基础设施与 DevOps技能

LiteLLM proxy server setup, TypeScript client patterns via OpenAI SDK, model routing, fallbacks, load balancing, spend tracking, virtual keys, and production deployment

中文简介正在准备中。当前显示原文说明。

Serverless GPU compute platform for AI model deployment — web endpoints, GPU functions, model serving, and TypeScript client patterns

中文简介正在准备中。当前显示原文说明。

Replicate SDK patterns for TypeScript/Node.js -- client setup, predictions, streaming, webhooks, file handling, model versioning, deployments, and training

中文简介正在准备中。当前显示原文说明。

The entry point and router for this pack: explains the research software quality framework - community-standard quality dimensions, measurable indicators and the three-tier model (analysis code, prototype tools, infrastructure) - and routes to the right companion rseng-* skill. Use PROACTIVELY at the start of any research software task to classify the software's tier and select which practices apply, and whenever the user asks what research software quality means, mentions quality dimensions, indicators or the three-tier model, wants a quality assessment or improvement plan for research software, or is unsure which quality practice to start with.

中文简介正在准备中。当前显示原文说明。

Covers making research software environments reproducible: pinning a language version and its dependencies in a per-project virtual environment, choosing a package/environment manager, and packaging code and its full stack into a container. Use when the user asks how to set up venv/conda/poetry/uv/renv, lock or pin dependencies, share a runnable environment, escape "dependency hell" or "works on my machine", write a Dockerfile, build an Apptainer/Singularity image for HPC, or decide between a virtual environment and a container. For regenerating a project's results end to end see rseng-reproducibility; for environments of multi-step pipelines see rseng-workflows.

中文简介正在准备中。当前显示原文说明。

Covers planning research software work: writing and maintaining a Software Management Plan (SMP), and choosing programming languages, tools, and infrastructures for a project. Use when the user wants to write or review an SMP, plan how software will be developed, maintained, shared, and preserved, needs the software sections of a proposal or funder template, wants to decide which language or framework to start a project in (Python, C++, R, Julia, Rust, Fortran, JavaScript), pick a project template or boilerplate, or weigh reuse, sustainability, and funder requirements at the start of a project. (Data management plans, maDMPs, DS-Wizard and DMPonline are rseng-data-management-plans; interactive new-project setup is rseng-project-kickoff; week-to-week task tracking is rseng-project-tracking.)

中文简介正在准备中。当前显示原文说明。

Author PR-ready RSSHub routes — namespace.ts, route handler, Radar rules and PR description — that survive code review. Distilled from 2,727 route PRs. Use when asked to write, fix or review an RSSHub route, add an RSS feed for a website via RSSHub, contribute a route to DIYgod/RSSHub, or when working with cheerio selectors, cache.tryGet, parseDate, Radar rules, or the RSSHub PR template. Trigger on RSSHub, RSS route, RSS feed for X, 给 X 做 RSS 订阅, namespace.ts, DataItem. Do not use for deploying RSSHub, debugging runtime errors, tuning cache/config, or non-RSSHub scraping.

中文简介正在准备中。当前显示原文说明。

Prepare logical commits, publish through Pharos’s protected-main pull-request gate, monitor deployment, and hand off operational acceptance. Use only when commit, push, publish, release, or deployment watching is requested.

中文简介正在准备中。当前显示原文说明。

Diagnose and fix failed Pharos GitHub Actions, adaptive PR checks, Cloudflare deploys, Pages releases, or scheduled automation. Use when a gate/run failed or the user asks to retrigger and iterate until clear.

中文简介正在准备中。当前显示原文说明。

Use when adding, reviewing, squashing, deploying, or rolling back Pharos D1 migrations or schema cleanup.

中文简介正在准备中。当前显示原文说明。

Author Prisma Next migrations — choose db update vs migration plan, edit the framework-rendered migration.ts (replace placeholder sentinels with dataTransform closures), recover from MIGRATION.HASH_MISMATCH or PN-MIG-2001 unfilled placeholder. Use for prisma migrate dev, prisma migrate deploy, prisma db push, db update, db update --dry-run, migration plan, migrate, migration new, migration show, db verify, db sign, data migration, this.dataTransform, dataTransform, placeholder, generated migration.ts, edit migration.ts, MIGRATION.HASH_MISMATCH, schema drift.

