353 个 · 按相关度排序
Add custom metadata headers (x-amz-meta-*) to AWS v4 signed requests for GCS S3-compatible API. Use when: (1) Adding custom metadata to GCS uploads via S3 API, (2) Getting signature mismatch errors after adding new headers, (3) x-amz-meta-* headers being ignored or causing 403 errors. Custom headers MUST be included in canonical headers and signed headers list.
中文简介正在准备中。当前显示原文说明。
Analyze HTTP security headers of web domains to identify vulnerabilities and misconfigurations. Use when you need to audit website security headers, assess header compliance, or get security recommendations for web applications. Trigger with phrases like "analyze security headers", "check HTTP headers", "audit website security headers", or "evaluate CSP and HSTS configuration".
中文简介正在准备中。当前显示原文说明。
Trace how requests travel through a CTF sandbox, from hostnames and proxy rules to containers and processes. Compare headers and live traffic to identify which service handles a request and what changes its destination.
中文简介正在准备中。当前显示英语简介。
Review HSTS, a browser policy that keeps site connections on HTTPS. Check response headers, policy duration, and subdomain coverage, guide server or CDN configuration, and explain the precautions needed before enabling browser preloading.
中文简介正在准备中。当前显示英语简介。
Examine Outlook PST and OST archives to extract messages, headers, attachments, and recoverable deleted items. Use the extracted records to trace email routing, reconstruct communication patterns, and support incident investigations or legal evidence review.
中文简介正在准备中。当前显示英语简介。
Helps add Apache 2.0 license headers to new Apache Beam files using the correct comment format and placement. Covers source files, configuration, documentation, and local checks for missing license notices.
中文简介正在准备中。当前显示英语简介。
Inspects and configures the security headers a Power Pages site sends to browsers — Content Security Policy, frame and clickjacking protection, cross-origin sharing, cookie behavior, and related site settings. Identifies gaps and walks the user through fixes. Use when the user wants to review headers, fix CSP errors, allow embedding in another site, control cross-origin access, harden cookie settings, or asks "are my browser settings safe?", "fix my CSP", "set up CORS" — even if they only mention a specific header name without saying "security headers".
中文简介正在准备中。当前显示原文说明。
Implements security headers and Content Security Policy with safe rollout strategy (report-only → enforce), testing, and compatibility checks. Use for "security headers", "CSP", "HTTP headers", or "XSS protection".
中文简介正在准备中。当前显示原文说明。
Review HTTP response headers and restrict browser features an application does not need, such as camera, microphone, and location access. Guide Permissions-Policy settings that limit what attackers could use if the site is compromised.
中文简介正在准备中。当前显示英语简介。
Review Referrer-Policy settings to limit sensitive URL details shared when visitors follow external links. Check response headers and pages containing private parameters, suggest suitable policy values, and explain how to verify the resulting browser behavior.
中文简介正在准备中。当前显示英语简介。
Compare how proxies and backend servers interpret HTTP requests in a CTF sandbox. Use paired requests and logs to pinpoint differences in paths, headers, or message boundaries, then document a minimal reproduction of unintended routing.
中文简介正在准备中。当前显示英语简介。
Trace how JWT, JWS, and JWE tokens become accepted identities or privileges in a CTF sandbox. Examine headers, key selection, and claims, the token's attributes, then preserve a minimal reproducible path demonstrating validation confusion.
中文简介正在准备中。当前显示英语简介。
Analyze suspicious email headers to trace delivery routes and assess sender spoofing. Review SPF, DKIM, and DMARC sender authentication results, compare sender and reply addresses, and examine links and attachment hashes for phishing indicators.
中文简介正在准备中。当前显示英语简介。
Extract data from Excel sheets with misplaced headers, merged header cells, or introductory rows. Uses text patterns to locate headers, clean column names, and remove empty rows so the data can be processed with pandas.
中文简介正在准备中。当前显示英语简介。
Search HTTP traffic and security findings stored in Burp Suite project files from the command line. Filter response headers or bodies with text patterns, extract affected URLs, and review selected proxy history or site map data.
中文简介正在准备中。当前显示英语简介。
Draw SVG illustrations of collaboration, commuting, and focused work using black lines and halftone dots, small dots that create shading. Produce monochrome artwork with hand-drawn contours for onboarding screens, empty states, blog headers, and marketing cards.
