Menü
Skills in diesem Repository
SkillsMP hat 484 Skills aus tomysh1337/openstarry-code gesammelt. Öffne einen Skill, um Quelle und Details zu prüfen.
tomysh1337/openstarry-codeEs werden 40 von 484 gesammelten Skills angezeigt.
Django settings security checklist for org-owned projects: DEBUG, SECRET_KEY, ALLOWED_HOSTS, CSRF/CORS/cookies, SSL redirect, HSTS, XSS/clickjacking middleware, and safe production settings modules. Use when Django security settings, django settings…
Quellsprache: Englisch
Assess and harden email authentication for owned domains: SPF, DKIM, and DMARC (policy rollout, alignment, reporting). Use when reviewing DNS TXT records, spoofing resistance, p=none→quarantine→reject progression, third-party senders, BIMI readiness, or…
Quellsprache: Englisch
Deploy and operate DNSSEC on zones you own or are authorized to manage: key models (KSK/ZSK or CSK), signing algorithms, DS publication at the parent, chain-of-trust validation, key rollover, NSEC/NSEC3, and failure triage. Use when enabling DNSSEC, fixing…
Quellsprache: Englisch
Review and harden docker-compose files for privileged mode, host port publishing, secrets, volume mounts, networks, and capability grants. Use when docker-compose.yml security, privileged containers, docker.sock mounts, Compose secrets, host network mode, or…
Quellsprache: Englisch
Diagnose and fix Docker Hub pull rate limits in CI: anonymous vs authenticated quotas, shared runner IPs, mirrors, private base caches, and registry migration. Use when CI fails with toomanyrequests, 429, Docker Hub rate limit, docker.io pulls flaky on GitHub…
Quellsprache: Englisch
Install, operate, and harden Docker Engine in rootless mode: user namespaces, dockerd-rootless-setuptool, systemd user units, slirp4netns/pasta networking, storage drivers, and known limitations vs rootful Docker. Use when setting up rootless Docker,…
Quellsprache: Englisch
Author and review Dockerfiles for multi-stage builds, non-root runtime, layer caching, and secrets that never land in image layers. Use when Dockerfile, Docker best practices, Docker 最佳实践, container image build, multi-stage build, non-root user,…
Quellsprache: Englisch
Creates task-oriented technical documentation with progressive disclosure. Use when writing READMEs, API docs, architecture docs, or markdown documentation. Also use this skill at the END of any completed reverse engineering, penetration testing, CTF, or…
Quellsprache: Mehrsprachig
Select the most specific installed skill for Word, PDF, slides, spreadsheets, Markdown, research, analysis, writing, reports, and diagrams. Use for DOCX, XLSX, PPTX, PDF, README, changelog, runbook, report, research, 文档, 表格, 幻灯片, 演示文稿, 报告, 研究, 论文, 引用, 流程图, or…
Quellsprache: Englisch
Decide when and how to write Python docstrings (PEP 257) and JS/TS JSDoc/TSDoc for public APIs, with templates and anti-patterns. Use when docstring, JSDoc, TSDoc, 文档字符串, API docs comments, typedoc, pydoc, or documenting exported functions/classes/modules.
Quellsprache: Englisch
Authorized DOM clobbering awareness: named HTML elements (id/name) shadowing window and document properties, form/collection multi-level clobbering, and client config or sink confusion without a script injection. Use when markup accepts attacker-controlled…
Quellsprache: Englisch
Assess and harden HTML download attribute usage, Content-Disposition filenames, content-type sniffing on file responses, and XSS or path risks via user-facing downloads. Use when reviewing <a download>, attachment/inline disposition, filename injection,…
Quellsprache: Englisch
Playwright end-to-end testing strategy: critical journeys, stable selectors, fixtures, isolation, and CI discipline. Use when Playwright, e2e tests, end-to-end, browser tests, page object, web-first assertions, or flaky UI suites. Complements…
Quellsprache: Englisch
Enable and operate Amazon ECR image vulnerability scanning for owned AWS accounts: basic vs enhanced (Inspector) scan, scan-on-push, registry and repository scan filters, finding triage, and CI/deploy gates on CRITICAL/HIGH. Use when reviewing ECR scan…
Quellsprache: Englisch
Authorized Elasticsearch security hardening: xpack.security, HTTP/transport TLS, anonymous access disabled, users/role mapping, no public 9200/9300, and least-privilege snapshot/restore. Use when reviewing elasticsearch.yml, Elastic Cloud / ECK / self-managed…
Quellsprache: Englisch
Authorized Electron desktop app security review: nodeIntegration, contextIsolation, sandbox, preload bridges, shell.openExternal, navigation and webview risks, and renderer XSS to OS/code execution. Use when assessing Electron, Spectron-era, or…
Quellsprache: Englisch
Defend mail-sending paths against CRLF / email header injection by rejecting control characters, using structured mail APIs, and never concatenating untrusted data into raw SMTP or MIME headers. Use when hardening Subject, To, From, Cc, Bcc, Reply-To, or…
Quellsprache: Englisch
Design and review rate limits for email one-time passwords (OTP): send/resend cooldowns, per-destination and dual keys, verify attempt budgets, enumeration-safe UX, and mail-provider cost controls. Use when email OTP throttle, resend cooldown, magic-code send…
Quellsprache: Englisch
Use for authorized email security review including phishing analysis, header authentication (SPF/DKIM/DMARC), BEC patterns, and mailbox token abuse research.
