メニュー
このリポジトリの skills
SkillsMP は tomysh1337/openstarry-code から 484 件の skill を収集しています。skill を開くとソースと詳細を確認できます。
tomysh1337/openstarry-code収集済み skill 484 件中 40 件を表示しています。
Authorized assessment of the OAuth 2.0 Device Authorization Grant (RFC 8628): device_code / user_code issuance, verification URI integrity, polling and rate limits, client binding, and token exchange abuse. Use when CLI tools, smart TVs, IoT, headless…
原文の言語: 英語
Authorized assessment of OAuth 2.0 / OIDC implicit and hybrid token-in-browser flows: response_type=token/id_token leakage, fragment handling, migration to authorization code + PKCE. Use when SPA or legacy SSO still issues access or ID tokens at the authorize…
原文の言語: 英語
Authorized assessment and hardening of OAuth 2.0 Pushed Authorization Requests (PAR, RFC 9126): back-channel request push, request_uri lifecycle, client auth at the PAR endpoint, and front-channel reduction. Use when AS discovery shows…
原文の言語: 英語
Authorized assessment checklist for OAuth 2.0 PKCE (RFC 7636): code_challenge, code_verifier, S256 vs plain, public-client enforcement, and related code interception controls. Use when SPA, mobile, native, or public clients use authorization code + PKCE under…
原文の言語: 英語
Authorized design and assessment of OAuth 2.0 Resource Indicators (RFC 8707): the resource request parameter, absolute resource URIs, multi-resource grants, and audience-restricted access tokens for the indicated protected resource(s). Use when clients or…
原文の言語: 英語
Authorized design and assessment of OAuth Demonstrating Proof of Possession (DPoP) and sender-constrained access tokens in the RFC 9449 style: DPoP proofs, htm/htu binding, nonce challenges, cnf.jkt key thumbprints, and Bearer vs DPoP enforcement. Use when…
原文の言語: 英語
Design and review metrics, logs, and traces as one observability system: RED/USE at a high level, correlation IDs, cardinality control, and safe telemetry. Use when observability, metrics, tracing, OpenTelemetry, APM, 可观测性, 指标, 链路追踪, Prometheus, span, SLI/SLO…
原文の言語: 英語
Extract text from images using Tesseract.js OCR (100% local, no API key required). Supports Chinese (simplified/traditional) and English.
原文の言語: 英語
Authorized design, implementation review, and assessment of OpenID Connect Back-Channel Logout: logout_token JWT validation, backchannel_logout_uri delivery, sid/sub session binding, events claim, and propagation to local sessions and refresh tokens. Use when…
原文の言語: 英語
Authorized validation and assessment of OpenID Connect ID tokens: iss, aud, exp/nbf, nonce, signature via JWKS, and azp/at_hash checks. Use when an RP or API accepts id_token JWTs after OIDC login, hybrid flow, or token exchange and you must verify claim…
原文の言語: 英語
OPA Gatekeeper policy-as-code for owned Kubernetes clusters: ConstraintTemplates (Rego + CRD schema), Constraints (match, parameters, enforcementAction), and audit vs deny behavior. Use when authoring or reviewing Gatekeeper templates and constraints, rolling…
原文の言語: 英語
Advanced open-redirect testing: multi-parser gaps, allowlist failures, encoding and scheme tricks, and chains into OAuth/OIDC redirect_uri and token theft. Use when basic next/return checks exist but Location still leaves the trusted host, or when…
原文の言語: 英語
Local speech-to-text with the Whisper CLI (no API key).
原文の言語: 英語
Verify OpenAPI (and similar) contracts against real producers/consumers: request/response conformance, CI gates, consumer-driven checks, and drift detection. Use when OpenAPI contract tests, schema conformance, Pact/OpenAPI validation,…
原文の言語: 英語
Authorized review of OpenID Connect discovery document hygiene: /.well-known/openid-configuration (and OAuth AS metadata), issuer exact-match, HTTPS-only endpoints, JWKS URI trust, advertised algorithms/grants, and cross-document consistency with live IdP…
原文の言語: 英語
Generate or declare an OpenRouter video asset for AwesomeWebpageMetaSkill using a parent-leased Provider Settings connection and configured non-secret model/output values.
原文の言語: 英語
Hide and keep hidden the real origin server IP behind a CDN/WAF edge for owned infrastructure: DNS hygiene, historical and cert leaks, origin firewall allowlists, authenticated origin pulls, and continuous exposure checks. Use when placing origins behind…
原文の言語: 英語
Use for authorized OT/ICS security assessment covering Purdue model zoning, PLC/SCADA exposure, industrial protocol discovery, and safe passive-first evaluation.