中文简介正在准备中。当前显示原文说明。

Route a vague Prisma Next prompt to the right specific skill. Use for "help me with Prisma Next", "what is Prisma Next", "explain Prisma Next", "I'm new to PN", "where do I start", "what can I do with Prisma Next", "what can I do next with Prisma", "just ran createprisma", "tour of Prisma Next", "Prisma Next overview", and comparison questions like "Prisma Next vs Prisma 7", "PN vs Drizzle", "PN vs Kysely", "PN vs TypeORM". Do NOT use when the prompt clearly matches a workflow skill — adoption / quickstart / first-touch orientation / brownfield introspection, schema / contract editing, migration authoring (db update / migration plan / migrate), migration review on deploy / concurrent migrations, queries / db.orm / db.sql / TypedSQL, runtime / db.ts / middleware wiring, build / Vite plugin / Next.js plugin, debug / structured error envelopes / PN-* error codes, or feedback / bug report / feature request — load that sibling skill directly.

中文简介正在准备中。当前显示原文说明。

SSRF playbook. Use when the server fetches URLs, resolves hostnames, imports remote content, or can be driven toward internal networks, cloud metadata, or secondary protocols.

中文简介正在准备中。当前显示原文说明。

Deploy an Evil Twin (Rogue Access Point) to clone a legitimate Wi-Fi network's SSID and MAC address. By combining this with targeted deauthentication attacks, an attacker aggressively forces nearby victims to silently connect to the malicious AP, enabling pervasive Man-in-the-Middle (MitM), captive portal phishing, and credentials interception.

中文简介正在准备中。当前显示原文说明。

Exploit Server-Side Request Forgery (SSRF) vulnerabilities in applications hosted on AWS to access the highly sensitive Instance Metadata Service (IMDS). This allows an attacker to steal valid IAM roles and temporary security credentials, leading to catastrophic cloud account compromise.

中文简介正在准备中。当前显示原文说明。

Server-Side Request Forgery (SSRF) occurs when user-controlled input is used to construct URLs that the server fetches, enabling access to internal services, cloud metadata endpoints (169.254.169.254), and local files via `file://` scheme. Detect via parameters accepting URLs or hostnames, PDF/report generators rendering `<iframe>/<img>/<script>`, and blind SSRF via out-of-band DNS callbacks. Bypass filters using IP decimal/octal/hex encoding, URL-userinfo tricks, and URL fragments. Tools: Burp Collaborator, curl.

中文简介正在准备中。当前显示原文说明。

Sandbox escape playbook. Use when breaking out of Python sandbox, Lua sandbox, seccomp filter, chroot jail, container/Docker, browser sandbox, or namespace isolation to achieve unrestricted code execution or file access.

中文简介正在准备中。当前显示原文说明。

Detects sensitive data stored insecurely on mobile devices (Android/iOS). Trigger on: SharedPreferences, NSUserDefaults, SQLite, Room DB, DataStore, Core Data, Keychain misconfiguration, external storage, backup exposure, plaintext files, unencrypted databases, adb backup, iCloud backup, NSFileProtection, EncryptedSharedPreferences, SQLCipher, allowBackup, FLAG_SECURE, keyboard cache, sensitive logs. Covers MASVS-STORAGE-1 (local storage) and MASVS-STORAGE-2 (exposure to unauthorized actors).

中文简介正在准备中。当前显示原文说明。

Identify and exploit logic flaws in OAuth implementations, focusing specifically on the absence or improper validation of the `state` parameter, which leads to Cross-Site Request Forgery (CSRF) and account takeover (ATO).

中文简介正在准备中。当前显示原文说明。

Exploit weak password reset and change flows via CSRF on reset forms, cross-user password modification by swapping username parameters, token predictability in reset links, reset displaying old password in plaintext (revealing weak storage), missing current-password verification on change forms, and session hijacker lockout via passwordless change. Test with Burp Suite, OWASP ZAP following OWASP Forgot Password Cheat Sheet.

中文简介正在准备中。当前显示原文说明。

Exploit misconfigured Kubernetes Role-Based Access Control (RBAC) to escalate privileges within a cluster. This skill covers identifying overly permissive roles and bindings, and leveraging them to gain cluster-admin access or compromise the host nodes.

中文简介正在准备中。当前显示原文说明。

HTTP/2 protocol-specific attack playbook. Use when the target supports HTTP/2 and you need to exploit binary framing, HPACK compression, h2c upgrade smuggling, pseudo-header injection, stream multiplexing abuse, or H2→H1 downgrade translation flaws.

中文简介正在准备中。当前显示原文说明。

Exploit misconfigured Docker environments, specifically focusing on privilege escalation via an exposed Docker daemon socket (`docker.sock`) or membership in the local `docker` user group to achieve root access on the host system.

中文简介正在准备中。当前显示原文说明。

Escape from Docker containers to the host system using container misconfigurations, mounted sockets, privileged mode, capabilities abuse, and kernel exploits. Use this skill when testing containerized environments for breakout vulnerabilities during penetration tests. Covers Docker socket mounting, cgroup escapes, nsenter techniques, and Kubernetes pod escapes.

中文简介正在准备中。当前显示原文说明。