菜单
这个仓库中的 skills
SkillsMP 已收集 tomysh1337/openstarry-code 中的 484 个 Skill。打开任一 Skill 可查看来源和详情。
tomysh1337/openstarry-code已展示 40 / 484 个已收集 Skill。
Authorized Azure Network Security Group (NSG) review for owned subscriptions: rule priority, Any/Any Allow, service tags, Application Security Groups (ASG), NSG flow logs, and effective security rules. Use when auditing Azure NSG inbound/outbound rules,…
原文语言：英语
Backpressure for async/streaming: bounded buffers, pull flow control, drop/sample/shed, slow consumers. Use when backpressure, bounded channel, overflow, 背压, 反压, or producer outruns consumer. Complements bulkheads, circuit breakers, async concurrency, and…
原文语言：英语
Design and implement MFA backup/recovery code generation, storage, display, redemption, and regeneration. Use when building or reviewing one-time backup codes, recovery codes, or offline second-factor fallbacks: entropy, hashing, single-use, rate limits,…
原文语言：英语
Run and gate Bandit (PyCQA) on owned Python trees: config discovery, severity/confidence policy, excludes, JSON/SARIF outputs, CI fail-closed gates, and triage of B-rules into fixes or owned suppressions. Use when Bandit, bandit -r, pyproject.toml…
原文语言：英语
Design and review Backend-for-Frontend (BFF) cookie sessions for SPAs: server-held tokens, HttpOnly session cookies, same-site edge layout, CSRF, and logout/revocation. Use when an SPA must avoid JS-readable access tokens, proxy OAuth/OIDC through a BFF, or…
原文语言：英语
Use when you need to run a binary, trace execution, or observe runtime behavior. Runtime analysis via QEMU emulation, GDB debugging, and Frida hooking - syscall tracing (strace), breakpoints, memory inspection, function interception. Keywords - "run binary",…
原文语言：英语
This skill should be used when analyzing binaries, executables, or bytecode to understand what they do or how they work. Triggers on "binary", "executable", "ELF", "what does this do", "reverse engineer", "disassemble", "decompile", "pyc file", "python…
原文语言：英语
Use when analyzing binary structure, disassembling code, or decompiling functions. Deep static analysis via radare2 (r2) and Ghidra headless - function enumeration, cross-references (xrefs), decompilation, control flow graphs. Keywords - "disassemble",…
原文语言：英语
Use when ready to document findings, generate a report, or summarize binary analysis results. Compiles analysis findings into structured reports - correlates facts from triage/static/dynamic phases, validates hypotheses, generates documentation with evidence…
原文语言：英语
Use when reverse engineering tools are missing, not working, or need configuration. Installation guides for radare2 (r2), Ghidra, GDB, QEMU, Frida, binutils, and cross-compilation toolchains. Keywords - "install radare2", "setup ghidra", "r2 not found", "qemu…
原文语言：英语
Use when first encountering an unknown binary, ELF file, executable, or firmware blob. Fast fingerprinting via rabin2 - architecture detection (ARM, x86, MIPS), ABI identification, dependency mapping, string extraction. Keywords - "what is this binary",…
原文语言：英语
Design bot-management signal pipelines: signal taxonomy, collection points, risk scoring, action thresholds (allow / challenge / throttle / block), feedback loops, privacy, and false-positive controls. Use when bot score design, device or TLS fingerprints as…
原文语言：英语
Run and triage Brakeman static analysis on Ruby on Rails apps you own: install/pin, repo config, confidence filters, JSON/SARIF reports, CI gates, ignore-file hygiene, and fix-then-rescan for SQLi, XSS, mass assignment, redirects, and related Rails sinks. Use…
原文语言：英语
Configure and audit GitHub/GitLab branch protection: required status checks, block force-push and deletion, linear history, admin/owner enforcement, and CODEOWNERS-required reviews. Use when branch protection, protected branch, required checks, force-push…
原文语言：英语
Use for authorized reverse engineering of browser extensions (Chrome/Firefox) including manifest analysis, background workers, and extension-based credential or traffic logic recovery.
Authorized browser extension security review: manifest permissions, content scripts, background/service workers, messaging, web_accessible_resources, update and store packaging risks. Use when assessing Chrome/Firefox/Edge extensions you own or are scoped to…
原文语言：英语
End-to-end bug bounty workflow for authorized public or private programs only: program selection, scope discipline, recon handoff, testing prioritization, evidence quality, and professional reporting. Use when hunting on HackerOne, Bugcrowd, Intigriti,…
原文语言：英语
Use when building, adapting, reviewing, or testing CDK/license-key activation and signed online updates in Windows desktop applications, especially Qt/QML, WPF/WinUI, or Electron projects.
