Menú
Skills en este repositorio
SkillsMP ha recopilado 484 skills de tomysh1337/openstarry-code. Abre una skill para revisar su origen y sus detalles.
tomysh1337/openstarry-codeMostrando 40 de 484 skills recopiladas.
Choose and configure HTML sanitizers (DOMPurify, bleach/nh3, sanitize-html, OWASP Java HTML Sanitizer) for untrusted markup: allowlists vs strip-all, SVG/MathML policy, HTML vs attribute vs URL context, and CSP as defense in depth. Use when picking or…
Idioma del texto original: inglés
High-level HTTP web cache poisoning methodology: unkeyed inputs, cache-key design, Host/X-Forwarded-* authority, fat GET, and second-client proofs. Use when shared caches (CDN, reverse proxy, gateway) may store attacker-influenced responses for other users…
Idioma del texto original: inglés
Assess HTTP method override / method spoofing risks: X-HTTP-Method-Override, X-HTTP-Method, X-Method-Override, body/query _method, and framework tunnels that change the effective verb after WAF or auth middleware. Use when authorized tests show ACL or CSRF…
Idioma del texto original: inglés
Edit prose to remove common AI-writing patterns while preserving every supplied fact and matching the intended voice. Use for humanize, natural rewrite, AI-sounding prose, 去除 AI 味, 降低机器感, 自然润色, or matching a provided writing sample. Do not use for code…
Idioma del texto original: inglés
Internationalization and localization patterns for apps: no hardcoded UI strings, message catalogs, ICU plurals/interpolation, locale negotiation, dates/numbers/currency, RTL, and pseudo-loc. Use when i18n, l10n, 国际化, 本地化, localization, react-i18next,…
Idioma del texto original: inglés
IDAPython scripting basics for authorized binary reverse engineering: batch idat/idat64 runs, function and xref enumeration, names/comments, Hex-Rays decompiler export when licensed, and reproducible IDB hygiene. Use when writing or debugging IDAPython,…
Idioma del texto original: inglés
IDA Pro 逆向分析辅助技能。当用户提到逆向、反编译、分析二进制/PE/ELF/APK/DLL/SO、破解、找密码、漏洞分析、病毒分析、firmware 固件分析，或需要分析 exe/dll/so/elf/macho/sys 等文件时，务必使用此技能。 Ensure to use this skill when the user wants to analyze any binary file, regardless of whether they explicitly mention "IDA" or…
Idioma del texto original: chino
Use for authorized assessment of federated identity systems including SAML, OIDC, OAuth2 flows, SSO misconfiguration, and token confusion issues.
Idioma del texto original: chino
GraphQL node/edge object-level authorization (BOLA/IDOR): Relay global IDs, nested resolvers, connections, mutations, and field-level leaks. Use when node(id), edges, or ID arguments appear under GraphQL and classic REST IDOR coverage is incomplete.…
Idioma del texto original: inglés
Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells,…
Idioma del texto original: inglés
Author and review operational incident runbooks: clear scope, severity, symptoms, diagnostics, mitigation steps, escalation, and communications. Use when runbook, incident response doc, 故障手册, on-call playbook, SEV ladder, incident procedure, pager runbook, or…
Idioma del texto original: inglés
Secure input validation at trust boundaries: allowlists, schemas, type and range checks, normalization, and fail-closed parsing. Use when input validation, 输入校验, request validation, allowlist, schema validation, boundary checks, sanitize vs validate, or…
Idioma del texto original: inglés
Decide when to write integration tests vs unit or e2e, and how to draw reliable boundaries. Use when integration tests, 集成测试, test pyramid, unit vs integration vs e2e, test boundaries, contract tests, or when suites are slow/flaky from wrong layer choice.…
Idioma del texto original: inglés
Authorized iOS Keychain access-control assessment: SecItem attributes, kSecAttrAccessible classes, access-control flags (biometry, device passcode, ThisDeviceOnly), access groups, and common storage mistakes. Use when reviewing how an owned or lab iOS app…
Idioma del texto original: inglés
Design and review Istio service-mesh authorization and peer mTLS: AuthorizationPolicy (ALLOW/DENY, principals, JWT, path/method), PeerAuthentication STRICT, deny-by-default, and common gaps. Use when hardening or assessing owned Istio meshes, drafting mesh…
Idioma del texto original: inglés
Recover, inspect, deobfuscate, rename, and verify Java JAR bytecode with local java-deobfuscator, Recaf, and Enigma-MCP. Use for obfuscated JARs, class-file triage, source recovery, mapping work, and IDEA-ready Java source exports.
