Menu
Skills in this repository
SkillsMP has collected 484 skills from tomysh1337/openstarry-code. Open a skill to review its source and details.
tomysh1337/openstarry-codeShowing 40 of 484 collected skills.
Adopt browser Trusted Types for DOM XSS mitigation: require-trusted-types-for, trusted-types, createPolicy, default policy risks, sink migration (innerHTML, outerHTML, insertAdjacentHTML, document.write, script src/text, eval), report-only rollout, browser…
Migrate a TypeScript codebase toward compiler strict mode: inventory current flags, enable checks incrementally (strictNullChecks, noImplicitAny, and the rest of strict), use per-package or path-scoped tsconfigs, ts-migrate/codemod patterns, and temporary…
Apply TypeScript strictness, ESLint/Prettier interplay, any-ban patterns, and import-order discipline while editing or reviewing TS/TSX code. Use when TypeScript style, ESLint, TS 风格, @typescript-eslint, no-explicit-any, import order, tsconfig strict, or…
UI/UX design intelligence for web, mobile, and desktop. This skill should be used when designing, building, reviewing, or fixing interfaces, including pages, components, design systems, accessibility, interaction, responsive layout, typography, color, charts,…
Single automatic entry point for selecting installed Codex skills by bilingual task keywords and exact intent. Use for broad, ambiguous, or multi-domain requests spanning engineering, frontend, security, cloud operations, science and data, documents and…
Design and review unit tests: what to test, naming, AAA structure, isolation, and focused assertions. Use when unit tests, 单元测试, test naming, Arrange-Act-Assert, table-driven tests, test design, or reviewing flaky/brittle unit suites. Complements…
HashiCorp Vault Agent Injector on Kubernetes: pod annotations, Agent vs template rendering, Kubernetes auth and other methods, secret rotation, and avoiding long-lived tokens in images or manifests. Use when designing or reviewing vault.hashicorp.com/*…
Guide for implementing smooth, native-feeling animations using React's View Transition API (ViewTransition component, addTransitionType, and CSS view transition pseudo-elements). Use this skill whenever the user wants to add page transitions, animate route…
Triage and analyze suspected VMProtect 3.0-3.5 native virtualization with staged static inspection, IDA debugger traces, and controlled dynamic execution. Use MogVMP as a reference for VM handler and dispatcher analysis; preserve evidence and avoid blind…
Structure Vue 3 components with Composition API, props/emits, slots, and colocation. Use when Vue, Vue 3, Composition API, props, emits, script setup, Vue 组件, 组合式 API, 组件结构, defineProps, defineEmits, or when reviewing Vue UI structure. Pairs with…
Design Vue Router navigation guards and route meta for auth UX: requiresAuth, role/permission meta, guest-only routes, redirect loops, and token refresh on navigation. Use when building or reviewing Vue 3 router beforeEach/afterEach, meta.requiresAuth, login…
Vulnerability management SLAs by severity, exception/risk-acceptance process, scanner-noise handling, and ticket lifecycle for org-owned findings. Use when vulnerability SLA, fix-by severity clocks, exception request, risk acceptance, vuln ticket workflow,…
Authorized WAF rule tuning basics: false-positive triage, detect-then-block rollout, exception design, managed vs custom rules, and evidence from WAF logs. Use when reducing noisy blocks on owned apps, staging a new managed ruleset, designing…
Web application penetration testing: SQL injection, XSS, CSRF, SSRF, auth bypass, file upload, command injection. Trigger: pentest, exploit web, sqli, xss, csrf, ssrf, auth bypass, upload exploit, rce, command inject.
Review WebAuthn/passkey attestation conveyance, statement formats, trust anchors, and AAGUID policy for registration. Use when choosing or auditing attestationPreference (none/indirect/direct/enterprise), MDS/trust-store verification, enterprise device…
Deep WebSocket authorization after the HTTP upgrade: re-bind identity per message, subscribe/channel ACL, token refresh, privilege changes mid-session, and cross-account action IDs. Use when sockets stay open long after 101 and message-layer authZ is unclear.…
Recover binary application protocols carried over WebSocket from PCAPs, browser traces, proxy exports, or runtime logs. Use when WebSocket opcode 2 frames are opaque, messages are fragmented, payloads use Protobuf, MessagePack, CBOR, compression, encryption,…
Design robust WebSocket clients: lifecycle, auth, reconnect/backoff, heartbeats, message typing, backpressure, and shutdown. Use when building or reviewing browser/native WS clients, realtime feeds, or chat sockets. Not primary for CSWSH testing…
Authorized testing of WebSocket Origin header validation, cookie-authenticated upgrades, and CSWSH-style (cross-site WebSocket hijacking) risks on the HTTP Upgrade path. Use when assessing whether browsers can open a session-backed WebSocket from a foreign…
Design WebSocket rate limits: connection/upgrade budgets, concurrent sockets, per-message and byte/frame caps, subscription fan-out, close/backpressure signals, and abuse-resistant keying. Use when WebSocket rate limit design, WS throttle, socket quota,…
Use for authorized wireless security assessment including Wi-Fi capture, WPA handshake analysis, rogue AP detection research, and lab-only deauth testing.
