tomysh1337/openstarry-code - Page 3

code-audit

Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.

Langue du texte source : chinois

code-quality-standards

Apply repository-aligned coding standards while adding features, fixing bugs, refactoring, or reviewing implementation changes. Use when writing or modifying production code and the task needs maintainability, clear boundaries, type and data-model discipline,…

Langue du texte source : anglais

code-review-comments-style

Write clear, kind, actionable code review comments with appropriate severity, and decide request-changes vs nit vs approve. Use when code review comments, PR review feedback, 评审意见写法, review tone, blocking vs non-blocking notes, or drafting GitHub/GitLab…

Langue du texte source : anglais

code-task

PREFERRED way to change code in a REAL repository: fix a GitHub issue, fix a bug, add/implement a function or feature, or make any edit to a project the user names by a filesystem path (e.g. /tmp/foo, ~/code/bar) or a git URL. Clones the repo, runs an…

Langue du texte source : anglais

codeowners-review-routing

Design and maintain CODEOWNERS path ownership, required review rules, and monorepo routing that avoids single-owner bottlenecks. Use when CODEOWNERS syntax, path owners, required reviewers, branch protection review counts, monorepo package ownership, review…

Langue du texte source : anglais

codeql-query-pack-basics

CodeQL packs: qlpack.yml layout, query vs library packs, dependencies, lock files, custom queries, suite selection, and analyze/CI wiring for org-owned codebases. Use when creating or packing CodeQL query packs, qlpack.yml / codeql-pack.yml, pack…

Langue du texte source : anglais

command-injection-defenses

Defend applications against OS command injection by avoiding shells, using argv arrays, allowlisting inputs and binaries, and preferring library APIs over exec. Use when hardening process spawning, subprocess/ProcessBuilder/ child_process sinks, CLI wrappers…

Langue du texte source : anglais

comment-writing-standards

Standards for when and why to write comments, what not to narrate, and how to document decisions, invariants, and non-obvious constraints in code. Use when writing comments, reviewing comment quality, documenting intent, 写注释, 注释规范, comment style, or deciding…

Langue du texte source : anglais

commit-message-conventions

Write clear git commit messages using Conventional Commits (type, optional scope, subject/body/footer), emphasizing why the change exists rather than restating the diff. Use when drafting or reviewing a commit message, Conventional Commits, 提交信息, git commit…

Langue du texte source : anglais

composer-security-audit

Run and gate PHP Composer dependency vulnerability checks with composer audit locally and in CI: Packagist/GitHub security advisories, composer.lock scans, JSON output, abandoneds, ignore policy, and upgrade paths for owned PHP apps. Use when composer audit,…

Langue du texte source : anglais

composio-app-automation-catalog

Route Composio and Rube app-automation requests to a cached catalog of 810 canonical workflows derived from 832 source skills. Use when a user asks to automate or connect a SaaS or API through Composio/Rube MCP, needs an app-specific tool sequence, or…

Langue du texte source : anglais

container-image-signing

Sign and verify container images with Cosign and Sigstore: keyless OIDC, long-lived keys, and admission or policy enforcement by digest. Use when cosign sign/verify, Fulcio/Rekor, keyless OIDC image signing, Kyverno or Gatekeeper or Sigstore policy-controller…

Langue du texte source : anglais

content-security-policy-bypass

Authorized Content-Security-Policy (CSP) review and bypass research: parse policy directives, assess nonce/hash/'strict-dynamic' posture, source expressions, and XSS impact under CSP. Use when responses or meta tags set CSP, inline script is blocked, or a…

Langue du texte source : anglais

content-strategy

When the user wants to plan a content strategy, decide what content to create, or figure out what topics to cover. Also use when the user mentions "content strategy," "what should I write about," "content ideas," "blog strategy," "topic clusters," "content…

Langue du texte source : anglais

content-type-sniffing-defense

Defend against MIME / content-type sniffing: enforce X-Content-Type-Options nosniff, accurate Content-Type, safe user-upload serve paths, and polyglot body risks that browsers re-interpret as HTML/script. Use when hardening or auditing response headers for…

Langue du texte source : anglais

contract-testing-pact

Consumer-driven contract testing (Pact-style): consumer expectations, provider verification, broker publish, and CI compatibility gates. Use when Pact, CDC, consumer-driven contracts, provider verification, pact broker, can-i-deploy, or API shape drift…

Langue du texte source : anglais

cookie-security-flags

Assess and harden HTTP cookie flags: Secure, HttpOnly, SameSite, Domain, Path, Prefixes (__Host-/__Secure-), and Max-Age/Expires. Use when reviewing session or auth cookies for missing flags, overly broad scope, CSRF exposure, or XSS cookie theft risk on…

Langue du texte source : anglais

coop-coep-isolation

Design, audit, and remediate Cross-Origin-Opener-Policy (COOP) and Cross-Origin-Embedder-Policy (COEP) for browser cross-origin isolation (crossOriginIsolated, SharedArrayBuffer, Spectre mitigations). Use when enabling or debugging COOP/COEP/CORP, SAB…

Langue du texte source : anglais

copywriting

When the user wants to write, rewrite, or improve marketing copy for any page — including homepage, landing pages, pricing pages, feature pages, about pages, or product pages. Also use when the user says "write copy for," "improve this copy," "rewrite this…

Langue du texte source : anglais

cordova-webview-risks

Authorized Cordova/PhoneGap hybrid app security review: config.xml navigation allowlists, file:// origin and content access, JS↔native bridge injection, and outdated/vulnerable plugins. Use when assessing Cordova, PhoneGap, Ionic Cordova, or…

