القائمة
Skills في هذا المستودع
جمع SkillsMP عدد ٤٨٤ من skills من tomysh1337/openstarry-code. افتح أي skill لمراجعة مصدره وتفاصيله.
tomysh1337/openstarry-codeعرض ٤٠ من أصل ٤٨٤ skills مجمعة.
Design and review property-based and fuzz-style property tests: invariants, generators, shrinking, and when properties beat examples. Use when property-based testing, 属性测试, hypothesis, fast-check, jqwik, proptest, generators, shrinking, or invariant testing.…
لغة النص الأصلي: الإنجليزية
Design and evolve Protobuf/gRPC API contracts: package and naming style, field numbers, types, oneof/map/repeated rules, compatibility, errors, pagination, and service layout. Use when writing or reviewing .proto files, gRPC service APIs, buf/lint rules, or…
لغة النص الأصلي: الإنجليزية
Recover and validate unknown Protobuf, gRPC, and gRPC-Web message structures from captures, application assets, binaries, or runtime traces. Use when payloads contain Protobuf wire data, `application/grpc`, `application/grpc-web+proto`, five-byte gRPC frames,…
لغة النص الأصلي: الإنجليزية
Master network protocol reverse engineering including packet analysis, protocol dissection, and custom protocol documentation. Use when analyzing network traffic, understanding proprietary protocols, or debugging network communication.
لغة النص الأصلي: الإنجليزية
Use for authorized reverse engineering of custom binary protocols, Protobuf/gRPC, WebSocket frames, and PCAP-driven protocol recovery.
لغة النص الأصلي: الصينية
Harden JavaScript and TypeScript applications against prototype pollution: safe merge/clone, key denylists and allowlists, null-prototype maps, parser settings, freeze/seal of config, and regression tests. Use when fixing or reviewing deep-merge, defaults,…
لغة النص الأصلي: الإنجليزية
Pulumi secrets and encrypted config for owned/authorized stacks: pulumi config set --secret, secrets providers (passphrase vs cloud KMS), stack outputs, and Pulumi ESC. Use when Pulumi secrets, stack config encryption, PULUMI_CONFIG_PASSPHRASE,…
لغة النص الأصلي: الإنجليزية
Authorized PWA security review: service worker scope, Cache API / precache poisoning, HTTPS-only installability, Web Push permissions, and offline auth tokens. Use when assessing service workers, Workbox caches, manifest install flows, push handlers, or…
لغة النص الأصلي: الإنجليزية
Configure and review PyPI (and TestPyPI) Trusted Publishing so CI publishes Python packages via short-lived OIDC identity instead of long-lived API tokens. Use when designing or auditing PyPI OIDC publishers, GitHub Actions or GitLab publish jobs,…
لغة النص الأصلي: الإنجليزية
Modern Python packaging with pyproject.toml, hatch/poetry/uv, src layout, versioning, and wheels. Use when packaging a Python library or app, authoring or migrating setup.py/setup.cfg to PEP 517/518/621, choosing hatchling/setuptools/ poetry-core, building…
لغة النص الأصلي: الإنجليزية
Apply PEP 8 style, modern type hints, and repo-aligned pyright/mypy plus black/ruff tooling when writing or reviewing Python. Use when Python style, typing, type hints, 类型注解, PEP 8, mypy, pyright, ruff, black, annotations, or Python formatting/linting…
لغة النص الأصلي: الإنجليزية
Own Astral uv lockfiles and install gates: uv.lock generation, upgrade, check, frozen sync, dependency groups/extras, index policy, and CI reproducibility for Python projects. Use when uv.lock, uv lock, uv sync --frozen, uv lock --check, uv lock --upgrade,…
لغة النص الأصلي: الإنجليزية
Capture, decrypt, and analyze QUIC and HTTP/3 traffic using endpoint key logs, qlog, PCAP, Wireshark, and implementation traces. Use when traffic is UDP-based and encrypted, ALPN is h3, connection IDs replace stable five-tuples, HTTP/3 streams use QPACK,…
لغة النص الأصلي: الإنجليزية
Authorized RabbitMQ security assessment and hardening: users, vhosts, configure/write/read permissions, TLS for AMQP and management, default guest account, loopback_users, and management UI exposure. Use when reviewing rabbitmq.conf / advanced.config,…
لغة النص الأصلي: الإنجليزية
Use for authorized RF/SDR security research including signal identification, replay feasibility study in shielded labs, and wireless protocol analysis outside classic Wi-Fi.
