Menu
Skills neste repositório
O SkillsMP coletou 484 skills de tomysh1337/openstarry-code. Abra uma skill para revisar a origem e os detalhes.
tomysh1337/openstarry-codeMostrando 40 de 484 skills coletadas.
Design load shedding under overload: admission control, priority queues, graceful degradation, and drop/reject policies that protect critical paths. Use when load shedding, overload, backpressure, 限流丢弃, 过载保护, 503 shedding, queue full, admission control, or…
Idioma do texto original: inglês
Standards for application logs: structured fields, correct levels, stable message templates, and no PII or secrets. Use when logging style, 日志规范, log messages, logger design, slog/zap/logrus/structlog, or when reviews flag noisy, string-interpolated, or leaky…
Idioma do texto original: inglês
Detect, prove, and remediate login CSRF: cross-site login that binds the victim browser to an attacker-controlled identity, silent account switch, and post-login action chaining. Use when login, SSO password-form, or magic-link consume endpoints lack…
Idioma do texto original: inglês
Use for authorized macOS and Mach-O reverse engineering including codesign, Objective-C/Swift recovery, endpoint security surfaces, and Apple platform malware analysis.
Idioma do texto original: chinês
Authorized assessment and hardening of passwordless magic-link authentication: token lifecycle, single-use/TTL, email binding, consume races, open-redirect after verify, prefetch/scanner consumption, and post-login session hygiene. Use when login, sign-in, or…
Idioma do texto original: inglês
Convert documents and files to Markdown using markitdown. Use when converting PDF, Word (.docx), PowerPoint (.pptx), Excel (.xlsx, .xls), HTML, CSV, JSON, XML, images (with EXIF/OCR), audio (with transcription), ZIP archives, YouTube URLs, or EPubs to…
Idioma do texto original: inglês
Write and edit Markdown documentation with consistent headings, links, tables, code fences, and docs-site hygiene. Use when markdown style, docs markdown, README polish, CONTRIBUTING, ADRs, MkDocs/Docusaurus/VitePress content, or fixing broken docs structure,…
Idioma do texto original: inglês
Harden Markdown-to-HTML pipelines against XSS: safe renderers, post-parse HTML sanitization, link/image URL allowlists, and tests for raw HTML and attribute breakouts. Use when user or third-party Markdown is rendered to HTML (comments, wikis, READMEs, chat,…
Idioma do texto original: inglês
Select the most specific installed skill for marketing strategy, SEO, copywriting, content, campaigns, positioning, pricing, launch, growth, retention, email, social media, and conversion optimization. Use for marketing, SEO, CRO, copy, campaign, 营销, 文案,…
Idioma do texto original: inglês
Find and safely prove mass assignment / over-posting when APIs or frameworks bind client JSON or form fields onto domain objects, including hidden role, ownership, price, and flag fields. Use when create/update endpoints accept broad DTOs,…
Idioma do texto original: inglês
Run and gate OWASP Dependency-Check on Maven projects: plugin config, NVD/API keys, suppressions, report formats, CI fail builds, and upgrade paths for owned Java/Maven modules. Use when dependency-check-maven, OWASP dependency check, Maven CVE scan, NVD API…
Idioma do texto original: inglês
Use this meta-skill instead of answering directly when the current user asks to generate an AI short-drama or 短剧 from a topic. The workflow infers render style, character identity, and shot count (1-10, default 5) from the request (filling in conservative…
Idioma do texto original: inglês
Authorized methodology for testing multi-factor authentication weaknesses: backup codes, remember-device, race on attempt counters, step-up gaps, and high-level response/status manipulation. Use when login, step-up, or recovery flows claim MFA is enforced but…
Idioma do texto original: inglês
Authorized methodology for MFA enrollment and setup-skip flaws: force MFA incomplete, bind attacker factors, disable without step-up, and treat enrollment as optional. Use when register/enroll/setup-2FA, skip setup, or optional MFA paths may leave accounts…
Idioma do texto original: inglês
编写和调试 Minecraft 1.20.1 Forge/ModLauncher 客户端 JavaScript 插件。适用于 SRG、官方混淆、启动器重映射或魔改端环境，以及 Mojmap 字段名无法直接访问的情况；覆盖类型确认、反射解析、Holder 解包、调试日志和性能安全的成品化流程。
Idioma do texto original: chinês
Find and fix HTTPS mixed content (active and passive), insecure third-party assets, missing upgrade-insecure-requests / HSTS, and CSP report endpoints for residual HTTP subresources. Use when hardening org-owned or authorized HTTPS sites that still load…
Idioma do texto original: inglês
Choose and review mocks, stubs, fakes, spies, and dummies: when each is appropriate, how to avoid over-mocking, and how to keep tests honest. Use when mock, test doubles, 单元测试 mock, stub, fake, spy, mockito, unittest.mock, jest.fn, or reviews flag brittle…
Idioma do texto original: inglês
Authorized MongoDB authentication and exposure hardening: SCRAM, bindIp, TLS, role-based access control, localhost exception, and free monitoring disablement. Use when reviewing mongod.conf, Atlas/self-hosted MongoDB, unauthorized access risk, or hardening…
Idioma do texto original: inglês
Mutual TLS (mTLS) client authentication basics for owned or authorized systems: client cert trust, require-and-verify config, identity mapping, revocation, and common misconfigs. Use when designing or reviewing mTLS between services or APIs, debugging…
Idioma do texto original: inglês
