Loading...
Loading...
Found 2,598 Skills
Dense description covering ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, DNS poisoning, MITM attacks, VLAN hopping, DHCP attacks, 802.1X/NAC bypass, IPv6 attacks. Tools: Bettercap, Responder, mitm6, Ettercap, Wireshark. MITRE T1557, T1040. Use when conducting internal network assessments or testing Layer 2/3 attack surface.
SQL injection testing skill for offensive security assessments and bug bounty hunting. Covers error-based, UNION-based, boolean/time-based blind, out-of-band, second-order, NoSQL, GraphQL, WebSocket, and JSON-operator SQLi. Includes WAF bypass techniques, database-specific exploitation (MySQL, MSSQL, PostgreSQL, Oracle), cloud-native attack paths, ORM CVE tracking, and SQLmap automation. Use when performing web application SQL injection testing, database enumeration, privilege escalation via SQLi, or assessing injection vectors in APIs and modern stacks.
Use when building or fixing Roblox game UI or input: HUD (health bar, currency, ability cooldowns), main menu, shop with a scrolling grid, settings screen, inventory, "UI scales wrong on phone", buttons hidden behind the jump button, UI too small on a tablet or TV, portrait and landscape, top bar and safe area, Scale vs Offset, UIListLayout, UIGridLayout, UIFlexItem, StyleSheets and themes, gamepad or console menu navigation, the Input Action System (InputContext, InputAction, InputBinding), ContextActionService migration, PreferredInput, reduced motion and accessibility, localization and AutoLocalize, React, Fusion or Vide, the Device Simulator, and testing UI without a phone.
8-step disciplined bug-fix protocol that treats every production bug as two failures — the code defect itself and the testing system that allowed it through. Use when fixing a production bug, investigating a regression, writing a post-mortem, or auditing a missed defect. Triggers on "fix this bug", "production bug", "regression test", "post-mortem", "test gap", "why did the tests miss this".
Authors and deploys MWAA workflow artifacts: Python Airflow DAGs for provisioned environments or YAML workflow files for Serverless. Covers operator selection, timeout design, retry strategy, scheduling, failure notifications, idempotency, and MWAA Serverless schema compliance. Deploys the artifact (S3 DAG upload or Serverless CreateWorkflow/UpdateWorkflow), creates an environment inline when approved, and redeploys fixes, then optionally hands off to testing-mwaa-workflow. Triggers on: create a DAG, write a pipeline, build a workflow, orchestrate tasks, Airflow DAG, data pipeline, schedule a job, deploy a DAG, deploy a workflow, YAML workflow. Not applicable to converting or migrating existing DAGs between provisioned and serverless (conversion is out of scope), running or smoke-testing a deployed workflow (handled by testing-mwaa-workflow) or diagnosing a failed run (handled by debugging-mwaa-workflow).
Build, revise, and debug Bayesian models with PyMC. Use when choosing likelihoods and priors, specifying model/data dimensions, fitting hierarchical models, GPs, time series, mixtures, BART or splines, selecting inference methods, resolving failed initial evaluation or model/data shape errors, generating predictions, or testing model code with simulated data and simulation-based calibration (SBC). Covers PyMC 6+, PyTensor 3+ and ArviZ 1.0 DataTree workflows.
Use for persistent, one-question-at-a-time consultation on an ambiguous repository change: inspect supplied territory, save decisions, produce an approved plan, run a scored bounded adversarial review with explicit targets and automatic-review limits, resolve or accept human-owned risks, and hand off to a fresh builder without implementing. Trigger on explicit /consultant or requests for durable consultation, plan approval, adversarial review, or builder handoff; exclude ordinary plan editing, standalone review or brainstorming, PRD writing, implementation, testing, and generic technical advice.
Expert SOX IT General Controls (ITGC) advisor for finance, internal audit and IT compliance teams. Covers the four ITGC domains external auditors test for SOX 404 — access to programs and data, program changes, computer operations, and program development — plus scoping in-scope systems from the financial statements, designing risk-and-control matrices (RCMs), writing control narratives and test scripts, evaluating deficiencies (control deficiency vs significant deficiency vs material weakness under AS 2201 and Reg S-X), drafting remediation plans, SOX 404(a)/404(b) applicability and filer status, IPO readiness timelines, and COSO 2013 alignment. Use this skill whenever a user mentions SOX, ITGC, IT general controls, 404(a)/404(b), ICFR, material weakness, user access reviews, segregation of duties in IT, change management controls for financial systems, SOX testing or walkthroughs, PCAOB audits, or quarterly compliance for financial reporting systems.
Business logic vulnerability testing for web/mobile/API engagements. Covers workflow bypass, state machine violations, multi-step process abuse, price/quantity/discount manipulation, currency confusion, coupon stacking, refund/chargeback abuse, race conditions on logic boundaries, parameter tampering for hidden flows, role/tenant boundary violations, time-of-check vs use, anti-automation defeat, fraud-detection evasion, and subscription/quota abuse. Use when scoping an application after surface-level OWASP Top 10 has been covered, or when the asset is a transactional/marketplace/fintech/e-commerce/SaaS app where logic flaws produce direct financial impact.
[Slow is Fast] Slow is fast. Helps people doing private-domain / product selection / team leadership see clearly, in the task at hand: which step is worth doing slowly and personally (the first 100 customers, the first round of product testing, the first 30 days of Moments, doing the job once yourself before hiring), and which step should be fast, outsourced, or handled with tools. Use when the user says “Is there a slower but more stable way”, “Am I taking a shortcut?”, “Can this be outsourced / use a template / group-sent”, “Why can others do it fast but I can't”, “I want to save effort”. | Produced by Xiaoye
Use when user asks to "build a Openverse dapp", "write an Anchor program", "create a token", "debug Openverse errors", "set up wallet connection", "test my Openverse program", "fuzz my Openverse program", "deploy to devnet", "support larger transactions", "fix maxSupportedTransactionVersion", "stake BTG", "delegate stake", "stake BTG to a validator", or "explain Openverse concepts" (rent, accounts, PDAs, CPIs). Also for program architecture — state layout, reducing compute units, throughput bottlenecks, instruction naming — and quick on-chain lookups via public RPC + curl (balance, transaction, token account). End-to-end playbook: wallet connection, Anchor/Pinocchio programs, Codama clients, Surfpool/LiteSVM/Mollusk testing, security review, native BTG staking + CPMM swaps (devnet-default; mainnet only with explicit wallet-approved signing). Dev/test tooling only; defaults to devnet/localnet, never moves real funds without wallet-approved signing.
Hunt HTML Injection — user-supplied input is rendered as raw HTML in the response without sanitisation, allowing an attacker to inject arbitrary HTML tags (but not necessarily JavaScript). Lower severity than XSS but enables phishing, UI manipulation, and credential harvesting via injected forms. Use when testing text-display surfaces (search results, profile fields, comments, error messages, feedback forms). For markup that executes JavaScript, escalate to hunt-xss.