Loading...
Loading...
Found 1,089 Skills
Hunt Open Redirect — all types including low-impact, chained to OAuth token theft → ATO, phishing chains. URL parameter manipulation, JavaScript redirect, meta refresh, header injection. Use when hunting redirect bugs or building ATO chains.
Hunt HTML Injection — user-supplied input is rendered as raw HTML in the response without sanitisation, allowing an attacker to inject arbitrary HTML tags (but not necessarily JavaScript). Lower severity than XSS but enables phishing, UI manipulation, and credential harvesting via injected forms. Use when testing text-display surfaces (search results, profile fields, comments, error messages, feedback forms). For markup that executes JavaScript, escalate to hunt-xss.
Pull original ("vanilla") Minecraft textures from Mojang's bedrock-samples repository through the jsDelivr CDN and apply them to Blockbench models, resolving block IDs to per-face files, tinting grayscale grass/leaves/water, tiling large faces, handling flipbooks, and importing the vanilla PBR texture_set (MERS/normal). Use when the user asks for vanilla, default, original, real or Minecraft-accurate textures, names a Minecraft block or material for a model (brick wall, oak log, stone bricks, grass block, wool, glass), wants a model to match the base game, or needs a Bedrock texture name mapped to Java Edition. Works for Bedrock, Java and generic models.
Generates Cucumber BDD tests with Gherkin feature files and step definitions in Java, JavaScript, or Ruby. Use when user mentions "Cucumber", "Gherkin", "Feature/Scenario", "Given/When/Then", "BDD". Triggers on: "Cucumber", "Gherkin", "BDD", "Feature file", "Given/When/Then", "step definitions".
Comprehensive guidance for Hexagonal Architecture (Ports & Adapters)—Alistair Cockburn's pattern with a domain core, port definitions, adapter implementations, and complete Java/Spring Boot implementation steps. Covers primary/driving adapters, secondary/driven adapters, use case ports, repository ports, and dependency injection configuration. Use when the user asks about Hexagonal Architecture, Ports and Adapters, Alistair Cockburn, or needs DDD with clean separation.
Checks whether this computer still trusts the compromised eMudhra certificate chains from the October 2026 incident, and removes that trust everywhere it can. Covers the system trust store, curl, git, every Python with its pip and certifi, Node.js, Java, Go, uv, rustup, Deno, Homebrew, WSL distributions, and lock files, on macOS, Windows, and Linux (Debian/Ubuntu, Fedora/RHEL, Arch, NixOS). Fixes what needs no admin rights, walks the user through one admin script in their own terminal, and re-checks. Asks before every action, labels each one as vetted or improvised, backs up everything it changes, and keeps an undo log. Use when someone asks whether their machine is affected by the eMudhra certificate compromise, asks to remove trust in the compromised eMudhra certificates, mentions the emSign or AAA Certificate Services intermediates or emudhra.we-have-a-problem.com, or invokes /remediate-emudhra-on-my-machine.
Set up, operate, tune, and troubleshoot Minecraft Java 26.x and legacy 1.21.x servers across Paper, Purpur, Folia, Velocity, Fabric, and NeoForge. Use for infrastructure, backups, proxies, and live operations, not plugin or mod development.
Create, edit, and debug vanilla Minecraft 26.x and 1.21.x datapacks, including functions, advancements, recipes, loot tables, predicates, tags, and pack metadata. Use when the deliverable is a datapack file tree without Java or loader APIs.
Write and debug Minecraft Java 26.x and 1.21.x commands, selectors, execute chains, scoreboards, NBT, and RCON scripts. Use for command-only work; use minecraft-datapack for complete datapack structures.
Refactor Express.js/Node.js code to improve maintainability, readability, and adherence to best practices. Transforms callback hell, fat route handlers, and outdated patterns into clean, modern JavaScript/TypeScript code. Applies async/await, controller-service-repository architecture, proper middleware patterns, and ESM modules. Identifies and fixes anti-patterns including blocking event loop, improper error handling, forEach with async callbacks, and memory leaks.
Workflow required before any Mule application upgrade work. Call use_skill as your FIRST action — before reading project files (pom.xml, mule-artifact.json) or editing versions yourself — whenever the user asks to upgrade, migrate, bump, modernize, or move a Mule app to a newer Java version, a newer Mule Runtime version, or both. Covers upgrading Java and/or Mule Runtime, getting latest compatible connector versions, updating connector and plugin versions, and fixing impacts from operation changes in flows, DataWeave scripts, and MUnit tests. Even a targeted single-version bump like 'move this app to Java 17' or 'upgrade the runtime to 4.6' requires this workflow — do not hand-edit pom.xml versions and attempt the change yourself. When you call this skill, it must be the only tool call in that response.
Add particle effects (smoke, fire, sparks, magic, glow, dust, snow, drips, bubbles, bursts) to Blockbench models with MCP tools. Covers Bedrock/Snowstorm particle JSON, presets and design knobs, locators, particle keyframes on animations, Blockbench's Animate-mode preview, and delivery to Bedrock resource packs (client entity particle_effects) and GeckoLib, plus fallbacks for glTF, Java block and Hytale targets that cannot carry particles. Use when a model needs an emitter, VFX, particle effect, locator, Snowstorm file, particle_effects keyframe, or effect polish in a deliverable.