35 skills · sorted by relevance
Review iframe and frame titles so screen reader users can identify embedded content before entering it. Find missing or empty title attributes, add meaningful descriptions, and verify the changes with browser accessibility tools or assistive technology.
Generate FrontendIntegration YAML for frontend-forge from a simplified configuration containing one menu and one or more pages. Define resource tables or embedded iframe pages, with the bundled generator expanding menu placements into the required YAML structure.
Audit page loading and defer offscreen images, videos, iframes, and heavy components until needed. Use measurements and page context to identify suitable changes while keeping images needed for the initial view loaded with priority.
Implement Google sign-in for web applications using Google Identity Services. Add sign-in buttons or One Tap, verify ID tokens as proof of identity, configure browser security policies, and handle sessions, sign-out, and account disconnection.
Review HTTP response headers and restrict browser features an application does not need, such as camera, microphone, and location access. Guide Permissions-Policy settings that limit what attackers could use if the site is compromised.
Diagnose image export and download failures in browsers and Electron. Separate image data preparation from file saving, investigate empty files and blocked writes, and choose a suitable fallback save method.
Find resources loaded over unencrypted HTTP within HTTPS pages, a problem called mixed content. Review resource URLs and security headers, then guide HTTPS replacements and automatic request upgrades to address blocked or insecure resources.
Guide web integrations for Zoom Contact Center, including chat and video embeds. Covers engagement events, app context, and Smart Embed messaging between a page and its embedded frame, with integration checks and troubleshooting references.
Code Apps などのブラウザ アプリで、Azure AI Speech のストリーミング文字起こしと録音を実装する。ブラウザから Speech へ WebSocket で直結し、短期トークンは Managed Identity の Function からカスタム コネクタ経由で受け取る。Code Apps の CSP・iframe・メインスレッドの制約に合わせた音声経路（同一オリジン AudioWorklet、Push ストリーム、Worker タイマー無効）と、端末・ホスト再現・実機の 3 段階の検証を提供する。
The English summary is being prepared. Showing the original description.
Copilot Studio の「全く新しいアーキテクチャ」（cliagent テンプレート）を開発標準の第一候補として構築・公開・連携する。Bot 作成、Instructions/モデル/メモリ、フラット Python スキル、アイコン、公開に加え、ブラウザで観測した private API による承認付き初回ツール・接続参照追加、Code Apps iframe、Agent flows を扱う。
The English summary is being prepared. Showing the original description.
Power Apps Code Apps（コードファースト）の初期化・Dataverse 接続・UI 設計・開発・デプロイ。TypeScript + React + Tailwind CSS で開発する。Copilot Studio v2 Web app iframe、Agent flows 非同期連携、CSP 構成・メール送信パターンも含む。
The English summary is being prepared. Showing the original description.
Identify and exploit Clickjacking (UI Redressing) vulnerabilities where a malicious website iframes a target application, tricking victims into performing unintended actions (e.g., transferring funds, deleting accounts, or granting permissions) via hidden layers.
The English summary is being prepared. Showing the original description.
計画・差分レビュー・E2E計画・E2E結果を 1 つのブラウザページ（タブ切替）に統合表示する review-hub の操作手順。agent-review-kit のページを iframe で束ね、タブごとの承認ボタン（計画承認・E2E実行承認・PR作成承認）を wait-approval で受け取る。ステータスバー（フェーズ進行・作業メモ）と中断ボタン、セッション再開手順（status / resume）も定義する。計画→実装→PR のように承認ゲートを挟むフロー系スキルから参照される。Use when a skill needs to show plans, diffs, or E2E results in one tabbed browser page, wait for a browser-side approval gate, or resume an interrupted review session.
The English summary is being prepared. Showing the original description.
Review cross-origin isolation, a browser security mode required by features such as SharedArrayBuffer. Check response headers and external resources, identify integrations that could break, and verify that isolation actually works in the browser.
Review links and external resources for domains that ad blockers commonly block. Find navigation and loading failures, test behavior with uBlock Origin, and suggest direct links, self-hosted scripts, or server-side forwarding where appropriate.
Build web applications from a bundled Express, Vite, React, Tailwind CSS, and Drizzle ORM template. Follow a schema-first workflow to create pages, backend APIs, and connected forms, with guidance for styling, testing, and deployment.
为 iPolloWork 新插件或插件工作区复用 UI 组件、颜色、字体及交互规范。按 Figma 成熟状态和代码清单优先采用已确认组件，区分宿主 React 与独立 HTML/iframe 的接入方式；适用于插件表单、导航、浮层、反馈、状态和进度设计及实现，不改变用户作品的视觉风格。
The English summary is being prepared. Showing the original description.