Source text: Chinese
Use for authorized Active Directory and Windows identity attacks including Kerberos, AD CS, BloodHound paths, NTLM relay, and domain privilege escalation research.
Source text: Chinese
Authorized Windows host hardening basics: local accounts and LSA, RDP and network exposure, Windows Update and features, Defender/ASR, audit policy, SMB/LLMNR reductions, and service least privilege. Use when hardening org-owned Windows servers or…
Defensive guidance and authorized assessment for XML external entity (XXE) and billion-laughs / entity-expansion DoS: parser hardening, DTD policy, expansion limits, and safe stack configuration. Use when hardening or retesting XML/SOAP/SAML/SVG/Office…
Hardening XML parsers against XXE by disabling external entities and DTDs with language-specific safe defaults (Java, Python, .NET, libxml/lxml, PHP). Use when configuring DocumentBuilderFactory, XmlReader, defusedxml, libxml, SOAP/SAML/SVG/Office parsers, or…
Practical YARA hunting loop against authorized corpora: scope, baselining, scan, triage hits, reduce false positives, and promote durable detections. Use when hunting malware/family matches with existing or draft rules — not as a full rule-authoring textbook…
Author, fix, and enforce Yarn Berry (Yarn 2+) workspace constraints for dependency consistency, banned packages, field rules, and CI gates. Use when yarn constraints, constraints.pro, yarn.config.cjs constraints, monorepo dependency alignment, workspace:…
Zip slip and archive path-traversal on extract: detect, prove, and prevent unsafe zip/tar/7z extraction that writes outside the intended directory via ../ or absolute entry names. Use when zip slip, archive extract, unzip path traversal, tar slip, malicious…
Query scholarly metadata and the web through Crossref, Brave, Tavily, and DuckDuckGo with a single CLI surface. Trigger when the user asks for research search, fact lookup, source discovery, or engine comparison. Results retain DOI, publication year, and…
Build, validate, and release OpenStarry Code desktop applications. Use for Electron packaging, Windows EXE/MSI installers, bundled runtimes, artifact verification, and GitHub Release publication.
Deterministic image downloader for AwesomeWebpageMetaSkill search results. Use as skill_exec to fetch candidate image URLs into the configured local project tree without sandboxed shell curl.
Render HTML (with CSS) to a PDF file. Trigger when the user wants to export a styled report, invoice, label, or any HTML/Jinja-rendered page to PDF. Uses WeasyPrint, which supports a meaningful subset of CSS Paged Media (page size, margins, headers/footers,…
Compile a LaTeX project (xelatex × bibtex × xelatex × xelatex) and report the log tail. Demo-only.
Internal cross-platform artifact persistence, assembly, citation-audit, and PDF compilation runtime for meta-paper-write.
Deterministic artifact-backed manuscript readiness gate for meta-paper-write. Validates the workspace LaTeX artifact before compilation while leaving final page-count enforcement to compile_pdf.
Internal tool (not user-invocable). Called by meta-skill-creator as a DAG step (kind: agent) to lint a candidate meta-skill SKILL.md against G1 (parse + reference check + xml_escape grep + structural lint) and G2 (scheduler dry-run with stub executors).…
Internal tool (not user-invocable). Called by meta-skill-creator's persist step and by `opensquilla meta accept` CLI (Phase 2) to manage `~/.opensquilla/proposals/`: write_proposal / list / accept. Returns JSON.
Burn an SRT subtitle file into an MP4 via ffmpeg's subtitles filter (libass). Single-pass re-encode of video; audio copied as-is. Uses a verified managed Noto Sans CJK font when available. Used by meta-short-drama as the final subtitling step after merge.
Read a UTF-8 text file and emit its raw content on stdout. Tiny helper for meta-skills that need to round-trip an artefact through disk so the user can hand-edit it between steps (e.g. tweak script.txt during a review pause). Unlike the builtin read_file tool…
Render a static title / ending card PNG with Pillow. Centered headline + optional subtitle on a solid-colour background. Uses managed or platform CJK fonts with glyph verification and fails actionably instead of rendering tofu. Pure deterministic, no LLM, no…