Discover and exploit mass assignment vulnerabilities in REST APIs to escalate privileges, modify restricted fields,
Detect and exploit NoSQL injection vulnerabilities in MongoDB, CouchDB, and other NoSQL databases to demonstrate
Detect and exploit JavaScript prototype pollution vulnerabilities on both client-side and server-side applications
Detect and exploit race condition vulnerabilities in web applications using Turbo Intruder's single-packet attack
Identifies and exploits SQL injection vulnerabilities in web applications during authorized penetration tests
Detecting and exploiting SQL injection vulnerabilities using sqlmap to extract database contents during authorized
Detecting and exploiting Server-Side Template Injection (SSTI) vulnerabilities across Jinja2, Twig, Freemarker,
Exploit PHP type juggling vulnerabilities caused by loose comparison operators to bypass authentication, circumvent
Expo's official example projects — the expo/examples repo of ~70 `with-*` integrations (Stripe, Clerk, Supabase, OpenAI, maps, Reanimated, SQLite, Skia, NativeWind, and more).
Apply consistent React Native + Expo conventions for project structure, Expo Router navigation, theming primitives, icons, sqlite data patterns, safe area handling, and bun/bunx…
Audit sicurezza OWASP avanzato per pre-lancio. Checklist completa. Trigger: "audit sicurezza", "OWASP", "penetration test", "security review"
Use when adding auth/authz, HTTP-surface hardening, or an OWASP review to a scaffolded FastAPI service after the auth provider decision is approved or deferred.
Guides development of Fastify Node.js backend servers and REST APIs using TypeScript or JavaScript. Use when building, configuring, or debugging a Fastify application — including…
前端质量与安全技能包，涵盖前端安全加固、错误监控集成、前端 CI/CD 流水线、无障碍（a11y）合规。 当需要加固前端安全防护（XSS/CSP/依赖审计）、集成错误监控（Sentry/自研SDK）、搭建前端 CI/CD 流水线（GitHub Actions/GitLab CI/Lighthouse…
Pulls recent run activities from the garmin-givemydata MCP server: triggers garmin_sync to refresh the local SQLite, queries activity IDs in the requested date range, fetches…
SSRF prevention via redirect chain control in HTTP fetch. Block automatic redirect following to internal IPs, validate post-redirect destination, manual redirect handling, and…
Focuses on routing, CSRF protection, context handling, and template usage within the internal handlers directory.
Use when when building a file I/O abstraction layer that must support multiple serialization formats (e.g., uncompressed mzML, gzip-compressed mzML, indexed gzip mzML, or…
Use when you have mass spectrometry data stored in a non-standard format (SQLite database, custom indexed gzip files, or other database backends) and want to enable pymzML's…
Identify and exploit file path traversal (directory traversal) vulnerabilities that allow attackers to read arbitrary files on the server, potentially including sensitive…
Use whenever the user wants to find, shortlist, vet, or enrich US cybersecurity firms — pen-testing/red team, security audits, vCISO, SOC 2 readiness, incident response, managed…
Analyze Firefox bookmarks and tags directly from the places.sqlite database. Extract recent bookmarks, analyze tag popularity, find bookmark statistics, and explore bookmark…
Use when building Flutter/Dart apps, debugging Flutter issues, reviewing Flutter PRs, choosing state management, testing widgets/providers, optimizing Flutter performance, or…
Security hardening superbrain — CWE Top 25, STRIDE threat modeling, Electron hardening, encryption, dependency audits, OWASP compliance
Observability pipeline and CI audit pack. JSONL-to-SQLite trace ingestion and CI workflow validation. 2 observability tools.
Fix security vulnerabilities found by a Strix pentest (open-source CLI or app.strix.ai cloud) — triage by severity, patch the root cause rather than the symptom, and re-run Strix…
Complete guide for using drift database library in Flutter applications. Use when building Flutter apps that need local SQLite database storage with type-safe queries, reactive…
Write a SQL-callable C function or call PostgreSQL fmgr / SPI from C — covers PG_FUNCTION_INFO_V1, PG_GETARG_* / PG_RETURN_*, PG_ARGISNULL, SRF_* set-returning function…
Security patterns for web forms including autocomplete attributes for password managers, CSRF protection, XSS prevention, and input sanitization.
Static security analysis of HTML forms without sending any requests. Checks for CSRF tokens, insecure actions, missing validation, hidden field issues, and common security…
AOSP Part VII — Framework Services. Use when reasoning about PackageManagerService (install/uninstall, APK parsing, permissions, package visibility), ContentProviders (Co — from…
Use when you need to design, review, or improve security in Micronaut applications — including micronaut-security authentication, @Secured and intercept-url-map rules, JW — from…
Use when you need to design, review, or improve security in Spring Boot applications — including SecurityFilterChain, OAuth2/JWT resource server patterns, form login basi — from…
Use when debugging or handling API errors in Frappe/ERPNext v14/v15/v16. Prevents silent failures and wrong HTTP status codes in REST endpoints.
