Menü
Skills in diesem Repository
SkillsMP hat 484 Skills aus tomysh1337/openstarry-code gesammelt. Öffne einen Skill, um Quelle und Details zu prüfen.
tomysh1337/openstarry-codeEs werden 40 von 484 gesammelten Skills angezeigt.
Write and review Bash/POSIX shell scripts with safe defaults: set -euo pipefail where appropriate, correct quoting, array-safe iteration, ShellCheck-clean patterns, and predictable error handling. Use when shell script style, bash style, shellcheck, quoting…
Quellsprache: Englisch
Configure and verify Git commit signing with GPG or SSH keys so hosts show a Verified badge and branch protection can require signed commits. Use when signed commits, commit signing, GPG sign, SSH signing key, git commit -S, Verified badge, required signed…
Quellsprache: Englisch
Route tasks across installed and source-cached Codex skills, then delegate to one of nine bilingual domain routers before loading a concrete workflow. Use when several skills could match, the user asks which skill should handle a task, or a complex request…
Quellsprache: Englisch
Inventory, refresh, audit, and selectively stage external Codex skill sources without bulk-registering them. Use when downloading skill repositories, updating skill-sources, checking provenance or duplicates, validating frontmatter and scripts, generating a…
Quellsprache: Englisch
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.
Quellsprache: Englisch
Design and harden SMS one-time password (OTP) risk controls: send/resend budgets, verify attempt limits, code entropy and TTL, purpose binding, and abuse-resistant UX. Use when login, signup, step-up, or recovery relies on SMS OTP and you need send-flood,…
Quellsprache: Englisch
Install, authenticate, and run the Snyk CLI for open-source SCA, Snyk Code, container images, and IaC on owned repositories and CI. Use when snyk test, snyk code test, snyk container test, snyk iac test, snyk monitor, SNYK_TOKEN, .snyk policy, severity…
Quellsprache: Englisch
Select the most specific installed skill for implementation, debugging, testing, code review, API/schema design, Git, packaging, language conventions, concurrency, and architecture. Use for coding, refactor, debug, unit tests, API design, Python, TypeScript,…
Quellsprache: Englisch
Configure and enforce SonarQube / SonarCloud Quality Gates in CI: gate conditions (coverage, duplications, ratings, new-code issues), waitForQualityGate / CE task polling, PR decoration, and fail-closed merge or release when the gate is red. Use when…
Quellsprache: Englisch
Authorized Spring Boot Actuator hardening: endpoint exposure, separate management port, Spring Security on /actuator, health details, and high-risk endpoints (env, heapdump, threaddump, loggers, shutdown, jolokia). Use when reviewing…
Quellsprache: Englisch
Spring Security config checklist: SecurityFilterChain, CSRF, sessions, method security, CORS, password encoding, actuators, JWT resource server. Use when reviewing Spring Boot Security, permitAll mistakes, or hardening org-owned Java/Kotlin apps — authorized…
Quellsprache: Englisch
Defend against SQL injection with parameterized queries and safe ORM patterns: bind values (never concatenate), allowlist ORDER BY/identifiers, avoid unsafe raw SQL APIs, and correct Sequelize/Prisma/SQLAlchemy/EF usage. Use when hardening data access,…
Quellsprache: Englisch
Format and structure SQL for readability and safe evolution: consistent keyword casing, clear table/column naming, explicit joins, migration hygiene, and review-friendly diffs. Use when SQL style, SQL 规范, schema naming, migration readability, query…
Quellsprache: Englisch
SSH key hygiene for org-owned hosts and workstations: modern key types, ssh-agent practices, authorized_keys review, permissions, rotation, and host-key trust. Use when hardening SSH keys, cleaning authorized_keys, agent-forwarding risk, or post-incident key…
Quellsprache: Englisch
Authorized assessment of SSO single logout (SLO) and cross-app session propagation: IdP/SP logout, front- vs back-channel termination, RP-initiated logout, refresh-token and cookie invalidation, and residual sessions after “logout everywhere.” Use when SSO…
Quellsprache: Englisch
Design SSRF defenses for server-side URL fetchers: hostname allowlists, scheme allowlists, metadata and private-IP blocks, DNS-rebinding-safe resolve-then- connect checks, and URL parser pitfalls. Use when hardening webhooks, previews, importers, unfurl,…
Quellsprache: Englisch
Systematic SSRF filter and URL-parser bypass catalog for authorized assessments: IP encoding, DNS/TOCTOU, redirect and scheme tricks, allowlist confusion, and cloud metadata edge cases. Use when a server-side fetch is confirmed but deny-lists, allowlists, or…
Quellsprache: Englisch
Choose and structure application state: client UI state vs server/cache state, and when to use React Context, Zustand, Redux, or URL state. Use when state management, Redux, Zustand, React Query, server state, client state, 状态管理, 全局状态, or when deciding where…
Quellsprache: Englisch
Design content-hashed static asset filenames, long-lived Cache-Control immutable headers, atomic deploy order, and safe HTML/manifest updates so browsers never pair new markup with missing or stale bundles. Use when bundler content hashes, fingerprinted…
Quellsprache: Englisch
Guided statistical analysis for research data - test selection, assumption checking, effect sizes, power analysis, Bayesian alternatives, and APA-formatted reporting. Use whenever a user wants to compare groups, test a hypothesis, analyze experimental or…
