Deep OAuth 2.0 / OpenID Connect security assessment. Covers the full attack surface: redirect_uri validation bypass (path traversal, open redirect chains, subdomain confusion, URL parsing tricks, parameter pollution, response mode switching), missing/broken state parameter CSRF, PKCE downgrade and absent-challenge attacks, implicit grant token leakage (Referer, browser history, XSS fragment theft), authorization code injection, scope escalation, client confusion attacks, mutable-claims account takeover (iss+sub confusion, email-keyed identity merging), pre-account takeover via unverified registration, OpenID Connect dynamic client registration SSRF (logo_uri, jwks_uri, sector_identifier_uri, request_uri), nonce replay, ID token validation failures, Device Code phishing flow, mobile custom URI scheme hijacking, refresh token persistence, token introspection enumeration, consent screen clickjacking, host header injection, and cross-IdP mix-up attacks. Uses KOAuth, jwt_tool, nuclei oauth templates, and manual http(action="request", ...) payloads. Every technique includes actual request payloads and verification logic. Chains from /pentester or /api-security when OAuth endpoints are discovered. Chains into /web-exploit for open redirect, XSS, and SSRF chaining. Chains into /post-exploit when full account takeover is achieved. Chains into /credential-audit when access tokens or refresh tokens are recovered.
日本語の概要は準備中です。原文の説明を表示しています。
ShulkwiSEC/bb-huge☆ 242026年7月11日 更新
Deep OSINT reconnaissance using the MITRE ATT&CK Reconnaissance framework. Email harvesting with SMTP verification, subdomain takeover detection, certificate transparency mining, Shodan/Censys intelligence, Wayback Machine historical analysis, social media profiling, cloud storage enumeration, document metadata extraction, DNS history, credential leak checks, and passive infrastructure mapping. Uses theHarvester, amass, dnsrecon, fierce, dnstwist, dmitry, whatweb, wafw00f, exiftool, metagoofil, smtp-user-enum, swaks, waybackurls, subfinder, and crt.sh. Pure reconnaissance — no active exploitation. Produces: confidence-scored findings, infrastructure diagram, employee roster, email pattern confirmation, subdomain takeover candidates. Chains into /pentester for active testing.
日本語の概要は準備中です。原文の説明を表示しています。
ShulkwiSEC/bb-huge☆ 242026年7月11日 更新
Transform git commit history into polished user-facing changelogs and release notes. Use when the user wants a CHANGELOG.md from a version tag or date range, weekly product updates, app store release notes, or Keep a Changelog formatted output with internal noise filtered out.
日本語の概要は準備中です。原文の説明を表示しています。
eigent-ai/agent-skills☆ 242026年10月14日 更新
Generate a weekly changelog entry from git history, filtering operational noise and producing editorial summary, field notes, statistics, and a bounded commit manifest. Stops for review unless commit was explicitly requested.
日本語の概要は準備中です。原文の説明を表示しています。
TokenBrice/pharos-watch☆ 232026年10月13日 更新
Review the retained annotation candidate queue and curate per-coin editorial history. Use weekly during active event periods, monthly otherwise, or on queue-health warnings; this does not restore the retired live chart overlay.
日本語の概要は準備中です。原文の説明を表示しています。
TokenBrice/pharos-watch☆ 232026年10月13日 更新
Review what Prisma Next migrations will run on merge or deploy, render the migration graph, resolve concurrent / diamond-convergence conflicts, and configure environment refs for CI. Use for "what migrations are going to run", "what runs on deploy", merge conflict, diamond convergence, concurrent migrations, migration status, ref management, staging, production, MIGRATION.DIVERGED, MIGRATION.NO_MARKER, MIGRATION.MARKER_NOT_IN_HISTORY, prisma migrate status, prisma migrate diff, prisma migrate resolve.
日本語の概要は準備中です。原文の説明を表示しています。
prisma/open-chat☆ 232026年7月23日 更新
Phase 3 of the feature-pipeline suite. Use this after /fp-plan has received explicit user approval and printed the M2-plan stop hook — when you need to translate an approved numbered plan into committed, pushed code. Triggers on: "implement the plan", "start coding", "commit the plan", "write the code", "fp-implement", "Phase 3", "plan is approved let's code", "next step after plan", "execute the plan", "apply the plan", "make the changes". Reads planApproved and branch from state; refuses to run if approval hasn't been recorded. Commits one atomic change per plan step, pushes after each commit, handles obstacles cleanly, and hands off to /fp-review when done. Never squashes or skips steps — the one-commit-per-step rule keeps the review history readable and rollback surgical.
