Menu
Skills neste repositório
O SkillsMP coletou 484 skills de tomysh1337/openstarry-code. Abra uma skill para revisar a origem e os detalhes.
tomysh1337/openstarry-codeMostrando 40 de 484 skills coletadas.
Design and review property-based and fuzz-style property tests: invariants, generators, shrinking, and when properties beat examples. Use when property-based testing, 属性测试, hypothesis, fast-check, jqwik, proptest, generators, shrinking, or invariant testing.…
Idioma do texto original: inglês
Design and evolve Protobuf/gRPC API contracts: package and naming style, field numbers, types, oneof/map/repeated rules, compatibility, errors, pagination, and service layout. Use when writing or reviewing .proto files, gRPC service APIs, buf/lint rules, or…
Idioma do texto original: inglês
Recover and validate unknown Protobuf, gRPC, and gRPC-Web message structures from captures, application assets, binaries, or runtime traces. Use when payloads contain Protobuf wire data, `application/grpc`, `application/grpc-web+proto`, five-byte gRPC frames,…
Idioma do texto original: inglês
Master network protocol reverse engineering including packet analysis, protocol dissection, and custom protocol documentation. Use when analyzing network traffic, understanding proprietary protocols, or debugging network communication.
Idioma do texto original: inglês
Use for authorized reverse engineering of custom binary protocols, Protobuf/gRPC, WebSocket frames, and PCAP-driven protocol recovery.
Idioma do texto original: chinês
Harden JavaScript and TypeScript applications against prototype pollution: safe merge/clone, key denylists and allowlists, null-prototype maps, parser settings, freeze/seal of config, and regression tests. Use when fixing or reviewing deep-merge, defaults,…
Idioma do texto original: inglês
Pulumi secrets and encrypted config for owned/authorized stacks: pulumi config set --secret, secrets providers (passphrase vs cloud KMS), stack outputs, and Pulumi ESC. Use when Pulumi secrets, stack config encryption, PULUMI_CONFIG_PASSPHRASE,…
Idioma do texto original: inglês
Authorized PWA security review: service worker scope, Cache API / precache poisoning, HTTPS-only installability, Web Push permissions, and offline auth tokens. Use when assessing service workers, Workbox caches, manifest install flows, push handlers, or…
Idioma do texto original: inglês
Configure and review PyPI (and TestPyPI) Trusted Publishing so CI publishes Python packages via short-lived OIDC identity instead of long-lived API tokens. Use when designing or auditing PyPI OIDC publishers, GitHub Actions or GitLab publish jobs,…
Idioma do texto original: inglês
Modern Python packaging with pyproject.toml, hatch/poetry/uv, src layout, versioning, and wheels. Use when packaging a Python library or app, authoring or migrating setup.py/setup.cfg to PEP 517/518/621, choosing hatchling/setuptools/ poetry-core, building…
Idioma do texto original: inglês
Apply PEP 8 style, modern type hints, and repo-aligned pyright/mypy plus black/ruff tooling when writing or reviewing Python. Use when Python style, typing, type hints, 类型注解, PEP 8, mypy, pyright, ruff, black, annotations, or Python formatting/linting…
Idioma do texto original: inglês
Own Astral uv lockfiles and install gates: uv.lock generation, upgrade, check, frozen sync, dependency groups/extras, index policy, and CI reproducibility for Python projects. Use when uv.lock, uv lock, uv sync --frozen, uv lock --check, uv lock --upgrade,…
Idioma do texto original: inglês
Capture, decrypt, and analyze QUIC and HTTP/3 traffic using endpoint key logs, qlog, PCAP, Wireshark, and implementation traces. Use when traffic is UDP-based and encrypted, ALPN is h3, connection IDs replace stable five-tuples, HTTP/3 streams use QPACK,…
Idioma do texto original: inglês
Authorized RabbitMQ security assessment and hardening: users, vhosts, configure/write/read permissions, TLS for AMQP and management, default guest account, loopback_users, and management UI exposure. Use when reviewing rabbitmq.conf / advanced.config,…
Idioma do texto original: inglês
Use for authorized RF/SDR security research including signal identification, replay feasibility study in shielded labs, and wireless protocol analysis outside classic Wi-Fi.
Idioma do texto original: Vários idiomas
Rails security checklist for org-owned apps: strong parameters, CSRF, sessions/cookies, ActiveRecord injection, secrets, headers, and authZ. Use when reviewing Rails apps, credentials, Devise/sessions, or hardening before release — authorized only.
