菜单
这个仓库中的 skills
SkillsMP 已收集 tomysh1337/openstarry-code 中的 484 个 Skill。打开任一 Skill 可查看来源和详情。
tomysh1337/openstarry-code已展示 40 / 484 个已收集 Skill。
Django settings security checklist for org-owned projects: DEBUG, SECRET_KEY, ALLOWED_HOSTS, CSRF/CORS/cookies, SSL redirect, HSTS, XSS/clickjacking middleware, and safe production settings modules. Use when Django security settings, django settings…
原文语言：英语
Assess and harden email authentication for owned domains: SPF, DKIM, and DMARC (policy rollout, alignment, reporting). Use when reviewing DNS TXT records, spoofing resistance, p=none→quarantine→reject progression, third-party senders, BIMI readiness, or…
原文语言：英语
Deploy and operate DNSSEC on zones you own or are authorized to manage: key models (KSK/ZSK or CSK), signing algorithms, DS publication at the parent, chain-of-trust validation, key rollover, NSEC/NSEC3, and failure triage. Use when enabling DNSSEC, fixing…
原文语言：英语
Review and harden docker-compose files for privileged mode, host port publishing, secrets, volume mounts, networks, and capability grants. Use when docker-compose.yml security, privileged containers, docker.sock mounts, Compose secrets, host network mode, or…
原文语言：英语
Diagnose and fix Docker Hub pull rate limits in CI: anonymous vs authenticated quotas, shared runner IPs, mirrors, private base caches, and registry migration. Use when CI fails with toomanyrequests, 429, Docker Hub rate limit, docker.io pulls flaky on GitHub…
原文语言：英语
Install, operate, and harden Docker Engine in rootless mode: user namespaces, dockerd-rootless-setuptool, systemd user units, slirp4netns/pasta networking, storage drivers, and known limitations vs rootful Docker. Use when setting up rootless Docker,…
原文语言：英语
Author and review Dockerfiles for multi-stage builds, non-root runtime, layer caching, and secrets that never land in image layers. Use when Dockerfile, Docker best practices, Docker 最佳实践, container image build, multi-stage build, non-root user,…
原文语言：英语
Creates task-oriented technical documentation with progressive disclosure. Use when writing READMEs, API docs, architecture docs, or markdown documentation. Also use this skill at the END of any completed reverse engineering, penetration testing, CTF, or…
原文语言：多语言混合
Select the most specific installed skill for Word, PDF, slides, spreadsheets, Markdown, research, analysis, writing, reports, and diagrams. Use for DOCX, XLSX, PPTX, PDF, README, changelog, runbook, report, research, 文档, 表格, 幻灯片, 演示文稿, 报告, 研究, 论文, 引用, 流程图, or…
原文语言：英语
Decide when and how to write Python docstrings (PEP 257) and JS/TS JSDoc/TSDoc for public APIs, with templates and anti-patterns. Use when docstring, JSDoc, TSDoc, 文档字符串, API docs comments, typedoc, pydoc, or documenting exported functions/classes/modules.
原文语言：英语
Authorized DOM clobbering awareness: named HTML elements (id/name) shadowing window and document properties, form/collection multi-level clobbering, and client config or sink confusion without a script injection. Use when markup accepts attacker-controlled…
原文语言：英语
Assess and harden HTML download attribute usage, Content-Disposition filenames, content-type sniffing on file responses, and XSS or path risks via user-facing downloads. Use when reviewing <a download>, attachment/inline disposition, filename injection,…
原文语言：英语
Playwright end-to-end testing strategy: critical journeys, stable selectors, fixtures, isolation, and CI discipline. Use when Playwright, e2e tests, end-to-end, browser tests, page object, web-first assertions, or flaky UI suites. Complements…
原文语言：英语
Enable and operate Amazon ECR image vulnerability scanning for owned AWS accounts: basic vs enhanced (Inspector) scan, scan-on-push, registry and repository scan filters, finding triage, and CI/deploy gates on CRITICAL/HIGH. Use when reviewing ECR scan…
原文语言：英语
Authorized Elasticsearch security hardening: xpack.security, HTTP/transport TLS, anonymous access disabled, users/role mapping, no public 9200/9300, and least-privilege snapshot/restore. Use when reviewing elasticsearch.yml, Elastic Cloud / ECK / self-managed…
原文语言：英语
Authorized Electron desktop app security review: nodeIntegration, contextIsolation, sandbox, preload bridges, shell.openExternal, navigation and webview risks, and renderer XSS to OS/code execution. Use when assessing Electron, Spectron-era, or…
原文语言：英语
Defend mail-sending paths against CRLF / email header injection by rejecting control characters, using structured mail APIs, and never concatenating untrusted data into raw SMTP or MIME headers. Use when hardening Subject, To, From, Cc, Bcc, Reply-To, or…
原文语言：英语
Design and review rate limits for email one-time passwords (OTP): send/resend cooldowns, per-destination and dual keys, verify attempt budgets, enumeration-safe UX, and mail-provider cost controls. Use when email OTP throttle, resend cooldown, magic-code send…
原文语言：英语
Use for authorized email security review including phishing analysis, header authentication (SPF/DKIM/DMARC), BEC patterns, and mailbox token abuse research.
