Menu
Skills in this repository
SkillsMP has collected 484 skills from tomysh1337/openstarry-code. Open a skill to review its source and details.
tomysh1337/openstarry-codeShowing 40 of 484 collected skills.
Authorized assessment of the OAuth 2.0 Device Authorization Grant (RFC 8628): device_code / user_code issuance, verification URI integrity, polling and rate limits, client binding, and token exchange abuse. Use when CLI tools, smart TVs, IoT, headless…
Authorized assessment of OAuth 2.0 / OIDC implicit and hybrid token-in-browser flows: response_type=token/id_token leakage, fragment handling, migration to authorization code + PKCE. Use when SPA or legacy SSO still issues access or ID tokens at the authorize…
Authorized assessment and hardening of OAuth 2.0 Pushed Authorization Requests (PAR, RFC 9126): back-channel request push, request_uri lifecycle, client auth at the PAR endpoint, and front-channel reduction. Use when AS discovery shows…
Authorized assessment checklist for OAuth 2.0 PKCE (RFC 7636): code_challenge, code_verifier, S256 vs plain, public-client enforcement, and related code interception controls. Use when SPA, mobile, native, or public clients use authorization code + PKCE under…
Authorized design and assessment of OAuth 2.0 Resource Indicators (RFC 8707): the resource request parameter, absolute resource URIs, multi-resource grants, and audience-restricted access tokens for the indicated protected resource(s). Use when clients or…
Authorized design and assessment of OAuth Demonstrating Proof of Possession (DPoP) and sender-constrained access tokens in the RFC 9449 style: DPoP proofs, htm/htu binding, nonce challenges, cnf.jkt key thumbprints, and Bearer vs DPoP enforcement. Use when…
Design and review metrics, logs, and traces as one observability system: RED/USE at a high level, correlation IDs, cardinality control, and safe telemetry. Use when observability, metrics, tracing, OpenTelemetry, APM, 可观测性, 指标, 链路追踪, Prometheus, span, SLI/SLO…
Extract text from images using Tesseract.js OCR (100% local, no API key required). Supports Chinese (simplified/traditional) and English.
Authorized design, implementation review, and assessment of OpenID Connect Back-Channel Logout: logout_token JWT validation, backchannel_logout_uri delivery, sid/sub session binding, events claim, and propagation to local sessions and refresh tokens. Use when…
Authorized validation and assessment of OpenID Connect ID tokens: iss, aud, exp/nbf, nonce, signature via JWKS, and azp/at_hash checks. Use when an RP or API accepts id_token JWTs after OIDC login, hybrid flow, or token exchange and you must verify claim…
OPA Gatekeeper policy-as-code for owned Kubernetes clusters: ConstraintTemplates (Rego + CRD schema), Constraints (match, parameters, enforcementAction), and audit vs deny behavior. Use when authoring or reviewing Gatekeeper templates and constraints, rolling…
Advanced open-redirect testing: multi-parser gaps, allowlist failures, encoding and scheme tricks, and chains into OAuth/OIDC redirect_uri and token theft. Use when basic next/return checks exist but Location still leaves the trusted host, or when…
Local speech-to-text with the Whisper CLI (no API key).
Verify OpenAPI (and similar) contracts against real producers/consumers: request/response conformance, CI gates, consumer-driven checks, and drift detection. Use when OpenAPI contract tests, schema conformance, Pact/OpenAPI validation,…
Authorized review of OpenID Connect discovery document hygiene: /.well-known/openid-configuration (and OAuth AS metadata), issuer exact-match, HTTPS-only endpoints, JWKS URI trust, advertised algorithms/grants, and cross-document consistency with live IdP…
Generate or declare an OpenRouter video asset for AwesomeWebpageMetaSkill using a parent-leased Provider Settings connection and configured non-secret model/output values.
Hide and keep hidden the real origin server IP behind a CDN/WAF edge for owned infrastructure: DNS hygiene, historical and cert leaks, origin firewall allowlists, authenticated origin pulls, and continuous exposure checks. Use when placing origins behind…
Use for authorized OT/ICS security assessment covering Purdue model zoning, PLC/SCADA exposure, industrial protocol discovery, and safe passive-first evaluation.
