Menu
Skills dans ce dépôt
SkillsMP a collecté 484 skills depuis tomysh1337/openstarry-code. Ouvrez un skill pour examiner sa source et ses détails.
tomysh1337/openstarry-codeAffichage de 40 skills collectés sur 484.
Choose and configure HTML sanitizers (DOMPurify, bleach/nh3, sanitize-html, OWASP Java HTML Sanitizer) for untrusted markup: allowlists vs strip-all, SVG/MathML policy, HTML vs attribute vs URL context, and CSP as defense in depth. Use when picking or…
Langue du texte source : anglais
High-level HTTP web cache poisoning methodology: unkeyed inputs, cache-key design, Host/X-Forwarded-* authority, fat GET, and second-client proofs. Use when shared caches (CDN, reverse proxy, gateway) may store attacker-influenced responses for other users…
Langue du texte source : anglais
Assess HTTP method override / method spoofing risks: X-HTTP-Method-Override, X-HTTP-Method, X-Method-Override, body/query _method, and framework tunnels that change the effective verb after WAF or auth middleware. Use when authorized tests show ACL or CSRF…
Langue du texte source : anglais
Edit prose to remove common AI-writing patterns while preserving every supplied fact and matching the intended voice. Use for humanize, natural rewrite, AI-sounding prose, 去除 AI 味, 降低机器感, 自然润色, or matching a provided writing sample. Do not use for code…
Langue du texte source : anglais
Internationalization and localization patterns for apps: no hardcoded UI strings, message catalogs, ICU plurals/interpolation, locale negotiation, dates/numbers/currency, RTL, and pseudo-loc. Use when i18n, l10n, 国际化, 本地化, localization, react-i18next,…
Langue du texte source : anglais
IDAPython scripting basics for authorized binary reverse engineering: batch idat/idat64 runs, function and xref enumeration, names/comments, Hex-Rays decompiler export when licensed, and reproducible IDB hygiene. Use when writing or debugging IDAPython,…
Langue du texte source : anglais
IDA Pro 逆向分析辅助技能。当用户提到逆向、反编译、分析二进制/PE/ELF/APK/DLL/SO、破解、找密码、漏洞分析、病毒分析、firmware 固件分析，或需要分析 exe/dll/so/elf/macho/sys 等文件时，务必使用此技能。 Ensure to use this skill when the user wants to analyze any binary file, regardless of whether they explicitly mention "IDA" or…
Langue du texte source : chinois
Use for authorized assessment of federated identity systems including SAML, OIDC, OAuth2 flows, SSO misconfiguration, and token confusion issues.
Langue du texte source : chinois
GraphQL node/edge object-level authorization (BOLA/IDOR): Relay global IDs, nested resolvers, connections, mutations, and field-level leaks. Use when node(id), edges, or ID arguments appear under GraphQL and classic REST IDOR coverage is incomplete.…
Langue du texte source : anglais
Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells,…
Langue du texte source : anglais
Author and review operational incident runbooks: clear scope, severity, symptoms, diagnostics, mitigation steps, escalation, and communications. Use when runbook, incident response doc, 故障手册, on-call playbook, SEV ladder, incident procedure, pager runbook, or…
Langue du texte source : anglais
Secure input validation at trust boundaries: allowlists, schemas, type and range checks, normalization, and fail-closed parsing. Use when input validation, 输入校验, request validation, allowlist, schema validation, boundary checks, sanitize vs validate, or…
Langue du texte source : anglais
Decide when to write integration tests vs unit or e2e, and how to draw reliable boundaries. Use when integration tests, 集成测试, test pyramid, unit vs integration vs e2e, test boundaries, contract tests, or when suites are slow/flaky from wrong layer choice.…
Langue du texte source : anglais
Authorized iOS Keychain access-control assessment: SecItem attributes, kSecAttrAccessible classes, access-control flags (biometry, device passcode, ThisDeviceOnly), access groups, and common storage mistakes. Use when reviewing how an owned or lab iOS app…
Langue du texte source : anglais
Design and review Istio service-mesh authorization and peer mTLS: AuthorizationPolicy (ALLOW/DENY, principals, JWT, path/method), PeerAuthentication STRICT, deny-by-default, and common gaps. Use when hardening or assessing owned Istio meshes, drafting mesh…
Langue du texte source : anglais
Recover, inspect, deobfuscate, rename, and verify Java JAR bytecode with local java-deobfuscator, Recaf, and Enigma-MCP. Use for obfuscated JARs, class-file triage, source recovery, mapping work, and IDEA-ready Java source exports.
