tomysh1337/openstarry-code - 第 3 页

code-audit

Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.

code-quality-standards

Apply repository-aligned coding standards while adding features, fixing bugs, refactoring, or reviewing implementation changes. Use when writing or modifying production code and the task needs maintainability, clear boundaries, type and data-model discipline,…

原文语言：英语

code-review-comments-style

Write clear, kind, actionable code review comments with appropriate severity, and decide request-changes vs nit vs approve. Use when code review comments, PR review feedback, 评审意见写法, review tone, blocking vs non-blocking notes, or drafting GitHub/GitLab…

原文语言：英语

code-task

PREFERRED way to change code in a REAL repository: fix a GitHub issue, fix a bug, add/implement a function or feature, or make any edit to a project the user names by a filesystem path (e.g. /tmp/foo, ~/code/bar) or a git URL. Clones the repo, runs an…

原文语言：英语

codeowners-review-routing

Design and maintain CODEOWNERS path ownership, required review rules, and monorepo routing that avoids single-owner bottlenecks. Use when CODEOWNERS syntax, path owners, required reviewers, branch protection review counts, monorepo package ownership, review…

原文语言：英语

codeql-query-pack-basics

CodeQL packs: qlpack.yml layout, query vs library packs, dependencies, lock files, custom queries, suite selection, and analyze/CI wiring for org-owned codebases. Use when creating or packing CodeQL query packs, qlpack.yml / codeql-pack.yml, pack…

原文语言：英语

command-injection-defenses

Defend applications against OS command injection by avoiding shells, using argv arrays, allowlisting inputs and binaries, and preferring library APIs over exec. Use when hardening process spawning, subprocess/ProcessBuilder/ child_process sinks, CLI wrappers…

原文语言：英语

comment-writing-standards

Standards for when and why to write comments, what not to narrate, and how to document decisions, invariants, and non-obvious constraints in code. Use when writing comments, reviewing comment quality, documenting intent, 写注释, 注释规范, comment style, or deciding…

原文语言：英语

commit-message-conventions

Write clear git commit messages using Conventional Commits (type, optional scope, subject/body/footer), emphasizing why the change exists rather than restating the diff. Use when drafting or reviewing a commit message, Conventional Commits, 提交信息, git commit…

原文语言：英语

composer-security-audit

Run and gate PHP Composer dependency vulnerability checks with composer audit locally and in CI: Packagist/GitHub security advisories, composer.lock scans, JSON output, abandoneds, ignore policy, and upgrade paths for owned PHP apps. Use when composer audit,…

原文语言：英语

composio-app-automation-catalog

Route Composio and Rube app-automation requests to a cached catalog of 810 canonical workflows derived from 832 source skills. Use when a user asks to automate or connect a SaaS or API through Composio/Rube MCP, needs an app-specific tool sequence, or…

原文语言：英语

container-image-signing

Sign and verify container images with Cosign and Sigstore: keyless OIDC, long-lived keys, and admission or policy enforcement by digest. Use when cosign sign/verify, Fulcio/Rekor, keyless OIDC image signing, Kyverno or Gatekeeper or Sigstore policy-controller…

原文语言：英语

content-security-policy-bypass

Authorized Content-Security-Policy (CSP) review and bypass research: parse policy directives, assess nonce/hash/'strict-dynamic' posture, source expressions, and XSS impact under CSP. Use when responses or meta tags set CSP, inline script is blocked, or a…

原文语言：英语

content-strategy

When the user wants to plan a content strategy, decide what content to create, or figure out what topics to cover. Also use when the user mentions "content strategy," "what should I write about," "content ideas," "blog strategy," "topic clusters," "content…

原文语言：英语

content-type-sniffing-defense

Defend against MIME / content-type sniffing: enforce X-Content-Type-Options nosniff, accurate Content-Type, safe user-upload serve paths, and polyglot body risks that browsers re-interpret as HTML/script. Use when hardening or auditing response headers for…

原文语言：英语

contract-testing-pact

Consumer-driven contract testing (Pact-style): consumer expectations, provider verification, broker publish, and CI compatibility gates. Use when Pact, CDC, consumer-driven contracts, provider verification, pact broker, can-i-deploy, or API shape drift…

原文语言：英语

cookie-security-flags

Assess and harden HTTP cookie flags: Secure, HttpOnly, SameSite, Domain, Path, Prefixes (__Host-/__Secure-), and Max-Age/Expires. Use when reviewing session or auth cookies for missing flags, overly broad scope, CSRF exposure, or XSS cookie theft risk on…

原文语言：英语

coop-coep-isolation

Design, audit, and remediate Cross-Origin-Opener-Policy (COOP) and Cross-Origin-Embedder-Policy (COEP) for browser cross-origin isolation (crossOriginIsolated, SharedArrayBuffer, Spectre mitigations). Use when enabling or debugging COOP/COEP/CORP, SAB…

原文语言：英语

copywriting

When the user wants to write, rewrite, or improve marketing copy for any page — including homepage, landing pages, pricing pages, feature pages, about pages, or product pages. Also use when the user says "write copy for," "improve this copy," "rewrite this…

原文语言：英语

cordova-webview-risks

Authorized Cordova/PhoneGap hybrid app security review: config.xml navigation allowlists, file:// origin and content access, JS↔native bridge injection, and outdated/vulnerable plugins. Use when assessing Cordova, PhoneGap, Ionic Cordova, or…

