170 个 · 按相关度排序
Use when pentesting a web application or API — injection, XSS/CSP, SSRF/cloud-metadata, HTTP desync & cache poisoning, SSTI/prototype-pollution/deserialization, JWT/OAuth/GraphQL/IDOR, business logic & single-packet race
中文简介正在准备中。当前显示原文说明。
Use when auditing source code for vulnerabilities — drive CodeQL/Semgrep/Joern to taint untrusted data source-to-sink across injection, memory safety, deserialization/prototype-pollution, secrets/crypto/authz/race, and supply-chain risks
中文简介正在准备中。当前显示原文说明。
Guide Django REST Framework and GeoDjango projects through django-rest-framework-gis installation, GeoJSON serialization, spatial filtering, pagination, OpenAPI schema generation, and backend troubleshooting.
中文简介正在准备中。当前显示原文说明。
Use DocArray for multimodal Pydantic-style documents, typed DocList and DocVec batches, serialization and local storage, FastAPI payloads, and vector retrieval indexes.
中文简介正在准备中。当前显示原文说明。
Route BERTopic topic modeling, embedding, vectorizer, labeling, visualization, and serialization workflows.
中文简介正在准备中。当前显示原文说明。
RCE hunting - template injection, YAML/XML deserialization, dependency confusion, Kubernetes surfaces, CVE-specific exploits (Apache CVE-2021-41773, Spring CVE-2022-22963). OOB-mandatory for blind cases. Wiki-first, FIND schema output.
中文简介正在准备中。当前显示原文说明。
Wiki-first "what do I use" lookup - pick the automated TOOL (wiki/tools/), then the PAYLOAD/technique (wiki/payloads/ + wiki/cheatsheets/), for a surface/service/vuln-class BEFORE hand-rolling or working from memory. Use for "tool for <service>", "automated tools for web/<service>", "what should I run on <surface>", "which tool for <X>", "payloads for <X>", "payload arsenal", "cheatsheet for <X>", "how do I exploit <tech/class>", "exploit/attack chain for <X>", "arsenal", any SSRF/XSS/SQLi/SSTI/LFI/JWT/XXE/IDOR/NoSQL/deserialization/CSRF/CORS/CRLF/GraphQL/smuggling/web-cache/OAuth/SAML/MFA/crypto/LDAP/XPath/WebAuthn/file-upload/IMDS/prompt-injection/Modbus ask, plus "privesc arsenal", "CVE arsenal", "default creds", "nuclei templates", "sqlmap/hydra/nmap/bloodhound", "password attacks".
中文简介正在准备中。当前显示原文说明。
Use when implementing caching, session storage, rate limiting, or any Redis integration. Covers cache-aside pattern, key naming, TTL strategy, and serialization config.
中文简介正在准备中。当前显示原文说明。
Statically analyze code to detect security vulnerabilities including buffer overflows, injection risks (SQL, command, XSS), insecure deserialization, improper authentication, hard-coded credentials, and unsafe cryptography. Use when: (1) Performing security code review, (2) Analyzing code for OWASP Top 10 vulnerabilities, (3) Identifying CWE-classified weaknesses, (4) Generating security audit reports, (5) Reviewing code before deployment, or (6) Assessing third-party code security. Findings categorized by CWE ID and severity (Critical/High/Medium/Low).
中文简介正在准备中。当前显示原文说明。
Proposes secure remediation strategies for detected security vulnerabilities including buffer overflows, injection risks, insecure deserialization, improper authentication, and unsafe cryptographic usage. Provides recommended security checks, safer API alternatives, design-level changes, code examples, trade-off analysis, and prioritized remediation plans. Does NOT automatically modify code unless explicitly requested.
中文简介正在准备中。当前显示原文说明。
Odoo 19 development knowledge base with 18 specialized guides covering Actions (ir.actions.*, cron jobs, server actions), Controllers (HTTP routing, endpoints, auth types), Data files (XML/CSV records, shortcuts, noupdate), API Decorators (@api.depends, @api.constrains, @api.ondelete, @api.onchange, @api.model, @api.private), SQL Constraints (models.Constraint replacing _sql_constraints), Database Indexes (models.Index), Module development (manifest, wizards, reports), Field types (Char, Text, Monetary, relational fields), Manifest configuration (__manifest__.py, dependencies, asset bundles), Mixins (mail.thread, mail.activity.mixin, mail.alias.mixin, utm.mixin), ORM Model methods (search, CRUD, domain filters, recordsets, CamelCase model naming), Migration scripts (pre/post/end hooks, data migration), OWL frontend components (hooks, services, lifecycle), Performance optimization (N+1 prevention, batch ops, _read_group), QWeb Reports (PDF/HTML, paper formats, barcodes, t-out), Security/ACL (record rules, field permissions, privilege-based groups, @api.private), Testing (TransactionCase, HttpCase, mocking, query count assertions), Transactions (savepoints, UniqueViolation, serialization failures), Translations (i18n, PO files, translatable fields), XML Views (list/form/search, kanban card templates, xpath inheritance, QWeb templates). Use when writing, reviewing, or debugging any Odoo 19 Python or XML code, creating or modifying modules, fixing performance issues, or looking up Odoo 19 API patterns and best practices. Includes CSS/SCSS asset authoring and review for Odoo addons.