Langue du texte source : anglais

cors-credentialed-requests

Authorized assessment of credentialed CORS: Access-Control-Allow-Credentials with cookies or client certs, forbidden ACAO *, origin reflection, null origin, preflight vs simple requests, and browser PoC requirements. Use when ACAC true, credentialed…

Langue du texte source : anglais

cors-preflight-cache

Authorized assessment of CORS preflight caching (Access-Control-Max-Age), browser OPTIONS cache behavior, ACAO reflection under credentials, and preflight/CDN cache-poison risks. Use when debugging CORS failures, tuning Max-Age, or validating that cached…

Langue du texte source : anglais

cosign-keyless-verify

Verify Cosign keyless (Sigstore/Fulcio/Rekor) signatures on images and artifacts with tight identity and OIDC issuer allowlists. Use when cosign verify, --certificate-identity, --certificate-oidc-issuer, keyless Sigstore check, Rekor transparency, signed…

Langue du texte source : anglais

crack-keygen

Software authorization analysis: key generation, license bypass, binary patching, DRM removal. Trigger: crack, keygen, patch, license, serial, bypass auth, activate, unlock.

Langue du texte source : anglais

cro

When the user wants to optimize, improve, or increase conversions on any marketing page or form — including homepage, landing pages, pricing pages, feature pages, lead capture forms, or contact forms. Also use when the user says 'CRO,' 'conversion rate…

Langue du texte source : anglais

cross-origin-opener-policy

Assess and implement Cross-Origin-Opener-Policy (COOP) for browsing-context isolation: same-origin, same-origin-allow-popups, unsafe-none, pairing with COEP for crossOriginIsolated / SharedArrayBuffer, and popup/OAuth breakage. Use when hardening…

Langue du texte source : anglais

csdn-skill-distiller

Convert Chinese technical research from CSDN or similar blogs into concise, validated Codex skills. Use when the user asks Codex to learn from CSDN, summarize Chinese developer articles into reusable workflows, create or update a skill from blog research, or…

Langue du texte source : anglais

csharp-style-conventions

Apply C# and .NET naming conventions, XML documentation comments, and nullable reference type style when writing or reviewing C# code. Use when C# style, .NET naming, XML docs, nullable reference types, EditorConfig/StyleCop alignment, or public API…

Langue du texte source : anglais

csp-report-only-rollout

Roll out Content-Security-Policy-Report-Only safely: report-uri/report-to, owned collectors, violation triage, noise filtering, gradual directive tightening, canary then enforce. Use when staging CSP without blocking production, cutting report floods,…

Langue du texte source : anglais

css-injection-exfiltration

Authorized CSS injection and style-based data exfiltration awareness: map untrusted input into style contexts, assess attribute-selector and url()/@import channels, and document impact under CSP style-src without treating CSS as full script XSS. Use when…

Langue du texte source : anglais

database-migration-safety

Plan and review safe database migrations: expand/contract, backward-compatible deploys, locking/index risks, backfills, and zero-downtime notes. Use when DB migration, 数据库迁移, schema change, online DDL, expand/contract, dual-write, backfill, or shipping…

Langue du texte source : anglais

database-security

Use for authorized database security assessment covering PostgreSQL/MySQL/MSSQL/Mongo/Redis exposure, authz, UDF/command paths, and misconfiguration review.

Langue du texte source : chinois

debugger-integration

Advanced debugging integration for vulnerability research

Langue du texte source : anglais

dependabot-config-hardening

Harden GitHub Dependabot: complete .github/dependabot.yml coverage, safe schedules and groups, PR limits, private registries, ignore expiry, monorepo directories, Actions and Docker updates, and review/CI gates without blind auto-merge. Use when…

Langue du texte source : anglais

dependency-pinning-strategies

Choose and enforce dependency pins: committed lockfiles, exact vs range versions, CI frozen installs, and Dependabot/Renovate update policy with supply-chain tradeoffs. Use when lockfiles, package-lock, yarn.lock, pnpm-lock, poetry.lock, go.sum, Cargo.lock,…

Langue du texte source : anglais

deserialization-safe-formats

Defensive guidance for safe interchange formats and deserializers: prefer JSON, Protobuf, and schema-bound codecs over pickle, native Java serialization, BinaryFormatter-class APIs, and unrestricted YAML load. Use when choosing or hardening serializers,…

Langue du texte source : anglais

device-binding-tokens

High-level design and authorized assessment of device-bound and proof-of-possession tokens (DPoP-style, mTLS/cnf, sender-constrained access tokens). Use when APIs, mobile apps, or SPAs claim tokens are bound to a key, device, or TLS client cert, or when…

Langue du texte source : anglais

digital-forensics

Use for authorized digital forensics including memory dumps, disk timelines, PCAP investigation, artifact triage, and IR evidence preservation.

Langue du texte source : chinois

distroless-image-adoption

Adopt and migrate application runtimes to distroless (or equivalent minimal non-shell) container images: multi-stage copy-in, language base choice (static/base/cc/java/nodejs/python), nonroot UIDs, CA/tzdata, and debug without a package manager. Use when…

Langue du texte source : anglais

django-csrf-middleware-tuning

Tune and review Django CsrfViewMiddleware and CSRF-related settings: CSRF_TRUSTED_ORIGINS, cookie flags, header names, exemptions, and middleware order for cookie-authenticated browser apps. Use when Django CSRF 403s after deploy, SPA/API Origin mismatches,…

Langue du texte source : anglais