Menú
Skills en este repositorio
SkillsMP ha recopilado 484 skills de tomysh1337/openstarry-code. Abre una skill para revisar su origen y sus detalles.
tomysh1337/openstarry-codeMostrando 40 de 484 skills recopiladas.
Design and review property-based and fuzz-style property tests: invariants, generators, shrinking, and when properties beat examples. Use when property-based testing, 属性测试, hypothesis, fast-check, jqwik, proptest, generators, shrinking, or invariant testing.…
Idioma del texto original: inglés
Design and evolve Protobuf/gRPC API contracts: package and naming style, field numbers, types, oneof/map/repeated rules, compatibility, errors, pagination, and service layout. Use when writing or reviewing .proto files, gRPC service APIs, buf/lint rules, or…
Idioma del texto original: inglés
Recover and validate unknown Protobuf, gRPC, and gRPC-Web message structures from captures, application assets, binaries, or runtime traces. Use when payloads contain Protobuf wire data, `application/grpc`, `application/grpc-web+proto`, five-byte gRPC frames,…
Idioma del texto original: inglés
Master network protocol reverse engineering including packet analysis, protocol dissection, and custom protocol documentation. Use when analyzing network traffic, understanding proprietary protocols, or debugging network communication.
Idioma del texto original: inglés
Use for authorized reverse engineering of custom binary protocols, Protobuf/gRPC, WebSocket frames, and PCAP-driven protocol recovery.
Idioma del texto original: chino
Harden JavaScript and TypeScript applications against prototype pollution: safe merge/clone, key denylists and allowlists, null-prototype maps, parser settings, freeze/seal of config, and regression tests. Use when fixing or reviewing deep-merge, defaults,…
Idioma del texto original: inglés
Pulumi secrets and encrypted config for owned/authorized stacks: pulumi config set --secret, secrets providers (passphrase vs cloud KMS), stack outputs, and Pulumi ESC. Use when Pulumi secrets, stack config encryption, PULUMI_CONFIG_PASSPHRASE,…
Idioma del texto original: inglés
Authorized PWA security review: service worker scope, Cache API / precache poisoning, HTTPS-only installability, Web Push permissions, and offline auth tokens. Use when assessing service workers, Workbox caches, manifest install flows, push handlers, or…
Idioma del texto original: inglés
Configure and review PyPI (and TestPyPI) Trusted Publishing so CI publishes Python packages via short-lived OIDC identity instead of long-lived API tokens. Use when designing or auditing PyPI OIDC publishers, GitHub Actions or GitLab publish jobs,…
Idioma del texto original: inglés
Modern Python packaging with pyproject.toml, hatch/poetry/uv, src layout, versioning, and wheels. Use when packaging a Python library or app, authoring or migrating setup.py/setup.cfg to PEP 517/518/621, choosing hatchling/setuptools/ poetry-core, building…
Idioma del texto original: inglés
Apply PEP 8 style, modern type hints, and repo-aligned pyright/mypy plus black/ruff tooling when writing or reviewing Python. Use when Python style, typing, type hints, 类型注解, PEP 8, mypy, pyright, ruff, black, annotations, or Python formatting/linting…
Idioma del texto original: inglés
Own Astral uv lockfiles and install gates: uv.lock generation, upgrade, check, frozen sync, dependency groups/extras, index policy, and CI reproducibility for Python projects. Use when uv.lock, uv lock, uv sync --frozen, uv lock --check, uv lock --upgrade,…
Idioma del texto original: inglés
Capture, decrypt, and analyze QUIC and HTTP/3 traffic using endpoint key logs, qlog, PCAP, Wireshark, and implementation traces. Use when traffic is UDP-based and encrypted, ALPN is h3, connection IDs replace stable five-tuples, HTTP/3 streams use QPACK,…
Idioma del texto original: inglés
Authorized RabbitMQ security assessment and hardening: users, vhosts, configure/write/read permissions, TLS for AMQP and management, default guest account, loopback_users, and management UI exposure. Use when reviewing rabbitmq.conf / advanced.config,…
Idioma del texto original: inglés
Use for authorized RF/SDR security research including signal identification, replay feasibility study in shielded labs, and wireless protocol analysis outside classic Wi-Fi.
Idioma del texto original: Varios idiomas
Rails security checklist for org-owned apps: strong parameters, CSRF, sessions/cookies, ActiveRecord injection, secrets, headers, and authZ. Use when reviewing Rails apps, credentials, Devise/sessions, or hardening before release — authorized only.