Quellsprache: Chinesisch
When the user wants to create or optimize an email sequence, drip campaign, automated email flow, or lifecycle email program. Also use when the user mentions "email sequence," "drip campaign," "nurture sequence," "onboarding emails," "welcome sequence,"…
Quellsprache: Englisch
Twelve-factor style application config: store config in the environment, strict separation of code from config, typed/validated env loading, and no secrets baked into images or git. Use when env config, 12-factor, 环境变量配置, twelve-factor config, dotenv, config…
Quellsprache: Englisch
Design, review, and troubleshoot Envoy external authorization (ext_authz): HTTP/network filter placement, gRPC vs HTTP auth services, CheckRequest/ CheckResponse, failure_mode_allow, header mutation, and route-level overrides. Use when hardening or assessing…
Quellsprache: Englisch
Write and review user-facing error messages that are actionable, free of secrets, and paired with stable machine codes. Use when error messages, 错误文案, exception messages for users, API error payloads, toast/alert copy, form validation text, or when UX/review…
Quellsprache: Englisch
Install, configure, and triage eslint-plugin-security for JavaScript and TypeScript: detectObjectInjection, detect-eval-with-expression, child_process and fs path patterns, legacy vs flat ESLint config, CI gates, and justified suppressions. Use when…
Quellsprache: Englisch
Defense evasion: AMSI bypass, ETW patch, obfuscation, packing, code signing bypass. Trigger: evade, obfuscate, pack, amsi, etw, bypass defender, hide, encode payload, crypt.
Quellsprache: Englisch
Design experiments and studies BEFORE data is collected — choosing a design, randomizing, blocking, and laying out treatment combinations so results are interpretable. Use whenever someone is planning a study, asks how to assign subjects/samples to groups,…
Quellsprache: Englisch
Exploit development: shellcode generation, ROP chain building, format string attacks, buffer overflow patterns. Trigger: exploit dev, shellcode, rop, buffer overflow, format string, use-after-free, heap spray, ret2libc.
Quellsprache: Englisch
Secure Express middleware stacks: helmet, CORS, rate limits, body limits, trust proxy, auth guards, and correct middleware order. Use when Express security, helmet, express-rate-limit, cors package, cookie/session middleware, JWT auth middleware, or hardening…
Quellsprache: Englisch
External Secrets Operator (ESO) for Kubernetes: SecretStore and ClusterSecretStore design, ExternalSecret sync, and provider IAM for AWS Secrets Manager, HashiCorp Vault, and GCP Secret Manager. Use when wiring or reviewing ESO CRDs, refresh intervals,…
Quellsprache: Englisch
Secure FastAPI apps: Depends-based auth, CORS/TrustedHost, HTTPS, security headers, Pydantic boundaries, JWT/OAuth2 schemes, and safe middleware order. Use when FastAPI security, FastAPI CORS, Depends auth, OAuth2PasswordBearer, TrustedHostMiddleware,…
Quellsprache: Englisch
Design and review feature flags, kill switches, targeting, rollout, and flag cleanup. Use when feature flags, feature toggles, kill switch, gradual rollout, percentage rollout, targeting rules, LaunchDarkly, Unleash, Flagsmith, OpenFeature, 功能开关, 灰度, 熔断开关, or…
Quellsprache: Englisch
Assess and implement Fetch Metadata request headers (Sec-Fetch-Site, Sec-Fetch-Mode, Sec-Fetch-Dest, Sec-Fetch-User) for CSRF mitigation and Resource Isolation Policy (RIP). Use when hardening or auditing same-origin vs same-site vs cross-site browser request…
Quellsprache: Englisch
Design and authorized review of FIDO2/WebAuthn enterprise attestation (EA): conveyance preference enterprise, vendor/platform EA enrollment of the RP, unique device-identifying attStmt chains, MDM-aligned allowlists, and privacy- safe storage. Use when…
Quellsprache: Englisch
Authorized methodology to detect and mitigate polyglot file uploads — one byte stream valid as multiple formats (image+HTML/JS, PDF+ZIP, SVG/XML dual parse, Office ZIP+XML). Use when assessing dual interpretation, stored XSS via polyglots, or building…
Quellsprache: Englisch
Design and review secure storage for user file uploads: random object keys, cookie-less separate domain, content-type/magic validation, antivirus hooks, size quotas, and non-executable permissions. Use when implementing or auditing upload landing zones,…
Quellsprache: Englisch
Search Tencent SkillHub for existing skills by Chinese or English task intent, category, target object, and action, then rank a short list for review. Use when the user asks to find, compare, recommend, or selectively install a SkillHub skill, or wants to…
Quellsprache: Englisch
Authorized firewall and security-group rule review methodology: inventory, least privilege, shadow/redundant rules, egress control, change hygiene, and evidence-based findings. Use when reviewing iptables/nftables, cloud SGs/NSGs, host firewalls, or network…
Quellsprache: Englisch
Firmware analysis basics for owned devices, vendor-supplied images, and CTF firmware blobs: identification, binwalk unpack, filesystem extract (squashfs, jffs2, ubifs, initramfs), credential/config triage, and hand-off to binary RE. Use when analyzing…
Quellsprache: Englisch
Historical and residual assessment of Adobe Flash crossdomain.xml and Microsoft Silverlight clientaccesspolicy.xml: over-permissive allow-access-from wildcards, socket policies, domain attributes, and leftover player surfaces. Use when legacy…
Quellsprache: Englisch
Authorized Flutter app security basics: flutter_secure_storage and secret placement, MethodChannel/EventChannel trust boundaries, Dart obfuscation limits, deep-link / App Links validation, and certificate-pinning packages. Use when reviewing or hardening…
Quellsprache: Englisch