Menu
Skills dans ce dépôt
SkillsMP a collecté 484 skills depuis tomysh1337/openstarry-code. Ouvrez un skill pour examiner sa source et ses détails.
tomysh1337/openstarry-codeAffichage de 40 skills collectés sur 484.
Write and review Bash/POSIX shell scripts with safe defaults: set -euo pipefail where appropriate, correct quoting, array-safe iteration, ShellCheck-clean patterns, and predictable error handling. Use when shell script style, bash style, shellcheck, quoting…
Langue du texte source : anglais
Configure and verify Git commit signing with GPG or SSH keys so hosts show a Verified badge and branch protection can require signed commits. Use when signed commits, commit signing, GPG sign, SSH signing key, git commit -S, Verified badge, required signed…
Langue du texte source : anglais
Route tasks across installed and source-cached Codex skills, then delegate to one of nine bilingual domain routers before loading a concrete workflow. Use when several skills could match, the user asks which skill should handle a task, or a complex request…
Langue du texte source : anglais
Inventory, refresh, audit, and selectively stage external Codex skill sources without bulk-registering them. Use when downloading skill repositories, updating skill-sources, checking provenance or duplicates, validating frontmatter and scripts, generating a…
Langue du texte source : anglais
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.
Langue du texte source : anglais
Design and harden SMS one-time password (OTP) risk controls: send/resend budgets, verify attempt limits, code entropy and TTL, purpose binding, and abuse-resistant UX. Use when login, signup, step-up, or recovery relies on SMS OTP and you need send-flood,…
Langue du texte source : anglais
Install, authenticate, and run the Snyk CLI for open-source SCA, Snyk Code, container images, and IaC on owned repositories and CI. Use when snyk test, snyk code test, snyk container test, snyk iac test, snyk monitor, SNYK_TOKEN, .snyk policy, severity…
Langue du texte source : anglais
Select the most specific installed skill for implementation, debugging, testing, code review, API/schema design, Git, packaging, language conventions, concurrency, and architecture. Use for coding, refactor, debug, unit tests, API design, Python, TypeScript,…
Langue du texte source : anglais
Configure and enforce SonarQube / SonarCloud Quality Gates in CI: gate conditions (coverage, duplications, ratings, new-code issues), waitForQualityGate / CE task polling, PR decoration, and fail-closed merge or release when the gate is red. Use when…
Langue du texte source : anglais
Authorized Spring Boot Actuator hardening: endpoint exposure, separate management port, Spring Security on /actuator, health details, and high-risk endpoints (env, heapdump, threaddump, loggers, shutdown, jolokia). Use when reviewing…
Langue du texte source : anglais
Spring Security config checklist: SecurityFilterChain, CSRF, sessions, method security, CORS, password encoding, actuators, JWT resource server. Use when reviewing Spring Boot Security, permitAll mistakes, or hardening org-owned Java/Kotlin apps — authorized…
Langue du texte source : anglais
Defend against SQL injection with parameterized queries and safe ORM patterns: bind values (never concatenate), allowlist ORDER BY/identifiers, avoid unsafe raw SQL APIs, and correct Sequelize/Prisma/SQLAlchemy/EF usage. Use when hardening data access,…
Langue du texte source : anglais
Format and structure SQL for readability and safe evolution: consistent keyword casing, clear table/column naming, explicit joins, migration hygiene, and review-friendly diffs. Use when SQL style, SQL 规范, schema naming, migration readability, query…
Langue du texte source : anglais
SSH key hygiene for org-owned hosts and workstations: modern key types, ssh-agent practices, authorized_keys review, permissions, rotation, and host-key trust. Use when hardening SSH keys, cleaning authorized_keys, agent-forwarding risk, or post-incident key…
Langue du texte source : anglais
Authorized assessment of SSO single logout (SLO) and cross-app session propagation: IdP/SP logout, front- vs back-channel termination, RP-initiated logout, refresh-token and cookie invalidation, and residual sessions after “logout everywhere.” Use when SSO…
Langue du texte source : anglais
Design SSRF defenses for server-side URL fetchers: hostname allowlists, scheme allowlists, metadata and private-IP blocks, DNS-rebinding-safe resolve-then- connect checks, and URL parser pitfalls. Use when hardening webhooks, previews, importers, unfurl,…
Langue du texte source : anglais
Systematic SSRF filter and URL-parser bypass catalog for authorized assessments: IP encoding, DNS/TOCTOU, redirect and scheme tricks, allowlist confusion, and cloud metadata edge cases. Use when a server-side fetch is confirmed but deny-lists, allowlists, or…
Langue du texte source : anglais
Choose and structure application state: client UI state vs server/cache state, and when to use React Context, Zustand, Redux, or URL state. Use when state management, Redux, Zustand, React Query, server state, client state, 状态管理, 全局状态, or when deciding where…
Langue du texte source : anglais
Design content-hashed static asset filenames, long-lived Cache-Control immutable headers, atomic deploy order, and safe HTML/manifest updates so browsers never pair new markup with missing or stale bundles. Use when bundler content hashes, fingerprinted…
Langue du texte source : anglais
Guided statistical analysis for research data - test selection, assumption checking, effect sizes, power analysis, Bayesian alternatives, and APA-formatted reporting. Use whenever a user wants to compare groups, test a hypothesis, analyze experimental or…
