Results for “misc”

CTF杂项知识库 — Python Jail逃逸、Bash Jail逃逸、编码链识别与解码、QR/音频/图像隐写、游戏VM逆向、CTFd API导航、Linux提权

The English summary is being prepared. Showing the original description.

Domain routing and boundary guidance for authorized cloud security testing, including IAM misconfiguration, exposed storage, metadata services, and serverless injection. Use when a task belongs to the cloud testing domain and needs scope, evidence, pivot, or exit criteria.

The English summary is being prepared. Showing the original description.

Create and secure S3 buckets following AWS best practices for access control, encryption, monitoring, and remediation of misconfigurations. Use when the user wants to secure a new bucket, audit an existing bucket, fix a security finding, configure encryption, or enable logging and monitoring. Do NOT use for general S3 data operations, S3 Tables setup, or discovering existing data assets.

The English summary is being prepared. Showing the original description.

Audit access control implementations for security vulnerabilities and misconfigurations. Use when reviewing authentication and authorization. Trigger with 'audit access control', 'check permissions', or 'validate authorization'.

The English summary is being prepared. Showing the original description.

Analyze HTTP security headers of web domains to identify vulnerabilities and misconfigurations. Use when you need to audit website security headers, assess header compliance, or get security recommendations for web applications. Trigger with phrases like "analyze security headers", "check HTTP headers", "audit website security headers", or "evaluate CSP and HSTS configuration".

The English summary is being prepared. Showing the original description.

Linux privilege escalation playbook. Use when you have low-privilege shell access and need to escalate to root via SUID/SGID binaries, capabilities, cron abuse, kernel exploits, misconfigurations, or credential harvesting on Linux systems.

The English summary is being prepared. Showing the original description.

Windows local privilege escalation playbook. Use when you have low-privilege shell access on Windows and need to escalate via token abuse, Potato exploits, service misconfigurations, DLL hijacking, UAC bypass, or registry autoruns.

The English summary is being prepared. Showing the original description.

Active Directory ACL abuse playbook. Use when exploiting misconfigured AD permissions including GenericAll, WriteDACL, DCSync rights, shadow credentials, LAPS reading, GPO abuse, and BloodHound-guided attack paths.

The English summary is being prepared. Showing the original description.

AD Certificate Services attack playbook. Use when targeting misconfigured AD CS for privilege escalation via ESC1-ESC13 template abuse, NTLM relay to enrollment, CA officer abuse, and certificate-based persistence.

The English summary is being prepared. Showing the original description.

WooYun business logic vulnerability methodology — 22,132 real cases across 6 domains (authentication bypass, authorization bypass, payment tampering, information disclosure, logic flaws, misconfiguration) and 33 vulnerability classes. Use for ANY security testing, auditing, or code review of web apps, APIs, or business systems — even without explicit "security" keywords. Triggers: penetration testing, security audit, vulnerability, bug bounty, payment security, IDOR, password reset, weak credentials, unauthorized access, race condition, parameter tampering, code review, 渗透测试, 安全审计, 漏洞挖掘, 支付安全, 越权, 逻辑漏洞, 业务安全, SRC, 代码审计. Also triggers on implicit intent: "test this endpoint", "find bugs", "can I bypass this", "帮我测测这个接口", "这个参数能不能改", "帮我找bug".

The English summary is being prepared. Showing the original description.

Imports gene expression count matrices from featureCounts, HTSeq, STAR ReadsPerGene, Salmon/kallisto via tximport or tximeta, RSEM, 10X Genomics MTX/H5, AnnData H5AD, and RDS. Handles silent-miscounting traps (featureCounts -p v2.0.2 API break, STAR strandedness column choice, salmon NumReads-sum without tximport, RSEM non-integer expected_count, GENCODE _PAR_Y suffix, zero-length-transcript TPM divide-by-zero), and encodes the tximport countsFromAbundance decision tree with the "lengthScaledTPM is not TPM" warning. Use when assembling a gene-by-sample count matrix from aligner or quantifier output, importing salmon/kallisto for DESeq2 vs limma-voom, choosing strandedness column for STAR, debugging zero-count panics, or building tx2gene mapping.

The English summary is being prepared. Showing the original description.

