Skills
18,283 skills, most installed first.
Browse
analyzing-sbom-for-supply-chain-vulnerabilitiesmukul975Parses Software Bill of Materials (SBOM) in CycloneDX and SPDX JSON formats to identify supply chain vulnerabilities by correlating components against the NVD CVE database via the NVD 2.0 API. Builds dependency graphs, calculates risk scores, identifies transitive vulnerability paths, and generates compliance reports. Activates for requests involving SBOM analysis, software composition analysis, supply chain security assessment, dependency vulnerability scanning, CycloneDX/SPDX parsing, or CVE canalyzing-web-server-logs-for-intrusionmukul975Parse Apache and Nginx access logs to detect SQL injection attempts, local file inclusion, directory traversal, web scanner fingerprints, and brute-force patterns. Uses regex-based pattern matching against OWASP attack signatures, GeoIP enrichment for source attribution, and statistical anomaly detection for request frequency and response size outliers.conducting-api-security-testingmukul975Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validation, and business logic. The tester uses the OWASP API Security Top 10 as the testing framework, combining Burp Suite interception with Postman collections and custom scripts to test endpoint security at every privilege level. Activates for requests involving API security testing, REST API pentest, GraphQL security assessment, or API vulnerability teexploiting-sql-injection-vulnerabilitiesmukul975Identifies and exploits SQL injection vulnerabilities in web applications during authorized penetration tests using manual techniques and automated tools like sqlmap. The tester detects injection points through error-based, union-based, blind boolean, and time-based blind techniques across all major database engines (MySQL, PostgreSQL, MSSQL, Oracle) to demonstrate data extraction, authentication bypass, and potential remote code execution. Activates for requests involving SQL injection testing,performing-web-application-penetration-testmukul975Performs systematic security testing of web applications following the OWASP Web Security Testing Guide (WSTG) methodology to identify vulnerabilities in authentication, authorization, input validation, session management, and business logic. The tester uses Burp Suite as the primary interception proxy alongside manual testing techniques to find flaws that automated scanners miss. Activates for requests involving web app pentest, OWASP testing, application security assessment, or web vulnerabiliperforming-web-application-vulnerability-triagemukul975Triages web application vulnerability findings from DAST/SAST scanners such as Burp Suite and ZAP, using the OWASP Risk Rating Methodology to confirm true positives, dismiss false positives, and prioritize remediation. Use when reviewing scanner output to reduce alert fatigue and rank vulnerabilities for development teams to fix.reverse-engineering-android-malware-with-jadxmukul975Reverse engineers malicious Android APK files using the JADX decompiler to read Java/Kotlin source, inspect manifest permissions, receivers, services, and native libraries, and identify data theft, C2 communication, privilege escalation, or overlay-attack behavior. Use when analyzing a suspected Android banking trojan, spyware, SMS stealer, or other flagged APK, or when investigating mobile malware or Android threats generally. 'testing-api-authentication-weaknessesmukul975Tests API authentication mechanisms for weaknesses including broken token validation, missing authentication on endpoints, weak password policies, credential stuffing susceptibility, token leakage in URLs or logs, and session management flaws. The tester evaluates JWT implementation, API key handling, OAuth flows, and session token entropy to identify authentication bypasses. Maps to OWASP API2:2023 Broken Authentication. Activates for requests involving API authentication testing, token validattesting-api-for-broken-object-level-authorizationmukul975Tests REST and GraphQL APIs for Broken Object Level Authorization (BOLA/IDOR, OWASP API1:2023) by intercepting API calls, identifying object ID parameters (numeric IDs, UUIDs, slugs), and systematically substituting IDs belonging to other users to check whether the server enforces per-object authorization. Use when asked to test BOLA or IDOR in an API, verify object-level authorization, or assess an API for access control bypass. 