Langue du texte source : anglais
Design and authorized assessment of step-up (re-authentication) patterns: sensitive-action challenges, short-lived elevation claims, binding to purpose and session, and server-side enforcement. Use when password change, payments, MFA disable, OAuth grants,…
Langue du texte source : anglais
Authorized malware sample strings and IOC triage: extract ASCII/UTF-16 strings, classify URLs/IPs/paths/mutexes/registry keys, score confidence, and export a minimal IOC set for IR/YARA handoff. Use when doing first-pass static clues on PE/ELF/dumps/scripts —…
Langue du texte source : anglais
Assess and implement Subresource Integrity (SRI) for script and link tags: sha384 digests, crossorigin, CDN trust, hash rotation, integrity mismatches, and service-worker edge cases. Use when reviewing third-party CDN scripts, missing integrity attributes,…
Langue du texte source : anglais
Brief Svelte/SvelteKit security notes: {@html} sinks, CSP, SSR XSS, client store secret hygiene, and hooks.server auth patterns. Use when reviewing or hardening SvelteKit apps, {@html} rich text, handle/hooks session guards, PUBLIC_ env leakage, or Svelte SSR…
Langue du texte source : anglais
Harden SVG handling against XSS and related active-content risks: script, event handlers, foreignObject, animation/set attributes, javascript:/data: URLs, external resource loads, and unsafe serve headers. Use when apps accept, sanitize, inline, or serve…
Langue du texte source : anglais
Generate Software Bills of Materials with Anchore Syft from source trees, container images, archives, and OCI digests: output formats (CycloneDX, SPDX, Syft JSON), scope and cataloger selection, reproducible CI-equivalent scans, and named hashed artifacts.…
Langue du texte source : anglais
Reverse tabnabbing and window.opener hardening for target=_blank links and window.open popups: rel=noopener noreferrer, Cross-Origin-Opener-Policy, and audits of user-generated or untrusted outbound links. Use when pages open third-party or UGC URLs in new…
Langue du texte source : anglais
Harden Tekton Pipelines on owned or authorized clusters: Task/Pipeline definitions, PipelineRun isolation, ServiceAccount RBAC, workspace and secret mounts, step image trust, Triggers EventListeners, and Chains provenance. Use when reviewing Tekton YAML,…
Langue du texte source : anglais
Pin Terraform/OpenTofu providers for reproducible init and plan: required_providers version constraints, .terraform.lock.hcl, terraform providers lock, registry source addresses, and CI lock-aware init. Use when provider versions float, lockfile is missing or…
Langue du texte source : anglais
Terraform security basics for authorized/org-owned infra: remote state and secrets hygiene, IAM least privilege, public S3 and open security groups, provider credential patterns, and safe plan/apply. Use when Terraform security, tfstate secrets, public…
Langue du texte source : anglais
Configure and review Terraform/OpenTofu remote state locking and encryption: S3 + DynamoDB (or native S3 lock), azurerm, and gcs backends; force-unlock risks; who may unlock; and least-privilege lock/state IAM. Use when state lock, DynamoDB lock table,…
Langue du texte source : anglais
Use for authorized security testing of desktop thick clients including local storage, update channels, IPC, traffic, and client-side trust boundaries.
Langue du texte source : chinois
Use for blue-team threat hunting, detection engineering with Sigma/YARA, SIEM query design, and incident detection validation.
Langue du texte source : chinois
STRIDE threat modeling workshop workflow for authorized product and system reviews: scope and DFDs, per-element STRIDE analysis, risk ranking, mitigations, and living model updates. Use when threat model, STRIDE, 威胁建模, DFD, attack surface workshop, security…
Langue du texte source : anglais
Own the TLS certificate lifecycle for systems you control: key generation, CSR, issuance (public CA, private CA, ACME), chain assembly, deployment, renewal, revocation, inventory, and expiry monitoring. Use when designing or reviewing cert…
Langue du texte source : anglais
Select and validate the least invasive method for obtaining TLS plaintext from owned or explicitly authorized applications. Use when proxy capture is empty, certificate trust fails, SSL pinning is suspected, the app uses native BoringSSL/OpenSSL, mTLS is…
Langue du texte source : anglais
Award-winning web design framework inspired by elite agencies (Locomotive, Studio Freight, AREA 17). Use when you need to: (1) build premium portfolio sites and brand websites, (2) create immersive web experiences with custom animations, (3) implement…
Langue du texte source : anglais
Implement and harden RFC 6238 TOTP multi-factor authentication: secret generation, otpauth enrollment, verify windows, attempt limits, backup codes, and session elevation. Use when building or reviewing authenticator-app 2FA (enroll QR, verify code,…
Langue du texte source : anglais
Design and review Traefik security middlewares: Headers (HSTS/CSP/XFO), IPAllowList, BasicAuth/DigestAuth/ForwardAuth, RateLimit, InFlightReq, RedirectScheme, CORS, and middleware chains on routers/services. Use when hardening Traefik static/dynamic config or…
Langue du texte source : anglais
Wire Trivy container image scans into CI with severity exit gates, ignore policy, DB freshness, and SARIF upload to code scanning. Use when Trivy image CI, trivy image --severity, --exit-code, SARIF upload, GitHub code scanning container CVE gate,…
Langue du texte source : anglais