原文语言：英语

cors-credentialed-requests

Authorized assessment of credentialed CORS: Access-Control-Allow-Credentials with cookies or client certs, forbidden ACAO *, origin reflection, null origin, preflight vs simple requests, and browser PoC requirements. Use when ACAC true, credentialed…

原文语言：英语

cors-preflight-cache

Authorized assessment of CORS preflight caching (Access-Control-Max-Age), browser OPTIONS cache behavior, ACAO reflection under credentials, and preflight/CDN cache-poison risks. Use when debugging CORS failures, tuning Max-Age, or validating that cached…

原文语言：英语

cosign-keyless-verify

Verify Cosign keyless (Sigstore/Fulcio/Rekor) signatures on images and artifacts with tight identity and OIDC issuer allowlists. Use when cosign verify, --certificate-identity, --certificate-oidc-issuer, keyless Sigstore check, Rekor transparency, signed…

原文语言：英语

crack-keygen

Software authorization analysis: key generation, license bypass, binary patching, DRM removal. Trigger: crack, keygen, patch, license, serial, bypass auth, activate, unlock.

原文语言：英语

cro

When the user wants to optimize, improve, or increase conversions on any marketing page or form — including homepage, landing pages, pricing pages, feature pages, lead capture forms, or contact forms. Also use when the user says 'CRO,' 'conversion rate…

原文语言：英语

cross-origin-opener-policy

Assess and implement Cross-Origin-Opener-Policy (COOP) for browsing-context isolation: same-origin, same-origin-allow-popups, unsafe-none, pairing with COEP for crossOriginIsolated / SharedArrayBuffer, and popup/OAuth breakage. Use when hardening…

原文语言：英语

csdn-skill-distiller

Convert Chinese technical research from CSDN or similar blogs into concise, validated Codex skills. Use when the user asks Codex to learn from CSDN, summarize Chinese developer articles into reusable workflows, create or update a skill from blog research, or…

原文语言：英语

csharp-style-conventions

Apply C# and .NET naming conventions, XML documentation comments, and nullable reference type style when writing or reviewing C# code. Use when C# style, .NET naming, XML docs, nullable reference types, EditorConfig/StyleCop alignment, or public API…

原文语言：英语

csp-report-only-rollout

Roll out Content-Security-Policy-Report-Only safely: report-uri/report-to, owned collectors, violation triage, noise filtering, gradual directive tightening, canary then enforce. Use when staging CSP without blocking production, cutting report floods,…

原文语言：英语

css-injection-exfiltration

Authorized CSS injection and style-based data exfiltration awareness: map untrusted input into style contexts, assess attribute-selector and url()/@import channels, and document impact under CSP style-src without treating CSS as full script XSS. Use when…

原文语言：英语

database-migration-safety

Plan and review safe database migrations: expand/contract, backward-compatible deploys, locking/index risks, backfills, and zero-downtime notes. Use when DB migration, 数据库迁移, schema change, online DDL, expand/contract, dual-write, backfill, or shipping…

原文语言：英语

database-security

Use for authorized database security assessment covering PostgreSQL/MySQL/MSSQL/Mongo/Redis exposure, authz, UDF/command paths, and misconfiguration review.

debugger-integration

Advanced debugging integration for vulnerability research

原文语言：英语

dependabot-config-hardening

Harden GitHub Dependabot: complete .github/dependabot.yml coverage, safe schedules and groups, PR limits, private registries, ignore expiry, monorepo directories, Actions and Docker updates, and review/CI gates without blind auto-merge. Use when…

原文语言：英语

dependency-pinning-strategies

Choose and enforce dependency pins: committed lockfiles, exact vs range versions, CI frozen installs, and Dependabot/Renovate update policy with supply-chain tradeoffs. Use when lockfiles, package-lock, yarn.lock, pnpm-lock, poetry.lock, go.sum, Cargo.lock,…

原文语言：英语

deserialization-safe-formats

Defensive guidance for safe interchange formats and deserializers: prefer JSON, Protobuf, and schema-bound codecs over pickle, native Java serialization, BinaryFormatter-class APIs, and unrestricted YAML load. Use when choosing or hardening serializers,…

原文语言：英语

device-binding-tokens

High-level design and authorized assessment of device-bound and proof-of-possession tokens (DPoP-style, mTLS/cnf, sender-constrained access tokens). Use when APIs, mobile apps, or SPAs claim tokens are bound to a key, device, or TLS client cert, or when…

原文语言：英语

digital-forensics

Use for authorized digital forensics including memory dumps, disk timelines, PCAP investigation, artifact triage, and IR evidence preservation.

distroless-image-adoption

Adopt and migrate application runtimes to distroless (or equivalent minimal non-shell) container images: multi-stage copy-in, language base choice (static/base/cc/java/nodejs/python), nonroot UIDs, CA/tzdata, and debug without a package manager. Use when…

原文语言：英语

django-csrf-middleware-tuning

Tune and review Django CsrfViewMiddleware and CSRF-related settings: CSRF_TRUSTED_ORIGINS, cookie flags, header names, exemptions, and middleware order for cookie-authenticated browser apps. Use when Django CSRF 403s after deploy, SPA/API Origin mismatches,…

原文语言：英语