Menu
Skills in this repository
SkillsMP has collected 1,313 skills from jeffreytse/grimoire-core. Open a skill to review its source and details.
jeffreytse/grimoire-coreShowing 40 of 1,313 collected skills.
Use when designing how errors, exceptions, and failures are surfaced to users and logged internally — ensuring error messages don't leak sensitive implementation details while providing enough context for debugging.
Use when adding multi-factor authentication to an application — implementing TOTP, WebAuthn/passkeys, recovery codes, and phishing-resistant options for high-value accounts.
Use when establishing or improving a software development lifecycle — embedding security requirements, threat modeling, and security testing at each phase to find vulnerabilities when they cost 10× less to fix.
Use when implementing user authentication state — creating, storing, transmitting, and expiring session tokens or cookies in a web application.
Use when designing software supply chain security controls including SBOM generation, artifact signing, dependency management, and build pipeline integrity
Use when designing a new system, reviewing architecture for security, adding an external-facing feature, handling sensitive data, or before a security audit.
Use when designing or migrating a security architecture to the zero trust model where no user, device, or network is trusted by default
Use when building any web page that performs state-changing actions on click — login forms, payment buttons, delete confirmations, or settings toggles that could be exploited if framed by an attacker.
Use when building login endpoints — detecting and blocking automated credential stuffing attacks using breached password detection, device fingerprinting, and bot detection.
Use when building any server-side endpoint that performs state-changing operations (POST, PUT, PATCH, DELETE) and is accessible by a browser session.
Use when deserializing data from untrusted sources — user-submitted cookies, API request bodies, message queue payloads, or any format that reconstructs objects (pickle, Java serialization, YAML, PHP serialize).
Use when binding HTTP request parameters or JSON bodies directly to model objects, database records, or data transfer objects — any place where user-supplied fields are mapped to internal properties.
Use when building any endpoint that redirects users based on a URL parameter — login redirects, logout returns, OAuth callback handling, or any redirect-after-action flow.
Use when building file upload, file download, file serving, or any feature where user input influences a filesystem path — including filename parameters, directory parameters, or file include logic.
Use when writing or reviewing regular expressions that process user-controlled input — especially patterns with nested quantifiers, alternation with overlapping cases, or patterns applied to long strings.
Use when writing code that constructs database queries using any data that originates outside the application — user input, API parameters, headers, cookies, or environment variables.
Use when building features that fetch URLs or make HTTP requests based on user-supplied input — web scrapers, webhook receivers, URL preview services, import-from-URL features, or any server-side HTTP client.
Use when rendering user-supplied content in HTML, writing JavaScript that inserts data into the DOM, or building APIs whose responses are rendered in a browser.
Use when parsing XML in any context — file uploads, SOAP APIs, RSS/Atom feeds, SVG processing, document conversion, or any XML-based data exchange format.
Use when penetration testing or auditing authentication mechanisms — executing WSTG OTG-AUTHN test cases for username enumeration, brute force, default credentials, weak lockout, MFA bypass, and password reset flaws.
Use when auditing a web application's security posture against a structured verification standard — applying OWASP ASVS Level 1, 2, or 3 requirements to find and document security gaps across authentication, session management, access control, cryptography,…
Use when reviewing a new codebase for security, before a production launch, after a security incident, or during a compliance audit requiring OWASP Top 10 coverage.
Use when reviewing how secrets, credentials, API keys, or certificates are stored, rotated, and accessed in a system
Use when penetration testing or auditing session handling — executing WSTG OTG-SESS test cases for session token analysis, cookie attribute verification, CSRF, session fixation, and logout completeness.
Use when writing code that accepts data from outside the process boundary — HTTP requests, file uploads, database reads, CLI arguments, environment variables, or inter-service calls — to reject malformed, malicious, or out-of-range data before it reaches…
Use when writing UI automation or end-to-end tests to keep test logic decoupled from page implementation details, so tests remain maintainable when the UI changes.
Use when a test passes and fails non-deterministically without code changes — to identify the root cause category (timing, shared state, concurrency, external dependency, randomness) and eliminate the flakiness rather than retrying or skipping the test.
Use when writing tests that verify the interaction between two or more components, services, or external systems
Use when writing a new unit test, reviewing tests for quality, adding tests to untested code, or when a test is fragile, slow, or hard to understand.
Use when quantifying greenhouse gas emissions for an organization, product, project, or activity to establish a baseline or report emissions.
Use when designing or transitioning agricultural land management to practices that restore soil health, sequester carbon, and enhance biodiversity while maintaining or improving productivity.
Use when conducting a formal assessment of a project, facility, or operation's impacts on ecosystems, biodiversity, and natural resources.
Use when assessing a building, facility, or organization's energy use to identify waste, prioritize efficiency improvements, and establish a baseline for reduction targets.
Use when developing a systematic plan to reduce energy consumption, improve energy performance, and achieve measurable efficiency targets for a facility, organization, or portfolio.
Use when planning, sizing, or evaluating a renewable energy system (solar, wind, storage, or hybrid) for a facility, campus, or organization.
Use when redesigning products, services, or business models to eliminate waste, keep materials in use, and regenerate natural systems.
Use when evaluating the environmental impacts of a product, process, or service across its entire life cycle from raw material extraction to end of life.
Use when assessing an organization's environmental management practices, compliance status, and sustainability performance against recognized standards.
Use when developing or improving an organization's systematic approach to minimizing waste generation, increasing diversion from landfill, and achieving zero waste targets.
Use when designing a systematic water conservation program for an organization, facility, or household to reduce water consumption, achieve compliance, or earn sustainability certification.