Menu
Skills in this repository
SkillsMP has collected 484 skills from tomysh1337/openstarry-code. Open a skill to review its source and details.
tomysh1337/openstarry-codeShowing 40 of 484 collected skills.
Write and review Bash/POSIX shell scripts with safe defaults: set -euo pipefail where appropriate, correct quoting, array-safe iteration, ShellCheck-clean patterns, and predictable error handling. Use when shell script style, bash style, shellcheck, quoting…
Configure and verify Git commit signing with GPG or SSH keys so hosts show a Verified badge and branch protection can require signed commits. Use when signed commits, commit signing, GPG sign, SSH signing key, git commit -S, Verified badge, required signed…
Route tasks across installed and source-cached Codex skills, then delegate to one of nine bilingual domain routers before loading a concrete workflow. Use when several skills could match, the user asks which skill should handle a task, or a complex request…
Inventory, refresh, audit, and selectively stage external Codex skill sources without bulk-registering them. Use when downloading skill repositories, updating skill-sources, checking provenance or duplicates, validating frontmatter and scripts, generating a…
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.
Design and harden SMS one-time password (OTP) risk controls: send/resend budgets, verify attempt limits, code entropy and TTL, purpose binding, and abuse-resistant UX. Use when login, signup, step-up, or recovery relies on SMS OTP and you need send-flood,…
Install, authenticate, and run the Snyk CLI for open-source SCA, Snyk Code, container images, and IaC on owned repositories and CI. Use when snyk test, snyk code test, snyk container test, snyk iac test, snyk monitor, SNYK_TOKEN, .snyk policy, severity…
Select the most specific installed skill for implementation, debugging, testing, code review, API/schema design, Git, packaging, language conventions, concurrency, and architecture. Use for coding, refactor, debug, unit tests, API design, Python, TypeScript,…
Configure and enforce SonarQube / SonarCloud Quality Gates in CI: gate conditions (coverage, duplications, ratings, new-code issues), waitForQualityGate / CE task polling, PR decoration, and fail-closed merge or release when the gate is red. Use when…
Authorized Spring Boot Actuator hardening: endpoint exposure, separate management port, Spring Security on /actuator, health details, and high-risk endpoints (env, heapdump, threaddump, loggers, shutdown, jolokia). Use when reviewing…
Spring Security config checklist: SecurityFilterChain, CSRF, sessions, method security, CORS, password encoding, actuators, JWT resource server. Use when reviewing Spring Boot Security, permitAll mistakes, or hardening org-owned Java/Kotlin apps — authorized…
Defend against SQL injection with parameterized queries and safe ORM patterns: bind values (never concatenate), allowlist ORDER BY/identifiers, avoid unsafe raw SQL APIs, and correct Sequelize/Prisma/SQLAlchemy/EF usage. Use when hardening data access,…
Format and structure SQL for readability and safe evolution: consistent keyword casing, clear table/column naming, explicit joins, migration hygiene, and review-friendly diffs. Use when SQL style, SQL 规范, schema naming, migration readability, query…
SSH key hygiene for org-owned hosts and workstations: modern key types, ssh-agent practices, authorized_keys review, permissions, rotation, and host-key trust. Use when hardening SSH keys, cleaning authorized_keys, agent-forwarding risk, or post-incident key…
Authorized assessment of SSO single logout (SLO) and cross-app session propagation: IdP/SP logout, front- vs back-channel termination, RP-initiated logout, refresh-token and cookie invalidation, and residual sessions after “logout everywhere.” Use when SSO…
Design SSRF defenses for server-side URL fetchers: hostname allowlists, scheme allowlists, metadata and private-IP blocks, DNS-rebinding-safe resolve-then- connect checks, and URL parser pitfalls. Use when hardening webhooks, previews, importers, unfurl,…
Systematic SSRF filter and URL-parser bypass catalog for authorized assessments: IP encoding, DNS/TOCTOU, redirect and scheme tricks, allowlist confusion, and cloud metadata edge cases. Use when a server-side fetch is confirmed but deny-lists, allowlists, or…
Choose and structure application state: client UI state vs server/cache state, and when to use React Context, Zustand, Redux, or URL state. Use when state management, Redux, Zustand, React Query, server state, client state, 状态管理, 全局状态, or when deciding where…
Design content-hashed static asset filenames, long-lived Cache-Control immutable headers, atomic deploy order, and safe HTML/manifest updates so browsers never pair new markup with missing or stale bundles. Use when bundler content hashes, fingerprinted…
Guided statistical analysis for research data - test selection, assumption checking, effect sizes, power analysis, Bayesian alternatives, and APA-formatted reporting. Use whenever a user wants to compare groups, test a hypothesis, analyze experimental or…
