Menu
SkillsMP has collected 484 skills from tomysh1337/openstarry-code. Open a skill to review its source and details.
Showing 40 of 484 collected skills.
Frontend accessibility (a11y) testing checklist at WCAG high level: semantic HTML, keyboard, focus, names/roles, contrast, forms, media, and ARIA discipline. Use when accessibility, a11y, 无障碍, WCAG, screen reader, keyboard navigation, ARIA, focus trap, color…
Design account lockout and progressive auth-failure controls: attempt counters, lock duration, dual keys (account + IP), unlock paths, enumeration-safe UX, and lockout vs soft rate limits. Use when login lockout policy, failed-attempt thresholds, temporary…
Authorized account-takeover (ATO) methodology that chains password-reset, session fixation, IDOR/BOLA, JWT/API tokens, and OAuth/OIDC failures into end-to-end impact paths. Use when planning or executing multi-vector ATO assessment with owned test accounts…
Automate ACME DNS-01 certificate issuance and renewal for owned zones: TXT hooks, provider APIs, propagation waits, wildcards, multi-name certs, cleanup, staging, and rate-limit safety. Use when wiring Certbot, lego, acme.sh, Caddy, or Traefik DNS-01 solvers;…
Enable, operate, and enforce Azure Container Registry (ACR) content trust and image integrity: legacy Docker Content Trust / Notary, modern Notation (ORAS) or Cosign signatures on ACR, digest-only promote, and pull/deploy gates for signed digests. Use when…
Evidence-driven Java JAR reverse engineering and deobfuscation workflow. Use when inspecting, recovering readable source from, or validating transformations on Java .jar/.class artifacts, including obfuscated desktop applications, Fabric/Forge mods, shaded…
Search and selectively apply the audited anbeime/skill community catalog of 63 unique skills, including Chinese content publishing, video, illustration, legal, Obsidian, ecommerce, and multi-agent workflows. Use when the user names anbeime/skill, asks to use…
Authorized Android exported-component security review: Activities, Services, BroadcastReceivers, ContentProviders, deep links, and intent-filter surface. Use when assessing android:exported, unprotected IPC, path permissions, or privilege escalation via…
End-to-end Android reverse-engineering workflow for APK/AAB/XAPK/AAR artifacts: framework fingerprinting, DEX/Java/Kotlin static analysis, Recaf and enigma-mcp coordination, JNI/ELF native tracing, dynamic sandbox validation, and structured API or call-flow…
Authorized Android WebView security review: JavaScript bridges (addJavascriptInterface), file URL access, universal access from file URLs, mixed content, SSL error handlers, and WebView XSS to native privilege. Use when reviewing owned apps, labs, and CTF…
Angular client security: template encoding defaults, DomSanitizer, bypassSecurityTrust* review, HttpClient XSRF/CSRF, and auth interceptors. Use when reviewing Angular XSS sinks, innerHTML bindings, DomSanitizer bypass, HttpClient withCredentials, XSRF-TOKEN,…
Ansible Vault encrypt/decrypt, vault IDs, password files, rekey, and CI secret injection so playbooks never commit plaintext secrets. Use when ansible-vault, vault_id, encrypted group_vars/host_vars, vault password file, rekey, or CI decrypt for…
Guide for understanding anti-cheat systems and bypass techniques. Use this skill when researching game protection systems (EAC, BattlEye, Vanguard), anti-cheat architecture, detection methods, or bypass strategies.
Write high-quality OpenAPI/Swagger operation descriptions, parameter and schema docs, error contracts, and request/response examples. Use when API docs, OpenAPI description writing, Swagger annotations, 写接口文档, endpoint documentation, operation…
Design and review API gateway authorization: JWT/OIDC validation, API keys, mTLS, claims- and scope-based route guards, identity header injection to backends, deny-by-default routing, and trust-boundary hardening. Use when configuring or assessing Kong,…
Design and operate the API key lifecycle: create, issue, store references, dual-run rotate, revoke, and audit. Use when API key creation, rotation, revocation, key grace periods, key metadata (prefix/last4/scopes), emergency kill switches, or partner/machine…
Authorized testing of API pagination controls: offset vs cursor designs, max page size enforcement, authorization across pages, filter/sort injection via list params, total-count and metadata leaks, and cursor integrity/signing. Use when list endpoints expose…
Design API rate limits and quotas: limit keys (IP, user, API key, route), budgets and windows, multi-tier policies, headers/UX, and abuse-resistant enforcement. Use when rate limit design, API quota, 限流设计, 429 policy, Retry-After, or throttle UX. Pair with…
Design and evolve HTTP/RPC API versions: URL path vs header vs media-type versioning, compatibility rules, deprecation, sunset, and client migration. Use when API versioning, 接口版本, v1/v2 paths, API-Version header, breaking change policy, or deprecation…
在 CLI 环境下做 Android APK 逆向时使用。适用于 APK 解包、Java 反编译、smali 修改、重打包、Frida 动态 Hook，以及按需切换到 so/native 分析。优先使用本机已安装的 jadx、apktool、frida、adb、ida-reverse、radare2。
