Menú
Skills en este repositorio
SkillsMP ha recopilado 484 skills de tomysh1337/openstarry-code. Abre una skill para revisar su origen y sus detalles.
tomysh1337/openstarry-codeMostrando 40 de 484 skills recopiladas.
Django settings security checklist for org-owned projects: DEBUG, SECRET_KEY, ALLOWED_HOSTS, CSRF/CORS/cookies, SSL redirect, HSTS, XSS/clickjacking middleware, and safe production settings modules. Use when Django security settings, django settings…
Idioma del texto original: inglés
Assess and harden email authentication for owned domains: SPF, DKIM, and DMARC (policy rollout, alignment, reporting). Use when reviewing DNS TXT records, spoofing resistance, p=none→quarantine→reject progression, third-party senders, BIMI readiness, or…
Idioma del texto original: inglés
Deploy and operate DNSSEC on zones you own or are authorized to manage: key models (KSK/ZSK or CSK), signing algorithms, DS publication at the parent, chain-of-trust validation, key rollover, NSEC/NSEC3, and failure triage. Use when enabling DNSSEC, fixing…
Idioma del texto original: inglés
Review and harden docker-compose files for privileged mode, host port publishing, secrets, volume mounts, networks, and capability grants. Use when docker-compose.yml security, privileged containers, docker.sock mounts, Compose secrets, host network mode, or…
Idioma del texto original: inglés
Diagnose and fix Docker Hub pull rate limits in CI: anonymous vs authenticated quotas, shared runner IPs, mirrors, private base caches, and registry migration. Use when CI fails with toomanyrequests, 429, Docker Hub rate limit, docker.io pulls flaky on GitHub…
Idioma del texto original: inglés
Install, operate, and harden Docker Engine in rootless mode: user namespaces, dockerd-rootless-setuptool, systemd user units, slirp4netns/pasta networking, storage drivers, and known limitations vs rootful Docker. Use when setting up rootless Docker,…
Idioma del texto original: inglés
Author and review Dockerfiles for multi-stage builds, non-root runtime, layer caching, and secrets that never land in image layers. Use when Dockerfile, Docker best practices, Docker 最佳实践, container image build, multi-stage build, non-root user,…
Idioma del texto original: inglés
Creates task-oriented technical documentation with progressive disclosure. Use when writing READMEs, API docs, architecture docs, or markdown documentation. Also use this skill at the END of any completed reverse engineering, penetration testing, CTF, or…
Idioma del texto original: Varios idiomas
Select the most specific installed skill for Word, PDF, slides, spreadsheets, Markdown, research, analysis, writing, reports, and diagrams. Use for DOCX, XLSX, PPTX, PDF, README, changelog, runbook, report, research, 文档, 表格, 幻灯片, 演示文稿, 报告, 研究, 论文, 引用, 流程图, or…
Idioma del texto original: inglés
Decide when and how to write Python docstrings (PEP 257) and JS/TS JSDoc/TSDoc for public APIs, with templates and anti-patterns. Use when docstring, JSDoc, TSDoc, 文档字符串, API docs comments, typedoc, pydoc, or documenting exported functions/classes/modules.
Idioma del texto original: inglés
Authorized DOM clobbering awareness: named HTML elements (id/name) shadowing window and document properties, form/collection multi-level clobbering, and client config or sink confusion without a script injection. Use when markup accepts attacker-controlled…
Idioma del texto original: inglés
Assess and harden HTML download attribute usage, Content-Disposition filenames, content-type sniffing on file responses, and XSS or path risks via user-facing downloads. Use when reviewing <a download>, attachment/inline disposition, filename injection,…
Idioma del texto original: inglés
Playwright end-to-end testing strategy: critical journeys, stable selectors, fixtures, isolation, and CI discipline. Use when Playwright, e2e tests, end-to-end, browser tests, page object, web-first assertions, or flaky UI suites. Complements…
Idioma del texto original: inglés
Enable and operate Amazon ECR image vulnerability scanning for owned AWS accounts: basic vs enhanced (Inspector) scan, scan-on-push, registry and repository scan filters, finding triage, and CI/deploy gates on CRITICAL/HIGH. Use when reviewing ECR scan…
Idioma del texto original: inglés
Authorized Elasticsearch security hardening: xpack.security, HTTP/transport TLS, anonymous access disabled, users/role mapping, no public 9200/9300, and least-privilege snapshot/restore. Use when reviewing elasticsearch.yml, Elastic Cloud / ECK / self-managed…
Idioma del texto original: inglés
Authorized Electron desktop app security review: nodeIntegration, contextIsolation, sandbox, preload bridges, shell.openExternal, navigation and webview risks, and renderer XSS to OS/code execution. Use when assessing Electron, Spectron-era, or…
Idioma del texto original: inglés
Defend mail-sending paths against CRLF / email header injection by rejecting control characters, using structured mail APIs, and never concatenating untrusted data into raw SMTP or MIME headers. Use when hardening Subject, To, From, Cc, Bcc, Reply-To, or…
Idioma del texto original: inglés
Design and review rate limits for email one-time passwords (OTP): send/resend cooldowns, per-destination and dual keys, verify attempt budgets, enumeration-safe UX, and mail-provider cost controls. Use when email OTP throttle, resend cooldown, magic-code send…
Idioma del texto original: inglés
Use for authorized email security review including phishing analysis, header authentication (SPF/DKIM/DMARC), BEC patterns, and mailbox token abuse research.
