tomysh1337/openstarry-code - Página 10

mobile-reverse

Reverse and assess Android and iOS applications with Frida, Objection, runtime instrumentation, pinning bypass, and OWASP MASTG workflows.

Idioma del texto original: chino

pentest-tools

主动渗透测试工具链。覆盖信息收集、端口扫描、漏洞扫描、Web 渗透、SQL 注入、目录爆破、密码破解等场景。 通过 MCP server（pentestMCP / mcp-security-hub）将 20+ 安全工具暴露给 AI agent。 触发关键词：渗透测试、端口扫描、Nmap、漏洞扫描、Nuclei、SQL 注入、SQLMap、目录爆破、FFUF、密码破解、Hashcat、信息收集、子域名、Web 渗透、ZAP、Burp。

Idioma del texto original: chino

src-hunter

实战 SRC / 众测 / Bug bounty 漏洞挖掘工作流 skill。包含：5 阶段方法论（intake → recon → enum → hunt → report）、19 个攻击类 playbook（SQLi/XSS/RCE/SSRF/IDOR/CSRF/Path Traversal/File Upload/SSTI/XXE/Race/HTTP Smuggling/OAuth/JWT/SAML/GraphQL/Mobile/LLM/DoS）、305 个结构化 payload、263 个 WAF/EDR…

Idioma del texto original: chino

radare2

Use this skill whenever the user wants to analyze binaries with radare2/r2 from the command line, including reverse engineering, disassembly, function analysis, strings/import inspection, patching, binary diffing, hex inspection, or r2 scripting. Also use it…

Idioma del texto original: chino

dsl-vm-reverse

Reverse JavaScript-based custom DSL virtual machines, opcode dispatchers, constant tables, interpreter loops, and nonstandard WASM-like runtimes.

Idioma del texto original: chino

reverse-engineering

Provides reverse engineering techniques. Use when the main job is to understand how a compiled, obfuscated, packed, or virtualized target works before exploiting or solving it, including binaries, APKs, WASM, firmware, custom VMs, bytecode, malware-like…

Idioma del texto original: inglés

reverse-skill

Master router for reverse engineering, authorized security research, CTF, binary, APK, JavaScript, firmware, mobile, malware, pwn, and API tasks. Use to select this package's specialized workflow and shared toolchain.

Idioma del texto original: chino

supply-chain-security

Assess software supply chains, dependencies, SBOMs, CI/CD pipelines, container images, build provenance, signatures, and artifact integrity.

Idioma del texto original: chino

rust-cargo-vet-basics

Set up and gate Rust supply-chain audits with cargo-vet: supply-chain/ config.toml and audits.toml, exemptions, peer audit imports, certify criteria (safe-to-run / safe-to-deploy), inspect/diff workflow, and CI fail-closed checks for owned Cargo workspaces.…

Idioma del texto original: inglés

rust-style-and-clippy

Apply rustfmt, Clippy, Rust API Guidelines (high level), rustdoc, and idiomatic error and naming style when writing or reviewing Rust code. Use when Rust style, clippy, rustfmt, rustdoc, API guidelines, or Cargo workspace formatting and lints are in scope.

Idioma del texto original: inglés

rust-unsafe-guidelines

Decide when Rust `unsafe` is justified, document soundness invariants, minimize unsafe surface, and verify with Miri and review checklists. Use when writing, reviewing, or refactoring `unsafe` blocks, raw pointers, FFI, transmute, interior mutability that…

Idioma del texto original: inglés

same-site-cookie-pitfalls

SameSite cookie attribute pitfalls for Lax, Strict, and None; browser defaults, top-level navigation exceptions, cross-site POST gaps, and CSRF interactions. Use when session cookies lack or mis-set SameSite, CSRF defenses depend only on browser cookie…

Idioma del texto original: inglés

saml-assertion-encryption

Authorized review of SAML 2.0 assertion encryption: EncryptedAssertion, key transport, SP encryption-certificate management, and decrypt-before- signature-verify order pitfalls. Use when EncryptedAssertion, EncryptedKey, WantAssertionsEncrypted, or SP…