中文简介正在准备中。当前显示原文说明。
Use when reviewing Java or Kotlin server changes on Spring or Quarkus - security config and method security, JPA/JPQL and JdbcTemplate queries, request binding, deserialization, XML parsers, SpEL, templates, Actuator, JNDI and reflection
中文简介正在准备中。当前显示原文说明。
Use when writing or restructuring Unity C# code - assembly definitions and dependency direction, small components with cached references, ScriptableObjects for data and events, DI instead of singletons, Input System, Addressables, serialization safety and Unity 6 API changes.
中文简介正在准备中。当前显示原文说明。
Neo4j JavaScript/TypeScript Driver v6 — driver lifecycle, executeQuery, managed transactions (executeRead/executeWrite), session.run, Integer handling, JSON serialization, record access, async/await patterns, TypeScript types, error handling, and connection setup for Node.js and browser. Use when writing JS/TS code that connects to Neo4j — neo4j.driver(), executeQuery, executeRead, executeWrite, session.run, neo4j.int, record.get, Integer, BookmarkManager, bolt://, neo4j+s://. Does NOT handle Cypher query authoring — use neo4j-cypher-skill. Does NOT cover driver version migration — use neo4j-migration-skill.
中文简介正在准备中。当前显示原文说明。
Threat-models and hardens an application, API, data flow, dependency, or deployment against authentication and authorization flaws, injection, secrets exposure, unsafe deserialization, SSRF, abuse, privacy loss, and supply-chain risk. Use for security review, threat modeling, hardening, or sensitive changes. Not for generic code style review or an unexplained bug without a security hypothesis.
中文简介正在准备中。当前显示原文说明。
Design a model training pipeline — algorithm selection, cross-validation, and serialization. Use when asked to "train a model for this", "design a training pipeline", or "which algorithm should we use".
中文简介正在准备中。当前显示原文说明。
Measure encoding/decoding throughput across Syrup implementations. This skill provides bandwidth benchmarks for comparing serialization performance.
中文简介正在准备中。当前显示原文说明。
Review a change for security defects such as secret exposure, injection, authentication/authorization failures, unsafe deserialization, and dependency risk. Use for an independent security perspective on a defined change set.
中文简介正在准备中。当前显示原文说明。
Ktor server patterns including routing DSL, plugins, authentication, Koin DI, kotlinx.serialization, WebSockets, and testApplication testing.
中文简介正在准备中。当前显示原文说明。
Apply AuthCrunch coding contracts when creating, modifying, or reviewing repository code. Covers package ownership, dedicated configuration parsers, public APIs, validation, errors, logging, serialization, and security boundaries, and routes to the owning implementation skill.
中文简介正在准备中。当前显示原文说明。
Maintain portal public signing-key discovery at .well-known/jwks.json, reusable admin API directive parsing, opt-in admin private-key export, KMS key serialization, asymmetric issuer selection, base-path routing, and JWT verification tests. Excludes upstream OAuth provider JWKS consumption.
中文简介正在准备中。当前显示原文说明。
Records and replays browser sessions using rrweb recording library with DOM mutation serialization. Integrates with LogRocket API and FullStory Data Export API for session analytics.
中文简介正在准备中。当前显示原文说明。
Exposes Advanced Custom Fields data through the WordPress REST API using register_rest_field and acf_format_value. Handles repeater fields, flexible content layouts, and gallery fields with proper serialization.
中文简介正在准备中。当前显示原文说明。
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for file uploads, imports, previews, archive extraction, format conversion, parser invocation, and deserialization chains. Use when the user asks to inspect an upload or import path, trace archive extraction, preview or converter behavior, explain how a file reaches a parser or deserializer, or connect one uploaded artifact to the decisive backend effect. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
中文简介正在准备中。当前显示原文说明。