Menú
Skills en este repositorio
SkillsMP ha recopilado 484 skills de tomysh1337/openstarry-code. Abre una skill para revisar su origen y sus detalles.
tomysh1337/openstarry-codeMostrando 40 de 484 skills recopiladas.
Authorized assessment of the OAuth 2.0 Device Authorization Grant (RFC 8628): device_code / user_code issuance, verification URI integrity, polling and rate limits, client binding, and token exchange abuse. Use when CLI tools, smart TVs, IoT, headless…
Idioma del texto original: inglés
Authorized assessment of OAuth 2.0 / OIDC implicit and hybrid token-in-browser flows: response_type=token/id_token leakage, fragment handling, migration to authorization code + PKCE. Use when SPA or legacy SSO still issues access or ID tokens at the authorize…
Idioma del texto original: inglés
Authorized assessment and hardening of OAuth 2.0 Pushed Authorization Requests (PAR, RFC 9126): back-channel request push, request_uri lifecycle, client auth at the PAR endpoint, and front-channel reduction. Use when AS discovery shows…
Idioma del texto original: inglés
Authorized assessment checklist for OAuth 2.0 PKCE (RFC 7636): code_challenge, code_verifier, S256 vs plain, public-client enforcement, and related code interception controls. Use when SPA, mobile, native, or public clients use authorization code + PKCE under…
Idioma del texto original: inglés
Authorized design and assessment of OAuth 2.0 Resource Indicators (RFC 8707): the resource request parameter, absolute resource URIs, multi-resource grants, and audience-restricted access tokens for the indicated protected resource(s). Use when clients or…
Idioma del texto original: inglés
Authorized design and assessment of OAuth Demonstrating Proof of Possession (DPoP) and sender-constrained access tokens in the RFC 9449 style: DPoP proofs, htm/htu binding, nonce challenges, cnf.jkt key thumbprints, and Bearer vs DPoP enforcement. Use when…
Idioma del texto original: inglés
Design and review metrics, logs, and traces as one observability system: RED/USE at a high level, correlation IDs, cardinality control, and safe telemetry. Use when observability, metrics, tracing, OpenTelemetry, APM, 可观测性, 指标, 链路追踪, Prometheus, span, SLI/SLO…
Idioma del texto original: inglés
Extract text from images using Tesseract.js OCR (100% local, no API key required). Supports Chinese (simplified/traditional) and English.
Idioma del texto original: inglés
Authorized design, implementation review, and assessment of OpenID Connect Back-Channel Logout: logout_token JWT validation, backchannel_logout_uri delivery, sid/sub session binding, events claim, and propagation to local sessions and refresh tokens. Use when…
Idioma del texto original: inglés
Authorized validation and assessment of OpenID Connect ID tokens: iss, aud, exp/nbf, nonce, signature via JWKS, and azp/at_hash checks. Use when an RP or API accepts id_token JWTs after OIDC login, hybrid flow, or token exchange and you must verify claim…
Idioma del texto original: inglés
OPA Gatekeeper policy-as-code for owned Kubernetes clusters: ConstraintTemplates (Rego + CRD schema), Constraints (match, parameters, enforcementAction), and audit vs deny behavior. Use when authoring or reviewing Gatekeeper templates and constraints, rolling…
Idioma del texto original: inglés
Advanced open-redirect testing: multi-parser gaps, allowlist failures, encoding and scheme tricks, and chains into OAuth/OIDC redirect_uri and token theft. Use when basic next/return checks exist but Location still leaves the trusted host, or when…
Idioma del texto original: inglés
Local speech-to-text with the Whisper CLI (no API key).
Idioma del texto original: inglés
Verify OpenAPI (and similar) contracts against real producers/consumers: request/response conformance, CI gates, consumer-driven checks, and drift detection. Use when OpenAPI contract tests, schema conformance, Pact/OpenAPI validation,…
Idioma del texto original: inglés
Authorized review of OpenID Connect discovery document hygiene: /.well-known/openid-configuration (and OAuth AS metadata), issuer exact-match, HTTPS-only endpoints, JWKS URI trust, advertised algorithms/grants, and cross-document consistency with live IdP…
Idioma del texto original: inglés
Generate or declare an OpenRouter video asset for AwesomeWebpageMetaSkill using a parent-leased Provider Settings connection and configured non-secret model/output values.
Idioma del texto original: inglés
Hide and keep hidden the real origin server IP behind a CDN/WAF edge for owned infrastructure: DNS hygiene, historical and cert leaks, origin firewall allowlists, authenticated origin pulls, and continuous exposure checks. Use when placing origins behind…
Idioma del texto original: inglés
Use for authorized OT/ICS security assessment covering Purdue model zoning, PLC/SCADA exposure, industrial protocol discovery, and safe passive-first evaluation.