Idioma del texto original: chino
When the user wants to create or optimize an email sequence, drip campaign, automated email flow, or lifecycle email program. Also use when the user mentions "email sequence," "drip campaign," "nurture sequence," "onboarding emails," "welcome sequence,"…
Idioma del texto original: inglés
Twelve-factor style application config: store config in the environment, strict separation of code from config, typed/validated env loading, and no secrets baked into images or git. Use when env config, 12-factor, 环境变量配置, twelve-factor config, dotenv, config…
Idioma del texto original: inglés
Design, review, and troubleshoot Envoy external authorization (ext_authz): HTTP/network filter placement, gRPC vs HTTP auth services, CheckRequest/ CheckResponse, failure_mode_allow, header mutation, and route-level overrides. Use when hardening or assessing…
Idioma del texto original: inglés
Write and review user-facing error messages that are actionable, free of secrets, and paired with stable machine codes. Use when error messages, 错误文案, exception messages for users, API error payloads, toast/alert copy, form validation text, or when UX/review…
Idioma del texto original: inglés
Install, configure, and triage eslint-plugin-security for JavaScript and TypeScript: detectObjectInjection, detect-eval-with-expression, child_process and fs path patterns, legacy vs flat ESLint config, CI gates, and justified suppressions. Use when…
Idioma del texto original: inglés
Defense evasion: AMSI bypass, ETW patch, obfuscation, packing, code signing bypass. Trigger: evade, obfuscate, pack, amsi, etw, bypass defender, hide, encode payload, crypt.
Idioma del texto original: inglés
Design experiments and studies BEFORE data is collected — choosing a design, randomizing, blocking, and laying out treatment combinations so results are interpretable. Use whenever someone is planning a study, asks how to assign subjects/samples to groups,…
Idioma del texto original: inglés
Exploit development: shellcode generation, ROP chain building, format string attacks, buffer overflow patterns. Trigger: exploit dev, shellcode, rop, buffer overflow, format string, use-after-free, heap spray, ret2libc.
Idioma del texto original: inglés
Secure Express middleware stacks: helmet, CORS, rate limits, body limits, trust proxy, auth guards, and correct middleware order. Use when Express security, helmet, express-rate-limit, cors package, cookie/session middleware, JWT auth middleware, or hardening…
Idioma del texto original: inglés
External Secrets Operator (ESO) for Kubernetes: SecretStore and ClusterSecretStore design, ExternalSecret sync, and provider IAM for AWS Secrets Manager, HashiCorp Vault, and GCP Secret Manager. Use when wiring or reviewing ESO CRDs, refresh intervals,…
Idioma del texto original: inglés
Secure FastAPI apps: Depends-based auth, CORS/TrustedHost, HTTPS, security headers, Pydantic boundaries, JWT/OAuth2 schemes, and safe middleware order. Use when FastAPI security, FastAPI CORS, Depends auth, OAuth2PasswordBearer, TrustedHostMiddleware,…
Idioma del texto original: inglés
Design and review feature flags, kill switches, targeting, rollout, and flag cleanup. Use when feature flags, feature toggles, kill switch, gradual rollout, percentage rollout, targeting rules, LaunchDarkly, Unleash, Flagsmith, OpenFeature, 功能开关, 灰度, 熔断开关, or…
Idioma del texto original: inglés
Assess and implement Fetch Metadata request headers (Sec-Fetch-Site, Sec-Fetch-Mode, Sec-Fetch-Dest, Sec-Fetch-User) for CSRF mitigation and Resource Isolation Policy (RIP). Use when hardening or auditing same-origin vs same-site vs cross-site browser request…
Idioma del texto original: inglés
Design and authorized review of FIDO2/WebAuthn enterprise attestation (EA): conveyance preference enterprise, vendor/platform EA enrollment of the RP, unique device-identifying attStmt chains, MDM-aligned allowlists, and privacy- safe storage. Use when…
Idioma del texto original: inglés
Authorized methodology to detect and mitigate polyglot file uploads — one byte stream valid as multiple formats (image+HTML/JS, PDF+ZIP, SVG/XML dual parse, Office ZIP+XML). Use when assessing dual interpretation, stored XSS via polyglots, or building…
Idioma del texto original: inglés
Design and review secure storage for user file uploads: random object keys, cookie-less separate domain, content-type/magic validation, antivirus hooks, size quotas, and non-executable permissions. Use when implementing or auditing upload landing zones,…
Idioma del texto original: inglés
Search Tencent SkillHub for existing skills by Chinese or English task intent, category, target object, and action, then rank a short list for review. Use when the user asks to find, compare, recommend, or selectively install a SkillHub skill, or wants to…
Idioma del texto original: inglés
Authorized firewall and security-group rule review methodology: inventory, least privilege, shadow/redundant rules, egress control, change hygiene, and evidence-based findings. Use when reviewing iptables/nftables, cloud SGs/NSGs, host firewalls, or network…
Idioma del texto original: inglés
Firmware analysis basics for owned devices, vendor-supplied images, and CTF firmware blobs: identification, binwalk unpack, filesystem extract (squashfs, jffs2, ubifs, initramfs), credential/config triage, and hand-off to binary RE. Use when analyzing…
Idioma del texto original: inglés
Historical and residual assessment of Adobe Flash crossdomain.xml and Microsoft Silverlight clientaccesspolicy.xml: over-permissive allow-access-from wildcards, socket policies, domain attributes, and leftover player surfaces. Use when legacy…
Idioma del texto original: inglés
Authorized Flutter app security basics: flutter_secure_storage and secret placement, MethodChannel/EventChannel trust boundaries, Dart obfuscation limits, deep-link / App Links validation, and certificate-pinning packages. Use when reviewing or hardening…
Idioma del texto original: inglés