224 skills · sorted by relevance
Organize Node.js, Express, and TypeScript APIs into layers with clear responsibilities. This guide covers request handling, business logic, database access, input validation, error tracking, configuration, and testing to support consistent implementation and refactoring across services.
Build, review, and refactor ASP.NET Core web applications using official guidance. Helps choose application structure, implement pages and APIs, configure authentication and services, and plan testing, performance improvements, deployment, and version upgrades.
Configure WebSocket connections for iii workers, including authentication and role-based access control. Define which functions workers may call or register, add invocation auditing, and isolate tenant namespaces through listener settings and authentication results.
Build Next.js applications with App Router, the app directory routing system. Get guidance on server rendering, data fetching, caching, API endpoints, and deployment settings, including loading states and image optimization for responsive page experiences.
Build PHP 8.3+ applications with Laravel or Symfony, including typed models, services, APIs, and tests. Use static analysis, which checks code without running it, alongside automated tests to verify the implementation.
Build Next.js 14+ applications with App Router, server-rendered components, and form actions. Produces routes, page layouts, data fetching, loading and error states, and SEO metadata, while supporting performance optimization and deployment preparation.
Build and maintain TypeScript MCP servers that connect AI to tools, plus interactive MCP Apps, using mcp-use. The skill guides implementation, authentication, migration, and verification based on the package version and types installed in the project.
Build and maintain TypeScript MCP servers and MCP Apps with mcp-use, giving AI assistants tools and interactive views. Guides implementation, authentication, debugging, migration, review, and verification against the package version installed in the project.
Build and maintain TypeScript MCP servers that connect AI to tools, plus interactive MCP Apps, using mcp-use. The skill guides implementation, authentication, migration, and verification based on the package version and types installed in the project.
Build Node.js, Express, and TypeScript APIs with consistent structure. Separate request handling, business logic, and database access, while following guidance for input validation, error tracking, configuration, and tests when adding features or refactoring existing services.
Compare Bifrost HTTP API code with OpenAPI, its API specification, to find missing routes and mismatched methods, authentication, parameters, and responses. Get an audit report with code references and recommended fixes.
Add a dashboard or admin panel across the server and interface. This skill follows existing project patterns to build API routes, service logic, components, registration, and styles, then connects request handlers so the new endpoint is reachable.
Nuxt full-stack Vue framework with SSR, auto-imports, and file-based routing. Use when working with Nuxt apps, server routes, useFetch, middleware, or hybrid rendering.
The English summary is being prepared. Showing the original description.
Guides creation and modification of ASP.NET Core Web API endpoints with correct HTTP semantics, OpenAPI metadata, and error handling. USE FOR: adding new API endpoints (controllers or minimal APIs), wiring up OpenAPI/Swagger, creating .http test files, setting up global error handling middleware. DO NOT USE FOR: general C# coding style, EF Core data access or query optimization (use optimizing-ef-core-queries), frontend/Blazor work, gRPC services, or SignalR hubs.
The English summary is being prepared. Showing the original description.
Discover a single-page-app's hidden backend API from its public JS bundle, then test that API for broken access control / missing authentication. One of the highest-yield web plays in modern recon — SPAs ship their entire backend route map to the browser, and the API behind them is frequently missing the auth middleware the login page implies. Built from an authorized engagement where this play found an unauthenticated financial API that an ASM scan reporting hundreds of "Criticals" completely missed. Use whenever a target serves a JS-heavy SPA (React/Vue/Angular/Next), an "app"/"console"/"dashboard"/"portal" subdomain, or any `*api*` host shows up in recon. Leaked build artifacts (source maps / .env / .git / asset-manifest) are owned by hunt-source-leak; API version-inventory and behavioral diffing by hunt-shadow-api; this skill owns mapping a live SPA's backend routes from its JS bundle and testing them for broken access control / missing auth.
The English summary is being prepared. Showing the original description.
