Menu
Skills in this repository
SkillsMP has collected 484 skills from tomysh1337/openstarry-code. Open a skill to review its source and details.
tomysh1337/openstarry-codeShowing 40 of 484 collected skills.
Django settings security checklist for org-owned projects: DEBUG, SECRET_KEY, ALLOWED_HOSTS, CSRF/CORS/cookies, SSL redirect, HSTS, XSS/clickjacking middleware, and safe production settings modules. Use when Django security settings, django settings…
Assess and harden email authentication for owned domains: SPF, DKIM, and DMARC (policy rollout, alignment, reporting). Use when reviewing DNS TXT records, spoofing resistance, p=none→quarantine→reject progression, third-party senders, BIMI readiness, or…
Deploy and operate DNSSEC on zones you own or are authorized to manage: key models (KSK/ZSK or CSK), signing algorithms, DS publication at the parent, chain-of-trust validation, key rollover, NSEC/NSEC3, and failure triage. Use when enabling DNSSEC, fixing…
Review and harden docker-compose files for privileged mode, host port publishing, secrets, volume mounts, networks, and capability grants. Use when docker-compose.yml security, privileged containers, docker.sock mounts, Compose secrets, host network mode, or…
Diagnose and fix Docker Hub pull rate limits in CI: anonymous vs authenticated quotas, shared runner IPs, mirrors, private base caches, and registry migration. Use when CI fails with toomanyrequests, 429, Docker Hub rate limit, docker.io pulls flaky on GitHub…
Install, operate, and harden Docker Engine in rootless mode: user namespaces, dockerd-rootless-setuptool, systemd user units, slirp4netns/pasta networking, storage drivers, and known limitations vs rootful Docker. Use when setting up rootless Docker,…
Author and review Dockerfiles for multi-stage builds, non-root runtime, layer caching, and secrets that never land in image layers. Use when Dockerfile, Docker best practices, Docker 最佳实践, container image build, multi-stage build, non-root user,…
Creates task-oriented technical documentation with progressive disclosure. Use when writing READMEs, API docs, architecture docs, or markdown documentation. Also use this skill at the END of any completed reverse engineering, penetration testing, CTF, or…
Source text: Mixed languages
Select the most specific installed skill for Word, PDF, slides, spreadsheets, Markdown, research, analysis, writing, reports, and diagrams. Use for DOCX, XLSX, PPTX, PDF, README, changelog, runbook, report, research, 文档, 表格, 幻灯片, 演示文稿, 报告, 研究, 论文, 引用, 流程图, or…
Decide when and how to write Python docstrings (PEP 257) and JS/TS JSDoc/TSDoc for public APIs, with templates and anti-patterns. Use when docstring, JSDoc, TSDoc, 文档字符串, API docs comments, typedoc, pydoc, or documenting exported functions/classes/modules.
Authorized DOM clobbering awareness: named HTML elements (id/name) shadowing window and document properties, form/collection multi-level clobbering, and client config or sink confusion without a script injection. Use when markup accepts attacker-controlled…
Assess and harden HTML download attribute usage, Content-Disposition filenames, content-type sniffing on file responses, and XSS or path risks via user-facing downloads. Use when reviewing <a download>, attachment/inline disposition, filename injection,…
Playwright end-to-end testing strategy: critical journeys, stable selectors, fixtures, isolation, and CI discipline. Use when Playwright, e2e tests, end-to-end, browser tests, page object, web-first assertions, or flaky UI suites. Complements…
Enable and operate Amazon ECR image vulnerability scanning for owned AWS accounts: basic vs enhanced (Inspector) scan, scan-on-push, registry and repository scan filters, finding triage, and CI/deploy gates on CRITICAL/HIGH. Use when reviewing ECR scan…
Authorized Elasticsearch security hardening: xpack.security, HTTP/transport TLS, anonymous access disabled, users/role mapping, no public 9200/9300, and least-privilege snapshot/restore. Use when reviewing elasticsearch.yml, Elastic Cloud / ECK / self-managed…
Authorized Electron desktop app security review: nodeIntegration, contextIsolation, sandbox, preload bridges, shell.openExternal, navigation and webview risks, and renderer XSS to OS/code execution. Use when assessing Electron, Spectron-era, or…
Defend mail-sending paths against CRLF / email header injection by rejecting control characters, using structured mail APIs, and never concatenating untrusted data into raw SMTP or MIME headers. Use when hardening Subject, To, From, Cc, Bcc, Reply-To, or…
Design and review rate limits for email one-time passwords (OTP): send/resend cooldowns, per-destination and dual keys, verify attempt budgets, enumeration-safe UX, and mail-provider cost controls. Use when email OTP throttle, resend cooldown, magic-code send…
Use for authorized email security review including phishing analysis, header authentication (SPF/DKIM/DMARC), BEC patterns, and mailbox token abuse research.