原文语言：多语言混合
BuildKit secret and SSH mounts so build-time credentials never land in image layers, history, or ARG/ENV. Use when docker buildx --secret, RUN --mount=type=secret, type=ssh private git/npm/registry auth, Dockerfile secret mounts, or replacing ARG TOKEN / COPY…
原文语言：英语
Isolate failure domains with bulkheads: separate pools, semaphores, queues, and resource budgets so one dependency or tenant cannot exhaust the process. Use when bulkhead, isolation, noisy neighbor, pool per dependency, 舱壁, 隔离舱, or cascading pool exhaustion.…
原文语言：英语
Keep Bun installs reproducible: commit bun.lock (or migrate bun.lockb), frozen CI with bun ci / --frozen-lockfile, single package-manager story, workspace lock fidelity, and lock-diff review. Use when bun.lock, bun.lockb, bun install, bun ci, frozen-lockfile,…
原文语言：英语
Design application and edge caches: key design, TTLs, invalidation, stampede protection, and consistency. Use when caching, cache invalidation, 缓存, Redis/Memcached, CDN cache keys, TTL, thundering herd, or cache-aside patterns. Not for web cache…
原文语言：英语
Authorized CAPTCHA and bot-challenge control research: when challenges bind, client-trust gaps, reusable tokens, logic skips, accessibility/alternate paths, and rate-limit interplay. Use for labs, CTFs, and scoped assessments measuring control effectiveness —…
原文语言：英语
Design and implement enterprise CAPTCHA / bot-challenge integration for owned applications: provider selection, sitekey and secret lifecycle, server-side token verification, action and hostname binding, score thresholds, fail-closed behavior, multi-client…
原文语言：英语
Run and gate Rust dependency vulnerability checks with cargo-audit locally and in CI: RustSec advisory DB, Cargo.lock scans, JSON outputs, ignore policy, version pins, and actionable upgrade paths for owned crates. Use when cargo-audit, RustSec, RUSTSEC-*,…
原文语言：英语
Design CDN/edge HTTP cache keys: scheme/host/path, Vary, cookie inclusion, query-string allowlists, unkeyed header poison defenses, and purge strategy. Use when configuring CloudFront/Fastly/Cloudflare/Akamai cache keys, Vary headers, qs whitelist, cookie…
原文语言：英语
Authorized CDN/WAF bypass awareness: edge fingerprinting, origin exposure, alternate entrypoints, inspection gaps, cache/bot control boundaries, and residual-risk notes when CDN or WAF is the primary control. Use when reviewing whether…
原文语言：英语
Kubernetes cert-manager basics for owned or authorized clusters: Issuer and ClusterIssuer design, ACME HTTP-01/DNS-01 challenges, Certificate CRDs, renewal and Secret delivery, and private CA issuers. Use when installing or reviewing cert-manager, debugging…
原文语言：英语
Certificate Transparency (CT) logs and Signed Certificate Timestamps (SCTs) for authorized recon, mis-issuance detection, and TLS evidence. Use when querying CT logs for hostnames, verifying SCTs in certificates or TLS handshakes, monitoring org domains for…
原文语言：英语
Maintain Keep a Changelog-style CHANGELOG entries and write user-facing release notes from commits, PRs, and version bumps. Use when changelog, release notes, 更新日志, CHANGELOG.md, GitHub/GitLab releases, version announcements, or mapping Conventional Commits…
原文语言：英语
Plan authorized chaos and fault-injection experiments in lab or owned non-prod: hypothesis, blast radius, steady state, inject/observe/stop. Use when chaos engineering, 混沌工程, fault injection, GameDay, Litmus, Chaos Mesh, Gremlin, toxiproxy, or resilience…
原文语言：英语
Design and review CI/CD pipelines for clear stages, secret hygiene, dependency and build caching, fail-fast feedback, and durable artifacts. Use when CI/CD, GitHub Actions, GitLab CI, pipeline, 持续集成, workflow YAML, deploy gates, OIDC to cloud, cache,…
原文语言：英语
Design circuit breakers for dependency isolation: closed/open/half-open states, failure thresholds, probe recovery, and fallbacks. Use when circuit breaker, 熔断, bulkhead isolation, fail-fast dependency, open circuit, or cascading failure protection toward a…
原文语言：英语
Defense-first clickjacking and frame-busting controls: X-Frame-Options, CSP frame-ancestors, SameSite cookie interaction, and authorized UI-redress validation. Use when hardening framable UI, reviewing anti-framing headers, replacing client-side…
原文语言：英语
Advanced authorized clickjacking and UI redress: multi-step overlays, drag-drop and cursor-jack chains, SameSite/third-party cookie limits, nested-frame and CSP frame-ancestors bypasses, and high-impact framed actions. Use when basic framing checks are done…
原文语言：英语
Cloud content audit bypass: output encoding, ZWSP insertion, Unicode homoglyph substitution, split delivery, code-block smuggling. Trigger: bypass audit, encode output, split deliver, cloud bypass, evade review, hide content.
原文语言：英语
Use for authorized cloud, container, and Kubernetes security assessment including metadata SSRF, IAM misconfig, container escape paths, and cluster RBAC review.
Defend applications and workloads against SSRF that reaches cloud instance metadata (IMDS): block link-local targets, enforce IMDSv2/hop limits, harden URL fetchers, and reduce role blast radius. Use when hardening against 169.254.169.254,…
原文语言：英语
Select the most specific installed skill for AWS, Azure, GCP, Kubernetes, containers, CI/CD, registries, networking, certificates, databases, observability, performance, and reliability. Use for cloud, Kubernetes, Docker, Terraform, deployment, DevOps, 云服务,…
原文语言：英语
CloudFormation IAM guardrails for owned AWS accounts: roles and policies in templates, CAPABILITY_IAM / CAPABILITY_NAMED_IAM deploy gates, permissions boundaries, CloudFormation service roles, stack policies, and least-privilege policies. Use when hardening…
原文语言：英语