中文简介正在准备中。当前显示英语简介。
Implement HTTP headers that pass GitHub Actions secrets through environment variables in gh-aw’s copilot engine. This reference explains secret extraction, generated MCP configuration, execution-step settings, and tests for keeping secret values out of configuration files.
中文简介正在准备中。当前显示英语简介。
The exact column header names required by the TRES Finance bulk transaction CSV upload. Use whenever building, fixing, or validating the header row of a TRES manual transaction or sub-transaction upload CSV — especially after an upload fails with "Missing required column(s): ...". Trigger phrases include: 'fix my CSV headers', 'bulk transaction upload failed', 'missing required columns', 'validate TRES upload CSV', 'transaction CSV template headers'. This skill is ONLY about the header naming convention; it does not cover row values or upload workflow. Do NOT trigger for contacts import CSV (use tres-import-contacts), wallet upload CSV (use tres-wallets-upload), or general CSV parsing unrelated to bulk TX upload headers.
中文简介正在准备中。当前显示原文说明。
Fix misleading HTTP response header values when debugging with curl -I or curl -sI. Use when: (1) Response headers differ between curl testing and actual browser/client behavior, (2) Cache-Control or other headers show unexpected values despite correct middleware code, (3) Server-side middleware that only applies to GET requests appears to not work when testing with curl -I. The -I flag sends HEAD requests, and middleware that checks for GET method will skip processing, returning handler-level headers instead of middleware-overridden ones.
中文简介正在准备中。当前显示原文说明。
Use when the diff reads Host or X-Forwarded-* headers, configures trusted proxies, builds absolute URLs or response headers from input, sets cache headers or CDN/reverse-proxy cache rules, or changes an ingress, auth proxy or custom HTTP parser - host and forwarded-header trust, cache poisoning and deception, header injection, trusted-proxy bypass and request framing
中文简介正在准备中。当前显示原文说明。
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for reverse proxies, Host headers, forwarded headers, vhost routing, websocket upgrades, path-prefix rewriting, base-URL derivation, and multi-node route resolution. Use when the user asks which host or container serves a route, why a public-looking domain still belongs to the sandbox, how headers or proxies change behavior, or how a route resolves across proxy, container, and worker boundaries. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
中文简介正在准备中。当前显示原文说明。
Configure Nginx as a web server and reverse proxy. Covers static file serving, reverse proxy to upstream services, SSL/TLS termination with Let's Encrypt, location blocks, load balancing, rate limiting, and security headers. Use when serving static files in production, reverse proxying to backend services (Node.js, Python, R/Shiny), terminating SSL/TLS, load balancing across instances, or adding rate limiting and security headers to harden an endpoint.
中文简介正在准备中。当前显示原文说明。
Use when designing or fixing a Content Security Policy on a real site, choosing between nonce-based and hash-based CSP, adding strict-dynamic, debugging "Refused to execute inline script" errors, deploying CSP in report-only mode first, configuring report-to / report-uri, or auditing an existing policy for unsafe-inline / unsafe-eval / wildcards. Triggers: "CSP blocks legitimate inline script", strict-dynamic, nonce-{RANDOM}, sha256-{HASH}, object-src none, base-uri none, frame-ancestors, Trusted Types, X-Content-Security-Policy obsolete, report-only vs enforced. NOT for general HTTP security headers (HSTS, COOP/COEP), Trusted Types deep dive, CORS configuration, or building a WAF.
中文简介正在准备中。当前显示原文说明。
Use when designing or fixing a Content Security Policy on a real site, choosing between nonce-based and hash-based CSP, adding strict-dynamic, debugging "Refused to execute inline script" errors, deploying CSP in report-only mode first, configuring report-to / report-uri, or auditing an existing policy for unsafe-inline / unsafe-eval / wildcards. Triggers: "CSP blocks legitimate inline script", strict-dynamic, nonce-{RANDOM}, sha256-{HASH}, object-src none, base-uri none, frame-ancestors, Trusted Types, X-Content-Security-Policy obsolete, report-only vs enforced. NOT for general HTTP security headers (HSTS, COOP/COEP), Trusted Types deep dive, CORS configuration, or building a WAF.
中文简介正在准备中。当前显示原文说明。