原文の言語: 中国語
Context-aware output encoding and safe sinks to prevent XSS, SQL injection, and related injection via string composition: HTML/XML, attributes, JS, URL, CSS, SQL/NoSQL parameters, shell argv, and log encoding. Use when output encoding, 输出编码, contextual…
原文の言語: 英語
Run and gate OWASP Dependency-Check (ODC) for multi-ecosystem SCA: CLI and build plugins, NVD data updates, suppression files, CVSS fail thresholds, and HTML/JSON/SARIF reports in local and CI pipelines. Use when dependency-check, OWASP Dependency-Check, ODC,…
原文の言語: 英語
Implement and review Passkeys / WebAuthn (W3C Web Authentication) registration and assertion flows: RP ID, origin, challenge binding, credential store, user verification, and safe fallbacks. Use when adding or hardening passwordless/passkey login, WebAuthn…
原文の言語: 英語
Design NIST-oriented password policies: length, deny/breach lists, no composition theater or forced rotation, modern hashing, and manager-friendly UX. Use when defining or reviewing password requirements, signup/change validation, breached-password checks, or…
原文の言語: 英語
Authorized testing of password-reset and magic-link poisoning: Host / X-Forwarded-Host influence on reset URLs, token leakage via attacker host, open-redirect and cache chains, and token handling flaws. Use when reset, invite, or verify emails embed absolute…
原文の言語: 英語
Defend filesystem path sinks against traversal and escape: canonicalize (resolve) then prefix-check under a fixed root, prefer openat/O_NOFOLLOW, chroot-like jail roots, and reject ".." segments and null bytes. Use when hardening download, include, template,…
原文の言語: 英語
主动渗透测试工具链。覆盖信息收集、端口扫描、漏洞扫描、Web 渗透、SQL 注入、目录爆破、密码破解等场景。 通过 MCP server（pentestMCP / mcp-security-hub）将 20+ 安全工具暴露给 AI agent。 触发关键词：渗透测试、端口扫描、Nmap、漏洞扫描、Nuclei、SQL 注入、SQLMap、目录爆破、FFUF、密码破解、Hashcat、信息收集、子域名、Web 渗透、ZAP、Burp。
原文の言語: 中国語
实战 SRC / 众测 / Bug bounty 漏洞挖掘工作流 skill。包含：5 阶段方法论（intake → recon → enum → hunt → report）、19 个攻击类 playbook（SQLi/XSS/RCE/SSRF/IDOR/CSRF/Path Traversal/File Upload/SSTI/XXE/Race/HTTP Smuggling/OAuth/JWT/SAML/GraphQL/Mobile/LLM/DoS）、305 个结构化 payload、263 个 WAF/EDR…
原文の言語: 中国語
Plan and review basic performance and load tests: goals, SLIs, scenarios, workloads, and high-level tools. Use when performance testing, 性能测试, load test, stress test, soak test, latency percentiles, k6, JMeter, Gatling, Locust, or capacity checks. Complements…
原文の言語: 英語
Assess and harden the Permissions-Policy (formerly Feature-Policy) HTTP response header: powerful browser features, allowlists, iframe delegation, and missing or over-permissive policies. Use when reviewing camera/mic/geo geolocation payment USB sensors…
原文の言語: 英語
Audit Python dependencies with pip-audit and enforce install integrity via constraints files and hash-checking mode (pip --require-hashes, hashed requirements). Use when Python CVE/SCA findings, pip-audit CI failures, requirements.txt/constraints.txt drift,…
原文の言語: 英語
Authorized design and assessment checklist for OAuth 2.0 PKCE on public clients (SPA, mobile, native, desktop): mandatory S256 code_challenge, code_verifier lifecycle, no embedded client secrets, and token-endpoint binding. Use when public clients run…
原文の言語: 英語
Select the most specific installed skill for project planning, task decomposition, persistent progress tracking, product requirements, PRDs, roadmaps, user stories, discovery, and prioritization. Use for project plan, task plan, roadmap, PRD, requirements,…
原文の言語: 英語
Use persistent task_plan.md, findings.md, and progress.md files to organize complex multi-step work and resume it across context changes. Use for project plans, task decomposition, research workflows, more than five expected tool calls, 任务规划, 项目计划, 拆解任务,…
原文の言語: 英語
Assess and reduce pnpm shamefully-hoist / flat node_modules risk: phantom dependencies, undeclared requires, monorepo cross-package imports, and safer hoist alternatives (public-hoist-pattern, packageExtensions). Use when shamefully-hoist,…
原文の言語: 英語
Authorized Podman security hardening and assessment: rootless vs rootful, user namespaces, capabilities, SELinux labels, privileged/host mounts, publish ports, Podman socket exposure, secrets, and image trust. Use when reviewing Containerfile runtime, podman…
原文の言語: 英語
Authorized PostgreSQL hardening for owned databases: pg_hba.conf access rules, SSL/TLS, SCRAM-SHA-256 password auth, role least privilege, superuser avoidance, extension allowlists, and connection/auth logging. Use when reviewing postgresql.conf /…
原文の言語: 英語
Authorized window.postMessage security review: origin validation on message handlers, targetOrigin misuse, untrusted data into DOM/code sinks, and XSS or token theft via postMessage. Use when apps use iframes, openers, webviews, or cross-window messaging, or…
原文の言語: 英語
Write clear pull/merge request titles and bodies using Why / What / Test structure, linked issues, and review-friendly scope. Use when PR description, 写 PR, pull request body, MR description, PR title, GitHub/GitLab PR template, or summarizing a branch for…
原文の言語: 英語
Resolve formatter/linter/EditorConfig hierarchy, avoid tool fights, and run a reliable format-then-lint fix pipeline. Use when prettier, eslint, editorconfig, 格式化, format-on-save conflicts, eslint-config-prettier, or CI format checks fail.
原文の言語: 英語
Design and review private PKI hierarchies for owned or authorized environments: offline root CA, intermediate and issuing CAs, pathLen and name constraints, trust anchors, CRL/OCSP distribution, and key custody. Use when planning or reviewing an internal CA…
原文の言語: 英語
When the user wants to create or update their product marketing context document. Also use when the user mentions 'product context,' 'marketing context,' 'set up context,' 'positioning,' 'who is my target audience,' 'describe my product,' 'ICP,' 'ideal…
原文の言語: 英語