لغة النص الأصلي: لغات متعددة
Rails security checklist for org-owned apps: strong parameters, CSRF, sessions/cookies, ActiveRecord injection, secrets, headers, and authZ. Use when reviewing Rails apps, credentials, Devise/sessions, or hardening before release — authorized only.
لغة النص الأصلي: الإنجليزية
Authorized testing of HTTP rate limits and anti-automation: limit keying (IP, user, session, API key), header-based IP trust, path/method aliases, protocol quirks, and IP-rotation awareness. Use when login, OTP, reset, or API quotas should throttle abuse but…
لغة النص الأصلي: الإنجليزية
Structure React components with clear props, hooks, composition, and colocation. Use when React components, hooks, props, colocation, compound components, React 组件, 组件结构, custom hooks, or when reviewing React UI structure. Pairs with code-quality-standards;…
لغة النص الأصلي: الإنجليزية
Harden React hooks against security pitfalls: dangerouslySetInnerHTML sinks, effect cleanup that leaks tokens/subscriptions, stale auth/closure state, and useMemo/useCallback values that land secrets in logs or client bundles. Use when reviewing or fixing…
لغة النص الأصلي: الإنجليزية
Authorized React Native mobile app security basics: expo-secure-store / react-native-keychain storage, certificate pinning notes, deep-link and universal-link handling, JS bundle tampering awareness, and WebView risks. Use when hardening or reviewing owned RN…
لغة النص الأصلي: الإنجليزية
Structure and write project README, CONTRIBUTING, and quickstart docs that get users running and contributors shipping safely. Use when README, CONTRIBUTING, quickstart, 写说明文档, project overview, onboarding docs, setup instructions, or polishing the repository…
لغة النص الأصلي: الإنجليزية
Design least-privilege Redis ACL users: command categories, key/channel patterns, AUTH secrets, and deny lists for dangerous commands. Use when defining users.acl, ACL SETUSER rules, app vs admin roles, key-prefix isolation, or replacing shared requirepass…
لغة النص الأصلي: الإنجليزية
Authorized Redis security assessment and hardening: bind addresses, protected-mode, AUTH/ACL, dangerous command exposure (FLUSH*, CONFIG, MODULE, DEBUG, SLAVEOF/REPLICAOF), network exposure, TLS, and safe config examples. Use when reviewing redis.conf, cloud…
لغة النص الأصلي: الإنجليزية
Strict refresh-token rotation and reuse detection: one-time rotate on use, reject previous tokens, revoke entire token family on reuse, concurrent-refresh races, grace windows, and storage/hash requirements. Use when assessing or implementing refresh…
لغة النص الأصلي: الإنجليزية
Design, assess, and harden trust in registry mirrors and pull-through caches for containers and packages (Harbor, Artifactory, Nexus, ECR/GHCR proxies, npm/PyPI/Maven mirrors). Use when clients resolve artifacts via a corporate mirror, when pull-through cache…
لغة النص الأصلي: الإنجليزية
Design and assess long-lived remember-me / persistent-login tokens: opaque selector+validator patterns, hashed storage, rotation, revocation, and cookie transport. Use when implementing or reviewing “stay signed in”, persistent login cookies, or multi-device…
لغة النص الأصلي: الإنجليزية