Source text: Chinese
Context-aware output encoding and safe sinks to prevent XSS, SQL injection, and related injection via string composition: HTML/XML, attributes, JS, URL, CSS, SQL/NoSQL parameters, shell argv, and log encoding. Use when output encoding, 输出编码, contextual…
Run and gate OWASP Dependency-Check (ODC) for multi-ecosystem SCA: CLI and build plugins, NVD data updates, suppression files, CVSS fail thresholds, and HTML/JSON/SARIF reports in local and CI pipelines. Use when dependency-check, OWASP Dependency-Check, ODC,…
Implement and review Passkeys / WebAuthn (W3C Web Authentication) registration and assertion flows: RP ID, origin, challenge binding, credential store, user verification, and safe fallbacks. Use when adding or hardening passwordless/passkey login, WebAuthn…
Design NIST-oriented password policies: length, deny/breach lists, no composition theater or forced rotation, modern hashing, and manager-friendly UX. Use when defining or reviewing password requirements, signup/change validation, breached-password checks, or…
Authorized testing of password-reset and magic-link poisoning: Host / X-Forwarded-Host influence on reset URLs, token leakage via attacker host, open-redirect and cache chains, and token handling flaws. Use when reset, invite, or verify emails embed absolute…
Defend filesystem path sinks against traversal and escape: canonicalize (resolve) then prefix-check under a fixed root, prefer openat/O_NOFOLLOW, chroot-like jail roots, and reject ".." segments and null bytes. Use when hardening download, include, template,…
主动渗透测试工具链。覆盖信息收集、端口扫描、漏洞扫描、Web 渗透、SQL 注入、目录爆破、密码破解等场景。 通过 MCP server（pentestMCP / mcp-security-hub）将 20+ 安全工具暴露给 AI agent。 触发关键词：渗透测试、端口扫描、Nmap、漏洞扫描、Nuclei、SQL 注入、SQLMap、目录爆破、FFUF、密码破解、Hashcat、信息收集、子域名、Web 渗透、ZAP、Burp。
Source text: Chinese
实战 SRC / 众测 / Bug bounty 漏洞挖掘工作流 skill。包含：5 阶段方法论（intake → recon → enum → hunt → report）、19 个攻击类 playbook（SQLi/XSS/RCE/SSRF/IDOR/CSRF/Path Traversal/File Upload/SSTI/XXE/Race/HTTP Smuggling/OAuth/JWT/SAML/GraphQL/Mobile/LLM/DoS）、305 个结构化 payload、263 个 WAF/EDR…
Source text: Chinese
Plan and review basic performance and load tests: goals, SLIs, scenarios, workloads, and high-level tools. Use when performance testing, 性能测试, load test, stress test, soak test, latency percentiles, k6, JMeter, Gatling, Locust, or capacity checks. Complements…
Assess and harden the Permissions-Policy (formerly Feature-Policy) HTTP response header: powerful browser features, allowlists, iframe delegation, and missing or over-permissive policies. Use when reviewing camera/mic/geo geolocation payment USB sensors…
Audit Python dependencies with pip-audit and enforce install integrity via constraints files and hash-checking mode (pip --require-hashes, hashed requirements). Use when Python CVE/SCA findings, pip-audit CI failures, requirements.txt/constraints.txt drift,…
Authorized design and assessment checklist for OAuth 2.0 PKCE on public clients (SPA, mobile, native, desktop): mandatory S256 code_challenge, code_verifier lifecycle, no embedded client secrets, and token-endpoint binding. Use when public clients run…
Select the most specific installed skill for project planning, task decomposition, persistent progress tracking, product requirements, PRDs, roadmaps, user stories, discovery, and prioritization. Use for project plan, task plan, roadmap, PRD, requirements,…
Use persistent task_plan.md, findings.md, and progress.md files to organize complex multi-step work and resume it across context changes. Use for project plans, task decomposition, research workflows, more than five expected tool calls, 任务规划, 项目计划, 拆解任务,…
Assess and reduce pnpm shamefully-hoist / flat node_modules risk: phantom dependencies, undeclared requires, monorepo cross-package imports, and safer hoist alternatives (public-hoist-pattern, packageExtensions). Use when shamefully-hoist,…
Authorized Podman security hardening and assessment: rootless vs rootful, user namespaces, capabilities, SELinux labels, privileged/host mounts, publish ports, Podman socket exposure, secrets, and image trust. Use when reviewing Containerfile runtime, podman…
Authorized PostgreSQL hardening for owned databases: pg_hba.conf access rules, SSL/TLS, SCRAM-SHA-256 password auth, role least privilege, superuser avoidance, extension allowlists, and connection/auth logging. Use when reviewing postgresql.conf /…
Authorized window.postMessage security review: origin validation on message handlers, targetOrigin misuse, untrusted data into DOM/code sinks, and XSS or token theft via postMessage. Use when apps use iframes, openers, webviews, or cross-window messaging, or…
Write clear pull/merge request titles and bodies using Why / What / Test structure, linked issues, and review-friendly scope. Use when PR description, 写 PR, pull request body, MR description, PR title, GitHub/GitLab PR template, or summarizing a branch for…
Resolve formatter/linter/EditorConfig hierarchy, avoid tool fights, and run a reliable format-then-lint fix pipeline. Use when prettier, eslint, editorconfig, 格式化, format-on-save conflicts, eslint-config-prettier, or CI format checks fail.
Design and review private PKI hierarchies for owned or authorized environments: offline root CA, intermediate and issuing CAs, pathLen and name constraints, trust anchors, CRL/OCSP distribution, and key custody. Use when planning or reviewing an internal CA…
When the user wants to create or update their product marketing context document. Also use when the user mentions 'product context,' 'marketing context,' 'set up context,' 'positioning,' 'who is my target audience,' 'describe my product,' 'ICP,' 'ideal…