95 个 · 按相关度排序
Review communication between different websites for security issues. Inspect code and browser behavior to identify overly broad CORS permissions, unchecked message senders, missing request protections, and unsafe redirects, then propose fixes and browser checks.
中文简介正在准备中。当前显示英语简介。
Audit a target's CORS posture — Access-Control-Allow-Origin handling, reflected-origin bypass, credentials+wildcard mismatch, preflight OPTIONS behavior, Vary header correctness. Use when: a third-party integration is failing CORS preflight and someone proposes "just set Allow-Origin to *" as the fix, OR your bug-bounty inbox has a credential-reuse exploit chain. Threshold: any reflection of arbitrary Origin into Allow-Origin, Allow-Credentials:true with wildcard origin (browser-rejected combo but server config wrong), missing Vary:Origin on per-origin responses, preflight cached over 86400s, OR Allow-Origin trust of attacker- controlled subdomain pattern. Trigger with: "audit cors", "check cors policy", "cors bypass", "preflight check".
中文简介正在准备中。当前显示原文说明。
检查Java Spring Boot服务的身份认证、访问权限和输入验证等安全措施，涵盖秘密信息管理、日志、API调用频率限制及依赖库漏洞。
Configure CORS for web APIs. Use when a user asks to fix CORS errors, allow cross-origin requests, configure CORS headers, handle preflight requests, or secure API access from different domains.
中文简介正在准备中。当前显示原文说明。
Verify changes to the copilot-kit-ag-ui demo by building and running its server. Check API routing, cross-origin access settings, and build configuration, then use real credentials to confirm that a requested chart appears.
中文简介正在准备中。当前显示英语简介。
Search HTTP traffic and security findings stored in Burp Suite project files from the command line. Filter response headers or bodies with text patterns, extract affected URLs, and review selected proxy history or site map data.
中文简介正在准备中。当前显示英语简介。
Configures Cross-Origin Resource Sharing with proper headers, preflight handling, and security best practices. Use when users request "CORS setup", "cross-origin requests", "API CORS", "preflight requests", or "CORS headers".
中文简介正在准备中。当前显示原文说明。
Domain routing and boundary guidance for authorized CORS misconfiguration testing, including reflected origins, null origins, subdomain trust, and credential exposure. Use when a task belongs to the CORS testing domain and needs scope, evidence, pivot, or exit criteria.
中文简介正在准备中。当前显示原文说明。
Identify and exploit Cross-Origin Resource Sharing (CORS) misconfigurations. Use this skill when auditing APIs or web applications that share sensitive data across domains, forcing victims' browsers to inadvertently leak private information (e.g., API keys, PII, CSRF tokens) to an attacker-controlled website.
中文简介正在准备中。当前显示原文说明。
Configure Messaging for In-App and Web (MIAW) channels in Service Cloud: Messaging Channel, Embedded Service Deployment, CORS/CSP Trusted Sites, pre-chat fields, session routing by Queue or Omni-Channel Flow, Status-Based capacity, Live Agent migration. Trigger keywords: MessagingChannel, EmbeddedServiceConfig, messagingChannelType, EmbeddedMessaging, sessionHandlerQueue, sessionHandlerFlow, embeddedConfig, automatedResponses, CorsWhitelistOrigin, CspTrustedSite, BrandingSet, MessagingSession, MessagingEndUser, enhanced chat, embedded messaging, chat widget, pre-chat form, auto-response. NOT for an Agentforce agent in the chat window - use agentforce/agent-channel-deployment. NOT for Omni-Channel enablement, Service Channels or skills-based routing - use admin/omni-channel-routing-setup.
中文简介正在准备中。当前显示原文说明。
Review cross-origin isolation, a browser security mode required by features such as SharedArrayBuffer. Check response headers and external resources, identify integrations that could break, and verify that isolation actually works in the browser.
中文简介正在准备中。当前显示英语简介。
Build serverless endpoints that relay external API requests for a dashboard while keeping API keys on the server. Includes Vercel examples for input checks, caching, cross-origin access, and consistent JSON responses.
中文简介正在准备中。当前显示英语简介。
Predict small-molecule binding poses with DiffDock-L (Corso et al. 2023/2024, github.com/gcorso/DiffDock) — blind diffusion docking that places a ligand into a protein pocket without a predefined search box and ranks the samples with a learned confidence model. Reach for this skill to dock a SMILES or SDF against a PDB, to generate ranked 3D poses for a small fragment library, or to get a starting pose for downstream rescoring. DiffDock predicts geometry, not affinity.
