查找技能

Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaining (IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth), bypass tables (SSRF IP bypass, open redirect bypass, file upload bypass), language-specific grep (JS prototype pollution, Python pickle, PHP type juggling, Go template.HTML, Ruby YAML.load, Rust unwrap), and reporting (7-Question Gate, 4 validation ...

中文简介正在准备中。当前显示原文说明。

Mine GitHub Security Advisories and CVE databases for incomplete fixes, finding variant vulnerabilities in patched code or similar patterns in related packages.

中文简介正在准备中。当前显示原文说明。

Convert raw notes, error logs, voice dictation, or screenshots into crisp GitHub-flavored markdown issue reports. Use when the user pastes bug info, error messages, or informal descriptions and wants a structured GitHub issue. Supports images/GIFs for visual evidence.

中文简介正在准备中。当前显示原文说明。

Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and advanced queries.

中文简介正在准备中。当前显示原文说明。

Automate GitHub workflows with AI assistance. Includes PR reviews, issue triage, CI/CD integration, and Git operations. Use when automating GitHub workflows, setting up PR review automation, creating GitHub Actions, or triaging issues.

中文简介正在准备中。当前显示原文说明。

Fetch, preview, merge, and test GitHub PRs locally. Great for trying upstream PRs before they're merged.

中文简介正在准备中。当前显示原文说明。

Use the Fly.io flyctl CLI for deploying and operating apps on Fly.io: deploys (local or remote builder), viewing status/logs, SSH/console, secrets/config, scaling, machines, volumes, and Fly Postgres (create/attach/manage databases). Use when asked to deploy to Fly.io, debug fly deploy/build/runtime failures, set up GitHub Actions deploys/previews, or safely manage Fly apps and Postgres.

中文简介正在准备中。当前显示原文说明。

Free AI search via Exa MCP. Web search for news/info, code search for docs/examples from GitHub/StackOverflow, company research for business intel. No API key needed.

中文简介正在准备中。当前显示原文说明。

Query the DeepWiki MCP server for GitHub repository documentation, wiki structure, and AI-powered questions.

中文简介正在准备中。当前显示原文说明。

Build autonomous AI agents with Claude Agent SDK. Structured outputs guarantee JSON schema validation, with plugins system and hooks for event-driven workflows. Prevents 14 documented errors. Use when: building coding agents, SRE systems, security auditors, or troubleshooting CLI not found, structured output validation, session forking errors, MCP config issues, subagent cleanup.

中文简介正在准备中。当前显示原文说明。

Run Codex CLI, Claude Code, OpenCode, or Pi Coding Agent via background process for programmatic control.

中文简介正在准备中。当前显示原文说明。

Microsoft Entra ID (Azure AD) authentication for React SPAs with MSAL.js and Cloudflare Workers JWT validation using jose library. Full-stack pattern with Authorization Code Flow + PKCE. Prevents 8 documented errors. Use when: implementing Microsoft SSO, troubleshooting AADSTS50058 loops, AADSTS700084 refresh token errors, React Router redirects, setActiveAccount re-render issues, or validating Entra ID tokens in Workers.

中文简介正在准备中。当前显示原文说明。

Self-hosted auth for TypeScript/Cloudflare Workers with social auth, 2FA, passkeys, organizations, RBAC, and 15+ plugins. Requires Drizzle ORM or Kysely for D1 (no direct adapter). Self-hosted alternative to Clerk/Auth.js. Use when: self-hosting auth on D1, building OAuth provider, multi-tenant SaaS, or troubleshooting D1 adapter errors, session caching, rate limits, Expo crashes, additionalFields bugs.

中文简介正在准备中。当前显示原文说明。

Use when you need to address review or issue comments on an open GitHub Pull Request using the gh CLI.

中文简介正在准备中。当前显示原文说明。

Build backend AI with Vercel AI SDK v6 stable. Covers Output API (replaces generateObject/streamObject), speech synthesis, transcription, embeddings, MCP tools with security guidance. Includes v4→v5 migration and 15 error solutions with workarounds. Use when: implementing AI SDK v5/v6, migrating versions, troubleshooting AI_APICallError, Workers startup issues, Output API errors, Gemini caching issues, Anthropic tool errors, MCP tools, or stream resumption failures.

中文简介正在准备中。当前显示原文说明。

Enterprise-grade code review agent. Reviews PRs, diffs, or code files for security vulnerabilities, performance issues, error handling gaps, architecture smells, and test coverage. Works with any language, any repo, no dependencies required.

中文简介正在准备中。当前显示原文说明。

Complete DevOps & Platform Engineering system. CI/CD pipelines, infrastructure as code, container orchestration, observability, incident response, and SRE practices — all platforms, all clouds.

中文简介正在准备中。当前显示原文说明。

Free AI search via Exa MCP. Web search for news/info, code search for docs/examples from GitHub/StackOverflow, company research for business intel. No API key needed.

中文简介正在准备中。当前显示原文说明。

Guides collaborative requirements discovery before implementation. Creates task directory, seeds PRD, asks high-value questions one at a time, researches technical choices, and converges on MVP scope. Use when requirements are unclear, there are multiple valid approaches, or the user describes a new feature or complex task.

中文简介正在准备中。当前显示原文说明。

Add automatic CI/CD environment detection using ci-info package. Generic pattern for any CLI tool that needs to adapt behavior (prompts, output, integrations) based on whether it's running in CI.

中文简介正在准备中。当前显示原文说明。

Set up GitHub Actions CI pipeline with test, lint, type-check, and build jobs for a Node.js/TypeScript project. Includes output grouping, error annotations, and job summary patterns.

中文简介正在准备中。当前显示原文说明。

Set up @changesets/cli for semantic versioning, CHANGELOG generation, and npm publishing in a monorepo or single package. Covers init, config, contributor workflow, GitHub Actions release automation, and npm provenance.

中文简介正在准备中。当前显示原文说明。

Create a GitHub PR with an engineered description that matches the team's established format — numbered problem-fix sections, technical tables, file-by-file breakdowns, commit lists, and verification checklists. Use this skill whenever the user asks to create a PR, ship code, prepare a merge request, write a PR description, or says anything like "ship to boss", "pr perfect", "make a PR", "prepare PR for merge", "create pull request", "engineer the PR", "PR description", or "ready to push". Also trigger when the user has finished a batch of work and says things like "let's wrap this up", "time to merge", "push this to main", or "get this ready for review". The skill handles everything: commit analysis, description generation, branch creation, and PR submission via gh CLI.

中文简介正在准备中。当前显示原文说明。

Review and resolve PR issues with Qodo - get AI-powered code review issues and fix them interactively (GitHub, GitLab, Bitbucket, Azure DevOps)

中文简介正在准备中。当前显示原文说明。