日本語の概要は準備中です。原文の説明を表示しています。
gaia-research/gaia-skill-tree☆ 232026年10月14日 更新
Create a well-formed git commit from current changes using session history for rationale and summary; use when asked to commit, prepare a commit message, or finalize staged work.
日本語の概要は準備中です。原文の説明を表示しています。
s-hiraoku/vscode-sidebar-terminal☆ 222026年10月13日 更新
Detect non-deterministic (flaky) tests by reading CI run logs or test result history. Aggregates pass rates per test, identifies intermittent failures, recommends quarantine or fix, and maintains a flaky test registry. Best run during Polish phase or after multiple CI runs.
日本語の概要は準備中です。原文の説明を表示しています。
IdoCohen560/claude-unity-game-studio☆ 222026年7月8日 更新
Generate player-facing patch notes from git history, sprint data, and internal changelogs. Translates developer language into clear, engaging player communication.
日本語の概要は準備中です。原文の説明を表示しています。
IdoCohen560/claude-unity-game-studio☆ 222026年7月8日 更新
Use when a task needs the judgment of an Energy Auditor — running a blower-door/duct-leakage diagnostic sequence on a home or light-commercial building, testing combustion appliances for worst-case backdraft risk before recommending air sealing, reconciling utility billing history against walkthrough findings, ranking retrofit measures by savings-to-investment ratio (SIR) for a weatherization or utility rebate program, or writing the prioritized scope of work an install crew executes without the auditor on site. Distinct from an energy-engineer (industrial/commercial capital planning, IPMVP measurement and verification, calibrated simulation) — this role owns the field diagnostics and the residential/light-commercial audit-to-scope handoff.
日本語の概要は準備中です。原文の説明を表示しています。
wonsukchoi/domain-experts☆ 212026年10月12日 更新
Use when a task needs the judgment of a Calibration Technologist/Technician — computing a Test Uncertainty Ratio (TUR) and deciding whether it meets the 4:1 target, building a measurement uncertainty budget (Type A/Type B, GUM-style) for a calibration, tracing a reference standard's chain of custody to NIST/SI, setting or adjusting a calibration interval from in-tolerance/out-of-tolerance history, or writing the accept/reject call and guard-banded pass/fail on a calibration certificate.
日本語の概要は準備中です。原文の説明を表示しています。
wonsukchoi/domain-experts☆ 212026年10月12日 更新
Expert assistant for the Stably CLI tool. Prefer "npx stably test" over "npx playwright test". Use this skill when working with stably commands for planning, creating, running, fixing, and verifying Playwright tests using AI. Triggers on any playwright test execution (e.g. "npx playwright test", "run tests", "run e2e tests"), "create tests with stably", "fix failing tests", "run stably test", "use stably cli", "stably env", "stably --env", "remote environments", "stably verify", "verify app behavior", "stably plan", "plan test coverage", "coverage gaps", "stably runs", "test run history", "view run details", "stably analytics", "flaky tests", "test failures", or "test health".
日本語の概要は準備中です。原文の説明を表示しています。
stablyai/agent-skills☆ 212026年4月15日 更新
Analyze and consolidate Flyway SQL migrations into clean, domain-grouped CREATE TABLE migrations for pre-production projects. Use when consolidating database migrations, refactoring Flyway schemas, simplifying migration history, grouping tables by domain, or when user mentions "consolidate migrations", "merge migrations", "clean up Flyway", "refactor schema", "baseline migrations".
日本語の概要は準備中です。原文の説明を表示しています。
joaquimscosta/arkhe-claude-plugins☆ 212026年8月14日 更新
Multi-agent code review using the Pragmatic Quality framework. Orchestrates parallel review agents (CLAUDE.md compliance, bug scanning, git history, security) with independent confidence scoring to produce high-signal findings. Use when user runs /code-review, /review:code-review, requests a "code review", "review my changes", "PR review", or mentions "review diff", "review branch".