Idioma del texto original: inglés

saml-metadata-hygiene

SAML 2.0 metadata trust and hygiene for owned or authorized SP/IdP integrations: EntityID pinning, signing-certificate import, ACS/SSO endpoint allowlists, metadata URL fetch controls, expiry/rotation, and admin dual control. Use when reviewing federation…

Idioma del texto original: inglés

saml-nameid-format-pitfalls

SAML 2.0 NameID format pitfalls for authorized SP/IdP review: email vs persistent vs transient identity keys, Format attribute mismatch, mutable subject linking, SPNameQualifier confusion, and account-merge ATO paths. Use when SAML Subject/NameID,…

Idioma del texto original: inglés

saml-signature-wrapping-awareness

Authorized lab methodology for SAML XML signature wrapping (XSW) awareness: verify-vs-parse node mismatch, duplicated assertions, and SP acceptance of unsigned identity. Use when SAMLResponse XML is in scope and signature wrapping, XSW, or “signed node ≠ used…

Idioma del texto original: inglés

saml-sso-basics

High-level authorized assessment of SAML SSO misconfigurations: signature validation, assertion/response signing, audience restriction, ACS URL handling, and related SP/IdP trust issues. Use when enterprise SAML login, Assertion Consumer Service, or…

Idioma del texto original: inglés

sast-dast-tooling-usage

When and how to run Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST), configure sensible baselines, and triage scanner noise into actionable work. Use when SAST, DAST, 静态扫描, 动态扫描, CodeQL, Semgrep, ZAP, Burp scan,…

Idioma del texto original: inglés

sbom-and-supply-chain

Generate and review Software Bills of Materials (SBOM), map direct and transitive dependencies, and harden software supply-chain hygiene across package managers, CI builds, and container images. Use when producing CycloneDX or SPDX SBOMs, reviewing…

Idioma del texto original: inglés

sbom-ci-enforcement

Enforce Software Bill of Materials (SBOM) generation in CI: CycloneDX and/or SPDX artifacts, build-linked attestation, publish-with-release, and hard gates when an SBOM is missing or empty. Use when wiring SBOM jobs in GitHub Actions, GitLab CI, or similar;…

Idioma del texto original: inglés

science-data-router

Select the most specific installed skill for scientific computing, statistics, data science, machine learning, experiments, visualization, bioinformatics, chemistry, and research methods. Use for science, statistics, pandas, NumPy, SciPy, scikit-learn,…

Idioma del texto original: inglés

scientific-visualization

Create and audit truthful, accessible, publication-ready scientific figures with Matplotlib, Seaborn, or Plotly. Use for figure design, multi-panel layouts, uncertainty and missing-data displays, color/contrast review, image metadata validation, and journal…

Idioma del texto original: inglés

scientific-writing

Draft, revise, and audit scientific manuscripts or reports with explicit evidence provenance, reporting-guideline coverage, authorship accountability, confidentiality controls, and local consistency checks. Use for manuscript sections, references,…

Idioma del texto original: inglés

scim-provisioning-security

Authorized assessment and hardening of SCIM 2.0 user/group provisioning: token auth, endpoint exposure, filter/PATCH abuse, privilege via attributes, deprovisioning gaps, and cross-tenant isolation. Use when SCIM, /Users, /Groups, ServiceProviderConfig, bulk…

Idioma del texto original: inglés

sealed-secrets-patterns

Bitnami SealedSecrets and kubeseal for GitOps-friendly secrets on owned clusters: seal plaintext Secrets into SealedSecret CRs, choose scope (strict/namespace-wide/ cluster-wide), manage controller keys and rotation, and avoid decrypt-side misuse. Use when…

Idioma del texto original: inglés

secrets-in-ci-pipelines

CI/CD secrets hygiene: prefer OIDC and short-lived federated cloud roles over long-lived tokens, scope secrets by environment, block fork-PR access, and keep credentials out of logs and artifacts. Use when GitHub Actions/GitLab OIDC, static AWS/GCP/Azure keys…