Harden Mend Renovate (self-hosted or app) for supply-chain and CI safety: token least privilege, auto-merge gates, allowScripts/ignoreScripts, hostRules secrets, registry allowlists, custom/regex managers, and PR trust under branch protection. Use when…
لغة النص الأصلي: الإنجليزية
Achieve bit-for-bit or policy-defined equivalent rebuilds: hermetic inputs, SOURCE_DATE_EPOCH, pinned toolchains, and binary equivalence checks. Use when reproducible builds, rebuild verification, deterministic builds, SOURCE_DATE_EPOCH, build nondeterminism,…
لغة النص الأصلي: الإنجليزية
Detect known-vulnerable JavaScript and Node libraries with Retire.js (CLI): js/node path scans, severity gates, ignore files, JSON/CycloneDX output, and CI fail-closed wiring for owned frontends and Node apps. Use when retire.js, retire CLI, JS library CVE…
لغة النص الأصلي: الإنجليزية
Design safe retries: exponential backoff, jitter, budgets, idempotency, and when not to retry. Use when retry, backoff, 重试, transient failure, 429/503 handling, dead-letter, or retry storms. Complements async cancel and cache loaders; not a substitute for…
لغة النص الأصلي: الإنجليزية
Trace and reverse Android native behavior end to end across Java or Kotlin call sites, JNI static or dynamic registration, APK/AAB/AAR native-library inventory, ELF and ARM/Thumb/AArch64 analysis, Frida or JNItrace validation, algorithm recovery, and minimal…
لغة النص الأصلي: الإنجليزية
Binary analysis: disassembly guidance, unpacking, string extraction, control-flow recovery. Trigger: reverse, disassemble, decompile, unpack, analyze binary, pe header, elf header.
لغة النص الأصلي: الإنجليزية
Guide for reverse engineering protected games and anti-cheat components across user mode, kernel mode, and hypervisor-aware environments. Use this skill when analyzing drivers, IOCTL protocols, callback registration, injected-code artifacts, integrity checks,…
لغة النص الأصلي: الإنجليزية
Test REST, GraphQL, WebSocket, and SOAP APIs for authentication, authorization, token, rate-limit, and protocol-specific security flaws.
لغة النص الأصلي: الصينية
在 CLI 环境下做 Android APK 逆向时使用。适用于 APK 解包、Java 反编译、smali 修改、重打包、Frida 动态 Hook，以及按需切换到 so/native 分析。优先使用本机已安装的 jadx、apktool、frida、adb、ida-reverse、radare2。
لغة النص الأصلي: الصينية
Plan and coordinate multi-stage authorized penetration-testing and CTF attack paths across reconnaissance, exploitation, privilege escalation, lateral movement, and reporting.
لغة النص الأصلي: الصينية
.NET / C# 二进制逆向。当目标是 .NET assembly（PE 头含 CLR、.exe/.dll 托管程序）、C# 编译产物（含 NativeAOT）、红队 Sharp* 工具（Rubeus / SharpHound / SharpHound 等）、.NET 混淆程序（ConfuserEx / SmartAssembly / Babel / Eazfuscator）、.NET loader / info-stealer / 套壳 malware 时使用。优先用 dnSpyEx + de4dot，需要…
لغة النص الأصلي: الصينية
IDA Pro 逆向分析辅助技能。当用户提到逆向、反编译、分析二进制/PE/ELF/APK/DLL/SO、破解、找密码、漏洞分析、病毒分析、firmware 固件分析，或需要分析 exe/dll/so/elf/macho/sys 等文件时，务必使用此技能。 Ensure to use this skill when the user wants to analyze any binary file, regardless of whether they explicitly mention "IDA" or…
لغة النص الأصلي: الصينية
Assess LLM and AI-agent applications for prompt injection, unsafe tool use, memory poisoning, data exposure, model supply-chain, and agentic security risks.
لغة النص الأصلي: الصينية
Analyze suspicious PE, ELF, Mach-O, APK, and script samples using static, dynamic, behavioral, IOC, YARA, Sigma, and anti-analysis workflows.
لغة النص الأصلي: الصينية