6030 个 · 按相关度排序
Produce and maintain repository documentation and release artifacts, including README files, PR descriptions, changelog entries, prompt templates, and instruction docs. Use when the user asks to create or update docs/process files under .github or project root.
中文简介正在准备中。当前显示原文说明。
Create safe, deterministic git worktrees for large or risky workstreams. Use when tasks are complex enough to warrant isolation from the main working tree.
中文简介正在准备中。当前显示原文说明。
Sync shared repo assets into local ~/.github, ~/.codex, and ~/.claude, and apply MCP settings from the shared canonical runtime catalog. Use when runtime assets are stale or after onboarding a new machine.
中文简介正在准备中。当前显示原文说明。
Build and maintain CI/CD pipelines, containerization, Kubernetes manifests, and quality gates. Use when tasks involve Docker, Kubernetes, GitHub Actions/Azure DevOps pipelines, deployment, reliability, or static analysis workflows.
中文简介正在准备中。当前显示原文说明。
Create safe, deterministic git worktrees for large or risky workstreams using the repository-owned runtime helper and Windows-safe defaults.
中文简介正在准备中。当前显示原文说明。
Git commit, branch, and pull request conventions for create-vue-dsfr. Use before creating commits, branches, issues, or PRs. This skill has priority over other project skills for commit and PR work.
中文简介正在准备中。当前显示原文说明。
Display project statistics — phases, plans, requirements, git metrics, and timeline
中文简介正在准备中。当前显示原文说明。
Safe git revert. Roll back phase or plan commits using the phase manifest with dependency checks.
中文简介正在准备中。当前显示原文说明。
Post-mortem investigation for failed GSD workflows — analyzes git history, artifacts, and state to diagnose what went wrong
中文简介正在准备中。当前显示原文说明。
Detects typosquatting attacks in npm and PyPI package registries by analyzing package name similarity using Levenshtein distance and other string metrics, examining publish date heuristics to identify recently created packages mimicking established ones, and flagging download count anomalies where suspicious packages have disproportionately low usage compared to their legitimate targets. The analyst queries the PyPI JSON API and npm registry API to gather package metadata for automated comparison. Activates for requests involving package typosquatting detection, dependency confusion analysis, malicious package identification, or software supply chain threat hunting in package registries.
中文简介正在准备中。当前显示原文说明。
Detect DLL side-loading attacks where adversaries place malicious DLLs alongside legitimate applications to hijack execution flow for defense evasion.
中文简介正在准备中。当前显示原文说明。
Detect abuse of legitimate Windows binaries (LOLBins) used for living off the land attacks. Monitors process creation, command-line arguments, and parent-child relationships to identify suspicious LOLBin execution patterns.
中文简介正在准备中。当前显示原文说明。
Detecting exposed AWS credentials in source code repositories, CI/CD pipelines, and configuration files using TruffleHog, git-secrets, and AWS-native detection mechanisms to prevent credential theft and unauthorized account access.
中文简介正在准备中。当前显示原文说明。
A Certificate Authority (CA) is the trust anchor in a PKI hierarchy, responsible for issuing, signing, and revoking digital certificates. This skill covers building a two-tier CA hierarchy (Root CA +
中文简介正在准备中。当前显示原文说明。
Parses and analyzes the Windows Amcache.hve registry hive to extract evidence of program execution, application installation, and driver loading for digital forensics investigations. Uses Eric Zimmerman's AmcacheParser and Timeline Explorer for artifact extraction, SHA-1 hash correlation with threat intel, and timeline reconstruction. Activates for requests involving Amcache forensics, program execution evidence, Windows artifact analysis, or application compatibility cache investigation.
中文简介正在准备中。当前显示原文说明。
Parse Windows Prefetch files using the windowsprefetch Python library to reconstruct application execution history, detect renamed or masquerading binaries, and identify suspicious program execution patterns.
中文简介正在准备中。当前显示原文说明。
Hand off the current task to the SLICC browser agent, or install a new skill into SLICC from a GitHub repo. Use this skill when the user says things like "handoff to slicc", "move this to slicc", "move to the browser", "test in the browser", "handoff to browser", "install this skill in slicc", "upskill slicc with this repo", "add this skill to slicc", or otherwise asks you to continue the work inside the SLICC browser agent.
中文简介正在准备中。当前显示原文说明。
Creates a new AEM Edge Delivery site from scratch — GitHub repo from the boilerplate, aem-code-sync installation, initial DA content (nav, footer, homepage), and a live preview URL. Use this skill whenever a user wants to create a new AEM Edge Delivery site and no repository or DA content exists yet.
中文简介正在准备中。当前显示原文说明。
Automates releases and package publishing with changesets or semantic-release. Handles versioning, changelog generation, git tags, and release notes. Use for "release automation", "semantic versioning", "package publishing", or "changelog generation".
中文简介正在准备中。当前显示原文说明。
Generates changelogs and release notes from git commits, PR titles, and issue references. Organizes changes by impact type (breaking, features, fixes, improvements), formats according to Keep a Changelog standard, and provides version tagging and semantic versioning suggestions. Use when users request "create changelog", "write release notes", "document version changes", or "prepare release".
中文简介正在准备中。当前显示原文说明。
Use before a tag, GitHub release, or Zenodo archive, when README, CATALOG, CHANGELOG, CITATION.cff, the disclosure aggregate, and skill discovery must agree, or when a go or no-go release verdict needs recorded evidence behind it.
中文简介正在准备中。当前显示原文说明。
Manage git worktrees using a centralized worktrees folder. Use for parallel development, PR reviews, or isolated work.
中文简介正在准备中。当前显示原文说明。
Discover a single-page-app's hidden backend API from its public JS bundle, then test that API for broken access control / missing authentication. One of the highest-yield web plays in modern recon — SPAs ship their entire backend route map to the browser, and the API behind them is frequently missing the auth middleware the login page implies. Built from an authorized engagement where this play found an unauthenticated financial API that an ASM scan reporting hundreds of 'Criticals' completely missed. Use whenever a target serves a JS-heavy SPA (React/Vue/Angular/Next), an 'app'/'console'/'dashboard'/'portal' subdomain, or any `*api*` host shows up in recon. Leaked build artifacts (source maps / .env / .git / asset-manifest) are owned by hunt-source-leak; API version-inventory and behavioral diffing by hunt-shadow-api; this skill owns mapping a live SPA's backend routes from its JS bundle and testing them for broken access control / missing auth.
中文简介正在准备中。当前显示原文说明。
Hunting skill for ssrf vulnerabilities. Built from 15 public bug bounty reports including AWS metadata SSRF (HackerOne $25k Analytics PDF, Shopify Exchange $25k, Capital One 106M-record breach, Dropbox/HelloSign $4,913), GCP metadata SSRF (Snapchat $4k), Azure IMDS SSRF (Azure DevOps $15k chain, ChatGPT Custom Actions MSRC), DNS rebinding SSRF (Concrete CMS, GitLab UrlBlocker), gopher-protocol-to-Redis-RCE (Yahoo Mail $15k), link-preview SSRF (Reddit Matrix $6k), and headless-browser PDF-generator SSRF chains. Use when hunting SSRF on any target — OOB Collaborator confirmation mandatory for blind cases.
中文简介正在准备中。当前显示原文说明。