查找技能

Hunting skill for idor vulnerabilities. Built from 26 public bug bounty reports. Use when hunting idor on any target.

中文简介正在准备中。当前显示原文说明。

Hunting skill for auth bypass vulnerabilities. Built from 12 public bug bounty reports across SAML XSW / parser-differential (GitHub Enterprise CVE-2025-25291/25292), SAML signature stripping (Uber, Rocket.Chat, samlify CVE-2025-47949), SAML domain enforcement bypass via control characters (HackerOne 2024), partner-portal cross-IdP assertion reuse (Slack), WordPress XMLRPC bypassing SSO (Uber), JWT alg-confusion HS256/RS256 (Jitsi), JWT signature-validation skip (Linktree, Newspack), and token-audience confusion (Argo CD CVE-2023-22482). For standalone JWT signature/crypto forging (alg:none, key confusion, kid/jku) see hunt-jwt-crypto; this skill covers JWT only inside SSO/SAML/token-trust bypass chains. SAML assertion-layer attacks (XSW, comment injection, signature stripping, XXE-in-assertion) are owned by hunt-saml; this skill owns the broader cross-protocol auth-bypass taxonomy. Use when hunting auth bypass — see the Legacy-Protocol Matrix for branded-UI vs legacy-endpoint patterns.

中文简介正在准备中。当前显示原文说明。

Hunting skill for cache poison vulnerabilities. Built from 10 public bug bounty reports including X-Forwarded-Host poisoning, X-HTTP-Method-Override / GCS cache, reflected→stored XSS via cache, classic Omer-Gil Web Cache Deception, Cloudflare Cache Deception Armor bypass, session-token cache deception, Akamai hop-by-hop smuggling → server-side edge poisoning, and Kettle's 2024 path-normalization WCD against Cloudflare/Fastly/GCP. Host/X-Forwarded-Host injection that reaches app logic (reset-link poisoning, routing SSRF, OAuth issuer) is owned by hunt-host-header; this skill owns the case where the poisoned response is CACHED and served to other users. Use when hunting cache poisoning, Web Cache Deception, CDN-fronted apps.

中文简介正在准备中。当前显示原文说明。

Scrape and extract public data from 27+ social media platforms using the ScrapeCreators REST API. Covers TikTok, Instagram, YouTube, LinkedIn, Facebook, Twitter/X, Reddit, Threads, Bluesky, Pinterest, Snapchat, Twitch, Kick, Truth Social, TikTok Shop, Google, and link-in-bio services (Linktree, Komi, Pillar, Linkbio, Linkme, Amazon Shop). Use when the user asks to scrape, fetch, extract, search, or look up social media profiles, posts, videos, reels, comments, transcripts, followers, ads, hashtags, trending content, or engagement metrics from any social platform. Also use when user mentions ScrapeCreators, social media API, ad library, or creator data.

中文简介正在准备中。当前显示原文说明。

E-commerce SEO audit for online stores (WooCommerce, Shopify, Magento, custom). Covers category / product listing pages (PLP), product detail pages (PDP), faceted navigation and its crawl-budget and duplicate-content traps, pagination, canonicals for variants and filters, out-of-stock / discontinued products, internal linking and breadcrumbs, and Product / Offer / Review / AggregateRating / BreadcrumbList structured data. Use whenever the user runs an online store and asks about product or category page SEO, filter URLs being indexed, product rich results, or thin/duplicate product pages. Trigger on: "e-commerce SEO", "ecommerce SEO", "product page SEO", "category page SEO", "WooCommerce SEO", "Shopify SEO", "faceted navigation", "filter URLs in Google", "product schema", "rich snippets for products", "out of stock SEO", "duplicate product pages". For a single URL use /seo-page; for full-site use /seo-analysis.

中文简介正在准备中。当前显示原文说明。

Lightweight green/red status panel for every configured integration. No gather, no actions.

中文简介正在准备中。当前显示原文说明。

Shopify store command center. Orders, inventory, fulfillment, analytics, and store health. Works with any Shopify store via Admin API.

中文简介正在准备中。当前显示原文说明。

Interactive setup wizard for the claude-ops plugin. Installs missing CLIs, configures env vars for each channel (Telegram, WhatsApp, Email, Slack, Notion, Linear, Sentry, Vercel), builds the project registry, and saves user preferences. Run once after installing the plugin or any time to reconfigure.

中文简介正在准备中。当前显示原文说明。

Post-setup credential manager. Shows current integration status (configured/missing/expired) and lets you update individual credentials without re-running the full setup wizard. Runs a smoke test after each update.

中文简介正在准备中。当前显示原文说明。

Revenue and costs tracker. AWS spend via aws ce, credits tracker, project revenue stages. Shows burn rate, runway estimate, credits expiring.

中文简介正在准备中。当前显示原文说明。

Automate Shopify tasks via Rube MCP (Composio): products, orders, customers, inventory, collections. Always search tools first for current schemas.

