Menu
Skills dans ce dépôt
SkillsMP a collecté 484 skills depuis tomysh1337/openstarry-code. Ouvrez un skill pour examiner sa source et ses détails.
tomysh1337/openstarry-codeAffichage de 40 skills collectés sur 484.
Authorized Azure Network Security Group (NSG) review for owned subscriptions: rule priority, Any/Any Allow, service tags, Application Security Groups (ASG), NSG flow logs, and effective security rules. Use when auditing Azure NSG inbound/outbound rules,…
Langue du texte source : anglais
Backpressure for async/streaming: bounded buffers, pull flow control, drop/sample/shed, slow consumers. Use when backpressure, bounded channel, overflow, 背压, 反压, or producer outruns consumer. Complements bulkheads, circuit breakers, async concurrency, and…
Langue du texte source : anglais
Design and implement MFA backup/recovery code generation, storage, display, redemption, and regeneration. Use when building or reviewing one-time backup codes, recovery codes, or offline second-factor fallbacks: entropy, hashing, single-use, rate limits,…
Langue du texte source : anglais
Run and gate Bandit (PyCQA) on owned Python trees: config discovery, severity/confidence policy, excludes, JSON/SARIF outputs, CI fail-closed gates, and triage of B-rules into fixes or owned suppressions. Use when Bandit, bandit -r, pyproject.toml…
Langue du texte source : anglais
Design and review Backend-for-Frontend (BFF) cookie sessions for SPAs: server-held tokens, HttpOnly session cookies, same-site edge layout, CSRF, and logout/revocation. Use when an SPA must avoid JS-readable access tokens, proxy OAuth/OIDC through a BFF, or…
Langue du texte source : anglais
Use when you need to run a binary, trace execution, or observe runtime behavior. Runtime analysis via QEMU emulation, GDB debugging, and Frida hooking - syscall tracing (strace), breakpoints, memory inspection, function interception. Keywords - "run binary",…
Langue du texte source : anglais
This skill should be used when analyzing binaries, executables, or bytecode to understand what they do or how they work. Triggers on "binary", "executable", "ELF", "what does this do", "reverse engineer", "disassemble", "decompile", "pyc file", "python…
Langue du texte source : anglais
Use when analyzing binary structure, disassembling code, or decompiling functions. Deep static analysis via radare2 (r2) and Ghidra headless - function enumeration, cross-references (xrefs), decompilation, control flow graphs. Keywords - "disassemble",…
Langue du texte source : anglais
Use when ready to document findings, generate a report, or summarize binary analysis results. Compiles analysis findings into structured reports - correlates facts from triage/static/dynamic phases, validates hypotheses, generates documentation with evidence…
Langue du texte source : anglais
Use when reverse engineering tools are missing, not working, or need configuration. Installation guides for radare2 (r2), Ghidra, GDB, QEMU, Frida, binutils, and cross-compilation toolchains. Keywords - "install radare2", "setup ghidra", "r2 not found", "qemu…
Langue du texte source : anglais
Use when first encountering an unknown binary, ELF file, executable, or firmware blob. Fast fingerprinting via rabin2 - architecture detection (ARM, x86, MIPS), ABI identification, dependency mapping, string extraction. Keywords - "what is this binary",…
Langue du texte source : anglais
Design bot-management signal pipelines: signal taxonomy, collection points, risk scoring, action thresholds (allow / challenge / throttle / block), feedback loops, privacy, and false-positive controls. Use when bot score design, device or TLS fingerprints as…
Langue du texte source : anglais
Run and triage Brakeman static analysis on Ruby on Rails apps you own: install/pin, repo config, confidence filters, JSON/SARIF reports, CI gates, ignore-file hygiene, and fix-then-rescan for SQLi, XSS, mass assignment, redirects, and related Rails sinks. Use…
Langue du texte source : anglais
Configure and audit GitHub/GitLab branch protection: required status checks, block force-push and deletion, linear history, admin/owner enforcement, and CODEOWNERS-required reviews. Use when branch protection, protected branch, required checks, force-push…
Langue du texte source : anglais
Use for authorized reverse engineering of browser extensions (Chrome/Firefox) including manifest analysis, background workers, and extension-based credential or traffic logic recovery.
Langue du texte source : chinois
Authorized browser extension security review: manifest permissions, content scripts, background/service workers, messaging, web_accessible_resources, update and store packaging risks. Use when assessing Chrome/Firefox/Edge extensions you own or are scoped to…
Langue du texte source : anglais
End-to-end bug bounty workflow for authorized public or private programs only: program selection, scope discipline, recon handoff, testing prioritization, evidence quality, and professional reporting. Use when hunting on HackerOne, Bugcrowd, Intigriti,…
Langue du texte source : anglais
Use when building, adapting, reviewing, or testing CDK/license-key activation and signed online updates in Windows desktop applications, especially Qt/QML, WPF/WinUI, or Electron projects.