中文简介正在准备中。当前显示原文说明。
Hunt CORS Misconfiguration — origin-reflection with credentials, null-origin trust, subdomain-regex bypass (unanchored vs unescaped-dot vs prefix-only), pre-flight (OPTIONS) gating bypass, postMessage origin checks. High only when an attacker-controlled origin can perform a CREDENTIALED cross-origin read of sensitive data and you have proven it in a browser. Use when testing API endpoints, SPAs, or any app emitting Access-Control-* headers.
中文简介正在准备中。当前显示原文说明。
Hunt API security misconfiguration — mass assignment, prototype pollution, HTTP verb tampering. Mass assignment: send {is_admin:true, role:admin, verified:true} on profile/account/reset endpoints — server blindly applies. JWT signature/crypto forging (alg:none, key confusion, kid/jku) is owned by hunt-jwt-crypto; this skill covers only non-crypto JWT handling. Prototype pollution: __proto__ injection in JSON merge / Object.assign / lodash _.merge → polluted prototype reaches sink (RCE in Node, XSS in browser). HTTP verb: GET-bypass-CSRF, X-HTTP-Method-Override, TRACE enabled. Detection: API responses with extra fields, JWTs in headers (decode at jwt.io). CORS misconfiguration (reflect-any-origin, null origin, subdomain-regex bypass, postMessage) is owned by hunt-cors. Use when hunting API misconfigs, mass-assignment, prototype pollution (JWT crypto → hunt-jwt-crypto).
中文简介正在准备中。当前显示原文说明。
CORS misconfiguration testing playbook. Use when analyzing cross-origin trust, credentialed browser reads, origin reflection, preflight policy bugs, and browser-based access to authenticated APIs.
中文简介正在准备中。当前显示原文说明。
Build, manage, and operate APIs with Amazon API Gateway (REST, HTTP, and WebSocket). Triggers on phrases like: API Gateway, REST API, HTTP API, WebSocket API, custom domain, Lambda authorizer, usage plan, throttling, CORS, VPC link, private API. Also covers troubleshooting API Gateway errors (4xx, 5xx, timeout, CORS failures) and IaC templates containing API Gateway resources. For general REST API design unrelated to AWS, do not trigger.
中文简介正在准备中。当前显示原文说明。
Cloudflare Workers security with authentication, CORS, rate limiting, input validation. Use for securing APIs, JWT/API keys, or encountering auth failures, CORS errors, XSS/injection vulnerabilities.
中文简介正在准备中。当前显示原文说明。
Cloudflare R2 S3-compatible object storage. Use for buckets, uploads, CORS, presigned URLs, or encountering R2_ERROR, CORS failures, multipart issues.
中文简介正在准备中。当前显示原文说明。
CORS misconfiguration testing playbook. Use when analyzing cross-origin trust, credentialed browser reads, origin reflection, preflight policy bugs, and browser-based access to authenticated APIs.
中文简介正在准备中。当前显示原文说明。
CORS misconfiguration allows attacker-controlled origins to read sensitive cross-origin responses when servers echo the `Origin` header in `Access-Control-Allow-Origin` or set it to `*` with `Access-Control-Allow-Credentials: true`. Detect via `Origin: https://attacker.com` reflection in `Access-Control-Allow-Origin` response header, wildcard `*` on credentialed endpoints, and null origin acceptance. Tools: OWASP ZAP, Burp Suite, manual `fetch()` with `credentials: include`.
中文简介正在准备中。当前显示原文说明。
Configures CORS policy for development and production
中文简介正在准备中。当前显示原文说明。
Expert debugger for Next.js + Cloudflare Workers + Supabase stacks. Systematic troubleshooting for auth, caching, workers, RLS, CORS, and build issues. Activate on: 'debug', 'not working', 'error', 'broken', '500', '401', '403', 'cache issue', 'RLS', 'CORS'. NOT for: feature development (use language skills), architecture design (use system-architect).
中文简介正在准备中。当前显示原文说明。
Expert debugger for Next.js + Cloudflare Workers + Supabase stacks. Systematic troubleshooting for auth, caching, workers, RLS, CORS, and build issues. Activate on: 'debug', 'not working', 'error', 'broken', '500', '401', '403', 'cache issue', 'RLS', 'CORS'. NOT for: feature development (use language skills), architecture design (use system-architect).
中文简介正在准备中。当前显示原文说明。