Source text: Chinese
Authorized APK signing-scheme and integrity assessment: APK Signature Scheme v1/v2/v3/v4, cert lineage, apksigner verification, split/AAB notes, and app-side integrity or repack detection patterns. Use when reviewing how an owned or lab Android package is…
Argo CD RBAC for owned or authorized GitOps control planes: global policy.csv in argocd-rbac-cm, Casbin p/g rules, SSO group scopes, AppProject roles, default policy, and least-privilege sync/delete/admin boundaries. Use when designing or reviewing Argo CD…
Authorized assessment and hardening of Google Cloud Artifact Registry IAM: repository- vs project-level bindings, reader/writer/repoAdmin least privilege, public allUsers exposure, CI push identities, and cross-project consumers. Use when reviewing org-owned…
Route reverse-engineering work by artifact type. Start JAR/Java/EXE work with a static project inventory, split modules into focused sub-agent tasks, use Recaf and enigma-mcp as background decompilation and mapping services, and validate selected paths with a…
Design and implement safe async/await and concurrency in application code: cancellation, timeouts, structured task lifetimes, shared-state races, and shutdown. Use when async, await, concurrency, 并发, race condition in code, CancellationToken/Context,…
OpenSquilla-compatible audio generation adapter for webpage audio requests. Prefer OpenRouter config/API key in OpenSquilla; preserve the upstream CellCog workflow only as optional ClawHub provenance.
Select the right installed automation or discovery skill for SaaS integrations, Composio/MCP, browser automation, publishing, downloads, scraping, SkillHub, and community catalogs. Use for automate, MCP, Composio, SkillHub, browser automation, web scraping,…
Search the full cached ComposioHQ/awesome-claude-skills repository plus its audited external repository manifest without registering hundreds of skills globally. Use when a user asks for an Awesome-list skill, needs a cached workflow that is not actively…
Build a local multimedia webpage project from a user topic, audience, language, style, and media preferences by framing requirements, researching, planning, acquiring media, generating files, packaging, validating, repairing, and delivering usage guidance.
Harden Amazon ECS task definitions and services for owned AWS accounts: task role vs execution role split, Secrets Manager/SSM injection, public tasks and assignPublicIp, security groups, Fargate vs EC2 launch type, and privileged containers. Use when…
AWS IAM least-privilege review methodology for owned cloud accounts: inventory principals, shrink Action/Resource wildcards, fix trust policies and privilege-escalation paths, prefer roles/OIDC over long-lived keys. Use when reviewing IAM policies, roles,…
AWS KMS customer managed key (CMK) hardening for owned accounts: key policies vs IAM, kms:ViaService, grants, key-admin least privilege, and encryption context. Use when reviewing CMK key policies, over-broad kms:*, missing ViaService conditions, grant…
AWS Lambda least-privilege hardening for owned accounts: execution-role IAM, function resource policies, env-var secrets, VPC ENI/SG posture, over-broad Action/Resource wildcards, and IAM Access Analyzer findings. Use when reviewing Lambda roles,…
Assess and harden Amazon RDS / Aurora for org-owned AWS accounts: PubliclyAccessible, DB subnet groups, security groups open to 0.0.0.0/0 on 3306/5432 (and engine ports), public snapshots, and encryption at rest. Use when reviewing publicly reachable…
AWS S3 bucket hardening for owned cloud accounts: Block Public Access, encryption (SSE-S3/SSE-KMS), bucket policies and ACLs, versioning, logging, and TLS-only access. Use when reviewing public buckets, missing BPA, plaintext objects, overly broad Principal…
AWS Secrets Manager automatic and immediate rotation for owned accounts: rotation Lambda steps, AWSCURRENT/AWSPENDING labels, multi-user strategies, hosted RDS/Redshift/DocumentDB rotation, and post-leak cutover. Use when enabling or fixing Secrets Manager…
Authorized AWS Security Group (SG) and related NACL review for owned accounts: inventory rules, flag 0.0.0.0/0 and ::/0, unused or stale rules, SG-to-SG references, least-privilege ports, and stateful SG vs stateless NACL semantics. Use when reviewing VPC…
Authorized assessment and hardening of Azure Blob Storage public access misconfigurations: container public access, anonymous read, SAS/shared keys, account firewalls, soft-delete/logging. Use when assessing org-owned accounts or written engagements — not…
Authorized assessment and hardening of Azure Key Vault: access policies vs Azure RBAC, network firewall and private endpoints, soft-delete and purge protection, managed identity data-plane access, and secret rotation. Use when reviewing org-owned Key Vaults,…
Authorized Azure managed identity hardening for owned subscriptions: system- vs user-assigned identity, IMDS token acquisition, Azure RBAC on the identity principal, and removing secrets from App Settings. Use when enabling or reviewing managed identity on…