Menü
Skills in diesem Repository
SkillsMP hat 484 Skills aus tomysh1337/openstarry-code gesammelt. Öffne einen Skill, um Quelle und Details zu prüfen.
tomysh1337/openstarry-codeEs werden 40 von 484 gesammelten Skills angezeigt.
Choose and configure HTML sanitizers (DOMPurify, bleach/nh3, sanitize-html, OWASP Java HTML Sanitizer) for untrusted markup: allowlists vs strip-all, SVG/MathML policy, HTML vs attribute vs URL context, and CSP as defense in depth. Use when picking or…
Quellsprache: Englisch
High-level HTTP web cache poisoning methodology: unkeyed inputs, cache-key design, Host/X-Forwarded-* authority, fat GET, and second-client proofs. Use when shared caches (CDN, reverse proxy, gateway) may store attacker-influenced responses for other users…
Quellsprache: Englisch
Assess HTTP method override / method spoofing risks: X-HTTP-Method-Override, X-HTTP-Method, X-Method-Override, body/query _method, and framework tunnels that change the effective verb after WAF or auth middleware. Use when authorized tests show ACL or CSRF…
Quellsprache: Englisch
Edit prose to remove common AI-writing patterns while preserving every supplied fact and matching the intended voice. Use for humanize, natural rewrite, AI-sounding prose, 去除 AI 味, 降低机器感, 自然润色, or matching a provided writing sample. Do not use for code…
Quellsprache: Englisch
Internationalization and localization patterns for apps: no hardcoded UI strings, message catalogs, ICU plurals/interpolation, locale negotiation, dates/numbers/currency, RTL, and pseudo-loc. Use when i18n, l10n, 国际化, 本地化, localization, react-i18next,…
Quellsprache: Englisch
IDAPython scripting basics for authorized binary reverse engineering: batch idat/idat64 runs, function and xref enumeration, names/comments, Hex-Rays decompiler export when licensed, and reproducible IDB hygiene. Use when writing or debugging IDAPython,…
Quellsprache: Englisch
IDA Pro 逆向分析辅助技能。当用户提到逆向、反编译、分析二进制/PE/ELF/APK/DLL/SO、破解、找密码、漏洞分析、病毒分析、firmware 固件分析，或需要分析 exe/dll/so/elf/macho/sys 等文件时，务必使用此技能。 Ensure to use this skill when the user wants to analyze any binary file, regardless of whether they explicitly mention "IDA" or…
Quellsprache: Chinesisch
Use for authorized assessment of federated identity systems including SAML, OIDC, OAuth2 flows, SSO misconfiguration, and token confusion issues.
Quellsprache: Chinesisch
GraphQL node/edge object-level authorization (BOLA/IDOR): Relay global IDs, nested resolvers, connections, mutations, and field-level leaks. Use when node(id), edges, or ID arguments appear under GraphQL and classic REST IDOR coverage is incomplete.…
Quellsprache: Englisch
Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells,…
Quellsprache: Englisch
Author and review operational incident runbooks: clear scope, severity, symptoms, diagnostics, mitigation steps, escalation, and communications. Use when runbook, incident response doc, 故障手册, on-call playbook, SEV ladder, incident procedure, pager runbook, or…
Quellsprache: Englisch
Secure input validation at trust boundaries: allowlists, schemas, type and range checks, normalization, and fail-closed parsing. Use when input validation, 输入校验, request validation, allowlist, schema validation, boundary checks, sanitize vs validate, or…
Quellsprache: Englisch
Decide when to write integration tests vs unit or e2e, and how to draw reliable boundaries. Use when integration tests, 集成测试, test pyramid, unit vs integration vs e2e, test boundaries, contract tests, or when suites are slow/flaky from wrong layer choice.…
Quellsprache: Englisch
Authorized iOS Keychain access-control assessment: SecItem attributes, kSecAttrAccessible classes, access-control flags (biometry, device passcode, ThisDeviceOnly), access groups, and common storage mistakes. Use when reviewing how an owned or lab iOS app…
Quellsprache: Englisch
Design and review Istio service-mesh authorization and peer mTLS: AuthorizationPolicy (ALLOW/DENY, principals, JWT, path/method), PeerAuthentication STRICT, deny-by-default, and common gaps. Use when hardening or assessing owned Istio meshes, drafting mesh…
Quellsprache: Englisch
Recover, inspect, deobfuscate, rename, and verify Java JAR bytecode with local java-deobfuscator, Recaf, and Enigma-MCP. Use for obfuscated JARs, class-file triage, source recovery, mapping work, and IDEA-ready Java source exports.
