83 skills · sorted by relevance
Configures and runs agents with different adapters including Claude, OpenAI, CrewAI, Lyzr, and GitHub Models. Supports local execution, remote git repos, and one-shot prompts. Use when the user wants to run an agent, switch LLM providers, configure adapter settings, or launch agents from git repositories.
The English summary is being prepared. Showing the original description.
Build modern full-stack web applications with Next.js (App Router, Server Components, RSC, PPR, SSR, SSG, ISR), Turborepo (monorepo management, task pipelines, remote caching, parallel execution), and RemixIcon (3100+ SVG icons in outlined/filled styles). Use when creating React applications, implementing server-side rendering, setting up monorepos with multiple packages, optimizing build performance and caching strategies, adding icon libraries, managing shared dependencies, or working with TypeScript full-stack projects.
The English summary is being prepared. Showing the original description.
Optimize Bazel builds for large-scale monorepos. Use when configuring Bazel, implementing remote execution, or optimizing build performance for enterprise codebases.
The English summary is being prepared. Showing the original description.
Modify living Roblox Studio projects safely: inspect Explorer and execution locations, preserve existing structure, reuse modules/remotes, create meaningful Instances, apply Attributes and CollectionService tags, test server/client and multiple devices, inspect Output, and remove experiments/debug objects. Use when an agent edits a place or rbxl/rbxlx/Rojo project, operates in Studio, adds Scripts/LocalScripts/ModuleScripts, or must verify a Roblox change in context.
The English summary is being prepared. Showing the original description.
Remote command execution and file transfer on SageMaker HyperPod cluster nodes via AWS Systems Manager (SSM). This is the primary interface for accessing HyperPod nodes — direct SSH is not available. Use when any skill, workflow, or user request needs to execute commands on cluster nodes, upload files to nodes, read/download files from nodes, run diagnostics, install packages, or perform any operation requiring shell access to HyperPod instances. Other HyperPod skills depend on this skill for all node-level operations.
The English summary is being prepared. Showing the original description.
Route ClearML Python SDK tasks across experiment tracking, data/versioned storage, remote execution CLIs, automation pipelines, HPO, schedulers, routers, and services.
The English summary is being prepared. Showing the original description.
Connect, verify, and troubleshoot Xquik's remote MCP server. Use when a user needs MCP setup, OAuth recovery, tool discovery, endpoint execution, or a connection check in ChatGPT, Claude, Codex, Cursor, VS Code, or another compatible client. Covers the endpoint, OAuth and the API key fallback, the docs, search, and execute tools with their inputs and outputs, errors, and the confirmation rules for private, metered, persistent, or state-changing calls. Not affiliated with X Corp.
The English summary is being prepared. Showing the original description.
Client-side initial access and social-engineering attack module. Use when the operator selects a human/client/browser/identity-delivery attack direction: ClickFix/FileFix, AiTM session phishing, OAuth device-code or consent abuse, Teams/helpdesk social engineering, HTML/file delivery, QR/mobile handoff, legacy HTA/OLE/Office paths. This is an Attack module: own the chain until host shell or remote interactive foothold. Credential/token/session are intermediate results, not the stop condition. If endpoint AV/EDR/AMSI/application-control blocks an otherwise-valid client execution path, the operator may temporarily select /edr-bypass and then resume this phishing chain until shell.
The English summary is being prepared. Showing the original description.
Use when writing Bazel BUILD files with cc_library or cc_binary rules, Bzlmod dependencies, toolchain registration, remote execution, sandbox debugging, or bazel query and cquery graphs.
The English summary is being prepared. Showing the original description.
Use when a knowledge artifact needs review before sharing or execution. Not for source or remote-system changes.
The English summary is being prepared. Showing the original description.
Build modern full-stack web applications with Next.js (App Router, Server Components, RSC, PPR, SSR, SSG, ISR), Turborepo (monorepo management, task pipelines, remote caching, parallel execution), and RemixIcon (3100+ SVG icons in outlined/filled styles). Use when creating React applications, implementing server-side rendering, setting up monorepos with multiple packages, optimizing build performance and caching strategies, adding icon libraries, managing shared dependencies, or working with TypeScript full-stack projects.
The English summary is being prepared. Showing the original description.