SPIFFE/SPIRE workload identity for mTLS: SPIFFE IDs (spiffe:// trust domain path), SVIDs (X.509 and JWT), Workload API attestation, trust bundles, and peer ID authorization. Use when designing or reviewing SPIRE agents/servers, mapping Kubernetes SA/node…
Idioma do texto original: inglês
Harden multi-stage Dockerfiles so build toolchains, secrets, and VCS context never reach the runtime image. Use when multi-stage Dockerfile security, COPY --from leakage, builder secrets in final layers, distroless or scratch runtime stages, BuildKit secret…
Idioma do texto original: inglês
Plan and review mutation testing: mutants, kill/survive scores, equivalent mutants, and CI budgets. Use when mutation testing, 变异测试, PIT, Stryker, mutmut, infection, mutant survival, or test strength beyond coverage %. Complements unit-testing-style and…
Idioma do texto original: inglês
Authorized MySQL/MariaDB security hardening: bind-address, local_infile, user@host accounts, SSL/TLS, remove test DB, FILE privilege, and validate_password. Use when reviewing my.cnf, cloud MySQL/MariaDB, or owned lab instances — not for scanning or abusing…
Idioma do texto original: inglês
General naming conventions for variables, functions, types, files, and packages: domain language, consistency, and avoiding Hungarian notation or noisy prefixes. Use when naming, renaming, choosing identifiers, 命名规范, 变量命名, 函数命名, file naming, or when reviews…
Idioma do texto original: inglês
Deterministic OpenRouter image generation adapter for Nano Banana Pro / Gemini image models. Use as skill_exec when a meta-skill needs local image files and structured IMAGE_READY records without spawning an LLM agent.
Idioma do texto original: inglês
Generate or edit a single image via OpenRouter (google/gemini-3.1-flash-image-preview by default). Accepts a text prompt and optional --input-image for image-to-image editing. Trigger when the user asks for an AI image, illustration, concept art, product…
Idioma do texto original: inglês
After an initial reverse-engineering pass, detect and classify native residue such as signed -3###### constants, 0x###### addresses, RVA/VA offsets, JNI pointers, and embedded native modules, then validate candidates with static analysis and an IDA debugger…
Idioma do texto original: inglês
Network penetration testing: port scanning, service enumeration, banner grabbing, protocol fuzzing. Trigger: scan network, enumerate ports, banner grab, service detect, fingerprint, network pentest.
Idioma do texto original: inglês
Network protocol capture, analysis, and fuzzing capabilities
Idioma do texto original: inglês
Capture and analyze network traffic with PCAP, tshark/Wireshark, Lua dissectors, Scapy crafting, state-machine recovery, debugging, and authorized fuzzing. Use for pcap triage, custom dissectors, packet reproduction, and controlled protocol testing on owned…
Idioma do texto original: inglês
Next.js security checklist for org-owned apps: App Router / RSC data exposure, middleware authz, env public vs server split, Server Actions, headers, and route handlers. Use when Next.js security, RSC leak, middleware bypass, NEXT_PUBLIC secrets, Server…
Idioma do texto original: inglês
Configure and review nginx limit_req / limit_req_zone (and related limit_conn) rate-limit zones: keys, shared-memory sizing, rate and burst, nodelay, status codes, trusted client IP, and per-location attachment. Use when designing or auditing nginx rate…
Idioma do texto original: inglês
Authorized nginx hardening and assessment: HTTP security headers, TLS termination settings, server_tokens, common reverse-proxy and header misconfigurations. Use when reviewing nginx.conf / sites-enabled, missing CSP/HSTS/XFO, weak TLS, version disclosure, or…
Idioma do texto original: inglês
Node.js security checklist for org-owned services: Express/Fastify/Nest defaults, validation, injection sinks, sessions/JWT cookies, secrets, dependencies, and HTTP hardening. Use when reviewing Node/Express APIs, npm risk, helmet/CORS, or release hardening —…
Idioma do texto original: inglês
Defend applications against NoSQL operator injection and type confusion: block $gt/$ne/$where and other operator keys, force typed scalars, sanitize Mongo-style filters, and use query sanitization libraries. Use when hardening MongoDB/Mongoose/CouchDB-style…
Idioma do texto original: inglês
Notion API for creating and managing pages, databases, and blocks.
Idioma do texto original: inglês
Keep npm package publish contents intentional: package.json "files", .npmignore vs .gitignore, npm pack dry-runs, and exclusion of secrets, tests, and build junk from the tarball. Use when npm pack, npm publish, package tarball contents, .npmignore,…
Idioma do texto original: inglês
Harden the npm supply chain: committed lockfiles, frozen CI installs (npm ci), integrity hashes, .npmrc registry pin, and lifecycle-script risk (preinstall/install/postinstall/prepare). Use when package-lock.json, npm ci vs npm install, ignore-scripts,…
Idioma do texto original: inglês
Keep NuGet dependency graphs healthy: PackageReference, Central Package Management, packages.lock.json, nuget.config sources, Package Source Mapping, restore locked mode, and vulnerable/deprecated package cleanup. Use when csproj PackageReference,…
Idioma do texto original: inglês
Authorized design and assessment of OAuth 2.0 / OIDC client authentication at the token and related client-auth endpoints: none, client_secret_basic/post, client_secret_jwt, private_key_jwt, and mTLS (tls_client_auth / self_signed_tls_client_auth). Use when…
Idioma do texto original: inglês