Menú
Skills en este repositorio
SkillsMP ha recopilado 484 skills de tomysh1337/openstarry-code. Abre una skill para revisar su origen y sus detalles.
tomysh1337/openstarry-codeMostrando 40 de 484 skills recopiladas.
Write and review Bash/POSIX shell scripts with safe defaults: set -euo pipefail where appropriate, correct quoting, array-safe iteration, ShellCheck-clean patterns, and predictable error handling. Use when shell script style, bash style, shellcheck, quoting…
Idioma del texto original: inglés
Configure and verify Git commit signing with GPG or SSH keys so hosts show a Verified badge and branch protection can require signed commits. Use when signed commits, commit signing, GPG sign, SSH signing key, git commit -S, Verified badge, required signed…
Idioma del texto original: inglés
Route tasks across installed and source-cached Codex skills, then delegate to one of nine bilingual domain routers before loading a concrete workflow. Use when several skills could match, the user asks which skill should handle a task, or a complex request…
Idioma del texto original: inglés
Inventory, refresh, audit, and selectively stage external Codex skill sources without bulk-registering them. Use when downloading skill repositories, updating skill-sources, checking provenance or duplicates, validating frontmatter and scripts, generating a…
Idioma del texto original: inglés
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.
Idioma del texto original: inglés
Design and harden SMS one-time password (OTP) risk controls: send/resend budgets, verify attempt limits, code entropy and TTL, purpose binding, and abuse-resistant UX. Use when login, signup, step-up, or recovery relies on SMS OTP and you need send-flood,…
Idioma del texto original: inglés
Install, authenticate, and run the Snyk CLI for open-source SCA, Snyk Code, container images, and IaC on owned repositories and CI. Use when snyk test, snyk code test, snyk container test, snyk iac test, snyk monitor, SNYK_TOKEN, .snyk policy, severity…
Idioma del texto original: inglés
Select the most specific installed skill for implementation, debugging, testing, code review, API/schema design, Git, packaging, language conventions, concurrency, and architecture. Use for coding, refactor, debug, unit tests, API design, Python, TypeScript,…
Idioma del texto original: inglés
Configure and enforce SonarQube / SonarCloud Quality Gates in CI: gate conditions (coverage, duplications, ratings, new-code issues), waitForQualityGate / CE task polling, PR decoration, and fail-closed merge or release when the gate is red. Use when…
Idioma del texto original: inglés
Authorized Spring Boot Actuator hardening: endpoint exposure, separate management port, Spring Security on /actuator, health details, and high-risk endpoints (env, heapdump, threaddump, loggers, shutdown, jolokia). Use when reviewing…
Idioma del texto original: inglés
Spring Security config checklist: SecurityFilterChain, CSRF, sessions, method security, CORS, password encoding, actuators, JWT resource server. Use when reviewing Spring Boot Security, permitAll mistakes, or hardening org-owned Java/Kotlin apps — authorized…
Idioma del texto original: inglés
Defend against SQL injection with parameterized queries and safe ORM patterns: bind values (never concatenate), allowlist ORDER BY/identifiers, avoid unsafe raw SQL APIs, and correct Sequelize/Prisma/SQLAlchemy/EF usage. Use when hardening data access,…
Idioma del texto original: inglés
Format and structure SQL for readability and safe evolution: consistent keyword casing, clear table/column naming, explicit joins, migration hygiene, and review-friendly diffs. Use when SQL style, SQL 规范, schema naming, migration readability, query…
Idioma del texto original: inglés
SSH key hygiene for org-owned hosts and workstations: modern key types, ssh-agent practices, authorized_keys review, permissions, rotation, and host-key trust. Use when hardening SSH keys, cleaning authorized_keys, agent-forwarding risk, or post-incident key…
Idioma del texto original: inglés
Authorized assessment of SSO single logout (SLO) and cross-app session propagation: IdP/SP logout, front- vs back-channel termination, RP-initiated logout, refresh-token and cookie invalidation, and residual sessions after “logout everywhere.” Use when SSO…
Idioma del texto original: inglés
Design SSRF defenses for server-side URL fetchers: hostname allowlists, scheme allowlists, metadata and private-IP blocks, DNS-rebinding-safe resolve-then- connect checks, and URL parser pitfalls. Use when hardening webhooks, previews, importers, unfurl,…
Idioma del texto original: inglés
Systematic SSRF filter and URL-parser bypass catalog for authorized assessments: IP encoding, DNS/TOCTOU, redirect and scheme tricks, allowlist confusion, and cloud metadata edge cases. Use when a server-side fetch is confirmed but deny-lists, allowlists, or…
Idioma del texto original: inglés
Choose and structure application state: client UI state vs server/cache state, and when to use React Context, Zustand, Redux, or URL state. Use when state management, Redux, Zustand, React Query, server state, client state, 状态管理, 全局状态, or when deciding where…
Idioma del texto original: inglés
Design content-hashed static asset filenames, long-lived Cache-Control immutable headers, atomic deploy order, and safe HTML/manifest updates so browsers never pair new markup with missing or stale bundles. Use when bundler content hashes, fingerprinted…
Idioma del texto original: inglés
Guided statistical analysis for research data - test selection, assumption checking, effect sizes, power analysis, Bayesian alternatives, and APA-formatted reporting. Use whenever a user wants to compare groups, test a hypothesis, analyze experimental or…
