666 skills · sorted by relevance
Operate KubeSphere DevOps pipelines within a permitted project using KubeSphere APIs and OAuth authentication. Create pipelines, run selected branches, monitor execution, and retrieve logs or build artifacts without requiring cluster administrator access or direct Jenkins access.
Connect supported work apps through browser consent without sharing passwords with the agent. The skill checks available connection methods, provides a single-use authorization link when appropriate, and guides personal Slack account linking.
Find Linear issues by text, assignee, or status, and read their details and comments. Prepare new issues, comments, and status changes for user approval, then return identifiers and links so results can be checked.
Test Omnigent’s native Antigravity integration with a live local server and the real agy CLI. Verify messages traveling between the web interface and terminal, mirrored replies, permission requests, interruption, session resumption, and process cleanup.
Query, create, update, and delete Tencent Cloud resources through tccli, its command-line tool. The skill checks API documentation before calls, supports browser-based OAuth authorization, and helps interpret results and troubleshoot errors during cloud automation.
Manage Mixpanel Headless login and connection settings, check credentials, and switch accounts, projects, or workspaces. Save named combinations of these settings as targets so an agent can select the intended connection together.
Guide a bug bounty investigation from scope checks and asset discovery to vulnerability testing, impact validation, and report writing. Covers web applications, source code, and AI features, with an emphasis on reproducible evidence of real harm.
Investigate subdomain takeover risks caused by DNS records pointing to abandoned services. The skill covers discovery, provider error checks, resource claimability, and evidence collection, then examines potential effects on login flows, shared cookies, and trusted content.
Review SAML single sign-on, where services exchange signed identity information, for signature and identity handling flaws. The skill guides testing and validation to determine whether altered assertions can change accounts, roles, or access decisions.
Guide bug bounty work from checking authorized scope and discovering assets to testing web and AI features. Validate practical impact, investigate related weaknesses, and organize reproducible evidence into a vulnerability report.
Guide bug bounty work from asset discovery to validation and reporting, while resolving local locations of security tools, wordlists, and cloned projects. It covers web and AI security testing with an emphasis on demonstrated impact.
Compare login approaches and authentication providers, then use implementation examples and security checklists to plan or review an app’s login flow. Covers sessions, tokens, external login providers, passkeys, and common implementation mistakes.
Prepare and publish an app built from an existing reference, covering release checks, production services, domain and email records, payments, sign-in, monitoring, and mobile distribution. It records results and requires user approval before going live.
Guide systematic security testing of Web applications and APIs across input handling, authentication, business rules, protocols, files, and deployment settings. Use topic-specific references and playbooks, or step-by-step testing guides, to choose checks suited to the target.
Connect external services and databases to Claude Code plugins through MCP, a protocol for exposing tools to agents. The skill guides server configuration, connection choices, authentication, tool permissions, and testing so plugins can use those services.
JWT and OAuth token attack playbook. Use when validating token trust, signing algorithms, key handling, claim abuse, bearer flows, and OAuth account-binding weaknesses.
The English summary is being prepared. Showing the original description.
Emulated Sign in with Apple / Apple OIDC for local development and testing. Use when the user needs to test Apple sign-in locally, emulate Apple OIDC discovery, handle Apple token exchange, configure Apple OAuth clients, or work with Apple userinfo without hitting real Apple APIs. Triggers include "Apple OAuth", "emulate Apple", "mock Apple login", "test Apple sign-in", "Sign in with Apple", "Apple OIDC", "local Apple auth", or any task requiring a local Apple OAuth/OIDC provider.
The English summary is being prepared. Showing the original description.
Emulated Google OAuth 2.0, OpenID Connect, Gmail, Calendar, and Drive for local development and testing. Use when the user needs to test Google sign-in locally, emulate OIDC discovery, handle Google token exchange, configure Google OAuth clients, work with Gmail messages/drafts/threads/labels, manage Calendar events, upload or list Drive files, or work with Google userinfo without hitting real Google APIs. Triggers include "Google OAuth", "emulate Google", "mock Google login", "test Google sign-in", "OIDC emulator", "Google OIDC", "Gmail API", "Google Calendar", "Google Drive", "local Google auth", or any task requiring a local Google API.
The English summary is being prepared. Showing the original description.
Generate a co-author / collaborator handoff brief for a multi-author, multi-machine project — summarizing what changed since the last brief (git delta), the current state of each artifact (manuscript, analysis, slides), open questions, how to reproduce locally, and any restricted-data access steps. Use when user says "coauthor brief", "handoff brief", "bring my coauthor up to speed", "what changed since last week", "onboard a collaborator", "write a handoff for [name]", or before sending a co-author the repo. NOT a commit or a checkpoint — it is the cross-machine, cross-person summary `meta-governance.md` only partially covers.
The English summary is being prepared. Showing the original description.
Fix OAuth PKCE "Session not found" or "No code verifier" errors in SPAs after redirect from external auth server. Use when: (1) OAuth callback fails with session/verifier not found despite flow starting correctly, (2) PKCE code_verifier stored in sessionStorage is missing after redirect back from auth server, (3) Error only happens in production or cross-origin redirects, not in local dev. Root cause: sessionStorage is lost when the browser opens a new tab, changes browsing context, or certain browsers clear it during cross-origin navigation. Fix: use localStorage instead (clean up after exchange).
The English summary is being prepared. Showing the original description.
Implement OAuth 2.0 authentication flows including authorization code with PKCE, client credentials, and device code for secure API integration. Use when the user requests oauth 2 0 setup or provides relevant inputs for this workflow.
The English summary is being prepared. Showing the original description.
When the user wants to set up authentication and authorization for a web application. Use when the user mentions "auth," "login," "OAuth," "SSO," "single sign-on," "role-based access," "RBAC," "permissions," "user roles," "access control," "authentication," or "authorization." Covers OAuth 2.0 provider integration, session management, and role/permission architecture. For JWT-specific tasks, see jwt-handler. For security review, see security-audit.
The English summary is being prepared. Showing the original description.
Security patterns for MCP servers including OAuth 2.0, rate limiting, input validation, and audit loggingUse when "mcp security, mcp authentication, mcp oauth, mcp rate limit, secure mcp server, mcp, security, oauth, authentication, rate-limiting, validation" mentioned.
The English summary is being prepared. Showing the original description.
Authentication and authorization expert for OAuth, sessions, JWT, MFA, and identity securityUse when "authentication flow, login system, oauth integration, jwt tokens, session management, password hashing, mfa setup, refresh tokens, social login, role-based access, authentication, authorization, oauth, oidc, jwt, sessions, mfa, passkeys, nextauth, supabase-auth, clerk" mentioned.
The English summary is being prepared. Showing the original description.