Loading...
Loading...
Found 2,454 Skills
Anti-exploit design, security auditing, and hardening Roblox games. Movement exploits, remote exploitation, economy attacks, DataStore abuse, and server-authority enforcement. Use when designing security systems or auditing code for vulnerabilities.
Backend code quality for clean, production-ready, maintainable code. Adapts to the existing language, framework, and style. Covers functions, reusability, modern syntax, error prevention, readability, and security awareness. Use when writing, reviewing, or refactoring backend code for quality, maintainability, or production readiness.
Catalyst Authentication — user login/signup, ZAID, Web SDK auth flows, and OAuth token management via Connections. Trigger on 'authentication', 'login', 'signup', 'getCurrentUser', 'ZAID', 'isUserAuthenticated', 'signOut', 'Connections', or 'getAccessToken'. You MUST load this skill whenever implementing user login or protecting data — ZAID differs between Development and Production and is the #1 cause of auth failures after environment promotion. For Security Rules (function invocation control), route to catalyst-functions.
Use when implementing Google authentication in a Node.js or Python web application — Google login, OAuth 2.0 flows, verifying Google ID tokens, service account authentication, Application Default Credentials, Google Identity Services, Workload Identity Federation, API keys, or working with google-auth-library (Node.js) or google-auth (Python). Covers ID token verification and security best practices. Triggers - "google auth", "google login", "google sign in", "OAuth 2.0 Google", "google-auth-library", "Sign In with Google", "Google Identity Services", "GIS", "ADC", "Application Default Credentials", "service account", "Google ID token", "verifyIdToken", "GOOGLE_APPLICATION_CREDENTIALS", "Google SSO", "вход через Google", "авторизация Google", "сервисный аккаунт", "проверить ID-токен", "гугл-логин". For end-user web sign-in only, use the google-signin skill instead.
Judge a change before it lands: a branch, a pull request, a diff against a base point, or uncommitted work. Says what was not inspected rather than calling it clean. Covers what was actually asked for, security and abuse paths, whether the tests prove what they claim, broken contracts and callers outside this repository, and stale docs. Every finding at file:line, and it never edits. Use when the user says "review this", "check this before I commit", "does this hold up", or hands over a branch before opening it. Not for explaining code, formatting-only passes, running the linter or tests, or responding to a review of your own work.
Focused Signals scout for PostHog projects collecting Content Security Policy (CSP) violation reports. Watches `$csp_violation` events for fresh blocked-URL clusters, per-directive bursts, page-scoped regressions after deploys, and suspicious third-party domains that may indicate a compromised script. Emits aggregated findings only when a cluster clears the confidence bar; otherwise writes durable memory and closes out empty. Self-contained peer in the signals-scout-* fleet — no dependencies on other skills.
Refactor Flask code to improve maintainability, readability, and adherence to best practices. This skill transforms Flask applications using the application factory pattern, Blueprint organization, and service layer separation. It addresses fat route handlers, missing error handling, improper context local usage, and security issues. Apply when you notice global app instances, routes without Blueprints, business logic in handlers, or missing CSRF protection.
Self-diagnosis skill for 5dive agents. Trigger this skill whenever the user says something is broken, not working, or behaving unexpectedly — or when any tool or command exits with an error. Runs a structured health check covering auth state, service health, disk, memory, recent CLI errors, and skill integrity. Surfaces a root-cause summary so the agent can fix the problem itself instead of asking the user. Also exposes a security audit sub-command for SSH keys, open ports, auth failures, and risky file permissions.
Creates task-oriented technical documentation with progressive disclosure. Use when writing READMEs, API docs, architecture docs, or markdown documentation. Also use this skill at the END of any completed reverse engineering, penetration testing, CTF, or security analysis task to generate a formal report in the user's project directory. Trigger keywords: 写报告, 写文档, 出报告, writeup, 技术文档, report, documentation.
Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.
Provides comprehensive guidance for Spring Security including authentication, authorization, OAuth2, JWT, and security best practices. Use when the user asks about Spring Security, needs to implement security in Spring applications, configure authentication, or work with security features.
Used for authorized security assessments of cloud, container, and Kubernetes environments, including metadata SSRF, IAM misconfiguration, container escape path detection, and cluster RBAC audits.