Idioma del texto original: chino
Context-aware output encoding and safe sinks to prevent XSS, SQL injection, and related injection via string composition: HTML/XML, attributes, JS, URL, CSS, SQL/NoSQL parameters, shell argv, and log encoding. Use when output encoding, 输出编码, contextual…
Idioma del texto original: inglés
Run and gate OWASP Dependency-Check (ODC) for multi-ecosystem SCA: CLI and build plugins, NVD data updates, suppression files, CVSS fail thresholds, and HTML/JSON/SARIF reports in local and CI pipelines. Use when dependency-check, OWASP Dependency-Check, ODC,…
Idioma del texto original: inglés
Implement and review Passkeys / WebAuthn (W3C Web Authentication) registration and assertion flows: RP ID, origin, challenge binding, credential store, user verification, and safe fallbacks. Use when adding or hardening passwordless/passkey login, WebAuthn…
Idioma del texto original: inglés
Design NIST-oriented password policies: length, deny/breach lists, no composition theater or forced rotation, modern hashing, and manager-friendly UX. Use when defining or reviewing password requirements, signup/change validation, breached-password checks, or…
Idioma del texto original: inglés
Authorized testing of password-reset and magic-link poisoning: Host / X-Forwarded-Host influence on reset URLs, token leakage via attacker host, open-redirect and cache chains, and token handling flaws. Use when reset, invite, or verify emails embed absolute…
Idioma del texto original: inglés
Defend filesystem path sinks against traversal and escape: canonicalize (resolve) then prefix-check under a fixed root, prefer openat/O_NOFOLLOW, chroot-like jail roots, and reject ".." segments and null bytes. Use when hardening download, include, template,…
Idioma del texto original: inglés
主动渗透测试工具链。覆盖信息收集、端口扫描、漏洞扫描、Web 渗透、SQL 注入、目录爆破、密码破解等场景。 通过 MCP server（pentestMCP / mcp-security-hub）将 20+ 安全工具暴露给 AI agent。 触发关键词：渗透测试、端口扫描、Nmap、漏洞扫描、Nuclei、SQL 注入、SQLMap、目录爆破、FFUF、密码破解、Hashcat、信息收集、子域名、Web 渗透、ZAP、Burp。
Idioma del texto original: chino
实战 SRC / 众测 / Bug bounty 漏洞挖掘工作流 skill。包含：5 阶段方法论（intake → recon → enum → hunt → report）、19 个攻击类 playbook（SQLi/XSS/RCE/SSRF/IDOR/CSRF/Path Traversal/File Upload/SSTI/XXE/Race/HTTP Smuggling/OAuth/JWT/SAML/GraphQL/Mobile/LLM/DoS）、305 个结构化 payload、263 个 WAF/EDR…
Idioma del texto original: chino
Plan and review basic performance and load tests: goals, SLIs, scenarios, workloads, and high-level tools. Use when performance testing, 性能测试, load test, stress test, soak test, latency percentiles, k6, JMeter, Gatling, Locust, or capacity checks. Complements…
Idioma del texto original: inglés
Assess and harden the Permissions-Policy (formerly Feature-Policy) HTTP response header: powerful browser features, allowlists, iframe delegation, and missing or over-permissive policies. Use when reviewing camera/mic/geo geolocation payment USB sensors…
Idioma del texto original: inglés
Audit Python dependencies with pip-audit and enforce install integrity via constraints files and hash-checking mode (pip --require-hashes, hashed requirements). Use when Python CVE/SCA findings, pip-audit CI failures, requirements.txt/constraints.txt drift,…
Idioma del texto original: inglés
Authorized design and assessment checklist for OAuth 2.0 PKCE on public clients (SPA, mobile, native, desktop): mandatory S256 code_challenge, code_verifier lifecycle, no embedded client secrets, and token-endpoint binding. Use when public clients run…
Idioma del texto original: inglés
Select the most specific installed skill for project planning, task decomposition, persistent progress tracking, product requirements, PRDs, roadmaps, user stories, discovery, and prioritization. Use for project plan, task plan, roadmap, PRD, requirements,…
Idioma del texto original: inglés
Use persistent task_plan.md, findings.md, and progress.md files to organize complex multi-step work and resume it across context changes. Use for project plans, task decomposition, research workflows, more than five expected tool calls, 任务规划, 项目计划, 拆解任务,…
Idioma del texto original: inglés
Assess and reduce pnpm shamefully-hoist / flat node_modules risk: phantom dependencies, undeclared requires, monorepo cross-package imports, and safer hoist alternatives (public-hoist-pattern, packageExtensions). Use when shamefully-hoist,…
Idioma del texto original: inglés
Authorized Podman security hardening and assessment: rootless vs rootful, user namespaces, capabilities, SELinux labels, privileged/host mounts, publish ports, Podman socket exposure, secrets, and image trust. Use when reviewing Containerfile runtime, podman…
Idioma del texto original: inglés
Authorized PostgreSQL hardening for owned databases: pg_hba.conf access rules, SSL/TLS, SCRAM-SHA-256 password auth, role least privilege, superuser avoidance, extension allowlists, and connection/auth logging. Use when reviewing postgresql.conf /…
Idioma del texto original: inglés
Authorized window.postMessage security review: origin validation on message handlers, targetOrigin misuse, untrusted data into DOM/code sinks, and XSS or token theft via postMessage. Use when apps use iframes, openers, webviews, or cross-window messaging, or…
Idioma del texto original: inglés
Write clear pull/merge request titles and bodies using Why / What / Test structure, linked issues, and review-friendly scope. Use when PR description, 写 PR, pull request body, MR description, PR title, GitHub/GitLab PR template, or summarizing a branch for…
Idioma del texto original: inglés
Resolve formatter/linter/EditorConfig hierarchy, avoid tool fights, and run a reliable format-then-lint fix pipeline. Use when prettier, eslint, editorconfig, 格式化, format-on-save conflicts, eslint-config-prettier, or CI format checks fail.
Idioma del texto original: inglés
Design and review private PKI hierarchies for owned or authorized environments: offline root CA, intermediate and issuing CAs, pathLen and name constraints, trust anchors, CRL/OCSP distribution, and key custody. Use when planning or reviewing an internal CA…
Idioma del texto original: inglés
When the user wants to create or update their product marketing context document. Also use when the user mentions 'product context,' 'marketing context,' 'set up context,' 'positioning,' 'who is my target audience,' 'describe my product,' 'ICP,' 'ideal…
Idioma del texto original: inglés