Idioma do texto original: inglês
Authorized testing of HTTP rate limits and anti-automation: limit keying (IP, user, session, API key), header-based IP trust, path/method aliases, protocol quirks, and IP-rotation awareness. Use when login, OTP, reset, or API quotas should throttle abuse but…
Idioma do texto original: inglês
Structure React components with clear props, hooks, composition, and colocation. Use when React components, hooks, props, colocation, compound components, React 组件, 组件结构, custom hooks, or when reviewing React UI structure. Pairs with code-quality-standards;…
Idioma do texto original: inglês
Harden React hooks against security pitfalls: dangerouslySetInnerHTML sinks, effect cleanup that leaks tokens/subscriptions, stale auth/closure state, and useMemo/useCallback values that land secrets in logs or client bundles. Use when reviewing or fixing…
Idioma do texto original: inglês
Authorized React Native mobile app security basics: expo-secure-store / react-native-keychain storage, certificate pinning notes, deep-link and universal-link handling, JS bundle tampering awareness, and WebView risks. Use when hardening or reviewing owned RN…
Idioma do texto original: inglês
Structure and write project README, CONTRIBUTING, and quickstart docs that get users running and contributors shipping safely. Use when README, CONTRIBUTING, quickstart, 写说明文档, project overview, onboarding docs, setup instructions, or polishing the repository…
Idioma do texto original: inglês
Design least-privilege Redis ACL users: command categories, key/channel patterns, AUTH secrets, and deny lists for dangerous commands. Use when defining users.acl, ACL SETUSER rules, app vs admin roles, key-prefix isolation, or replacing shared requirepass…
Idioma do texto original: inglês
Authorized Redis security assessment and hardening: bind addresses, protected-mode, AUTH/ACL, dangerous command exposure (FLUSH*, CONFIG, MODULE, DEBUG, SLAVEOF/REPLICAOF), network exposure, TLS, and safe config examples. Use when reviewing redis.conf, cloud…
Idioma do texto original: inglês
Strict refresh-token rotation and reuse detection: one-time rotate on use, reject previous tokens, revoke entire token family on reuse, concurrent-refresh races, grace windows, and storage/hash requirements. Use when assessing or implementing refresh…
Idioma do texto original: inglês
Design, assess, and harden trust in registry mirrors and pull-through caches for containers and packages (Harbor, Artifactory, Nexus, ECR/GHCR proxies, npm/PyPI/Maven mirrors). Use when clients resolve artifacts via a corporate mirror, when pull-through cache…
Idioma do texto original: inglês
Design and assess long-lived remember-me / persistent-login tokens: opaque selector+validator patterns, hashed storage, rotation, revocation, and cookie transport. Use when implementing or reviewing “stay signed in”, persistent login cookies, or multi-device…
Idioma do texto original: inglês
Harden Mend Renovate (self-hosted or app) for supply-chain and CI safety: token least privilege, auto-merge gates, allowScripts/ignoreScripts, hostRules secrets, registry allowlists, custom/regex managers, and PR trust under branch protection. Use when…
Idioma do texto original: inglês
Achieve bit-for-bit or policy-defined equivalent rebuilds: hermetic inputs, SOURCE_DATE_EPOCH, pinned toolchains, and binary equivalence checks. Use when reproducible builds, rebuild verification, deterministic builds, SOURCE_DATE_EPOCH, build nondeterminism,…
Idioma do texto original: inglês
Detect known-vulnerable JavaScript and Node libraries with Retire.js (CLI): js/node path scans, severity gates, ignore files, JSON/CycloneDX output, and CI fail-closed wiring for owned frontends and Node apps. Use when retire.js, retire CLI, JS library CVE…
Idioma do texto original: inglês
Design safe retries: exponential backoff, jitter, budgets, idempotency, and when not to retry. Use when retry, backoff, 重试, transient failure, 429/503 handling, dead-letter, or retry storms. Complements async cancel and cache loaders; not a substitute for…
Idioma do texto original: inglês
Trace and reverse Android native behavior end to end across Java or Kotlin call sites, JNI static or dynamic registration, APK/AAB/AAR native-library inventory, ELF and ARM/Thumb/AArch64 analysis, Frida or JNItrace validation, algorithm recovery, and minimal…
Idioma do texto original: inglês
Binary analysis: disassembly guidance, unpacking, string extraction, control-flow recovery. Trigger: reverse, disassemble, decompile, unpack, analyze binary, pe header, elf header.
Idioma do texto original: inglês
Guide for reverse engineering protected games and anti-cheat components across user mode, kernel mode, and hypervisor-aware environments. Use this skill when analyzing drivers, IOCTL protocols, callback registration, injected-code artifacts, integrity checks,…
Idioma do texto original: inglês
Test REST, GraphQL, WebSocket, and SOAP APIs for authentication, authorization, token, rate-limit, and protocol-specific security flaws.
Idioma do texto original: chinês
在 CLI 环境下做 Android APK 逆向时使用。适用于 APK 解包、Java 反编译、smali 修改、重打包、Frida 动态 Hook，以及按需切换到 so/native 分析。优先使用本机已安装的 jadx、apktool、frida、adb、ida-reverse、radare2。
Idioma do texto original: chinês
Plan and coordinate multi-stage authorized penetration-testing and CTF attack paths across reconnaissance, exploitation, privilege escalation, lateral movement, and reporting.
Idioma do texto original: chinês
.NET / C# 二进制逆向。当目标是 .NET assembly（PE 头含 CLR、.exe/.dll 托管程序）、C# 编译产物（含 NativeAOT）、红队 Sharp* 工具（Rubeus / SharpHound / SharpHound 等）、.NET 混淆程序（ConfuserEx / SmartAssembly / Babel / Eazfuscator）、.NET loader / info-stealer / 套壳 malware 时使用。优先用 dnSpyEx + de4dot，需要…
Idioma do texto original: chinês
IDA Pro 逆向分析辅助技能。当用户提到逆向、反编译、分析二进制/PE/ELF/APK/DLL/SO、破解、找密码、漏洞分析、病毒分析、firmware 固件分析，或需要分析 exe/dll/so/elf/macho/sys 等文件时，务必使用此技能。 Ensure to use this skill when the user wants to analyze any binary file, regardless of whether they explicitly mention "IDA" or…
Idioma do texto original: chinês
Assess LLM and AI-agent applications for prompt injection, unsafe tool use, memory poisoning, data exposure, model supply-chain, and agentic security risks.
Idioma do texto original: chinês
Analyze suspicious PE, ELF, Mach-O, APK, and script samples using static, dynamic, behavioral, IOC, YARA, Sigma, and anti-analysis workflows.
Idioma do texto original: chinês