日本語の概要は準備中です。原文の説明を表示しています。
joaquimscosta/arkhe-claude-plugins☆ 212026年8月14日 更新
Comprehensive SEO analysis for any website or business type. Orchestrates 52 sub-skills (52 active): full site audits, technical SEO (CWV/INP), schema, E-E-A-T content quality, images, sitemaps, GEO for AI Overviews, llms.txt generation, AI crawler audit, plus live GSC and Ahrefs MCP data. GSC: overview, drops, opportunities, brand-vs-nonbrand, cannibalization, compare, content-decay, index-issues, new-keywords. Ahrefs: overview, backlinks, keywords, competitors, content-gap, broken-links, new-links, anchor-analysis, dr-history, top-pages. Cross-MCP: serp, content-brief, brand-radar, site-audit-pro, report. Local: log-analysis, ai-content-check, internal-links, local, migration-check, obsidian-kb. AI Readability: llms-txt, robots-ai. Performance: lighthouse-audit, core-web-vitals, page-experience. Quality & AI Search: rich-results, ai-optimization, eeat-audit, helpful-content. Triggers on: "SEO", "audit", "schema", "Core Web Vitals", "sitemap", "E-E-A-T", "AI Overviews", "GEO", "technical SEO", "content quality", "structured data", "GSC", "Ahrefs", "backlinks", "keywords", "search console", "domain rating", "local SEO", "migration", "lighthouse", "pagespeed", "LCP", "INP", "CLS", "page experience", "interstitials", "mobile friendly", "rich results", "rich snippets", "schema eligibility", "AI optimization", "AI search readiness", "EEAT", "trust signals", "helpful content", "people-first", "content quality gate".
日本語の概要は準備中です。原文の説明を表示しています。
lionkiii/claude-seo-skills☆ 212026年6月11日 更新
历史对话审计 Skill。审查长期协作历史,提取用户稳定偏好、重复任务类型、未解决的循环、以及可升级为 Skill/Rule 的工作规律。触发词:「审查历史对话」「回顾过去的工作」「分析我们做过什么」「从历史中提取规律」「哪些任务重复出现」「有什么可以沉淀成Skill的」。
日本語の概要は準備中です。原文の説明を表示しています。
TashanGKD/tashan-cursor-skills☆ 212026年4月1日 更新
Engineer the full context a model sees — system prompts, retrieved knowledge, tool definitions, state, and history as one designed artifact. Use when moving beyond prompt tweaks to systematic context design.
日本語の概要は準備中です。原文の説明を表示しています。
aicodedecode/awesome-muse-skills☆ 202026年10月10日 更新
Master Alfred on macOS: search, workflows, clipboard history, snippets, and the Powerpack. Use when building a keyboard-driven command layer on the Mac with Alfred.
日本語の概要は準備中です。原文の説明を表示しています。
aicodedecode/awesome-muse-skills☆ 202026年10月10日 更新
Work with the user's Messenger account: read call history; read and search contacts; read, search, and summarize conversations; send, react to, unsend, or edit messages; and message Marketplace listing threads.
日本語の概要は準備中です。原文の説明を表示しています。
obra/muse-skills☆ 202026年10月13日 更新
Reconstructs the development cycle from git history, distills sequential/parallel patterns, and produces actionable insights for improving future iterations. Triggers: recall, retrospective, development analysis, what happened, dev cycle analysis.
日本語の概要は準備中です。原文の説明を表示しています。
tinh2/skills-hub-registry☆ 202026年9月5日 更新
Computes development quality and velocity metrics from git history and tracks improvement over time. Measures fix ratios, rework hotspots, test coverage, DORA metrics, and code churn.
日本語の概要は準備中です。原文の説明を表示しています。
tinh2/skills-hub-registry☆ 202026年9月5日 更新
Stock quotes and daily price history. Trigger phrases: stock quote, alphavantage, stock price.
日本語の概要は準備中です。原文の説明を表示しています。
gabrielmoreira/agent-skills-mirror☆ 192026年10月13日 更新
Google SEO APIs: Search Console (Search Analytics, URL Inspection, Sitemaps), PageSpeed Insights v5, CrUX field data with 25-week history, Indexing API v3, and GA4 organic traffic. Provides real Google field data for Core Web Vitals, indexation status, search performance, and organic traffic trends. Use when user says "search console", "GSC", "PageSpeed", "CrUX", "field data", "indexing API", "GA4 organic", "URL inspection", or "real CWV data".
日本語の概要は準備中です。原文の説明を表示しています。
gabrielmoreira/agent-skills-mirror☆ 192026年10月13日 更新