Manage the freshie ecosystem inventory database — a CMDB tracking all plugins, skills, packs, and compliance grades across 50 SQLite tables.
Ultimate 25+ years expert-level frontend skill covering Next.js, React, TypeScript, Tailwind CSS, styled-components, Redux, Zustand, Webpack, Vite, Parcel, Jest/Vitest testing,…
You are a frontend security specialist focusing on Cross-Site Scripting (XSS) vulnerability detection and prevention.
Writing/reviewing client-side UI (React/Vue/vanilla) — insecure-render + client-trust gaps AI ships: XSS via innerHTML, client secrets, client-only auth, CORS wildcard, token in…
Audit frontend codebases for security vulnerabilities and bad practices. Use when performing security reviews, auditing code for XSS/CSRF/DOM vulnerabilities, checking Content…
Expert in secure frontend coding practices specializing in XSS prevention, output sanitization, and client-side security patterns.
Implement data persistence using SQLite with Dapper, JSON files, or event sourcing. Use when: "database", "save data", "store", "CRUD", "create table", "query", "SQL", "SQLite",…
Sets up dynamic security testing — coverage-guided fuzzing of parsers and input handlers (libFuzzer/cargo-fuzz/AFL++/go test -fuzz/atheris) and DAST scanning of a running app…
DB 조회/분석 지원. gandy 쿼리, .gandy 설정, 데이터 수집/분석 워크플로우. Use when querying databases, writing gandy queries, setting up .gandy project config, collecting or analyzing DB data, exploring…
全面的代码安全检查和服务器安全审计skill。适用于：(1) 代码漏洞扫描 - 检测SQL注入、XSS、SSRF等OWASP Top 10漏洞，(2) 依赖安全检查 - 识别过时或有漏洞的第三方库（如React2Shell CVE-2025-55182、Next.js CVE-2025-66478），(3) 服务器配置审计 -…
Generate repository class for SQLite data access with CRUD methods, row mapping, and TypeScript types. Use when creating new database tables or data access layers.
Gerador e executor de quiz sobre conhecimento RAG. Comandos: '/gerar-quiz-rag gerar' para gerar perguntas do banco RAG e salvar em JSON, '/gerar-quiz-rag iniciar' para executar…
Scan, tag, validate, and catalog files using the Ghost Catalog semantic file header system (SOM-XXX-NNNN-vX.X.X).
Add opencode-mem to OpenCode so coding sessions can store, search, and reuse project memories through a local SQLite and vector index.
Echo (LabStack) — Go Web framework リファレンス。routing（Group）、echo.Context、 Bind、Validator、HTTPError、HTTPErrorHandler、middleware（JWT, CORS, CSRF, BasicAuth, Gzip, Recover, Logger,…
Maps a need to the ralvarezdev shared Go modules — restkit, ginkit, pgkit, mcpkit (REST envelope and problem details, gin, Postgres, MCP), identity and identitygin (accounts,…
Security review for Go applications: input validation, SQL injection, authentication/authorization, secrets management, TLS, OWASP Top 10, and secure coding patterns.
Use for generic Go exploit prevention: authz, SSRF, files, commands, crypto, secrets, and supply chain. Do not use for PCI scope.
Review Go code for security vulnerabilities including OWASP Top 10, injection, auth/authz, crypto, secrets, SSRF, XSS, and input validation.
Security best practices and vulnerability prevention for Golang. Covers injection (SQL, command, XSS), cryptography, filesystem safety, network security, cookies, secrets…
Build or incrementally update the code knowledge graph for a codebase. Uses Tree-sitter for multi-language AST parsing and stores nodes/edges in SQLite.
Secure GraphQL APIs - authentication, authorization, rate limiting, and validation
Мгновенный поиск по всему GroveMind через SQLite FTS5. 3012 файлов, 9 категорий. Триггер: «найди», «поищи», «где у нас», «что есть про», «поиск по району», «grove search», «db…
Panduan komprehensif integrasi package explorin/laravel-guard ke berbagai aplikasi host Laravel (WAF perimeter, mitigasi IDOR di controller, auto-banned user database c_status,…
Apply the OWASP API Security Top 10 to REST and GraphQL endpoints. Covers broken object-level authorization (BOLA), mass assignment, excessive data exposure, unrestricted resource…
Audit an inherited or unfamiliar codebase systematically rather than ad-hoc. Covers scope discipline, day-0 triage, SAST and SCA tool recipes (semgrep, CodeQL, gitleaks, trivy),…