-hoist / flat node_modules risk: phantom dependencies, undeclared requires, monorepo cross-package imports, and safer hoist alternatives (public-hoist-pattern, packageExtensions). Use when shamefully-hoist,…
لغة النص الأصلي: الإنجليزية
Authorized Podman security hardening and assessment: rootless vs rootful, user namespaces, capabilities, SELinux labels, privileged/host mounts, publish ports, Podman socket exposure, secrets, and image trust. Use when reviewing Containerfile runtime, podman…
لغة النص الأصلي: الإنجليزية
Authorized PostgreSQL hardening for owned databases: pg_hba.conf access rules, SSL/TLS, SCRAM-SHA-256 password auth, role least privilege, superuser avoidance, extension allowlists, and connection/auth logging. Use when reviewing postgresql.conf /…
لغة النص الأصلي: الإنجليزية
Authorized window.postMessage security review: origin validation on message handlers, targetOrigin misuse, untrusted data into DOM/code sinks, and XSS or token theft via postMessage. Use when apps use iframes, openers, webviews, or cross-window messaging, or…
لغة النص الأصلي: الإنجليزية
Write clear pull/merge request titles and bodies using Why / What / Test structure, linked issues, and review-friendly scope. Use when PR description, 写 PR, pull request body, MR description, PR title, GitHub/GitLab PR template, or summarizing a branch for…
لغة النص الأصلي: الإنجليزية
Resolve formatter/linter/EditorConfig hierarchy, avoid tool fights, and run a reliable format-then-lint fix pipeline. Use when prettier, eslint, editorconfig, 格式化, format-on-save conflicts, eslint-config-prettier, or CI format checks fail.
لغة النص الأصلي: الإنجليزية
Design and review private PKI hierarchies for owned or authorized environments: offline root CA, intermediate and issuing CAs, pathLen and name constraints, trust anchors, CRL/OCSP distribution, and key custody. Use when planning or reviewing an internal CA…
لغة النص الأصلي: الإنجليزية
When the user wants to create or update their product marketing context document. Also use when the user mentions 'product context,' 'marketing context,' 'set up context,' 'positioning,' 'who is my target audience,' 'describe my product,' 'ICP,' 'ideal…
لغة النص الأصلي: الإنجليزية