Langue du texte source : Plusieurs langues
BuildKit secret and SSH mounts so build-time credentials never land in image layers, history, or ARG/ENV. Use when docker buildx --secret, RUN --mount=type=secret, type=ssh private git/npm/registry auth, Dockerfile secret mounts, or replacing ARG TOKEN / COPY…
Langue du texte source : anglais
Isolate failure domains with bulkheads: separate pools, semaphores, queues, and resource budgets so one dependency or tenant cannot exhaust the process. Use when bulkhead, isolation, noisy neighbor, pool per dependency, 舱壁, 隔离舱, or cascading pool exhaustion.…
Langue du texte source : anglais
Keep Bun installs reproducible: commit bun.lock (or migrate bun.lockb), frozen CI with bun ci / --frozen-lockfile, single package-manager story, workspace lock fidelity, and lock-diff review. Use when bun.lock, bun.lockb, bun install, bun ci, frozen-lockfile,…
Langue du texte source : anglais
Design application and edge caches: key design, TTLs, invalidation, stampede protection, and consistency. Use when caching, cache invalidation, 缓存, Redis/Memcached, CDN cache keys, TTL, thundering herd, or cache-aside patterns. Not for web cache…
Langue du texte source : anglais
Authorized CAPTCHA and bot-challenge control research: when challenges bind, client-trust gaps, reusable tokens, logic skips, accessibility/alternate paths, and rate-limit interplay. Use for labs, CTFs, and scoped assessments measuring control effectiveness —…
Langue du texte source : anglais
Design and implement enterprise CAPTCHA / bot-challenge integration for owned applications: provider selection, sitekey and secret lifecycle, server-side token verification, action and hostname binding, score thresholds, fail-closed behavior, multi-client…
Langue du texte source : anglais
Run and gate Rust dependency vulnerability checks with cargo-audit locally and in CI: RustSec advisory DB, Cargo.lock scans, JSON outputs, ignore policy, version pins, and actionable upgrade paths for owned crates. Use when cargo-audit, RustSec, RUSTSEC-*,…
Langue du texte source : anglais
Design CDN/edge HTTP cache keys: scheme/host/path, Vary, cookie inclusion, query-string allowlists, unkeyed header poison defenses, and purge strategy. Use when configuring CloudFront/Fastly/Cloudflare/Akamai cache keys, Vary headers, qs whitelist, cookie…
Langue du texte source : anglais
Authorized CDN/WAF bypass awareness: edge fingerprinting, origin exposure, alternate entrypoints, inspection gaps, cache/bot control boundaries, and residual-risk notes when CDN or WAF is the primary control. Use when reviewing whether…
Langue du texte source : anglais
Kubernetes cert-manager basics for owned or authorized clusters: Issuer and ClusterIssuer design, ACME HTTP-01/DNS-01 challenges, Certificate CRDs, renewal and Secret delivery, and private CA issuers. Use when installing or reviewing cert-manager, debugging…
Langue du texte source : anglais
Certificate Transparency (CT) logs and Signed Certificate Timestamps (SCTs) for authorized recon, mis-issuance detection, and TLS evidence. Use when querying CT logs for hostnames, verifying SCTs in certificates or TLS handshakes, monitoring org domains for…
Langue du texte source : anglais
Maintain Keep a Changelog-style CHANGELOG entries and write user-facing release notes from commits, PRs, and version bumps. Use when changelog, release notes, 更新日志, CHANGELOG.md, GitHub/GitLab releases, version announcements, or mapping Conventional Commits…
Langue du texte source : anglais
Plan authorized chaos and fault-injection experiments in lab or owned non-prod: hypothesis, blast radius, steady state, inject/observe/stop. Use when chaos engineering, 混沌工程, fault injection, GameDay, Litmus, Chaos Mesh, Gremlin, toxiproxy, or resilience…
Langue du texte source : anglais
Design and review CI/CD pipelines for clear stages, secret hygiene, dependency and build caching, fail-fast feedback, and durable artifacts. Use when CI/CD, GitHub Actions, GitLab CI, pipeline, 持续集成, workflow YAML, deploy gates, OIDC to cloud, cache,…
Langue du texte source : anglais
Design circuit breakers for dependency isolation: closed/open/half-open states, failure thresholds, probe recovery, and fallbacks. Use when circuit breaker, 熔断, bulkhead isolation, fail-fast dependency, open circuit, or cascading failure protection toward a…
Langue du texte source : anglais
Defense-first clickjacking and frame-busting controls: X-Frame-Options, CSP frame-ancestors, SameSite cookie interaction, and authorized UI-redress validation. Use when hardening framable UI, reviewing anti-framing headers, replacing client-side…
Langue du texte source : anglais
Advanced authorized clickjacking and UI redress: multi-step overlays, drag-drop and cursor-jack chains, SameSite/third-party cookie limits, nested-frame and CSP frame-ancestors bypasses, and high-impact framed actions. Use when basic framing checks are done…
Langue du texte source : anglais
Cloud content audit bypass: output encoding, ZWSP insertion, Unicode homoglyph substitution, split delivery, code-block smuggling. Trigger: bypass audit, encode output, split deliver, cloud bypass, evade review, hide content.
Langue du texte source : anglais
Use for authorized cloud, container, and Kubernetes security assessment including metadata SSRF, IAM misconfig, container escape paths, and cluster RBAC review.
Langue du texte source : chinois
Defend applications and workloads against SSRF that reaches cloud instance metadata (IMDS): block link-local targets, enforce IMDSv2/hop limits, harden URL fetchers, and reduce role blast radius. Use when hardening against 169.254.169.254,…
Langue du texte source : anglais
Select the most specific installed skill for AWS, Azure, GCP, Kubernetes, containers, CI/CD, registries, networking, certificates, databases, observability, performance, and reliability. Use for cloud, Kubernetes, Docker, Terraform, deployment, DevOps, 云服务,…
Langue du texte source : anglais
CloudFormation IAM guardrails for owned AWS accounts: roles and policies in templates, CAPABILITY_IAM / CAPABILITY_NAMED_IAM deploy gates, permissions boundaries, CloudFormation service roles, stack policies, and least-privilege policies. Use when hardening…
Langue du texte source : anglais