Menu
Skills neste repositório
O SkillsMP coletou 484 skills de tomysh1337/openstarry-code. Abra uma skill para revisar a origem e os detalhes.
tomysh1337/openstarry-codeMostrando 40 de 484 skills coletadas.
Authorized Azure Network Security Group (NSG) review for owned subscriptions: rule priority, Any/Any Allow, service tags, Application Security Groups (ASG), NSG flow logs, and effective security rules. Use when auditing Azure NSG inbound/outbound rules,…
Idioma do texto original: inglês
Backpressure for async/streaming: bounded buffers, pull flow control, drop/sample/shed, slow consumers. Use when backpressure, bounded channel, overflow, 背压, 反压, or producer outruns consumer. Complements bulkheads, circuit breakers, async concurrency, and…
Idioma do texto original: inglês
Design and implement MFA backup/recovery code generation, storage, display, redemption, and regeneration. Use when building or reviewing one-time backup codes, recovery codes, or offline second-factor fallbacks: entropy, hashing, single-use, rate limits,…
Idioma do texto original: inglês
Run and gate Bandit (PyCQA) on owned Python trees: config discovery, severity/confidence policy, excludes, JSON/SARIF outputs, CI fail-closed gates, and triage of B-rules into fixes or owned suppressions. Use when Bandit, bandit -r, pyproject.toml…
Idioma do texto original: inglês
Design and review Backend-for-Frontend (BFF) cookie sessions for SPAs: server-held tokens, HttpOnly session cookies, same-site edge layout, CSRF, and logout/revocation. Use when an SPA must avoid JS-readable access tokens, proxy OAuth/OIDC through a BFF, or…
Idioma do texto original: inglês
Use when you need to run a binary, trace execution, or observe runtime behavior. Runtime analysis via QEMU emulation, GDB debugging, and Frida hooking - syscall tracing (strace), breakpoints, memory inspection, function interception. Keywords - "run binary",…
Idioma do texto original: inglês
This skill should be used when analyzing binaries, executables, or bytecode to understand what they do or how they work. Triggers on "binary", "executable", "ELF", "what does this do", "reverse engineer", "disassemble", "decompile", "pyc file", "python…
Idioma do texto original: inglês
Use when analyzing binary structure, disassembling code, or decompiling functions. Deep static analysis via radare2 (r2) and Ghidra headless - function enumeration, cross-references (xrefs), decompilation, control flow graphs. Keywords - "disassemble",…
Idioma do texto original: inglês
Use when ready to document findings, generate a report, or summarize binary analysis results. Compiles analysis findings into structured reports - correlates facts from triage/static/dynamic phases, validates hypotheses, generates documentation with evidence…
Idioma do texto original: inglês
Use when reverse engineering tools are missing, not working, or need configuration. Installation guides for radare2 (r2), Ghidra, GDB, QEMU, Frida, binutils, and cross-compilation toolchains. Keywords - "install radare2", "setup ghidra", "r2 not found", "qemu…
Idioma do texto original: inglês
Use when first encountering an unknown binary, ELF file, executable, or firmware blob. Fast fingerprinting via rabin2 - architecture detection (ARM, x86, MIPS), ABI identification, dependency mapping, string extraction. Keywords - "what is this binary",…
Idioma do texto original: inglês
Design bot-management signal pipelines: signal taxonomy, collection points, risk scoring, action thresholds (allow / challenge / throttle / block), feedback loops, privacy, and false-positive controls. Use when bot score design, device or TLS fingerprints as…
Idioma do texto original: inglês
Run and triage Brakeman static analysis on Ruby on Rails apps you own: install/pin, repo config, confidence filters, JSON/SARIF reports, CI gates, ignore-file hygiene, and fix-then-rescan for SQLi, XSS, mass assignment, redirects, and related Rails sinks. Use…
Idioma do texto original: inglês
Configure and audit GitHub/GitLab branch protection: required status checks, block force-push and deletion, linear history, admin/owner enforcement, and CODEOWNERS-required reviews. Use when branch protection, protected branch, required checks, force-push…
Idioma do texto original: inglês
Use for authorized reverse engineering of browser extensions (Chrome/Firefox) including manifest analysis, background workers, and extension-based credential or traffic logic recovery.
Idioma do texto original: chinês
Authorized browser extension security review: manifest permissions, content scripts, background/service workers, messaging, web_accessible_resources, update and store packaging risks. Use when assessing Chrome/Firefox/Edge extensions you own or are scoped to…
Idioma do texto original: inglês
End-to-end bug bounty workflow for authorized public or private programs only: program selection, scope discipline, recon handoff, testing prioritization, evidence quality, and professional reporting. Use when hunting on HackerOne, Bugcrowd, Intigriti,…
Idioma do texto original: inglês
Use when building, adapting, reviewing, or testing CDK/license-key activation and signed online updates in Windows desktop applications, especially Qt/QML, WPF/WinUI, or Electron projects.
