Deep API security assessment beyond surface scanning. Covers the full OWASP API Security Top 10 (2023): Broken Object Level Authorization (BOLA / IDOR), Broken Authentication, Broken Object Property Level Authorization (mass assignment + excessive data exposure), Unrestricted Resource Consumption, Broken Function Level Authorization (BFLA / vertical privilege escalation), Unrestricted Access to Sensitive Business Flows, Server-Side Request Forgery via API parameters, Security Misconfiguration, Improper Inventory Management (shadow/zombie/deprecated endpoints, v1/v2 drift), and Unsafe Consumption of third-party APIs. Works across REST, GraphQL, gRPC, SOAP, and MCP servers. Discovers APIs from OpenAPI/Swagger specs, GraphQL introspection, gRPC reflection, .well-known endpoints, JS bundles, and traffic capture. Uses kiterunner, ffuf, schemathesis, restler-fuzzer, openapi-fuzzer, graphql-cop, clairvoyance, batchql, inql, jwt_tool, postman, mitmproxy, and manual http(action="request", ...) payloads. Every technique includes actual payloads, commands, and verification logic. Chains from /pentester or /codebase when API endpoints are discovered, chains into /web-exploit when classic injection points are found in API parameters, chains into /post-exploit when RCE is achieved, and chains into /ai-redteam when an LLM/AI endpoint is discovered (chat APIs, completion endpoints, RAG search, agentic tool-use, MCP servers).
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
ShulkwiSEC/bb-huge☆ 232026년 7월 11일 업데이트
Consult this skill BEFORE proposing a fix to any CLI gap or schema gap that touches evidence, trust magnitude, evidence types, evidence grades, the TM formula, or star-level promotion gates. Also read it whenever an issue mentions citations, stars, commits, contributors, views, reviewers, percentile, arxiv, github-stars-own, repo-own, social-signal, benchmark-result, peer-review, self-attestation, fusion-recipe, verifier-attestation, or proxy-containment — those are the 10 canonical evidence types and the raw inputs that feed their formulas. Also read it when asked whether a skill qualifies for a given star level (0★–6★): the Star Bar and promotion gates live in `META.md`, not in the TM methodology page. Reading both prevents proposing a calibration that satisfies the TM grade threshold but violates a Star Bar installability or link requirement.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
gaia-research/gaia-skill-tree☆ 232026년 10월 20일 업데이트
Generate accurate Volcengine SDK examples by locating an API through API Explorer search, fetching its swagger, and calling api/common/explorer/make-code with user-provided Params. Use when the user asks how to write Volcengine SDK code, generate SDK samples, or call a Volcengine API in Python, Go, Java, PHP, cURL, Node.js. Supports Chinese and English API names such as "角色扮演", "AssumeRole", or "STS AssumeRole". Also use for explicit SDK configuration questions about retry, timeout, AK/SK, STS, AssumeRole, temporary credentials, proxy, connection pooling, SSL, debug mode, request signing, response parsing, and error handling. If the user only needs API parameters, enum values, required fields, error codes, response schemas, pagination, or API comparisons, hand off to volcengine-api. If they need CLI-based operations, hand off to volcengine-cli.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
volcengine/volcengine-agent-toolkit☆ 222026년 10월 19일 업데이트
用于创建、配置、审查或调试基于 Vite 的前端项目、vite.config.ts、环境变量、dev server proxy、HMR、插件顺序、library mode、依赖预打包、bundle splitting 或 Vite 构建性能。React/Vue 组件架构请使用框架专项 skill;中文触发词包括 Vite 配置、vite.config、Vite 构建、Vite 性能。
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
bovinphang/frontend-craft☆ 222026년 9월 26일 업데이트
Use when creating, configuring, reviewing, or debugging Vite-based frontend projects, vite.config.ts, env variables, dev server proxy, HMR, plugin ordering, library mode, dependency pre-bundling, bundle splitting, or Vite build performance. Use framework-specific skills for React/Vue component architecture; Chinese triggers include Vite configuration, vite.config, Vite build, Vite performance.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
bovinphang/frontend-craft☆ 222026년 9월 26일 업데이트
Troubleshoots Google Cloud Gemini Enterprise Agent Platform issues (Agent Gateway, Registry, Identity, Policies, Model Armor, Identity-Aware Proxy (IAP)). Use when agent requests fail with 403 (especially unauthorized egress), Agent Runtime queries return 500, or gateway/IAP logs show permission errors. Don't use for general Google Cloud Identity and Access Management (IAM) debugging or networking issues unrelated to the Agent Platform stack.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
vaila-multimodaltoolbox/vaila☆ 212026년 10월 20일 업데이트
Guide for integrating NHGRI-EBI GWAS Catalog associations with ENCODE regulatory data. Use when users need to find GWAS variants in ENCODE peaks, connect regulatory elements to disease associations, or prioritize functional variants using ENCODE annotations. Trigger on: GWAS, genome-wide association, SNP association, trait association, GWAS Catalog, disease association, risk variant, lead SNP, LD proxy.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
ammawla/encode-toolkit☆ 212026년 9월 27일 업데이트
A self-evolution engine for AI agents. Analyzes runtime history to identify improvements and applies protocol-constrained evolution. Communicates with EvoMap Hub via local Proxy mailbox.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
gabrielmoreira/agent-skills-mirror☆ 192026년 10월 19일 업데이트
Drafts jurisdiction-specific Advance Health Care Directive packages with agent appointment, living will instructions, HIPAA authorization bridge, organ donation preferences, and execution compliance checklists. Trigger when the user mentions advance directive, healthcare proxy, living will, health care agent, HIPAA authorization, medical power of attorney, end-of-life planning, capacity trigger planning, state-specific directive forms, witness/notary requirements for healthcare documents, or cross-state directive portability.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
CSlawyer1985/legal-skillhub☆ 182026년 9월 23일 업데이트
Token bucket, sliding window, and Redis-based rate limiting for API protection. Activate on: rate limiting, throttling, token bucket, sliding window, API abuse, DDoS protection, quota management. NOT for: API gateway setup (use api-gateway-reverse-proxy-expert), caching (use cache-strategy-invalidation-expert).