Code review and validation for CloudBase projects. After writing code for Web / miniprogram / CloudRun / cloud-function projects, call this skill to check for known pitfalls — auth guard misuse, missing database tables, RLS misconfiguration, storage domain setup, and SDK API misuse. Supports automated lint scripts (regex-based) + LLM semantic review.

The English summary is being prepared. Showing the original description.

This skill should be used when the user asks to "analyze Terraform modules", "scan IaC for security issues", "review Terraform configurations", "check infrastructure code for misconfigurations", or "audit cloud resources".

The English summary is being prepared. Showing the original description.

Design a diagnostic hinge question that reveals whether students understand enough to move on. Use when planning key checkpoints mid-lesson during explicit or direct instruction.

The English summary is being prepared. Showing the original description.

Design deliberately flawed examples that develop error-detection skills and deepen understanding. Use when students make characteristic errors and need practice spotting mistakes.

The English summary is being prepared. Showing the original description.

Verifies UK case-law citations, pinpoint references and quotations against the official public register — The National Archives' Find Case Law — and statutory references against legislation.gov.uk, before a document that cites them is relied on, served or filed. Every check returns a graded verdict: VERIFIED, MISMATCH (the citation resolves to a different case — the classic AI miscitation), NOT ON REGISTER, OUTSIDE COVERAGE (the register cannot answer — absence proves nothing), or UNCHECKABLE (a law-report citation). The grading exists because there are two ways to get this wrong: citing a case that does not exist, and accusing a real case of not existing. Use when asked to check citations, verify a case exists, confirm a quotation is verbatim, check a pinpoint paragraph, audit a draft's authorities, screen a document for hallucinated cases, or check a statutory provision is in force. Not a substitute for reading the judgment: existence is not authority.

The English summary is being prepared. Showing the original description.

用于编码题、pyjail、bash jail、RF/SDR、DNS 异常、Unicode、奇特语言、QR、音频、约束求解、博弈论与沙箱逃逸等跨类或边缘 CTF 题;触发名:ctf-misc

The English summary is being prepared. Showing the original description.

Use for authorized database security assessment covering PostgreSQL/MySQL/MSSQL/Mongo/Redis exposure, authz, UDF/command paths, and misconfiguration review.

The English summary is being prepared. Showing the original description.

Use for authorized assessment of federated identity systems including SAML, OIDC, OAuth2 flows, SSO misconfiguration, and token confusion issues.

The English summary is being prepared. Showing the original description.

Use for authorized cloud, container, and Kubernetes security assessment including metadata SSRF, IAM misconfig, container escape paths, and cluster RBAC review.

The English summary is being prepared. Showing the original description.

Implements miscellaneous functions for interpretation of single-cell RNA-seq data. Methods are provided for assignment of cell cycle phase, detection of highly variable and significantly correlated genes, identification of marker genes, and

The English summary is being prepared. Showing the original description.

Creates a Check for Understanding (CFU) for a math topic or standard: 1–3 targeted formative items whose distractors come from documented student misconceptions, plus a teacher guide routing each likely response to a specific next instructional step. Load BEFORE asking any clarifying question about grade, standard, or topic. This skill is for math; for other subjects, help as you normally would and don't mention the skill to the user. Triggers on asks to create, write, generate, or design a check for understanding, formative check, quick check, or exit ticket for a math concept or standard, and on implicit signals like "I need to see who got it before I move on." Not a quiz, test, or practice set — a CFU is read for what it reveals, not scored, so a numbered quiz or a bare answer key is a different job. Does not create a lesson (k12-lesson-plan-creation, which brings its own exit ticket), tier one (k12-lesson-differentiation), or prepare a teacher to teach one (k12-lesson-prep).

The English summary is being prepared. Showing the original description.

Scan .claude/ directory for security misconfigurations, exposed secrets, unsafe permissions

The English summary is being prepared. Showing the original description.

Train strict project ownership from repo-local docs/ai memory and central LLM Wiki project entities. Use when Codex or Claude Code should initialize a learning question bank, quiz or grade the user, run code tracing or failure drills, record misconceptions, schedule spaced repetition, or generate Markdown/JSON mastery dashboards without replacing llm-wiki or ai-project-memory.

The English summary is being prepared. Showing the original description.