Loading...
Loading...
Found 8 Skills
Fix security vulnerabilities found by a Strix pentest (open-source CLI or app.strix.ai cloud) — triage by severity, patch the root cause rather than the symptom, and re-run Strix to prove each fix actually closes the exploit. Handles injection, XSS, SSRF, broken access control, IDOR, and other validated findings. Use after a Strix scan reports findings, or when the user asks to remediate, patch, or fix security issues from a strix_runs report, vulnerabilities.json, findings.sarif, or a cloud scan.
Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.
ActivityPub protocol specification and federation concepts. Use when working with ActivityPub activities, understanding federation mechanics, implementing protocol features, or debugging federation issues.
Verify code for security issues including hardcoded secrets, input validation, error exposure, and dependency vulnerabilities. Use when asked to "verify security", "check for secrets", or "scan for vulnerabilities".
Guidance for filtering JavaScript and XSS attack vectors from HTML while preserving original formatting. This skill should be used when tasks involve removing script content, sanitizing HTML, filtering XSS payloads, or creating security filters that must preserve the original document structure unchanged.
Triage a batch of raw security findings. Verify each is real, collapse duplicates, re-rank by derived exploitability, and tag with an owner. Takes a directory or file of scanner output and writes TRIAGE.json + TRIAGE.md sorted by what actually needs engineering attention. Use when asked to "triage findings", "validate scanner output", "prioritize vulns", or "review the backlog". Runs interactively by default; pass --auto to skip the interview.
Triage and remediate vulnerabilities found by a Strix pentest (open-source CLI or app.strix.ai cloud), then re-run Strix to verify each fix. Use after a Strix scan reports findings, or when the user asks to fix security issues from a strix_runs report, vulnerabilities.json, findings.sarif, or a cloud scan's vulnerabilities.
Convert a token name into a vetted, sized buy order. Two capabilities are exclusive to this skill: resolving a token name or symbol to the correct contract among its copycats, and sizing an order — including amount, slippage, gas fees, and position sizing. No other sibling skill performs either of these functions. USE THIS SKILL when preparing to place a buy order, which may involve a token name/symbol, a purchase amount, or both — including straightforward requests with no mention of verification: "I want to buy 200U worth of PENGU", "Help me buy $500 of BONK", "Buy 1 SOL worth of WIF", "Help me buy some dogwifhat", "I want to go all-in with 100U on XX", "Can I buy PENGU now?", "Is PENGU a good buy?", "Should I dive in?", "Is it worth entering?", "Make sure it's the official token not a copycat before buying", "Buy me $500 of PENGU" — and also applies when a contract address is provided along with a purchase amount. DO NOT USE THIS SKILL for a standalone contract address with no name to resolve and no amount to size (e.g., "Can I buy this token?", "Rate this token", "Due diligence", "Is it a honeypot?", "Rug check", "Is this token safe"): such requests belong to gmgn-contract-dd, the skill that returns a 0-100 safety score. This skill never calculates its own safety verdict — it CALLS gmgn-contract-dd and defers to its judgment — so handling such requests would only result in an unwanted order card for the user. Return to this skill once the user specifies an amount. Buy-related questions about a token launcher instead of the token itself — e.g., "Should I buy this dev's new token?", "Is their next token worth investing in?", "Should I buy his next launch?", "Will this dev rug pull at launch?" — fall under gmgn-dev-score, which evaluates the creator's track record; since there's no token name to resolve or amount to size yet, this skill doesn't apply. Return to this skill once the user names the specific token. Mentioning a token without any buy intent falls under gmgn-market search. gmgn-swap is the endpoint of this skill, not a competitor: gmgn-swap signs and submits transactions, while this skill never touches private keys or places orders. A basic buy request starts HERE and only proceeds to gmgn-swap after the user confirms the order card. Note that gmgn-swap cannot start from a token name either — its --output-token requires a contract address, and it only resolves the currency names SOL/BNB/ETH/USDC — so requests like "Help me buy some dogwifhat" must be handled by this skill regardless of context. Go directly to gmgn-swap only when the user explicitly requests to skip pre-buy checks (e.g., "Skip the checks", "Buy directly", "No due diligence needed", "I'm in a hurry"), or for functions this skill doesn't cover: selling, percentage-based sells, limit orders, stop loss, take profit, trailing orders, multi-wallet batch trading, order status checks, and gas price lookups. The division is based on what the request still requires, not who executes it: if a name needs resolving or an amount needs sizing, start here; if a standalone address only needs a safety verdict, use gmgn-contract-dd; if a signed transaction is needed, it's always gmgn-swap's responsibility.