Hunt Clickjacking — missing X-Frame-Options / CSP frame-ancestors lets an attacker embed the target page in an invisible iframe and trick victims into clicking buttons they cannot see (UI redressing). Targets: login flows, money transfers, account settings, OAuth confirmation pages. Confirm by fetching the page, then PROVE it frames in a real browser and a sensitive state-changing action survives the cross-site context (SameSite cookies / framebusting JS can defeat it) — header-absence alone is not a finding.
The English summary is being prepared. Showing the original description.
Comprehensive Content Security Policy audit for MCP Apps in sandboxed iframes. Discovers all network origins, traces them to source, and generates CSP configuration for registerAppResource.
The English summary is being prepared. Showing the original description.
Configure Vite with vite-plugin-singlefile for mandatory single-file HTML bundling of MCP Apps. All assets (JS, CSS, images, fonts) must be inlined into a single HTML file for sandboxed iframe compatibility.
The English summary is being prepared. Showing the original description.
Use when building, modifying, or reviewing a Stripe App — or when the user describes something that implies one (e.g. "add a panel to the customer page", "customize my Stripe Dashboard", "react to Stripe events from my app", "connect my service to Stripe without sharing API keys"). Covers the full app development workflow (scaffold, preview, upload, versioning), UI extension architecture (sandboxed iframe, Stripe UI toolkit, viewports), extension types (UI extensions, backend-only, extension interfaces, embedded apps), authentication (platform keys, OAuth, restricted API keys), stripe-app.yaml manifest setup (permissions, viewports, CSP), webhook configuration for apps, Secret Store API, `fetchStripeSignature` auth, and marketplace publishing, plus submitting one agentic feedback report after a build. Use when the user mentions Stripe Apps, UI extensions, @stripe/ui-extension-sdk, @stripe/extensibility-sdk, script extensions, stripe-app.yaml, Dashboard extensions, or customizing the Stripe Dashboard.
The English summary is being prepared. Showing the original description.
N개 brand experiment를 한 화면에서 비교하는 gallery index.html을 생성. 각 카드는 brand name, wow rating, multi-turn refinement deltas, iframe scaled preview, standalone link 포함. '결과물 한 번에 보여줘', '갤러리 만들어', '5개 비교 뷰', 'experiment 결과 정리' 류 트리거. omd:harness가 N개 brand batch 작업 끝낸 직후 자동 호출되거나 사용자가 명시적으로 호출.
The English summary is being prepared. Showing the original description.
Use when writing Playwright tests, fixing flaky tests, debugging failures, implementing Page Object Model, configuring CI/CD, optimizing performance, mocking APIs, handling authentication or OAuth, testing accessibility (axe-core), file uploads/downloads, date/time mocking, WebSockets, geolocation, permissions, multi-tab/popup flows, mobile/responsive layouts, touch gestures, GraphQL, error handling, offline mode, multi-user collaboration, third-party services (payments, email verification), console error monitoring, global setup/teardown, test annotations (skip, fixme, slow), test tags (@smoke, @fast, @critical, filtering with --grep), project dependencies, security testing (XSS, CSRF, auth), performance budgets (Web Vitals, Lighthouse), iframes, component testing, canvas/WebGL, service workers/PWA, test coverage, i18n/localization, Electron apps, or browser extension testing. Covers E2E, component, API, visual, accessibility, security, Electron, and extension testing.
The English summary is being prepared. Showing the original description.
JeecgBoot 门户（Portal）全生命周期管理——通过 API 自动创建、删除、配置门户，管理门户内的 14 种组件（轮播图、新闻动态、系统公告、流程中心、应用快捷入口、协同待办、我的计划、知识库、文本、iframe 等），动态查询数据源并填充组件内容，支持 Web 和 App 双端布局。 只要用户意图涉及「门户」就必须使用本技能，包括但不限于： 创建或生成门户（"做一个门户"、"创建门户"、"新增门户"、"生成一个包含轮播图和新闻的门户"、"做一个全组件门户"）、 删除门户（"删除门户"、"移除XX门户"）、 修改门户类型（"设为个人工作台"、"设为主门户"、"设为普通门户"、"改门户类型"）、 管理门户组件（"添加组件"、"加个轮播图"、"加个系统公告"、"删除组件"、"去掉流程中心"）、 修改组件配置（"修改轮播图配置"、"改标题颜色"、"把新闻动态宽度改为占满一行"、"修改门户里的XX"）、 查询门户（"查看门户列表"、"有哪些门户"）。 即使用户没有明确说"门户"二字，只要描述的是 JeecgBoot 系统首页定制、工作台组件配置、portal 相关操作，也应触发此技能。 关键词触发：门户、portal、工作台、首页定制、门户组件、portalDesign。
The English summary is being prepared. Showing the original description.