Idioma del texto original: inglés
Authorized testing of HTTP rate limits and anti-automation: limit keying (IP, user, session, API key), header-based IP trust, path/method aliases, protocol quirks, and IP-rotation awareness. Use when login, OTP, reset, or API quotas should throttle abuse but…
Idioma del texto original: inglés
Structure React components with clear props, hooks, composition, and colocation. Use when React components, hooks, props, colocation, compound components, React 组件, 组件结构, custom hooks, or when reviewing React UI structure. Pairs with code-quality-standards;…
Idioma del texto original: inglés
Harden React hooks against security pitfalls: dangerouslySetInnerHTML sinks, effect cleanup that leaks tokens/subscriptions, stale auth/closure state, and useMemo/useCallback values that land secrets in logs or client bundles. Use when reviewing or fixing…
Idioma del texto original: inglés
Authorized React Native mobile app security basics: expo-secure-store / react-native-keychain storage, certificate pinning notes, deep-link and universal-link handling, JS bundle tampering awareness, and WebView risks. Use when hardening or reviewing owned RN…
Idioma del texto original: inglés
Structure and write project README, CONTRIBUTING, and quickstart docs that get users running and contributors shipping safely. Use when README, CONTRIBUTING, quickstart, 写说明文档, project overview, onboarding docs, setup instructions, or polishing the repository…
Idioma del texto original: inglés
Design least-privilege Redis ACL users: command categories, key/channel patterns, AUTH secrets, and deny lists for dangerous commands. Use when defining users.acl, ACL SETUSER rules, app vs admin roles, key-prefix isolation, or replacing shared requirepass…
Idioma del texto original: inglés
Authorized Redis security assessment and hardening: bind addresses, protected-mode, AUTH/ACL, dangerous command exposure (FLUSH*, CONFIG, MODULE, DEBUG, SLAVEOF/REPLICAOF), network exposure, TLS, and safe config examples. Use when reviewing redis.conf, cloud…
Idioma del texto original: inglés
Strict refresh-token rotation and reuse detection: one-time rotate on use, reject previous tokens, revoke entire token family on reuse, concurrent-refresh races, grace windows, and storage/hash requirements. Use when assessing or implementing refresh…
Idioma del texto original: inglés
Design, assess, and harden trust in registry mirrors and pull-through caches for containers and packages (Harbor, Artifactory, Nexus, ECR/GHCR proxies, npm/PyPI/Maven mirrors). Use when clients resolve artifacts via a corporate mirror, when pull-through cache…
Idioma del texto original: inglés
Design and assess long-lived remember-me / persistent-login tokens: opaque selector+validator patterns, hashed storage, rotation, revocation, and cookie transport. Use when implementing or reviewing “stay signed in”, persistent login cookies, or multi-device…
Idioma del texto original: inglés
Harden Mend Renovate (self-hosted or app) for supply-chain and CI safety: token least privilege, auto-merge gates, allowScripts/ignoreScripts, hostRules secrets, registry allowlists, custom/regex managers, and PR trust under branch protection. Use when…
Idioma del texto original: inglés
Achieve bit-for-bit or policy-defined equivalent rebuilds: hermetic inputs, SOURCE_DATE_EPOCH, pinned toolchains, and binary equivalence checks. Use when reproducible builds, rebuild verification, deterministic builds, SOURCE_DATE_EPOCH, build nondeterminism,…
Idioma del texto original: inglés
Detect known-vulnerable JavaScript and Node libraries with Retire.js (CLI): js/node path scans, severity gates, ignore files, JSON/CycloneDX output, and CI fail-closed wiring for owned frontends and Node apps. Use when retire.js, retire CLI, JS library CVE…
Idioma del texto original: inglés
Design safe retries: exponential backoff, jitter, budgets, idempotency, and when not to retry. Use when retry, backoff, 重试, transient failure, 429/503 handling, dead-letter, or retry storms. Complements async cancel and cache loaders; not a substitute for…
Idioma del texto original: inglés
Trace and reverse Android native behavior end to end across Java or Kotlin call sites, JNI static or dynamic registration, APK/AAB/AAR native-library inventory, ELF and ARM/Thumb/AArch64 analysis, Frida or JNItrace validation, algorithm recovery, and minimal…
Idioma del texto original: inglés
Binary analysis: disassembly guidance, unpacking, string extraction, control-flow recovery. Trigger: reverse, disassemble, decompile, unpack, analyze binary, pe header, elf header.
Idioma del texto original: inglés
Guide for reverse engineering protected games and anti-cheat components across user mode, kernel mode, and hypervisor-aware environments. Use this skill when analyzing drivers, IOCTL protocols, callback registration, injected-code artifacts, integrity checks,…
Idioma del texto original: inglés
Test REST, GraphQL, WebSocket, and SOAP APIs for authentication, authorization, token, rate-limit, and protocol-specific security flaws.
Idioma del texto original: chino
在 CLI 环境下做 Android APK 逆向时使用。适用于 APK 解包、Java 反编译、smali 修改、重打包、Frida 动态 Hook，以及按需切换到 so/native 分析。优先使用本机已安装的 jadx、apktool、frida、adb、ida-reverse、radare2。
Idioma del texto original: chino
Plan and coordinate multi-stage authorized penetration-testing and CTF attack paths across reconnaissance, exploitation, privilege escalation, lateral movement, and reporting.
Idioma del texto original: chino
.NET / C# 二进制逆向。当目标是 .NET assembly（PE 头含 CLR、.exe/.dll 托管程序）、C# 编译产物（含 NativeAOT）、红队 Sharp* 工具（Rubeus / SharpHound / SharpHound 等）、.NET 混淆程序（ConfuserEx / SmartAssembly / Babel / Eazfuscator）、.NET loader / info-stealer / 套壳 malware 时使用。优先用 dnSpyEx + de4dot，需要…
Idioma del texto original: chino
IDA Pro 逆向分析辅助技能。当用户提到逆向、反编译、分析二进制/PE/ELF/APK/DLL/SO、破解、找密码、漏洞分析、病毒分析、firmware 固件分析，或需要分析 exe/dll/so/elf/macho/sys 等文件时，务必使用此技能。 Ensure to use this skill when the user wants to analyze any binary file, regardless of whether they explicitly mention "IDA" or…
Idioma del texto original: chino
Assess LLM and AI-agent applications for prompt injection, unsafe tool use, memory poisoning, data exposure, model supply-chain, and agentic security risks.
Idioma del texto original: chino
Analyze suspicious PE, ELF, Mach-O, APK, and script samples using static, dynamic, behavioral, IOC, YARA, Sigma, and anti-analysis workflows.
Idioma del texto original: chino