Menu
Skills neste repositório
O SkillsMP coletou 484 skills de tomysh1337/openstarry-code. Abra uma skill para revisar a origem e os detalhes.
tomysh1337/openstarry-codeMostrando 40 de 484 skills coletadas.
Adopt browser Trusted Types for DOM XSS mitigation: require-trusted-types-for, trusted-types, createPolicy, default policy risks, sink migration (innerHTML, outerHTML, insertAdjacentHTML, document.write, script src/text, eval), report-only rollout, browser…
Idioma do texto original: inglês
Migrate a TypeScript codebase toward compiler strict mode: inventory current flags, enable checks incrementally (strictNullChecks, noImplicitAny, and the rest of strict), use per-package or path-scoped tsconfigs, ts-migrate/codemod patterns, and temporary…
Idioma do texto original: inglês
Apply TypeScript strictness, ESLint/Prettier interplay, any-ban patterns, and import-order discipline while editing or reviewing TS/TSX code. Use when TypeScript style, ESLint, TS 风格, @typescript-eslint, no-explicit-any, import order, tsconfig strict, or…
Idioma do texto original: inglês
UI/UX design intelligence for web, mobile, and desktop. This skill should be used when designing, building, reviewing, or fixing interfaces, including pages, components, design systems, accessibility, interaction, responsive layout, typography, color, charts,…
Idioma do texto original: inglês
Single automatic entry point for selecting installed Codex skills by bilingual task keywords and exact intent. Use for broad, ambiguous, or multi-domain requests spanning engineering, frontend, security, cloud operations, science and data, documents and…
Idioma do texto original: inglês
Design and review unit tests: what to test, naming, AAA structure, isolation, and focused assertions. Use when unit tests, 单元测试, test naming, Arrange-Act-Assert, table-driven tests, test design, or reviewing flaky/brittle unit suites. Complements…
Idioma do texto original: inglês
HashiCorp Vault Agent Injector on Kubernetes: pod annotations, Agent vs template rendering, Kubernetes auth and other methods, secret rotation, and avoiding long-lived tokens in images or manifests. Use when designing or reviewing vault.hashicorp.com/*…
Idioma do texto original: inglês
Guide for implementing smooth, native-feeling animations using React's View Transition API (ViewTransition component, addTransitionType, and CSS view transition pseudo-elements). Use this skill whenever the user wants to add page transitions, animate route…
Idioma do texto original: inglês
Triage and analyze suspected VMProtect 3.0-3.5 native virtualization with staged static inspection, IDA debugger traces, and controlled dynamic execution. Use MogVMP as a reference for VM handler and dispatcher analysis; preserve evidence and avoid blind…
Idioma do texto original: inglês
Structure Vue 3 components with Composition API, props/emits, slots, and colocation. Use when Vue, Vue 3, Composition API, props, emits, script setup, Vue 组件, 组合式 API, 组件结构, defineProps, defineEmits, or when reviewing Vue UI structure. Pairs with…
Idioma do texto original: inglês
Design Vue Router navigation guards and route meta for auth UX: requiresAuth, role/permission meta, guest-only routes, redirect loops, and token refresh on navigation. Use when building or reviewing Vue 3 router beforeEach/afterEach, meta.requiresAuth, login…
Idioma do texto original: inglês
Vulnerability management SLAs by severity, exception/risk-acceptance process, scanner-noise handling, and ticket lifecycle for org-owned findings. Use when vulnerability SLA, fix-by severity clocks, exception request, risk acceptance, vuln ticket workflow,…
Idioma do texto original: inglês
Authorized WAF rule tuning basics: false-positive triage, detect-then-block rollout, exception design, managed vs custom rules, and evidence from WAF logs. Use when reducing noisy blocks on owned apps, staging a new managed ruleset, designing…
Idioma do texto original: inglês
Web application penetration testing: SQL injection, XSS, CSRF, SSRF, auth bypass, file upload, command injection. Trigger: pentest, exploit web, sqli, xss, csrf, ssrf, auth bypass, upload exploit, rce, command inject.
Idioma do texto original: inglês
Review WebAuthn/passkey attestation conveyance, statement formats, trust anchors, and AAGUID policy for registration. Use when choosing or auditing attestationPreference (none/indirect/direct/enterprise), MDS/trust-store verification, enterprise device…
Idioma do texto original: inglês
Deep WebSocket authorization after the HTTP upgrade: re-bind identity per message, subscribe/channel ACL, token refresh, privilege changes mid-session, and cross-account action IDs. Use when sockets stay open long after 101 and message-layer authZ is unclear.…
Idioma do texto original: inglês
Recover binary application protocols carried over WebSocket from PCAPs, browser traces, proxy exports, or runtime logs. Use when WebSocket opcode 2 frames are opaque, messages are fragmented, payloads use Protobuf, MessagePack, CBOR, compression, encryption,…
Idioma do texto original: inglês
Design robust WebSocket clients: lifecycle, auth, reconnect/backoff, heartbeats, message typing, backpressure, and shutdown. Use when building or reviewing browser/native WS clients, realtime feeds, or chat sockets. Not primary for CSWSH testing…
Idioma do texto original: inglês
Authorized testing of WebSocket Origin header validation, cookie-authenticated upgrades, and CSWSH-style (cross-site WebSocket hijacking) risks on the HTTP Upgrade path. Use when assessing whether browsers can open a session-backed WebSocket from a foreign…
Idioma do texto original: inglês
Design WebSocket rate limits: connection/upgrade budgets, concurrent sockets, per-message and byte/frame caps, subscription fan-out, close/backpressure signals, and abuse-resistant keying. Use when WebSocket rate limit design, WS throttle, socket quota,…
Idioma do texto original: inglês
Use for authorized wireless security assessment including Wi-Fi capture, WPA handshake analysis, rogue AP detection research, and lab-only deauth testing.
