tomysh1337/openstarry-code - Page 3

code-audit

Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.

Source text: Chinese

code-quality-standards

Apply repository-aligned coding standards while adding features, fixing bugs, refactoring, or reviewing implementation changes. Use when writing or modifying production code and the task needs maintainability, clear boundaries, type and data-model discipline,…

code-review-comments-style

Write clear, kind, actionable code review comments with appropriate severity, and decide request-changes vs nit vs approve. Use when code review comments, PR review feedback, 评审意见写法, review tone, blocking vs non-blocking notes, or drafting GitHub/GitLab…

code-task

PREFERRED way to change code in a REAL repository: fix a GitHub issue, fix a bug, add/implement a function or feature, or make any edit to a project the user names by a filesystem path (e.g. /tmp/foo, ~/code/bar) or a git URL. Clones the repo, runs an…

codeowners-review-routing

Design and maintain CODEOWNERS path ownership, required review rules, and monorepo routing that avoids single-owner bottlenecks. Use when CODEOWNERS syntax, path owners, required reviewers, branch protection review counts, monorepo package ownership, review…

codeql-query-pack-basics

CodeQL packs: qlpack.yml layout, query vs library packs, dependencies, lock files, custom queries, suite selection, and analyze/CI wiring for org-owned codebases. Use when creating or packing CodeQL query packs, qlpack.yml / codeql-pack.yml, pack…

command-injection-defenses

Defend applications against OS command injection by avoiding shells, using argv arrays, allowlisting inputs and binaries, and preferring library APIs over exec. Use when hardening process spawning, subprocess/ProcessBuilder/ child_process sinks, CLI wrappers…

comment-writing-standards

Standards for when and why to write comments, what not to narrate, and how to document decisions, invariants, and non-obvious constraints in code. Use when writing comments, reviewing comment quality, documenting intent, 写注释, 注释规范, comment style, or deciding…

commit-message-conventions

Write clear git commit messages using Conventional Commits (type, optional scope, subject/body/footer), emphasizing why the change exists rather than restating the diff. Use when drafting or reviewing a commit message, Conventional Commits, 提交信息, git commit…

composer-security-audit

Run and gate PHP Composer dependency vulnerability checks with composer audit locally and in CI: Packagist/GitHub security advisories, composer.lock scans, JSON output, abandoneds, ignore policy, and upgrade paths for owned PHP apps. Use when composer audit,…

composio-app-automation-catalog

Route Composio and Rube app-automation requests to a cached catalog of 810 canonical workflows derived from 832 source skills. Use when a user asks to automate or connect a SaaS or API through Composio/Rube MCP, needs an app-specific tool sequence, or…

container-image-signing

Sign and verify container images with Cosign and Sigstore: keyless OIDC, long-lived keys, and admission or policy enforcement by digest. Use when cosign sign/verify, Fulcio/Rekor, keyless OIDC image signing, Kyverno or Gatekeeper or Sigstore policy-controller…

content-security-policy-bypass

Authorized Content-Security-Policy (CSP) review and bypass research: parse policy directives, assess nonce/hash/'strict-dynamic' posture, source expressions, and XSS impact under CSP. Use when responses or meta tags set CSP, inline script is blocked, or a…

content-strategy

When the user wants to plan a content strategy, decide what content to create, or figure out what topics to cover. Also use when the user mentions "content strategy," "what should I write about," "content ideas," "blog strategy," "topic clusters," "content…

content-type-sniffing-defense

Defend against MIME / content-type sniffing: enforce X-Content-Type-Options nosniff, accurate Content-Type, safe user-upload serve paths, and polyglot body risks that browsers re-interpret as HTML/script. Use when hardening or auditing response headers for…

contract-testing-pact

Consumer-driven contract testing (Pact-style): consumer expectations, provider verification, broker publish, and CI compatibility gates. Use when Pact, CDC, consumer-driven contracts, provider verification, pact broker, can-i-deploy, or API shape drift…

cookie-security-flags

Assess and harden HTTP cookie flags: Secure, HttpOnly, SameSite, Domain, Path, Prefixes (__Host-/__Secure-), and Max-Age/Expires. Use when reviewing session or auth cookies for missing flags, overly broad scope, CSRF exposure, or XSS cookie theft risk on…

coop-coep-isolation

Design, audit, and remediate Cross-Origin-Opener-Policy (COOP) and Cross-Origin-Embedder-Policy (COEP) for browser cross-origin isolation (crossOriginIsolated, SharedArrayBuffer, Spectre mitigations). Use when enabling or debugging COOP/COEP/CORP, SAB…

copywriting

When the user wants to write, rewrite, or improve marketing copy for any page — including homepage, landing pages, pricing pages, feature pages, about pages, or product pages. Also use when the user says "write copy for," "improve this copy," "rewrite this…

cordova-webview-risks

Authorized Cordova/PhoneGap hybrid app security review: config.xml navigation allowlists, file:// origin and content access, JS↔native bridge injection, and outdated/vulnerable plugins. Use when assessing Cordova, PhoneGap, Ionic Cordova, or…