Quellsprache: Englisch
Design and authorized assessment of step-up (re-authentication) patterns: sensitive-action challenges, short-lived elevation claims, binding to purpose and session, and server-side enforcement. Use when password change, payments, MFA disable, OAuth grants,…
Quellsprache: Englisch
Authorized malware sample strings and IOC triage: extract ASCII/UTF-16 strings, classify URLs/IPs/paths/mutexes/registry keys, score confidence, and export a minimal IOC set for IR/YARA handoff. Use when doing first-pass static clues on PE/ELF/dumps/scripts —…
Quellsprache: Englisch
Assess and implement Subresource Integrity (SRI) for script and link tags: sha384 digests, crossorigin, CDN trust, hash rotation, integrity mismatches, and service-worker edge cases. Use when reviewing third-party CDN scripts, missing integrity attributes,…
Quellsprache: Englisch
Brief Svelte/SvelteKit security notes: {@html} sinks, CSP, SSR XSS, client store secret hygiene, and hooks.server auth patterns. Use when reviewing or hardening SvelteKit apps, {@html} rich text, handle/hooks session guards, PUBLIC_ env leakage, or Svelte SSR…
Quellsprache: Englisch
Harden SVG handling against XSS and related active-content risks: script, event handlers, foreignObject, animation/set attributes, javascript:/data: URLs, external resource loads, and unsafe serve headers. Use when apps accept, sanitize, inline, or serve…
Quellsprache: Englisch
Generate Software Bills of Materials with Anchore Syft from source trees, container images, archives, and OCI digests: output formats (CycloneDX, SPDX, Syft JSON), scope and cataloger selection, reproducible CI-equivalent scans, and named hashed artifacts.…
Quellsprache: Englisch
Reverse tabnabbing and window.opener hardening for target=_blank links and window.open popups: rel=noopener noreferrer, Cross-Origin-Opener-Policy, and audits of user-generated or untrusted outbound links. Use when pages open third-party or UGC URLs in new…
Quellsprache: Englisch
Harden Tekton Pipelines on owned or authorized clusters: Task/Pipeline definitions, PipelineRun isolation, ServiceAccount RBAC, workspace and secret mounts, step image trust, Triggers EventListeners, and Chains provenance. Use when reviewing Tekton YAML,…
Quellsprache: Englisch
Pin Terraform/OpenTofu providers for reproducible init and plan: required_providers version constraints, .terraform.lock.hcl, terraform providers lock, registry source addresses, and CI lock-aware init. Use when provider versions float, lockfile is missing or…
Quellsprache: Englisch
Terraform security basics for authorized/org-owned infra: remote state and secrets hygiene, IAM least privilege, public S3 and open security groups, provider credential patterns, and safe plan/apply. Use when Terraform security, tfstate secrets, public…
Quellsprache: Englisch
Configure and review Terraform/OpenTofu remote state locking and encryption: S3 + DynamoDB (or native S3 lock), azurerm, and gcs backends; force-unlock risks; who may unlock; and least-privilege lock/state IAM. Use when state lock, DynamoDB lock table,…
Quellsprache: Englisch
Use for authorized security testing of desktop thick clients including local storage, update channels, IPC, traffic, and client-side trust boundaries.
Quellsprache: Chinesisch
Use for blue-team threat hunting, detection engineering with Sigma/YARA, SIEM query design, and incident detection validation.
Quellsprache: Chinesisch
STRIDE threat modeling workshop workflow for authorized product and system reviews: scope and DFDs, per-element STRIDE analysis, risk ranking, mitigations, and living model updates. Use when threat model, STRIDE, 威胁建模, DFD, attack surface workshop, security…
Quellsprache: Englisch
Own the TLS certificate lifecycle for systems you control: key generation, CSR, issuance (public CA, private CA, ACME), chain assembly, deployment, renewal, revocation, inventory, and expiry monitoring. Use when designing or reviewing cert…
Quellsprache: Englisch
Select and validate the least invasive method for obtaining TLS plaintext from owned or explicitly authorized applications. Use when proxy capture is empty, certificate trust fails, SSL pinning is suspected, the app uses native BoringSSL/OpenSSL, mTLS is…
Quellsprache: Englisch
Award-winning web design framework inspired by elite agencies (Locomotive, Studio Freight, AREA 17). Use when you need to: (1) build premium portfolio sites and brand websites, (2) create immersive web experiences with custom animations, (3) implement…
Quellsprache: Englisch
Implement and harden RFC 6238 TOTP multi-factor authentication: secret generation, otpauth enrollment, verify windows, attempt limits, backup codes, and session elevation. Use when building or reviewing authenticator-app 2FA (enroll QR, verify code,…
Quellsprache: Englisch
Design and review Traefik security middlewares: Headers (HSTS/CSP/XFO), IPAllowList, BasicAuth/DigestAuth/ForwardAuth, RateLimit, InFlightReq, RedirectScheme, CORS, and middleware chains on routers/services. Use when hardening Traefik static/dynamic config or…
Quellsprache: Englisch
Wire Trivy container image scans into CI with severity exit gates, ignore policy, DB freshness, and SARIF upload to code scanning. Use when Trivy image CI, trivy image --severity, --exit-code, SARIF upload, GitHub code scanning container CVE gate,…
Quellsprache: Englisch