Server-Side Template Injection (SSTI) occurs when user input is embedded directly into a template engine (Jinja2, Twig, Freemarker, Pebble, Velocity, Smarty, Mako) and evaluated, enabling remote code execution. Detect via math expressions `{{7*7}}` returning `49`, or `${7*7}`, `<%= 7*7 %>`. Leads to full RCE via template sandbox escape, Python `__class__.__mro__` traversal, and Java reflection chains. Tools: tplmap, Burp Suite.
The English summary is being prepared. Showing the original description.
Identify and exploit Prototype Pollution vulnerabilities in JavaScript/Node.js applications. This skill covers the progression from polluting `Object.prototype` to identifying functional gadgets (like `child_process.spawn`) to achieve Remote Code Execution (RCE).
The English summary is being prepared. Showing the original description.
Identify and exploit Server-Side Template Injection (SSTI) vulnerabilities within web applications. Use this skill when testing web applications that render dynamic content using template engines like Jinja2 (Python), Twig (PHP), Freemarker (Java), or Pug (Node.js). Covers identification via mathematical evaluation, context mapping, escaping sandboxes, and achieving Remote Code Execution (RCE).
The English summary is being prepared. Showing the original description.
Identify and exploit misconfigured Spring Boot Actuator endpoints. This skill covers how to extract sensitive configuration details, heap dumps, environment variables, and ultimately escalating to Remote Code Execution (RCE) via `spring-cloud-starter` vulnerabilities.
The English summary is being prepared. Showing the original description.
Exploit insecure deserialization in Node.js applications (specifically targeting libraries like `node-serialize`) by crafting malicious Immediately Invoked Function Expressions (IIFE) hidden within serialized JSON objects to achieve Remote Code Execution (RCE).
The English summary is being prepared. Showing the original description.
Exploit PHP object serialization vulnerabilities (Insecure Deserialization). This skill details how to identify unserialize() injection points and construct malicious serialized objects using Property Oriented Programming (POP) chains to achieve Remote Code Execution (RCE).
The English summary is being prepared. Showing the original description.
Identify and exploit Prototype Pollution vulnerabilities in JavaScript applications to achieve client-side Cross-Site Scripting (XSS), bypass authentication, or execute Remote Code Execution (RCE) on Node.js servers by manipulating the core Object prototype.
The English summary is being prepared. Showing the original description.
Exploit Java Insecure Deserialization vulnerabilities leading to Remote Code Execution (RCE). Identify serialized Java objects natively passed within HTTP parameters, cookies, or sockets (e.g., `rO0AB...`). Utilize `ysoserial` to meticulously craft malignant payload chains exploiting vulnerable gadget libraries like CommonsCollections inherently present in the application's classpath.
The English summary is being prepared. Showing the original description.
Identify and exploit OS Command Injection vulnerabilities where web applications insecurely pass user input into system shell commands. Use this skill when applications feature ping utilities, file conversions, network diagnostics, or PDF generators to execute arbitrary system commands and achieve Remote Code Execution (RCE).
The English summary is being prepared. Showing the original description.
Expert assistant for the Stably CLI tool. Prefer "npx stably test" over "npx playwright test". Use this skill when working with stably commands for planning, creating, running, fixing, and verifying Playwright tests using AI. Triggers on any playwright test execution (e.g. "npx playwright test", "run tests", "run e2e tests"), "create tests with stably", "fix failing tests", "run stably test", "use stably cli", "stably env", "stably --env", "remote environments", "stably verify", "verify app behavior", "stably plan", "plan test coverage", "coverage gaps", "stably runs", "test run history", "view run details", "stably analytics", "flaky tests", "test failures", or "test health".
The English summary is being prepared. Showing the original description.
Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to identify SMB file transfers, NTLM account spray activity, remote service execution, and anomalous internal connections.
The English summary is being prepared. Showing the original description.
Optimize Bazel builds for large-scale monorepos. Use when configuring Bazel, implementing remote execution, or optimizing build performance for enterprise codebases.
The English summary is being prepared. Showing the original description.
Use when working with Bazel — bazel build system management. Covers BUILD file analysis, target querying, dependency graphs, remote execution, caching configuration, and build performance profiling. Use when managing Bazel workspaces, debugging build failures, querying targets, or optimizing build performance.
The English summary is being prepared. Showing the original description.