Source text: Chinese
When the user wants to create or optimize an email sequence, drip campaign, automated email flow, or lifecycle email program. Also use when the user mentions "email sequence," "drip campaign," "nurture sequence," "onboarding emails," "welcome sequence,"…
Twelve-factor style application config: store config in the environment, strict separation of code from config, typed/validated env loading, and no secrets baked into images or git. Use when env config, 12-factor, 环境变量配置, twelve-factor config, dotenv, config…
Design, review, and troubleshoot Envoy external authorization (ext_authz): HTTP/network filter placement, gRPC vs HTTP auth services, CheckRequest/ CheckResponse, failure_mode_allow, header mutation, and route-level overrides. Use when hardening or assessing…
Write and review user-facing error messages that are actionable, free of secrets, and paired with stable machine codes. Use when error messages, 错误文案, exception messages for users, API error payloads, toast/alert copy, form validation text, or when UX/review…
Install, configure, and triage eslint-plugin-security for JavaScript and TypeScript: detectObjectInjection, detect-eval-with-expression, child_process and fs path patterns, legacy vs flat ESLint config, CI gates, and justified suppressions. Use when…
Defense evasion: AMSI bypass, ETW patch, obfuscation, packing, code signing bypass. Trigger: evade, obfuscate, pack, amsi, etw, bypass defender, hide, encode payload, crypt.
Design experiments and studies BEFORE data is collected — choosing a design, randomizing, blocking, and laying out treatment combinations so results are interpretable. Use whenever someone is planning a study, asks how to assign subjects/samples to groups,…
Exploit development: shellcode generation, ROP chain building, format string attacks, buffer overflow patterns. Trigger: exploit dev, shellcode, rop, buffer overflow, format string, use-after-free, heap spray, ret2libc.
Secure Express middleware stacks: helmet, CORS, rate limits, body limits, trust proxy, auth guards, and correct middleware order. Use when Express security, helmet, express-rate-limit, cors package, cookie/session middleware, JWT auth middleware, or hardening…
External Secrets Operator (ESO) for Kubernetes: SecretStore and ClusterSecretStore design, ExternalSecret sync, and provider IAM for AWS Secrets Manager, HashiCorp Vault, and GCP Secret Manager. Use when wiring or reviewing ESO CRDs, refresh intervals,…
Secure FastAPI apps: Depends-based auth, CORS/TrustedHost, HTTPS, security headers, Pydantic boundaries, JWT/OAuth2 schemes, and safe middleware order. Use when FastAPI security, FastAPI CORS, Depends auth, OAuth2PasswordBearer, TrustedHostMiddleware,…
Design and review feature flags, kill switches, targeting, rollout, and flag cleanup. Use when feature flags, feature toggles, kill switch, gradual rollout, percentage rollout, targeting rules, LaunchDarkly, Unleash, Flagsmith, OpenFeature, 功能开关, 灰度, 熔断开关, or…
Assess and implement Fetch Metadata request headers (Sec-Fetch-Site, Sec-Fetch-Mode, Sec-Fetch-Dest, Sec-Fetch-User) for CSRF mitigation and Resource Isolation Policy (RIP). Use when hardening or auditing same-origin vs same-site vs cross-site browser request…
Design and authorized review of FIDO2/WebAuthn enterprise attestation (EA): conveyance preference enterprise, vendor/platform EA enrollment of the RP, unique device-identifying attStmt chains, MDM-aligned allowlists, and privacy- safe storage. Use when…
Authorized methodology to detect and mitigate polyglot file uploads — one byte stream valid as multiple formats (image+HTML/JS, PDF+ZIP, SVG/XML dual parse, Office ZIP+XML). Use when assessing dual interpretation, stored XSS via polyglots, or building…
Design and review secure storage for user file uploads: random object keys, cookie-less separate domain, content-type/magic validation, antivirus hooks, size quotas, and non-executable permissions. Use when implementing or auditing upload landing zones,…
Search Tencent SkillHub for existing skills by Chinese or English task intent, category, target object, and action, then rank a short list for review. Use when the user asks to find, compare, recommend, or selectively install a SkillHub skill, or wants to…
Authorized firewall and security-group rule review methodology: inventory, least privilege, shadow/redundant rules, egress control, change hygiene, and evidence-based findings. Use when reviewing iptables/nftables, cloud SGs/NSGs, host firewalls, or network…
Firmware analysis basics for owned devices, vendor-supplied images, and CTF firmware blobs: identification, binwalk unpack, filesystem extract (squashfs, jffs2, ubifs, initramfs), credential/config triage, and hand-off to binary RE. Use when analyzing…
Historical and residual assessment of Adobe Flash crossdomain.xml and Microsoft Silverlight clientaccesspolicy.xml: over-permissive allow-access-from wildcards, socket policies, domain attributes, and leftover player surfaces. Use when legacy…
Authorized Flutter app security basics: flutter_secure_storage and secret placement, MethodChannel/EventChannel trust boundaries, Dart obfuscation limits, deep-link / App Links validation, and certificate-pinning packages. Use when reviewing or hardening…