Quellsprache: Englisch
Stateful orchestration for recovering readable, buildable, IDEA-ready Java source from obfuscated JAR and class files. Use for multi-round Java decompilation or deobfuscation, CFR/Vineflower/Procyon comparison, Recaf navigation, java-deobfuscator or custom…
Quellsprache: Englisch
Plan and review JPMS boundaries: module-info.java, requires/exports/opens, automatic and unnamed modules, and classpath-to-module-path migration. Use when modularizing Java apps/libraries, fixing module graph errors (exports, requires transitive, split…
Quellsprache: Englisch
Analyze, triage, decompile, and deobfuscate protected Java artifacts and mixed Java/native targets. Use for JAR, WAR, APK, AAB, .class, DEX, JNI .so/.dll/.dylib, Minecraft/plugin jars, Java malware, CTF reverse challenges, and protectors or symptoms such as…
Quellsprache: Englisch
Build a staged Java/JAR reverse-engineering workspace with static inventory, Recaf inspection, enigma-mcp mappings, decompiler comparison, debugger checks, and reproducible verification. Use for Java projects, JARs, class files, shaded libraries, and…
Quellsprache: Englisch
Run and gate SpotBugs (and FindSecBugs) for Java/JVM security static analysis: plugin setup, confidence/rank filters, Maven/Gradle/CI wiring, suppressions with owners, and triage of SECURITY-category bugs. Use when SpotBugs, FindBugs successor, FindSecBugs,…
Quellsprache: Englisch
Apply Java naming, Google/Oracle-style layout conventions, and Javadoc discipline when writing or reviewing Java (and closely related Kotlin interop surfaces). Use when Java style, Javadoc, package/class naming, public API docs, Checkstyle/google-java-format…
Quellsprache: Englisch
Jenkins credential storage, scoping, pipeline binding, masking, rotation, and leak hygiene for owned controllers: Credentials plugin types, folder vs global scope, withCredentials / credentials() usage, JCasC secrets, agent and log exposure. Use when Jenkins…
Quellsprache: Englisch
Design and evolve JSON Schema (and OpenAPI-aligned schemas): types, required fields, formats, composition, versioning, and validation at boundaries. Use when JSON Schema, schema design, OpenAPI components/schemas, AJV/Zod/Pydantic contract alignment,…
Quellsprache: Englisch
Authorized assessment of legacy JSONP endpoints: callback parameter injection, cross-origin data exfiltration via script tags with ambient cookies, content-type and padding pitfalls, and migration from JSONP to CORS or same-origin APIs. Use when responses…
Quellsprache: Englisch
Authorized assessment and hardening of JWT issuer, audience, and authorized-party claims: missing, weak, multi-value, and cross-service acceptance of iss/aud/azp. Use when resource servers, API gateways, or OIDC relying parties verify Bearer or ID tokens and…
Quellsprache: Englisch
Authorized design and assessment of JOSE JWE token encryption: compact five-part structure, key encryption (alg) vs content encryption (enc), CEK handling, nested JWT (JWS inside JWE), and decryption/key-management checks. Use when APIs or clients issue or…
Quellsprache: Englisch
Authorized design and assessment of JWT access + refresh token patterns: rotation, reuse detection, revocation, and storage (cookie vs localStorage). Use when implementing or reviewing refresh endpoints, sliding sessions, or long-lived offline tokens under…
Quellsprache: Englisch
Kafka ACL and auth hardening for owned or authorized clusters: SASL/SSL, super.users, authorizer config, least-privilege topic and consumer-group ACLs, and ZooKeeper vs KRaft metadata-auth notes. Use when reviewing server.properties / kraft configs,…
Quellsprache: Englisch
Authorized basics for Kerberos Service Principal Names (SPNs): registration, format, ticket targeting, missing/duplicate SPNs, and service identity hygiene on owned Active Directory or lab domains. Use when apps fail negotiate/Kerberos SSO, setspn/AD…
Quellsprache: Englisch
Design, review, and harden Kubernetes admission webhooks: MutatingWebhookConfiguration, ValidatingWebhookConfiguration, AdmissionReview, failurePolicy, sideEffects, selectors, TLS/caBundle, and availability. Use when implementing or auditing…
Quellsprache: Englisch
Kubernetes etcd encryption at rest for owned or authorized clusters: API server EncryptionConfiguration, resource selection (Secrets and more), aescbc/aesgcm/ secretbox/kms providers, identity fallback, key rotation, and re-encrypt verification. Use when…
Quellsprache: Englisch
Harden Kubernetes workloads with Pod Security Standards (baseline/restricted), PSA labels, securityContext (runAsNonRoot, capabilities, privileged, hostPath), and PodSecurityPolicy migration. Use when reviewing Deployments/Pods for PSS violations, enforcing…
Quellsprache: Englisch
Kubernetes RBAC least-privilege review for owned clusters: ServiceAccounts, Roles/ClusterRoles, RoleBindings/ClusterRoleBindings, verb/resource scoping, and bind-escalation footguns. Use when hardening default SA usage, trimming cluster-admin, splitting…
Quellsprache: Englisch
Harden Kubernetes Secrets handling on owned clusters: base64 is not encryption, etcd encryption at rest, RBAC least privilege, mount vs env injection, and safe inventory without dumping Secret data into pods or logs. Use when reviewing Secret objects,…
Quellsprache: Englisch
Laravel security basics: APP_KEY, session/cookies, CSRF, mass assignment, policies, validation, rate limits, files, Sanctum/Passport. Use when reviewing Laravel config, $fillable/$guarded, Blade XSS, or hardening org-owned PHP apps — authorized only.
Quellsprache: Englisch
Harden and assess LDAP/AD directory binds for owned systems: disable anonymous and unauthenticated binds, prefer LDAPS or StartTLS, least-privilege service accounts, simple vs SASL bind choices, AD LDAP signing/channel binding, lockout- safe auth, and secret…
Quellsprache: Englisch
Detect and safely test LDAP injection in directory search filters and bind DNs, including filter syntax metacharacters, boolean result differentials, and blind extraction discipline. Use when apps query Active Directory, OpenLDAP, or other LDAP directories…
Quellsprache: Englisch
Scan third-party OSS licenses against org allow/deny lists, flag copyleft and dual-license ambiguity, verify NOTICE/attribution artifacts, and wire CI license gates. Use when reviewing dependency license compliance, SPDX identifiers, forbidden licenses…
Quellsprache: Englisch
Authorized Linux host hardening checklist: accounts and SSH, firewall and listening services, package/update hygiene, filesystem and kernel sysctl, audit/logging, and service least privilege. Use when hardening org-owned Linux servers, lab VMs, or reviewing…
Quellsprache: Englisch