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
curiositech/windags-skills☆ 162026년 10월 19일 업데이트
API migration strategies, deprecation workflows, and header/URL/content versioning. Activate on: API versioning, backward compatibility, deprecation, breaking change, API migration, v1 v2, sunset header. NOT for: schema evolution in data (use schema-evolution-manager), gateway routing (use api-gateway-reverse-proxy-expert).
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
curiositech/windags-skills☆ 162026년 10월 19일 업데이트
Execute CLI commands through RTK proxy for token-optimized output
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
baekenough/second-brain☆ 152026년 10월 8일 업데이트
Use when explicitly authorized lab traffic must be captured, searched, or exported from the project's mitmproxy-backed Docker lab recorder.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
justsml/ExploitHunter.app☆ 142026년 10월 17일 업데이트
This skill enables IP address masking and accessing hidden services.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
luokai0/ai-agent-skills-by-luo-kai☆ 132026년 5월 6일 업데이트
Use when setting up Traefik as a local reverse proxy — real domains on 127.0.0.1, trusted HTTPS via mkcert, automatic service discovery, and multi-project routing.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
event4u-app/agent-config☆ 122026년 10월 20일 업데이트
Run a two-agent proxy approval council for autonomous sprint gates. Use when a sprint needs delegated approval for human gates such as deploy, live mutation, push, cleanup, skip, or shortened watch decisions, while requiring two independent agents to reach consensus that the human principal would approve under written policy and preferences.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
dazzaji/interlateral_agents☆ 112026년 9월 28일 업데이트
Apply after completing a task, before declaring done. Verify against the real artifact (run the feature, read the actual value, inspect the diff), not a proxy, self-report, or 'it compiles.'
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
painhardcore/pstack☆ 112026년 10월 16일 업데이트
Read-only first troubleshooting workflow for Python project deployments, including systemd startup failures, dependency issues, encoding problems, permissions, proxy setup, and readiness gates.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
Dirtytrii/codex-skills☆ 112026년 10월 9일 업데이트
Build a SuperCollider piece up while it plays - start a sound, change it in place, layer it, and stop it cleanly - using the dsh-supercollider tools (sc_exec, sc_nodes, sc_play, sc_stop-via-sc_exec) and the idioms that make a session survive (Ndef, ProxySpace, Pbind, ~variables, s.freeAll).
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
vecnode/vn-code☆ 102026년 10월 20일 업데이트
Leverages Splunk Enterprise Security and SPL (Search Processing Language) to investigate security incidents through log correlation, timeline reconstruction, and anomaly detection. Covers Windows event logs, firewall logs, proxy logs, and authentication data analysis. Activates for requests involving Splunk investigation, SPL queries, SIEM log analysis, security event correlation, or log-based incident investigation.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
andycungkrinx91/konoha☆ 92026년 10월 19일 업데이트
Computer Use Agent — autonomous browser control via Steel, Browser Use, and Browserbase cloud providers. Supports headful CDP sessions, CAPTCHA solving, proxy rotation, live view, session recording/replay, Playwright/Puppeteer integration, and LLM-driven visual browsing. Use when asked about computer use, browser automation, web scraping, Steel sessions, cloud browsers, headful browsing, CAPTCHA solving, or autonomous web navigation.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
x402agent/SolanaOS☆ 92026년 7월 23일 업데이트
Load for Blazor BFF server work involving YARP proxy routes, cookie sessions, access-token forwarding/refresh, downstream API calls, BFF handlers, or browser-to-API auth failures; not for client component rendering or API JWT validation alone.
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
islamu-ngo/Event☆ 82026년 10월 20일 업데이트
Use when the user asks to "monitor brand mentions", "set up social listening", "did anything spike about us this week", or "watch these accounts for buying triggers"; runs always-on keyless listening — a versioned listening-query architecture (brand variants incl. misspellings and 中文 names, exclusion terms, per-source syntax for HN Algolia / Bluesky / GDELT / Tavily), a mention sweep with six-class triage (crisis / bug / lead / praise / question / spam) each routed with an SLA, a 7-day rolling baseline with spike flags (the crisis trigger input), a B2B trigger watchlist (funding / hiring / launch signals), and an explicit coverage disclosure where X/IG/TikTok/LinkedIn/小红书 numbers are proxy-labeled, never Measured. Not for launch-window telemetry (T-0→T+30 rank and review polling) — use launch-monitor. 舆情监听/品牌提及监测/基线突刺/触发信号
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
unempyd/revenueos☆ 72026년 9월 14일 업데이트
Use when the user asks to "set up conversion values so tROAS optimizes profit not orders", "map margin onto my purchase value", "build value rules for lead / phone / signup conversions", or "stop bidding to revenue when I care about profit"; defines and QAs the conversion VALUE model — per-conversion values, margin/net-value adjustment, static-vs-dynamic value rules, proxy values for non-revenue actions, and a value-vs-count sanity check — as a value-model spec plus a pre-launch value QA sheet. Not for whether the tag fires or UTMs are clean — use conversion-signal-qa; not for cross-platform double-count de-dup — use attribution-reconciler; not for scoring R1/R2 — that is a scored veto in ad-account-auditor. 付费广告转化价值建模/利润出价/价值规则QA
한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.
unempyd/revenueos☆ 72026년 9월 14일 업데이트