스킬 찾기

Hunting skill for oauth vulnerabilities. Built from 19 public bug bounty reports. Use when hunting oauth on any target.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

WAF bypass techniques checklist: encoding bypass (URL/HTML/Unicode/double encoding), case variation, comment injection, HTTP header manipulation, chunked encoding, IP rotation, timing attacks, and payload obfuscation per WAF vendor. Use when WAF is blocking payloads during web app tests.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Microsoft 365 / Entra ID red-team attack chain — current 2026 reality. AADSTS code reference, user enumeration vectors (with hardening status), Smart Lockout math, Conditional Access bypass options, ROPC + SAML SSO browser flow, Burp/Playwright templates. Built from authorized red-team work where ROPC spray surfaced pre-existing lockouts and CA-blocked credentials, plus real-time external attacker activity correlation. Use for any M365/Entra credential attack, password spray, user enumeration, CA-bypass exploration, or active-attacker-detection scenario.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Automated web form filling and file uploading skill with Playwright browser automation. Handles login persistence, form detection, file uploads, and waits for manual confirmation before submission.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Design patterns for building autonomous coding agents. Covers tool integration, permission systems, browser automation, and human-in-the-loop workflows. Use when building AI agents, designing tool APIs, implementing permission systems, or creating autonomous coding assistants.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Climb the browser ladder — start free, escalate only when needed. L1 (fetch) → L2 (local Playwright) → L3 (BrowserCat) → L4 (Browserless.io for CAPTCHA/bot bypass).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Browser automation powers web testing, scraping, and AI agent interactions. The difference between a flaky script and a reliable system comes down to understanding selectors, waiting strategies, and anti-detection patterns. This skill covers Playwright (recommended) and Puppeteer, with patterns for testing, scraping, and agentic browser control. Key insight: Playwright won the framework war. Unless you need Puppeteer's stealth ecosystem or are Chrome-only, Playwright is the better choice in 202

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Design and build custom Claude Code agents with effective descriptions, tool access patterns, and self-documenting prompts. Covers Task tool delegation, model selection, memory limits, and declarative instruction design. Use when: creating custom agents, designing agent descriptions for auto-delegation, troubleshooting agent memory issues, or building agent pipelines.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Complete Claude Code productivity system — project setup, prompting patterns, sub-agent orchestration, context management, debugging, refactoring, TDD, and shipping 10X faster. Zero scripts needed.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Complete methodology for building production-grade React applications with architecture decisions, component design, state management, performance optimization, testing, and deployment.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Create product demo videos by automating browser interactions and capturing frames. Use when the user wants to record a demo, walkthrough, product showcase, or interactive video of a web application. Supports Playwright CDP screencast for high-quality capture and FFmpeg for video encoding.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

AI-powered Reddit seeding agent for founders. Analyzes a product spec, maps relevant subreddits, finds real threads where target users need help, drafts personalized replies and DMs, and posts approved outreach via Reddit API. Use when someone wants to find and engage their first users on Reddit, seed a product launch, or do community-led growth without a budget.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

X (Twitter) integration for NanoClaw. Post tweets, like, reply, retweet, and quote. Use for setup, testing, or troubleshooting X functionality. Triggers on "setup x", "x integration", "twitter", "post tweet", "tweet".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Tiered web access router. TIER 1 insane-search: headless extraction plus WAF bypass via curl_cffi, yt-dlp, Jina Reader, public APIs, Playwright fallback for blocked/403/Cloudflare pages, articles, YouTube subtitles. TIER 1.5 agent-reach: platform-native readers for Chinese/social platforms: Xiaohongshu, Douyin, Weibo, Bilibili, V2EX, WeChat, plus Twitter/Reddit/LinkedIn/GitHub. TIER 2 aside-browser FIRST (user's real logged-in browser: aside exec agent, aside repl Playwright), then CloakBrowser + agent-browser as the stealth fallback: source-patched stealth Chromium (CloakBrowser) driven over CDP by the agent-browser CLI for clicks, forms, screenshots, video, cookie login, QA/dogfood, Electron apps. Triggers: browse, stealth browser, CloakBrowser, agent-browser, cloak launch, bypass bot detection, blocked site, scrape, fill form, screenshot, import cookies, play youtube, podcast transcript. NOT for simple searches (web-search), fetches (webfetch), or messaging/workspace platforms — Slack/Discord/Notion/Gmail have Tier-1 CLIs in external-communication; come here only as its fallback.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Gates whether a new test should exist and forces it to be efficient, protecting CI from low-value test bloat. Use before any change to what a pytest, Jest, or Playwright test asserts or sets up, down to one fixture or one assertion added to an existing block. Front-loads the value bar (every test must catch a realistic regression no existing test already catches; extend the nearest existing test before writing a new standalone one; test behavior through the public interface, not implementation details; collapse near-duplicates into parameterized cases) and the efficiency bar (deterministic, isolated, fast; pick the cheapest test level; Django TestCase over TransactionTestCase; no sleeps, no real network; no time bombs from absolute dates left to age against the real clock; no database a test never uses). Includes a "don't write it" decision tree. For fixing an existing flaky test use `/fixing-flaky-tests`; after this gate says a Playwright test is warranted, use `/playwright-test` for mechanics.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Guides an agent through reproducing, root-causing, fixing, and validating flaky tests in the PostHog monorepo. Use when a test fails intermittently in CI but passes on rerun or locally, when `hogli ci:insights` or the debugging-ci-failures skill classifies a failure as a flaky test, when given a GitHub Actions URL for a flaky job, when asked to check Trunk Flaky Tests for a test, PR, or master, or when asked to deflake, stabilize, or fix a flaky Jest, pytest, or Playwright test. Core discipline: reproduce locally before changing anything, fix the root cause (never mask it with sleeps, retries, or bigger timeouts), and prove the fix with an N-run validation loop sized to the observed failure rate. Stabilizing is not the only valid outcome — the skill also gates whether the test should exist, so deleting a test that catches nothing real, or re-leveling one that flakes because of the level it runs at, are first-class endings.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Debugs failing GitHub Actions CI runs for PostHog PRs, commits, and branches, and answers broad CI-health questions ("is CI red?", "is master green today?", "what's broken right now?"). Use when the user asks why CI is red, asks for the current CI or master status, or mentions a failing check, GitHub Actions run, Depot runner, workflow, job, shard, merge queue kick, flaky test, lint failure, typecheck failure, snapshot diff, migration check, generated types drift, or skills build failure. Start with the `hogli ci:insights` digest (cross-run CI history from engineering analytics), then guides read-only inspection, failure classification, smallest local reproduction with hogli, and safe reporting without rerunning CI or posting to GitHub. Running unattended as the "Master-red diagnosis" workflow: see references/master-red-incident.md.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.