Hunt Next.js specific vulnerabilities — Server Actions arbitrary function execution, Middleware auth bypass via static asset paths, ISR cache poisoning, Image Optimization SSRF (/_next/image), RSC payload leakage, getServerSideProps injection, source map exposure, debug endpoint leakage. Use when target runs Next.js 13/14/15 or any React SSR framework.
The English summary is being prepared. Showing the original description.
Hunt MFA / 2FA bypass — 7 distinct patterns. (1) MFA not enforced on sensitive endpoints (password change, email change accept without MFA challenge), (2) MFA-step skip via direct navigation to post-login URL, (3) MFA-token replay (same code accepted twice), (4) brute-force the 6-digit OTP without rate limit (10^6 attempts at server speed), (5) race condition on OTP validation, (6) recovery-code dump via /api/me, (7) backup factor downgrade (SMS factor with no rate limit). Plus the chain: cookie theft + password oracle + no step-up = ATO without MFA challenge. Detection: trace auth flow in Burp, find every state transition, check if MFA is middleware-gated vs per-endpoint, check OTP entropy and rate limit on OTP-validate. Validate: attacker session reaching post-MFA state. Use when hunting auth bypass, MFA flows, chaining primitives toward ATO.
The English summary is being prepared. Showing the original description.
Hunting skill for csrf vulnerabilities. Built from 15 public bug bounty reports including modern variants — SameSite=Lax sibling-subdomain bypass (Argo CD CVE-2024-22424), GraphQL mutations-via-GET (GitLab $3,370), framework-wide CSRF middleware disabled (Stripe Dashboard $5,000), path-traversal CSRF-token bypass (GitHub Enterprise CVE-2022-23732 $10k), Origin-omission bypass (TikTok $2,500), OAuth-state null-byte (Streamlabs), WebSocket CSRF / CSWSH (Coda), default-SameSite email-change → ATO (YoYo Games $400), social-account-link CSRF (HackerOne), JSON-CSRF via text/plain on email-change (TikTok $500). Use when hunting modern CSRF — heavy emphasis on chain-to-ATO patterns.
The English summary is being prepared. Showing the original description.
Use this skill when adding NeMo Relay typed wrappers, domain types, or provider codecs while preserving JSON middleware semantics and caller-visible behavior.
The English summary is being prepared. Showing the original description.
Use this skill when an application owns tool or LLM/provider call sites and needs to wrap them with NeMo Relay scopes and managed execution APIs for lifecycle events, middleware, or guardrails.
The English summary is being prepared. Showing the original description.
Structured logging extensions for Golang using samber/slog-**** packages — multi-handler pipelines (slog-multi), log sampling (slog-sampling), attribute formatting (slog-formatter), HTTP middleware (slog-fiber, slog-gin, slog-chi, slog-echo), and backend routing (slog-datadog, slog-sentry, slog-loki, slog-syslog, slog-logstash, slog-graylog...). Apply when using or adopting slog, or when the codebase already imports any github.com/samber/slog-* package.
The English summary is being prepared. Showing the original description.
Idiomatic Golang error handling — creation, wrapping with %w, errors.Is/As, errors.Join, custom error types, sentinel errors, panic/recover, the single handling rule, structured logging with slog, HTTP request logging middleware, and samber/oops for production errors. Built to make logs usable at scale with log aggregation 3rd-party tools. Apply when creating, wrapping, inspecting, or logging errors in Go code. For samber/oops specifics → See `samber/cc-skills-golang@golang-samber-oops` skill; for slog handler ecosystem → See `samber/cc-skills-golang@golang-samber-slog` skill.
The English summary is being prepared. Showing the original description.
Create Zustand stores with TypeScript, subscribeWithSelector middleware, and proper state/action separation. Use when building React state management, creating global stores, or implementing reactive state patterns with Zustand.
The English summary is being prepared. Showing the original description.
Build, debug, or review Cloudflare Workers invoked by the Forward action in Gateway HTTP policies, including the GatewayMiddleware entrypoint, Gateway types, context, and continuation.
The English summary is being prepared. Showing the original description.