Design and authorized assessment of step-up (re-authentication) patterns: sensitive-action challenges, short-lived elevation claims, binding to purpose and session, and server-side enforcement. Use when password change, payments, MFA disable, OAuth grants,…
Authorized malware sample strings and IOC triage: extract ASCII/UTF-16 strings, classify URLs/IPs/paths/mutexes/registry keys, score confidence, and export a minimal IOC set for IR/YARA handoff. Use when doing first-pass static clues on PE/ELF/dumps/scripts —…
Assess and implement Subresource Integrity (SRI) for script and link tags: sha384 digests, crossorigin, CDN trust, hash rotation, integrity mismatches, and service-worker edge cases. Use when reviewing third-party CDN scripts, missing integrity attributes,…
Brief Svelte/SvelteKit security notes: {@html} sinks, CSP, SSR XSS, client store secret hygiene, and hooks.server auth patterns. Use when reviewing or hardening SvelteKit apps, {@html} rich text, handle/hooks session guards, PUBLIC_ env leakage, or Svelte SSR…
Harden SVG handling against XSS and related active-content risks: script, event handlers, foreignObject, animation/set attributes, javascript:/data: URLs, external resource loads, and unsafe serve headers. Use when apps accept, sanitize, inline, or serve…
Generate Software Bills of Materials with Anchore Syft from source trees, container images, archives, and OCI digests: output formats (CycloneDX, SPDX, Syft JSON), scope and cataloger selection, reproducible CI-equivalent scans, and named hashed artifacts.…
Reverse tabnabbing and window.opener hardening for target=_blank links and window.open popups: rel=noopener noreferrer, Cross-Origin-Opener-Policy, and audits of user-generated or untrusted outbound links. Use when pages open third-party or UGC URLs in new…
Harden Tekton Pipelines on owned or authorized clusters: Task/Pipeline definitions, PipelineRun isolation, ServiceAccount RBAC, workspace and secret mounts, step image trust, Triggers EventListeners, and Chains provenance. Use when reviewing Tekton YAML,…
Pin Terraform/OpenTofu providers for reproducible init and plan: required_providers version constraints, .terraform.lock.hcl, terraform providers lock, registry source addresses, and CI lock-aware init. Use when provider versions float, lockfile is missing or…
Terraform security basics for authorized/org-owned infra: remote state and secrets hygiene, IAM least privilege, public S3 and open security groups, provider credential patterns, and safe plan/apply. Use when Terraform security, tfstate secrets, public…
Configure and review Terraform/OpenTofu remote state locking and encryption: S3 + DynamoDB (or native S3 lock), azurerm, and gcs backends; force-unlock risks; who may unlock; and least-privilege lock/state IAM. Use when state lock, DynamoDB lock table,…
Use for authorized security testing of desktop thick clients including local storage, update channels, IPC, traffic, and client-side trust boundaries.
Source text: Chinese
Use for blue-team threat hunting, detection engineering with Sigma/YARA, SIEM query design, and incident detection validation.
Source text: Chinese
STRIDE threat modeling workshop workflow for authorized product and system reviews: scope and DFDs, per-element STRIDE analysis, risk ranking, mitigations, and living model updates. Use when threat model, STRIDE, 威胁建模, DFD, attack surface workshop, security…
Own the TLS certificate lifecycle for systems you control: key generation, CSR, issuance (public CA, private CA, ACME), chain assembly, deployment, renewal, revocation, inventory, and expiry monitoring. Use when designing or reviewing cert…
Select and validate the least invasive method for obtaining TLS plaintext from owned or explicitly authorized applications. Use when proxy capture is empty, certificate trust fails, SSL pinning is suspected, the app uses native BoringSSL/OpenSSL, mTLS is…
Award-winning web design framework inspired by elite agencies (Locomotive, Studio Freight, AREA 17). Use when you need to: (1) build premium portfolio sites and brand websites, (2) create immersive web experiences with custom animations, (3) implement…
Implement and harden RFC 6238 TOTP multi-factor authentication: secret generation, otpauth enrollment, verify windows, attempt limits, backup codes, and session elevation. Use when building or reviewing authenticator-app 2FA (enroll QR, verify code,…
Design and review Traefik security middlewares: Headers (HSTS/CSP/XFO), IPAllowList, BasicAuth/DigestAuth/ForwardAuth, RateLimit, InFlightReq, RedirectScheme, CORS, and middleware chains on routers/services. Use when hardening Traefik static/dynamic config or…
Wire Trivy container image scans into CI with severity exit gates, ignore policy, DB freshness, and SARIF upload to code scanning. Use when Trivy image CI, trivy image --severity, --exit-code, SARIF upload, GitHub code scanning container CVE gate,…