When the user wants to create or optimize an email sequence, drip campaign, automated email flow, or lifecycle email program. Also use when the user mentions "email sequence," "drip campaign," "nurture sequence," "onboarding emails," "welcome sequence,"…
原文语言：英语
Twelve-factor style application config: store config in the environment, strict separation of code from config, typed/validated env loading, and no secrets baked into images or git. Use when env config, 12-factor, 环境变量配置, twelve-factor config, dotenv, config…
原文语言：英语
Design, review, and troubleshoot Envoy external authorization (ext_authz): HTTP/network filter placement, gRPC vs HTTP auth services, CheckRequest/ CheckResponse, failure_mode_allow, header mutation, and route-level overrides. Use when hardening or assessing…
原文语言：英语
Write and review user-facing error messages that are actionable, free of secrets, and paired with stable machine codes. Use when error messages, 错误文案, exception messages for users, API error payloads, toast/alert copy, form validation text, or when UX/review…
原文语言：英语
Install, configure, and triage eslint-plugin-security for JavaScript and TypeScript: detectObjectInjection, detect-eval-with-expression, child_process and fs path patterns, legacy vs flat ESLint config, CI gates, and justified suppressions. Use when…
原文语言：英语
Defense evasion: AMSI bypass, ETW patch, obfuscation, packing, code signing bypass. Trigger: evade, obfuscate, pack, amsi, etw, bypass defender, hide, encode payload, crypt.
原文语言：英语
Design experiments and studies BEFORE data is collected — choosing a design, randomizing, blocking, and laying out treatment combinations so results are interpretable. Use whenever someone is planning a study, asks how to assign subjects/samples to groups,…
原文语言：英语
Exploit development: shellcode generation, ROP chain building, format string attacks, buffer overflow patterns. Trigger: exploit dev, shellcode, rop, buffer overflow, format string, use-after-free, heap spray, ret2libc.
原文语言：英语
Secure Express middleware stacks: helmet, CORS, rate limits, body limits, trust proxy, auth guards, and correct middleware order. Use when Express security, helmet, express-rate-limit, cors package, cookie/session middleware, JWT auth middleware, or hardening…
原文语言：英语
External Secrets Operator (ESO) for Kubernetes: SecretStore and ClusterSecretStore design, ExternalSecret sync, and provider IAM for AWS Secrets Manager, HashiCorp Vault, and GCP Secret Manager. Use when wiring or reviewing ESO CRDs, refresh intervals,…
原文语言：英语
Secure FastAPI apps: Depends-based auth, CORS/TrustedHost, HTTPS, security headers, Pydantic boundaries, JWT/OAuth2 schemes, and safe middleware order. Use when FastAPI security, FastAPI CORS, Depends auth, OAuth2PasswordBearer, TrustedHostMiddleware,…
原文语言：英语
Design and review feature flags, kill switches, targeting, rollout, and flag cleanup. Use when feature flags, feature toggles, kill switch, gradual rollout, percentage rollout, targeting rules, LaunchDarkly, Unleash, Flagsmith, OpenFeature, 功能开关, 灰度, 熔断开关, or…
原文语言：英语
Assess and implement Fetch Metadata request headers (Sec-Fetch-Site, Sec-Fetch-Mode, Sec-Fetch-Dest, Sec-Fetch-User) for CSRF mitigation and Resource Isolation Policy (RIP). Use when hardening or auditing same-origin vs same-site vs cross-site browser request…
原文语言：英语
Design and authorized review of FIDO2/WebAuthn enterprise attestation (EA): conveyance preference enterprise, vendor/platform EA enrollment of the RP, unique device-identifying attStmt chains, MDM-aligned allowlists, and privacy- safe storage. Use when…
原文语言：英语
Authorized methodology to detect and mitigate polyglot file uploads — one byte stream valid as multiple formats (image+HTML/JS, PDF+ZIP, SVG/XML dual parse, Office ZIP+XML). Use when assessing dual interpretation, stored XSS via polyglots, or building…
原文语言：英语
Design and review secure storage for user file uploads: random object keys, cookie-less separate domain, content-type/magic validation, antivirus hooks, size quotas, and non-executable permissions. Use when implementing or auditing upload landing zones,…
原文语言：英语
Search Tencent SkillHub for existing skills by Chinese or English task intent, category, target object, and action, then rank a short list for review. Use when the user asks to find, compare, recommend, or selectively install a SkillHub skill, or wants to…
原文语言：英语
Authorized firewall and security-group rule review methodology: inventory, least privilege, shadow/redundant rules, egress control, change hygiene, and evidence-based findings. Use when reviewing iptables/nftables, cloud SGs/NSGs, host firewalls, or network…
原文语言：英语
Firmware analysis basics for owned devices, vendor-supplied images, and CTF firmware blobs: identification, binwalk unpack, filesystem extract (squashfs, jffs2, ubifs, initramfs), credential/config triage, and hand-off to binary RE. Use when analyzing…
原文语言：英语
Historical and residual assessment of Adobe Flash crossdomain.xml and Microsoft Silverlight clientaccesspolicy.xml: over-permissive allow-access-from wildcards, socket policies, domain attributes, and leftover player surfaces. Use when legacy…
原文语言：英语
Authorized Flutter app security basics: flutter_secure_storage and secret placement, MethodChannel/EventChannel trust boundaries, Dart obfuscation limits, deep-link / App Links validation, and certificate-pinning packages. Use when reviewing or hardening…
原文语言：英语