中文简介正在准备中。当前显示原文说明。

Use when the user asks to "check technical SEO"; audits crawlability, indexing, Core Web Vitals, robots.txt, sitemaps, canonicals, redirects, and migrations. Not for on-page tags or content — use on-page-seo-checker. 技术SEO/网站速度

中文简介正在准备中。当前显示原文说明。

Build animations in React Native and Expo, making the decisions in the order that determines whether they feel right — should it animate, which thread it runs on, which properties, spring or timing, how the gesture hands off, how it degrades. Writes the implementation with Reanimated, Gesture Handler, Expo Router and expo-haptics. Use when animating anything in an Expo app, adding gestures, sheets, screen transitions, press feedback or haptics, or fixing motion that stutters on device. For web animation use `animate`.

中文简介正在准备中。当前显示原文说明。

Extract, suggest, and sync tags and categories for blog posts across all major CMS platforms. Supports WordPress REST API, Shopify GraphQL, Ghost Content API, Strapi REST/GraphQL, and Sanity GROQ. Generates tag suggestions from content analysis (keyword frequency, heading extraction, semantic grouping), enforces minimum post-count thresholds to prevent thin tag archives, and syncs taxonomy via authenticated API calls. Use when user says "tags", "categories", "taxonomy", "tag suggestions", "sync tags", "WordPress tags", "Shopify tags".

中文简介正在准备中。当前显示原文说明。

Suggest tags and categories for a blog post from its content, audit a site's tag and category health, and, only after the user approves a shown plan, sync tags and categories to WordPress, Shopify, Ghost, Strapi, or Sanity. suggest and audit are read-only; sync is dry-run by default and never deletes, merges, or edits post content. Use when the user says "tag suggestions", "taxonomy audit", "sync tags", "WordPress tags", "Shopify tags". Not for keyword research (blog-brief) or schema markup (blog-schema).

中文简介正在准备中。当前显示原文说明。

Build Shopify applications, extensions, and themes using GraphQL/REST APIs, Shopify CLI, Polaris UI components, and Liquid templating. Capabilities include app development with OAuth authentication, checkout UI extensions for customizing checkout flow, admin UI extensions for dashboard integration, POS extensions for retail, theme development with Liquid, webhook management, billing API integration, product/order/customer management. Use when building Shopify apps, implementing checkout customizations, creating admin interfaces, developing themes, integrating payment processing, managing store data via APIs, or extending Shopify functionality.

中文简介正在准备中。当前显示原文说明。

1:1 rebuild of award-winning creative websites (WebGL / scroll-animation / portfolio sites). Evidence-driven pipeline - mirror-first forensics, line-number-traceable reverse engineering of minified bundles, verbatim porting, quantitative verification gates. Use when user asks to "复刻网站", "重建网站", "1:1 rebuild", "clone this site", or provides a URL of a creative/award site to reproduce.

中文简介正在准备中。当前显示原文说明。

Write a product listing for an overseas marketplace or store, localised for the buyer rather than translated from Chinese: title, bullet points, description, search terms and the compliance claims that must or must not appear. Use when asked 帮我写亚马逊 listing, 跨境电商标题, write a product listing for Amazon, TikTok Shop, Shopee, Lazada, Etsy or Shopify, or localise my listing for the US, UK, Germany or Japan. Produces the listing in the target language within the platform's field limits, a keyword map, a compliance check of every claim, and a list of images the listing needs.

中文简介正在准备中。当前显示原文说明。

Help users build a professional eye for quality, articulate the reasoning behind successful product paradigms, and develop the conviction to make high-stakes decisions before data is available.

中文简介正在准备中。当前显示原文说明。

Work with your Shopify store: view orders, products, customers; create products and discounts (with confirmation). No order or customer writes. Trigger phrases: shopify, shopify orders, shopify store, shopify discount.

中文简介正在准备中。当前显示原文说明。

This skill should be used when the user asks to "agentize a website", "transform a website", "create an agentfront", "build a WWA app", "make an agent-first website", "turn a website into an agent experience", "agentizer", "wwa transform", or mentions "agentfront" in context of building one from a URL.

中文简介正在准备中。当前显示原文说明。

Anti-slop frontend skill for landing pages, portfolios, and redesigns. The agent reads the brief, infers the right design direction, and ships interfaces that do not look templated. Real design systems when applicable, audit-first on redesigns, strict pre-flight check.

中文简介正在准备中。当前显示原文说明。

Generates Instagram-ready product reels from any e-commerce product page URL. Scrapes product images, classifies by type, generates AI-animated clips via Higgsfield API, creates text overlays with style presets, and composes a 15-20 second reel with music. Supports model-based and product-only reels.

中文简介正在准备中。当前显示原文说明。

Find Twitter/X influencers to promote a product or brand. Use when asked to find influencers, discover Twitter accounts for partnerships, identify creators in a niche, or build an influencer outreach list.

中文简介正在准备中。当前显示原文说明。