Langue du texte source : anglais
Stateful orchestration for recovering readable, buildable, IDEA-ready Java source from obfuscated JAR and class files. Use for multi-round Java decompilation or deobfuscation, CFR/Vineflower/Procyon comparison, Recaf navigation, java-deobfuscator or custom…
Langue du texte source : anglais
Plan and review JPMS boundaries: module-info.java, requires/exports/opens, automatic and unnamed modules, and classpath-to-module-path migration. Use when modularizing Java apps/libraries, fixing module graph errors (exports, requires transitive, split…
Langue du texte source : anglais
Analyze, triage, decompile, and deobfuscate protected Java artifacts and mixed Java/native targets. Use for JAR, WAR, APK, AAB, .class, DEX, JNI .so/.dll/.dylib, Minecraft/plugin jars, Java malware, CTF reverse challenges, and protectors or symptoms such as…
Langue du texte source : anglais
Build a staged Java/JAR reverse-engineering workspace with static inventory, Recaf inspection, enigma-mcp mappings, decompiler comparison, debugger checks, and reproducible verification. Use for Java projects, JARs, class files, shaded libraries, and…
Langue du texte source : anglais
Run and gate SpotBugs (and FindSecBugs) for Java/JVM security static analysis: plugin setup, confidence/rank filters, Maven/Gradle/CI wiring, suppressions with owners, and triage of SECURITY-category bugs. Use when SpotBugs, FindBugs successor, FindSecBugs,…
Langue du texte source : anglais
Apply Java naming, Google/Oracle-style layout conventions, and Javadoc discipline when writing or reviewing Java (and closely related Kotlin interop surfaces). Use when Java style, Javadoc, package/class naming, public API docs, Checkstyle/google-java-format…
Langue du texte source : anglais
Jenkins credential storage, scoping, pipeline binding, masking, rotation, and leak hygiene for owned controllers: Credentials plugin types, folder vs global scope, withCredentials / credentials() usage, JCasC secrets, agent and log exposure. Use when Jenkins…
Langue du texte source : anglais
Design and evolve JSON Schema (and OpenAPI-aligned schemas): types, required fields, formats, composition, versioning, and validation at boundaries. Use when JSON Schema, schema design, OpenAPI components/schemas, AJV/Zod/Pydantic contract alignment,…
Langue du texte source : anglais
Authorized assessment of legacy JSONP endpoints: callback parameter injection, cross-origin data exfiltration via script tags with ambient cookies, content-type and padding pitfalls, and migration from JSONP to CORS or same-origin APIs. Use when responses…
Langue du texte source : anglais
Authorized assessment and hardening of JWT issuer, audience, and authorized-party claims: missing, weak, multi-value, and cross-service acceptance of iss/aud/azp. Use when resource servers, API gateways, or OIDC relying parties verify Bearer or ID tokens and…
Langue du texte source : anglais
Authorized design and assessment of JOSE JWE token encryption: compact five-part structure, key encryption (alg) vs content encryption (enc), CEK handling, nested JWT (JWS inside JWE), and decryption/key-management checks. Use when APIs or clients issue or…
Langue du texte source : anglais
Authorized design and assessment of JWT access + refresh token patterns: rotation, reuse detection, revocation, and storage (cookie vs localStorage). Use when implementing or reviewing refresh endpoints, sliding sessions, or long-lived offline tokens under…
Langue du texte source : anglais
Kafka ACL and auth hardening for owned or authorized clusters: SASL/SSL, super.users, authorizer config, least-privilege topic and consumer-group ACLs, and ZooKeeper vs KRaft metadata-auth notes. Use when reviewing server.properties / kraft configs,…
Langue du texte source : anglais
Authorized basics for Kerberos Service Principal Names (SPNs): registration, format, ticket targeting, missing/duplicate SPNs, and service identity hygiene on owned Active Directory or lab domains. Use when apps fail negotiate/Kerberos SSO, setspn/AD…
Langue du texte source : anglais
Design, review, and harden Kubernetes admission webhooks: MutatingWebhookConfiguration, ValidatingWebhookConfiguration, AdmissionReview, failurePolicy, sideEffects, selectors, TLS/caBundle, and availability. Use when implementing or auditing…
Langue du texte source : anglais
Kubernetes etcd encryption at rest for owned or authorized clusters: API server EncryptionConfiguration, resource selection (Secrets and more), aescbc/aesgcm/ secretbox/kms providers, identity fallback, key rotation, and re-encrypt verification. Use when…
Langue du texte source : anglais
Harden Kubernetes workloads with Pod Security Standards (baseline/restricted), PSA labels, securityContext (runAsNonRoot, capabilities, privileged, hostPath), and PodSecurityPolicy migration. Use when reviewing Deployments/Pods for PSS violations, enforcing…
Langue du texte source : anglais
Kubernetes RBAC least-privilege review for owned clusters: ServiceAccounts, Roles/ClusterRoles, RoleBindings/ClusterRoleBindings, verb/resource scoping, and bind-escalation footguns. Use when hardening default SA usage, trimming cluster-admin, splitting…
Langue du texte source : anglais
Harden Kubernetes Secrets handling on owned clusters: base64 is not encryption, etcd encryption at rest, RBAC least privilege, mount vs env injection, and safe inventory without dumping Secret data into pods or logs. Use when reviewing Secret objects,…
Langue du texte source : anglais
Laravel security basics: APP_KEY, session/cookies, CSRF, mass assignment, policies, validation, rate limits, files, Sanctum/Passport. Use when reviewing Laravel config, $fillable/$guarded, Blade XSS, or hardening org-owned PHP apps — authorized only.
Langue du texte source : anglais
Harden and assess LDAP/AD directory binds for owned systems: disable anonymous and unauthenticated binds, prefer LDAPS or StartTLS, least-privilege service accounts, simple vs SASL bind choices, AD LDAP signing/channel binding, lockout- safe auth, and secret…
Langue du texte source : anglais
Detect and safely test LDAP injection in directory search filters and bind DNs, including filter syntax metacharacters, boolean result differentials, and blind extraction discipline. Use when apps query Active Directory, OpenLDAP, or other LDAP directories…
Langue du texte source : anglais
Scan third-party OSS licenses against org allow/deny lists, flag copyleft and dual-license ambiguity, verify NOTICE/attribution artifacts, and wire CI license gates. Use when reviewing dependency license compliance, SPDX identifiers, forbidden licenses…
Langue du texte source : anglais
Authorized Linux host hardening checklist: accounts and SSH, firewall and listening services, package/update hygiene, filesystem and kernel sysctl, audit/logging, and service least privilege. Use when hardening org-owned Linux servers, lab VMs, or reviewing…
Langue du texte source : anglais