Idioma do texto original: Vários idiomas
BuildKit secret and SSH mounts so build-time credentials never land in image layers, history, or ARG/ENV. Use when docker buildx --secret, RUN --mount=type=secret, type=ssh private git/npm/registry auth, Dockerfile secret mounts, or replacing ARG TOKEN / COPY…
Idioma do texto original: inglês
Isolate failure domains with bulkheads: separate pools, semaphores, queues, and resource budgets so one dependency or tenant cannot exhaust the process. Use when bulkhead, isolation, noisy neighbor, pool per dependency, 舱壁, 隔离舱, or cascading pool exhaustion.…
Idioma do texto original: inglês
Keep Bun installs reproducible: commit bun.lock (or migrate bun.lockb), frozen CI with bun ci / --frozen-lockfile, single package-manager story, workspace lock fidelity, and lock-diff review. Use when bun.lock, bun.lockb, bun install, bun ci, frozen-lockfile,…
Idioma do texto original: inglês
Design application and edge caches: key design, TTLs, invalidation, stampede protection, and consistency. Use when caching, cache invalidation, 缓存, Redis/Memcached, CDN cache keys, TTL, thundering herd, or cache-aside patterns. Not for web cache…
Idioma do texto original: inglês
Authorized CAPTCHA and bot-challenge control research: when challenges bind, client-trust gaps, reusable tokens, logic skips, accessibility/alternate paths, and rate-limit interplay. Use for labs, CTFs, and scoped assessments measuring control effectiveness —…
Idioma do texto original: inglês
Design and implement enterprise CAPTCHA / bot-challenge integration for owned applications: provider selection, sitekey and secret lifecycle, server-side token verification, action and hostname binding, score thresholds, fail-closed behavior, multi-client…
Idioma do texto original: inglês
Run and gate Rust dependency vulnerability checks with cargo-audit locally and in CI: RustSec advisory DB, Cargo.lock scans, JSON outputs, ignore policy, version pins, and actionable upgrade paths for owned crates. Use when cargo-audit, RustSec, RUSTSEC-*,…
Idioma do texto original: inglês
Design CDN/edge HTTP cache keys: scheme/host/path, Vary, cookie inclusion, query-string allowlists, unkeyed header poison defenses, and purge strategy. Use when configuring CloudFront/Fastly/Cloudflare/Akamai cache keys, Vary headers, qs whitelist, cookie…
Idioma do texto original: inglês
Authorized CDN/WAF bypass awareness: edge fingerprinting, origin exposure, alternate entrypoints, inspection gaps, cache/bot control boundaries, and residual-risk notes when CDN or WAF is the primary control. Use when reviewing whether…
Idioma do texto original: inglês
Kubernetes cert-manager basics for owned or authorized clusters: Issuer and ClusterIssuer design, ACME HTTP-01/DNS-01 challenges, Certificate CRDs, renewal and Secret delivery, and private CA issuers. Use when installing or reviewing cert-manager, debugging…
Idioma do texto original: inglês
Certificate Transparency (CT) logs and Signed Certificate Timestamps (SCTs) for authorized recon, mis-issuance detection, and TLS evidence. Use when querying CT logs for hostnames, verifying SCTs in certificates or TLS handshakes, monitoring org domains for…
Idioma do texto original: inglês
Maintain Keep a Changelog-style CHANGELOG entries and write user-facing release notes from commits, PRs, and version bumps. Use when changelog, release notes, 更新日志, CHANGELOG.md, GitHub/GitLab releases, version announcements, or mapping Conventional Commits…
Idioma do texto original: inglês
Plan authorized chaos and fault-injection experiments in lab or owned non-prod: hypothesis, blast radius, steady state, inject/observe/stop. Use when chaos engineering, 混沌工程, fault injection, GameDay, Litmus, Chaos Mesh, Gremlin, toxiproxy, or resilience…
Idioma do texto original: inglês
Design and review CI/CD pipelines for clear stages, secret hygiene, dependency and build caching, fail-fast feedback, and durable artifacts. Use when CI/CD, GitHub Actions, GitLab CI, pipeline, 持续集成, workflow YAML, deploy gates, OIDC to cloud, cache,…
Idioma do texto original: inglês
Design circuit breakers for dependency isolation: closed/open/half-open states, failure thresholds, probe recovery, and fallbacks. Use when circuit breaker, 熔断, bulkhead isolation, fail-fast dependency, open circuit, or cascading failure protection toward a…
Idioma do texto original: inglês
Defense-first clickjacking and frame-busting controls: X-Frame-Options, CSP frame-ancestors, SameSite cookie interaction, and authorized UI-redress validation. Use when hardening framable UI, reviewing anti-framing headers, replacing client-side…
Idioma do texto original: inglês
Advanced authorized clickjacking and UI redress: multi-step overlays, drag-drop and cursor-jack chains, SameSite/third-party cookie limits, nested-frame and CSP frame-ancestors bypasses, and high-impact framed actions. Use when basic framing checks are done…
Idioma do texto original: inglês
Cloud content audit bypass: output encoding, ZWSP insertion, Unicode homoglyph substitution, split delivery, code-block smuggling. Trigger: bypass audit, encode output, split deliver, cloud bypass, evade review, hide content.
Idioma do texto original: inglês
Use for authorized cloud, container, and Kubernetes security assessment including metadata SSRF, IAM misconfig, container escape paths, and cluster RBAC review.
Idioma do texto original: chinês
Defend applications and workloads against SSRF that reaches cloud instance metadata (IMDS): block link-local targets, enforce IMDSv2/hop limits, harden URL fetchers, and reduce role blast radius. Use when hardening against 169.254.169.254,…
Idioma do texto original: inglês
Select the most specific installed skill for AWS, Azure, GCP, Kubernetes, containers, CI/CD, registries, networking, certificates, databases, observability, performance, and reliability. Use for cloud, Kubernetes, Docker, Terraform, deployment, DevOps, 云服务,…
Idioma do texto original: inglês
CloudFormation IAM guardrails for owned AWS accounts: roles and policies in templates, CAPABILITY_IAM / CAPABILITY_NAMED_IAM deploy gates, permissions boundaries, CloudFormation service roles, stack policies, and least-privilege policies. Use when hardening…
Idioma do texto original: inglês