Idioma del texto original: inglés
Stateful orchestration for recovering readable, buildable, IDEA-ready Java source from obfuscated JAR and class files. Use for multi-round Java decompilation or deobfuscation, CFR/Vineflower/Procyon comparison, Recaf navigation, java-deobfuscator or custom…
Idioma del texto original: inglés
Plan and review JPMS boundaries: module-info.java, requires/exports/opens, automatic and unnamed modules, and classpath-to-module-path migration. Use when modularizing Java apps/libraries, fixing module graph errors (exports, requires transitive, split…
Idioma del texto original: inglés
Analyze, triage, decompile, and deobfuscate protected Java artifacts and mixed Java/native targets. Use for JAR, WAR, APK, AAB, .class, DEX, JNI .so/.dll/.dylib, Minecraft/plugin jars, Java malware, CTF reverse challenges, and protectors or symptoms such as…
Idioma del texto original: inglés
Build a staged Java/JAR reverse-engineering workspace with static inventory, Recaf inspection, enigma-mcp mappings, decompiler comparison, debugger checks, and reproducible verification. Use for Java projects, JARs, class files, shaded libraries, and…
Idioma del texto original: inglés
Run and gate SpotBugs (and FindSecBugs) for Java/JVM security static analysis: plugin setup, confidence/rank filters, Maven/Gradle/CI wiring, suppressions with owners, and triage of SECURITY-category bugs. Use when SpotBugs, FindBugs successor, FindSecBugs,…
Idioma del texto original: inglés
Apply Java naming, Google/Oracle-style layout conventions, and Javadoc discipline when writing or reviewing Java (and closely related Kotlin interop surfaces). Use when Java style, Javadoc, package/class naming, public API docs, Checkstyle/google-java-format…
Idioma del texto original: inglés
Jenkins credential storage, scoping, pipeline binding, masking, rotation, and leak hygiene for owned controllers: Credentials plugin types, folder vs global scope, withCredentials / credentials() usage, JCasC secrets, agent and log exposure. Use when Jenkins…
Idioma del texto original: inglés
Design and evolve JSON Schema (and OpenAPI-aligned schemas): types, required fields, formats, composition, versioning, and validation at boundaries. Use when JSON Schema, schema design, OpenAPI components/schemas, AJV/Zod/Pydantic contract alignment,…
Idioma del texto original: inglés
Authorized assessment of legacy JSONP endpoints: callback parameter injection, cross-origin data exfiltration via script tags with ambient cookies, content-type and padding pitfalls, and migration from JSONP to CORS or same-origin APIs. Use when responses…
Idioma del texto original: inglés
Authorized assessment and hardening of JWT issuer, audience, and authorized-party claims: missing, weak, multi-value, and cross-service acceptance of iss/aud/azp. Use when resource servers, API gateways, or OIDC relying parties verify Bearer or ID tokens and…
Idioma del texto original: inglés
Authorized design and assessment of JOSE JWE token encryption: compact five-part structure, key encryption (alg) vs content encryption (enc), CEK handling, nested JWT (JWS inside JWE), and decryption/key-management checks. Use when APIs or clients issue or…
Idioma del texto original: inglés
Authorized design and assessment of JWT access + refresh token patterns: rotation, reuse detection, revocation, and storage (cookie vs localStorage). Use when implementing or reviewing refresh endpoints, sliding sessions, or long-lived offline tokens under…
Idioma del texto original: inglés
Kafka ACL and auth hardening for owned or authorized clusters: SASL/SSL, super.users, authorizer config, least-privilege topic and consumer-group ACLs, and ZooKeeper vs KRaft metadata-auth notes. Use when reviewing server.properties / kraft configs,…
Idioma del texto original: inglés
Authorized basics for Kerberos Service Principal Names (SPNs): registration, format, ticket targeting, missing/duplicate SPNs, and service identity hygiene on owned Active Directory or lab domains. Use when apps fail negotiate/Kerberos SSO, setspn/AD…
Idioma del texto original: inglés
Design, review, and harden Kubernetes admission webhooks: MutatingWebhookConfiguration, ValidatingWebhookConfiguration, AdmissionReview, failurePolicy, sideEffects, selectors, TLS/caBundle, and availability. Use when implementing or auditing…
Idioma del texto original: inglés
Kubernetes etcd encryption at rest for owned or authorized clusters: API server EncryptionConfiguration, resource selection (Secrets and more), aescbc/aesgcm/ secretbox/kms providers, identity fallback, key rotation, and re-encrypt verification. Use when…
Idioma del texto original: inglés
Harden Kubernetes workloads with Pod Security Standards (baseline/restricted), PSA labels, securityContext (runAsNonRoot, capabilities, privileged, hostPath), and PodSecurityPolicy migration. Use when reviewing Deployments/Pods for PSS violations, enforcing…
Idioma del texto original: inglés
Kubernetes RBAC least-privilege review for owned clusters: ServiceAccounts, Roles/ClusterRoles, RoleBindings/ClusterRoleBindings, verb/resource scoping, and bind-escalation footguns. Use when hardening default SA usage, trimming cluster-admin, splitting…
Idioma del texto original: inglés
Harden Kubernetes Secrets handling on owned clusters: base64 is not encryption, etcd encryption at rest, RBAC least privilege, mount vs env injection, and safe inventory without dumping Secret data into pods or logs. Use when reviewing Secret objects,…
Idioma del texto original: inglés
Laravel security basics: APP_KEY, session/cookies, CSRF, mass assignment, policies, validation, rate limits, files, Sanctum/Passport. Use when reviewing Laravel config, $fillable/$guarded, Blade XSS, or hardening org-owned PHP apps — authorized only.
Idioma del texto original: inglés
Harden and assess LDAP/AD directory binds for owned systems: disable anonymous and unauthenticated binds, prefer LDAPS or StartTLS, least-privilege service accounts, simple vs SASL bind choices, AD LDAP signing/channel binding, lockout- safe auth, and secret…
Idioma del texto original: inglés
Detect and safely test LDAP injection in directory search filters and bind DNs, including filter syntax metacharacters, boolean result differentials, and blind extraction discipline. Use when apps query Active Directory, OpenLDAP, or other LDAP directories…
Idioma del texto original: inglés
Scan third-party OSS licenses against org allow/deny lists, flag copyleft and dual-license ambiguity, verify NOTICE/attribution artifacts, and wire CI license gates. Use when reviewing dependency license compliance, SPDX identifiers, forbidden licenses…
Idioma del texto original: inglés
Authorized Linux host hardening checklist: accounts and SSH, firewall and listening services, package/update hygiene, filesystem and kernel sysctl, audit/logging, and service least privilege. Use when hardening org-owned Linux servers, lab VMs, or reviewing…
Idioma del texto original: inglés