Idioma do texto original: chinês
Use for authorized Active Directory and Windows identity attacks including Kerberos, AD CS, BloodHound paths, NTLM relay, and domain privilege escalation research.
Idioma do texto original: chinês
Authorized Windows host hardening basics: local accounts and LSA, RDP and network exposure, Windows Update and features, Defender/ASR, audit policy, SMB/LLMNR reductions, and service least privilege. Use when hardening org-owned Windows servers or…
Idioma do texto original: inglês
Defensive guidance and authorized assessment for XML external entity (XXE) and billion-laughs / entity-expansion DoS: parser hardening, DTD policy, expansion limits, and safe stack configuration. Use when hardening or retesting XML/SOAP/SAML/SVG/Office…
Idioma do texto original: inglês
Hardening XML parsers against XXE by disabling external entities and DTDs with language-specific safe defaults (Java, Python, .NET, libxml/lxml, PHP). Use when configuring DocumentBuilderFactory, XmlReader, defusedxml, libxml, SOAP/SAML/SVG/Office parsers, or…
Idioma do texto original: inglês
Practical YARA hunting loop against authorized corpora: scope, baselining, scan, triage hits, reduce false positives, and promote durable detections. Use when hunting malware/family matches with existing or draft rules — not as a full rule-authoring textbook…
Idioma do texto original: inglês
Author, fix, and enforce Yarn Berry (Yarn 2+) workspace constraints for dependency consistency, banned packages, field rules, and CI gates. Use when yarn constraints, constraints.pro, yarn.config.cjs constraints, monorepo dependency alignment, workspace:…
Idioma do texto original: inglês
Zip slip and archive path-traversal on extract: detect, prove, and prevent unsafe zip/tar/7z extraction that writes outside the intended directory via ../ or absolute entry names. Use when zip slip, archive extract, unzip path traversal, tar slip, malicious…
Idioma do texto original: inglês
Query scholarly metadata and the web through Crossref, Brave, Tavily, and DuckDuckGo with a single CLI surface. Trigger when the user asks for research search, fact lookup, source discovery, or engine comparison. Results retain DOI, publication year, and…
Idioma do texto original: inglês
Build, validate, and release OpenStarry Code desktop applications. Use for Electron packaging, Windows EXE/MSI installers, bundled runtimes, artifact verification, and GitHub Release publication.
Idioma do texto original: inglês
Deterministic image downloader for AwesomeWebpageMetaSkill search results. Use as skill_exec to fetch candidate image URLs into the configured local project tree without sandboxed shell curl.
Idioma do texto original: inglês
Render HTML (with CSS) to a PDF file. Trigger when the user wants to export a styled report, invoice, label, or any HTML/Jinja-rendered page to PDF. Uses WeasyPrint, which supports a meaningful subset of CSS Paged Media (page size, margins, headers/footers,…
Idioma do texto original: inglês
Compile a LaTeX project (xelatex × bibtex × xelatex × xelatex) and report the log tail. Demo-only.
Idioma do texto original: inglês
Internal cross-platform artifact persistence, assembly, citation-audit, and PDF compilation runtime for meta-paper-write.
Idioma do texto original: inglês
Deterministic artifact-backed manuscript readiness gate for meta-paper-write. Validates the workspace LaTeX artifact before compilation while leaving final page-count enforcement to compile_pdf.
Idioma do texto original: inglês
Internal tool (not user-invocable). Called by meta-skill-creator as a DAG step (kind: agent) to lint a candidate meta-skill SKILL.md against G1 (parse + reference check + xml_escape grep + structural lint) and G2 (scheduler dry-run with stub executors).…
Idioma do texto original: inglês
Internal tool (not user-invocable). Called by meta-skill-creator's persist step and by `opensquilla meta accept` CLI (Phase 2) to manage `~/.opensquilla/proposals/`: write_proposal / list / accept. Returns JSON.
Idioma do texto original: inglês
Burn an SRT subtitle file into an MP4 via ffmpeg's subtitles filter (libass). Single-pass re-encode of video; audio copied as-is. Uses a verified managed Noto Sans CJK font when available. Used by meta-short-drama as the final subtitling step after merge.
Idioma do texto original: inglês
Read a UTF-8 text file and emit its raw content on stdout. Tiny helper for meta-skills that need to round-trip an artefact through disk so the user can hand-edit it between steps (e.g. tweak script.txt during a review pause). Unlike the builtin read_file tool…
Idioma do texto original: inglês
Render a static title / ending card PNG with Pillow. Centered headline + optional subtitle on a solid-colour background. Uses managed or platform CJK fonts with glyph verification and fails actionably instead of rendering tofu. Pure deterministic, no LLM, no…
Idioma do texto original: inglês