Idioma del texto original: inglés

secrets-management-hygiene

Secrets management hygiene for org-owned code and platforms: keep secrets out of source, use vault/platform secret stores, least-privilege injection, rotation and revocation, and safe logging. Use when secrets management, 密钥管理, .env secrets, API keys in repo,…

Idioma del texto original: inglés

secure-sdlc-checklist

Phase-by-phase secure software development lifecycle (SSDLC) checklist for org-owned products: requirements, design, implementation, verification, release, and operations. Use when secure SDLC, 安全开发生命周期, SSDLC, security release gate, security requirements, or…

Idioma del texto original: inglés

security-champion-program

Design and run an organizational security champion program: role definitions, selection, training paths, office hours, metrics, and escalation between product teams and AppSec. Use when security champions, AppSec champions, federated security program,…

Idioma del texto original: inglés

security-reverse-router

Select the most specific installed skill for security research, CTF, vulnerability analysis, authentication, reverse engineering, malware, mobile, binary, crypto, and forensics. Use for security, CTF, pentest, APK, Ghidra, IDA, Frida, pwn, PCAP, malware, 安全,…

Idioma del texto original: inglés

security-sandbox

Isolated analysis environment management for malware and exploit testing. Create and manage isolated VMs, configure Cuckoo Sandbox, set up REMnux/FlareVM environments, manage Docker-based analysis containers, and capture filesystem and process changes.

Idioma del texto original: inglés

seedance-2-prompt

Render a single 3-15s video clip via Seedance 2.0. Supports two backends: OpenRouter (default, model bytedance/seedance-2.0) and the official Volcengine ARK / BytePlus ModelArk endpoint (model doubao-seedance-2-0-260128 / dreamina-seedance-2-0-260128).…

Idioma del texto original: inglés

semgrep-rule-authoring

Author, test, and tune Semgrep rules for org-owned codebases: YAML rule schema, pattern/pattern-either/pattern-not, metavariables, taint mode, message/severity/metadata, language packs, and rule tests. Use when writing custom Semgrep rules, fixing false…

Idioma del texto original: inglés

seo-audit

When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," "SEO health check," "my traffic dropped," "lost…

Idioma del texto original: inglés

service-mesh-mtls-rollout

Plan and execute progressive service-mesh mTLS rollouts on owned clusters: baseline inventory, PERMISSIVE then STRICT, canary namespaces, DestinationRule / peer policy alignment, plaintext exception budgets, and evidence-based cutover. Use when enabling mesh…

Idioma del texto original: inglés

service-worker-security

Service Worker security: scope, registration source, fetch hijacking, cache isolation, updates, push/notifications, and CSP interaction. Use when adding or reviewing service workers, Workbox, PWA offline shells, or SW fetch interception. Authorized…

Idioma del texto original: inglés

session-cookie-theft-defense

Defend against session cookie theft with secure cookie flags, session binding, rotation and invalidation, short lifetimes, and theft-window reduction. Use when hardening cookie-based sessions, designing session middleware, responding to XSS or network theft…

Idioma del texto original: inglés

session-fixation-management

Detect and prevent session fixation: pre-auth session IDs that remain valid after login, URL/cookie injection of attacker-chosen SIDs, and missing regenerate-on-auth. Use when assessing cookie, header, or URL-based session mechanisms under authorization and…

Idioma del texto original: inglés

session-timeout-design

Design idle and absolute session timeouts, sliding renewal, server-side TTL, and re-auth UX. Use when choosing session lifetime, idle vs absolute expiry, sliding windows, remember-me bounds, or timeout middleware for cookie or server sessions under clear…

Idioma del texto original: inglés

shadcn

Manages shadcn components and projects — adding, searching, fixing, debugging, styling, and composing UI, including chat interfaces. Provides project context, component docs, and usage examples. Applies when working with shadcn/ui, component registries,…

Idioma del texto original: inglés