cors-credentialed-requests

Authorized assessment of credentialed CORS: Access-Control-Allow-Credentials with cookies or client certs, forbidden ACAO *, origin reflection, null origin, preflight vs simple requests, and browser PoC requirements. Use when ACAC true, credentialed…

cors-preflight-cache

Authorized assessment of CORS preflight caching (Access-Control-Max-Age), browser OPTIONS cache behavior, ACAO reflection under credentials, and preflight/CDN cache-poison risks. Use when debugging CORS failures, tuning Max-Age, or validating that cached…

cosign-keyless-verify

Verify Cosign keyless (Sigstore/Fulcio/Rekor) signatures on images and artifacts with tight identity and OIDC issuer allowlists. Use when cosign verify, --certificate-identity, --certificate-oidc-issuer, keyless Sigstore check, Rekor transparency, signed…

crack-keygen

Software authorization analysis: key generation, license bypass, binary patching, DRM removal. Trigger: crack, keygen, patch, license, serial, bypass auth, activate, unlock.

cro

When the user wants to optimize, improve, or increase conversions on any marketing page or form — including homepage, landing pages, pricing pages, feature pages, lead capture forms, or contact forms. Also use when the user says 'CRO,' 'conversion rate…

cross-origin-opener-policy

Assess and implement Cross-Origin-Opener-Policy (COOP) for browsing-context isolation: same-origin, same-origin-allow-popups, unsafe-none, pairing with COEP for crossOriginIsolated / SharedArrayBuffer, and popup/OAuth breakage. Use when hardening…

csdn-skill-distiller

Convert Chinese technical research from CSDN or similar blogs into concise, validated Codex skills. Use when the user asks Codex to learn from CSDN, summarize Chinese developer articles into reusable workflows, create or update a skill from blog research, or…

csharp-style-conventions

Apply C# and .NET naming conventions, XML documentation comments, and nullable reference type style when writing or reviewing C# code. Use when C# style, .NET naming, XML docs, nullable reference types, EditorConfig/StyleCop alignment, or public API…

csp-report-only-rollout

Roll out Content-Security-Policy-Report-Only safely: report-uri/report-to, owned collectors, violation triage, noise filtering, gradual directive tightening, canary then enforce. Use when staging CSP without blocking production, cutting report floods,…

css-injection-exfiltration

Authorized CSS injection and style-based data exfiltration awareness: map untrusted input into style contexts, assess attribute-selector and url()/@import channels, and document impact under CSP style-src without treating CSS as full script XSS. Use when…

database-migration-safety

Plan and review safe database migrations: expand/contract, backward-compatible deploys, locking/index risks, backfills, and zero-downtime notes. Use when DB migration, 数据库迁移, schema change, online DDL, expand/contract, dual-write, backfill, or shipping…

database-security

Use for authorized database security assessment covering PostgreSQL/MySQL/MSSQL/Mongo/Redis exposure, authz, UDF/command paths, and misconfiguration review.

Source text: Chinese

debugger-integration

Advanced debugging integration for vulnerability research

dependabot-config-hardening

Harden GitHub Dependabot: complete .github/dependabot.yml coverage, safe schedules and groups, PR limits, private registries, ignore expiry, monorepo directories, Actions and Docker updates, and review/CI gates without blind auto-merge. Use when…

dependency-pinning-strategies

Choose and enforce dependency pins: committed lockfiles, exact vs range versions, CI frozen installs, and Dependabot/Renovate update policy with supply-chain tradeoffs. Use when lockfiles, package-lock, yarn.lock, pnpm-lock, poetry.lock, go.sum, Cargo.lock,…

deserialization-safe-formats

Defensive guidance for safe interchange formats and deserializers: prefer JSON, Protobuf, and schema-bound codecs over pickle, native Java serialization, BinaryFormatter-class APIs, and unrestricted YAML load. Use when choosing or hardening serializers,…

device-binding-tokens

High-level design and authorized assessment of device-bound and proof-of-possession tokens (DPoP-style, mTLS/cnf, sender-constrained access tokens). Use when APIs, mobile apps, or SPAs claim tokens are bound to a key, device, or TLS client cert, or when…

digital-forensics

Use for authorized digital forensics including memory dumps, disk timelines, PCAP investigation, artifact triage, and IR evidence preservation.

Source text: Chinese

distroless-image-adoption

Adopt and migrate application runtimes to distroless (or equivalent minimal non-shell) container images: multi-stage copy-in, language base choice (static/base/cc/java/nodejs/python), nonroot UIDs, CA/tzdata, and debug without a package manager. Use when…

django-csrf-middleware-tuning

Tune and review Django CsrfViewMiddleware and CSRF-related settings: CSRF_TRUSTED_ORIGINS, cookie flags, header names, exemptions, and middleware order for cookie-authenticated browser apps. Use when Django CSRF 403s after deploy, SPA/API Origin mismatches,…