开发技能

API reconnaissance and documentation review playbook. Use when discovering endpoints, schemas, versions, OpenAPI specs, hidden docs, and surface area for API testing.

中文简介正在准备中。当前显示原文说明。

401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths. Covers path manipulation, HTTP method tampering, header injection, protocol downgrade, and automated bypass tools.

中文简介正在准备中。当前显示原文说明。

Decompile, analyze, and reverse engineer Android applications (APKs). Utilize tools like JADX, Apktool, and dex2jar to extract source code (Java/Kotlin), analyze manifest configurations (Intents, Activities), and identify hardcoded secrets or insecure API endpoints.

中文简介正在准备中。当前显示原文说明。

Anti-debugging detection and bypass playbook. Use when reversing protected binaries that detect debuggers via ptrace, PEB flags, timing checks, or signal/exception handlers on Linux and Windows.

中文简介正在准备中。当前显示原文说明。

Test APIs for authentication and authorization bypass vulnerabilities including JWT manipulation, OAuth2 flaws, API key leakage, broken authentication, and token forgery. Use this skill when assessing REST/GraphQL APIs for access control weaknesses, session management flaws, or credential handling issues. Covers JWT algorithm confusion, OAuth redirect manipulation, and rate limit bypass.

中文简介正在准备中。当前显示原文说明。

Systematically discover hidden Application Programming Interfaces (APIs), uncover undocumented endpoints (Shadow APIs), and fuzz parameters. Use this skill as the pivotal first step in API Bug Hunting, transforming a basic frontend application into a vast mapped attack surface.

中文简介正在准备中。当前显示原文说明。

API authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level authorization.

中文简介正在准备中。当前显示原文说明。

Arbitrary write to RCE playbook. Use when you have an arbitrary write primitive (from heap exploitation, format string, or OOB write) and need to convert it into code execution by targeting GOT, hooks, _IO_FILE vtable, exit_funcs, TLS_dtor_list, modprobe_path, .fini_array, or C++ vtables.

中文简介正在准备中。当前显示原文说明。

Identify and exploit flaws in API rate limiting enforcement. Use this skill when encountering HTTP 429 Too Many Requests errors during password brute-forcing, OTP validation, credential stuffing, or enumeration attacks. These bypasses leverage IP spoofing, parameter manipulation, and edge-case application logic.

中文简介正在准备中。当前显示原文说明。

Entry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any deeper API topic skill.

中文简介正在准备中。当前显示原文说明。

API authentication and JWT abuse playbook. Use when testing bearer tokens, API keys, claim trust, header spoofing, rate limits, and API auth boundary weaknesses.

中文简介正在准备中。当前显示原文说明。

Use ONLY when the user explicitly asks to orchestrate parallel external agents (Codex or Claude Code) in tmux sessions via tp (tmux-pilot). Or when a user tells you that you're the boss or orchestrator. You can also use this if you are an operclaw agent. NEVER auto-invoke for a generic "do this in parallel" request. For in-process subagents, use superpowers:dispatching-parallel-agents instead.

中文简介正在准备中。当前显示原文说明。

Diagnose and fix Flutter layout, overflow, unbounded constraint, scroll, and responsive rendering issues in this repository while preserving the template's existing feature, theme, localization, and shared widget patterns. Use when UI overflows, text clips, widgets disappear, layouts fail on mobile/tablet/desktop, or a feature needs responsive behavior.

中文简介正在准备中。当前显示原文说明。

Run Flutter/Dart formatting and static analysis for this repository. Use after completing Dart, Flutter, generated-source-input, or project configuration changes; when the user asks to lint, format, analyze, or check code style; or when preparing code for a pull request.

中文简介正在准备中。当前显示原文说明。

Review and resolve PR review comments on the current branch's PR in this Flutter repository, from both AI reviewers (CodeRabbit, CodiumAI, CodePilot, Copilot, etc.) and human reviewers. Fetches comments via `gh`, splits them into AI and human groups, verifies each comment against the actual Flutter code, triages them, proposes fixes, and optionally applies fixes, replies to comments, and pushes. Use when the user asks to review PR comments, resolve PR feedback, review AI comments, review human review comments, or handle code review feedback.

中文简介正在准备中。当前显示原文说明。

Create or update a GitHub PR for this Flutter repository using gh CLI. Verifies the work with build-verify and pr-review, generates an inline PR description, commits pending changes when approved, pushes, and opens or updates the PR. Supports stacked PRs by asking for the base branch when detection is ambiguous. Use when the user says "create PR", "open PR", "push PR", or wants to submit their work for review.

中文简介正在准备中。当前显示原文说明。

Customize a new project created from this Flutter template, including app identity, package name, platform cleanup, icons, splash screen, Firebase/secrets decisions, setup tool execution, code generation, and validation.

中文简介正在准备中。当前显示原文说明。

AI rules for writing tests with Stably Playwright SDK. Use this skill when writing or modifying Playwright tests with Stably AI features. Covers when to use Playwright vs Stably methods, plus minimal patterns for aiAssert, extract, getLocatorsByAI, agent.act, Inbox, and Google auth.

中文简介正在准备中。当前显示原文说明。

Expert assistant for the Stably CLI tool. Prefer "npx stably test" over "npx playwright test". Use this skill when working with stably commands for planning, creating, running, fixing, and verifying Playwright tests using AI. Triggers on any playwright test execution (e.g. "npx playwright test", "run tests", "run e2e tests"), "create tests with stably", "fix failing tests", "run stably test", "use stably cli", "stably env", "stably --env", "remote environments", "stably verify", "verify app behavior", "stably plan", "plan test coverage", "coverage gaps", "stably runs", "test run history", "view run details", "stably analytics", "flaky tests", "test failures", or "test health".

中文简介正在准备中。当前显示原文说明。

Expert setup assistant for the Stably Playwright SDK. Use this skill when installing Stably SDK in a new project, migrating from @playwright/test, or configuring Stably reporter for CI/CD. Triggers on tasks like "setup stably", "install stably sdk", or "configure playwright with stably".

中文简介正在准备中。当前显示原文说明。

Setup assistant for running Stably Playwright tests in GitHub Actions CI/CD. Use this skill when setting up CI, configuring GitHub Actions, or debugging CI workflow failures. Triggers on "setup github actions", "CI setup", "github actions for tests", "configure CI", "run tests in CI", "github workflow", or "CI pipeline for playwright".

中文简介正在准备中。当前显示原文说明。

Use when Codex Desktop sidebar sessions disappear, fail with systemError, or cannot continue after a model_provider switch. Diagnoses and repairs active, non-archived sessions without changing authentication or provider configuration.

中文简介正在准备中。当前显示原文说明。

Use when preparing or publishing a local project as a clean GitHub repository. Covers new repositories, private staging releases, public README cleanup, updates to existing remotes, and research-code packaging without datasets, checkpoints, papers, or generated artifacts.

中文简介正在准备中。当前显示原文说明。

OpenUI generative UI with a Java Spring Boot (WebFlux) backend. Streams the OpenAI API directly via WebClient as SSE.

中文简介正在准备中。当前显示原文说明。