Idioma del texto original: inglés
Design and authorized assessment of step-up (re-authentication) patterns: sensitive-action challenges, short-lived elevation claims, binding to purpose and session, and server-side enforcement. Use when password change, payments, MFA disable, OAuth grants,…
Idioma del texto original: inglés
Authorized malware sample strings and IOC triage: extract ASCII/UTF-16 strings, classify URLs/IPs/paths/mutexes/registry keys, score confidence, and export a minimal IOC set for IR/YARA handoff. Use when doing first-pass static clues on PE/ELF/dumps/scripts —…
Idioma del texto original: inglés
Assess and implement Subresource Integrity (SRI) for script and link tags: sha384 digests, crossorigin, CDN trust, hash rotation, integrity mismatches, and service-worker edge cases. Use when reviewing third-party CDN scripts, missing integrity attributes,…
Idioma del texto original: inglés
Brief Svelte/SvelteKit security notes: {@html} sinks, CSP, SSR XSS, client store secret hygiene, and hooks.server auth patterns. Use when reviewing or hardening SvelteKit apps, {@html} rich text, handle/hooks session guards, PUBLIC_ env leakage, or Svelte SSR…
Idioma del texto original: inglés
Harden SVG handling against XSS and related active-content risks: script, event handlers, foreignObject, animation/set attributes, javascript:/data: URLs, external resource loads, and unsafe serve headers. Use when apps accept, sanitize, inline, or serve…
Idioma del texto original: inglés
Generate Software Bills of Materials with Anchore Syft from source trees, container images, archives, and OCI digests: output formats (CycloneDX, SPDX, Syft JSON), scope and cataloger selection, reproducible CI-equivalent scans, and named hashed artifacts.…
Idioma del texto original: inglés
Reverse tabnabbing and window.opener hardening for target=_blank links and window.open popups: rel=noopener noreferrer, Cross-Origin-Opener-Policy, and audits of user-generated or untrusted outbound links. Use when pages open third-party or UGC URLs in new…
Idioma del texto original: inglés
Harden Tekton Pipelines on owned or authorized clusters: Task/Pipeline definitions, PipelineRun isolation, ServiceAccount RBAC, workspace and secret mounts, step image trust, Triggers EventListeners, and Chains provenance. Use when reviewing Tekton YAML,…
Idioma del texto original: inglés
Pin Terraform/OpenTofu providers for reproducible init and plan: required_providers version constraints, .terraform.lock.hcl, terraform providers lock, registry source addresses, and CI lock-aware init. Use when provider versions float, lockfile is missing or…
Idioma del texto original: inglés
Terraform security basics for authorized/org-owned infra: remote state and secrets hygiene, IAM least privilege, public S3 and open security groups, provider credential patterns, and safe plan/apply. Use when Terraform security, tfstate secrets, public…
Idioma del texto original: inglés
Configure and review Terraform/OpenTofu remote state locking and encryption: S3 + DynamoDB (or native S3 lock), azurerm, and gcs backends; force-unlock risks; who may unlock; and least-privilege lock/state IAM. Use when state lock, DynamoDB lock table,…
Idioma del texto original: inglés
Use for authorized security testing of desktop thick clients including local storage, update channels, IPC, traffic, and client-side trust boundaries.
Idioma del texto original: chino
Use for blue-team threat hunting, detection engineering with Sigma/YARA, SIEM query design, and incident detection validation.
Idioma del texto original: chino
STRIDE threat modeling workshop workflow for authorized product and system reviews: scope and DFDs, per-element STRIDE analysis, risk ranking, mitigations, and living model updates. Use when threat model, STRIDE, 威胁建模, DFD, attack surface workshop, security…
Idioma del texto original: inglés
Own the TLS certificate lifecycle for systems you control: key generation, CSR, issuance (public CA, private CA, ACME), chain assembly, deployment, renewal, revocation, inventory, and expiry monitoring. Use when designing or reviewing cert…
Idioma del texto original: inglés
Select and validate the least invasive method for obtaining TLS plaintext from owned or explicitly authorized applications. Use when proxy capture is empty, certificate trust fails, SSL pinning is suspected, the app uses native BoringSSL/OpenSSL, mTLS is…
Idioma del texto original: inglés
Award-winning web design framework inspired by elite agencies (Locomotive, Studio Freight, AREA 17). Use when you need to: (1) build premium portfolio sites and brand websites, (2) create immersive web experiences with custom animations, (3) implement…
Idioma del texto original: inglés
Implement and harden RFC 6238 TOTP multi-factor authentication: secret generation, otpauth enrollment, verify windows, attempt limits, backup codes, and session elevation. Use when building or reviewing authenticator-app 2FA (enroll QR, verify code,…
Idioma del texto original: inglés
Design and review Traefik security middlewares: Headers (HSTS/CSP/XFO), IPAllowList, BasicAuth/DigestAuth/ForwardAuth, RateLimit, InFlightReq, RedirectScheme, CORS, and middleware chains on routers/services. Use when hardening Traefik static/dynamic config or…
Idioma del texto original: inglés
Wire Trivy container image scans into CI with severity exit gates, ignore policy, DB freshness, and SARIF upload to code scanning. Use when Trivy image CI, trivy image --severity, --exit-code, SARIF upload, GitHub code scanning container CVE gate,…
Idioma del texto original: inglés