'testing-api-security-with-owasp-top-10mukul975Systematically assesses REST, GraphQL, and gRPC API endpoints against the OWASP API Security Top 10 (2023) using Burp Suite and Postman for automated and manual testing. Use during authorized API penetration tests, before deploying new endpoints to production, or when validating API gateway controls and rate limiting.testing-cors-misconfigurationmukul975Identifying and exploiting Cross-Origin Resource Sharing misconfigurations that allow unauthorized cross-domain data access and credential theft during security assessments.testing-for-broken-access-controlmukul975Systematically tests web applications and APIs for broken access control (OWASP A01:2021), including privilege escalation, missing function-level checks, insecure direct object references, and multi-tenant data leakage, using Burp Suite with the Authorize extension. Use during authorized penetration tests or RBAC/multi-tenant authorization audits.testing-for-json-web-token-vulnerabilitiesmukul975Tests JWT implementations for algorithm confusion, "none" algorithm bypass, kid/jku parameter injection, and weak secret exploitation using jwt_tool and Burp Suite's JWT Editor extension, aiming to achieve authentication bypass and privilege escalation. Use when assessing JWT-based auth/session management, OAuth2/OIDC token handling, or SSO systems during a security engagement.testing-for-xss-vulnerabilitiesmukul975Tests web applications for reflected, stored, and DOM-based Cross-Site Scripting by injecting JavaScript payloads with Burp Suite (XSS extensions, Active Scan++) and browser tools, then bypassing sanitization and CSP to demonstrate session hijacking and user impersonation. Use for OWASP WSTG client-side injection testing or when evaluating input sanitization and output encoding coverage.testing-jwt-token-securitymukul975Assessing JSON Web Token implementations for cryptographic weaknesses, algorithm confusion attacks, and authorization bypass vulnerabilities during security engagements.hand-drawn-diagramsmuthuishereCreate hand-drawn Excalidraw diagrams, flows, explainers, wireframes, and page mockups. Default to monochrome sketch output; allow restrained color only for page mockups when the user explicitly wants webpage-like fidelity. Use when the user asks for a diagram, flowchart, wireframe, sketch, visual explanation, mind map, architecture overview, or any Excalidraw-based drawing.pp-airbnbmvanhornSkip the Airbnb platform fee. Find the host's direct booking site for any Airbnb listing. Trigger phrases: `find the direct booking site`, `skip the airbnb fee`, `vacation rental cheapest`, `book direct`, `use airbnb-pp`, `run airbnb-pp`. NOTE: VRBO support is currently disabled — pending Akamai workaround.pp-archive-ismvanhornUse this skill whenever the user wants to archive a URL, bypass a paywall, look up an existing archive, view a cached version of a webpage, pull article text from archive.today or the Wayback Machine, or batch-archive a list of URLs. archive.today + Wayback Machine CLI with lookup-before-submit, automatic fallback when one backend is down, and agent-friendly output. No API key required. Triggers on phrasings like 'archive this article', 'bypass the paywall on this link', 'grab the cached text', pp-booking-commvanhornEvery Booking.com workflow, plus offline price history, wishlist drop alerts, and multi-leg planning no other... Trigger phrases: `search booking.com for hotels in`, `what's the cheapest week to stay in`, `track price drops on my booking.com wishlist`, `compare these two hotels`, `are any of my booking trips about to lose free cancellation`, `plan a multi-city trip on booking.com`, `use booking-com`, `run booking-com`.pp-coingeckomvanhornPrinting Press CLI for Coingecko. CoinGecko public API for cryptocurrency data. Free tier, no API key required for basic endpoints.pp-company-goatmvanhornLook up startups across SEC Form D, GitHub, Hacker News, Companies House, YC, and Wikidata in one command — including the SEC fundraising data hidden behind paid Crunchbase tiers. Trigger phrases: `look up this startup`, `research <company>`, `what does <company> do`, `form D for <company>`, `is <company> still active`, `compare <a> and <b>`, `use company-goat`, `run company-goat-pp-cli`.pp-contact-goatmvanhornSuper LinkedIn for the terminal. Search, enrich, and map warm-intro paths across LinkedIn (stickerdaniel/linkedin-mcp-server subprocess), Happenstance (cookie-first free quota with bearer-API fallback), and Deepline (paid enrichment). Two Happenstance auth surfaces coexist: Chrome cookie session (free monthly allocation) and HAPPENSTANCE_API_KEY bearer (paid credits, deeper schema). Use when the user asks who they know at a company, how to get a warm intro, who to prospect, or wants cross-sourcepp-craigslistmvanhornThe local-first Craigslist watcher and triage tool that knows what's a repost, what's a scam, and what just dropped in price. Trigger phrases: `watch craigslist for`, `find new listings on craigslist`, `craigslist deal alert`, `scan craigslist across cities`, `craigslist repost`, `craigslist scam check`, `use craigslist-pp-cli`, `run craigslist-pp`.pp-figmamvanhornEvery Figma endpoint, plus codegen-ready frame extracts, comments audit, orphans finder, tokens diff Trigger phrases: `extract a figma frame for codegen`, `compact figma file context for AI`, `find unresolved figma comments`, `figma stale components`, `diff figma design tokens`, `figma file fingerprint for CI`, `replay figma webhook deliveries`, `where is this figma variable used`, `use figma`, `run figma-pp-cli`.pp-firecrawlmvanhornPrinting Press CLI for Firecrawl. API for interacting with Firecrawl services to perform web scraping and crawling tasks.pp-google-search-consolemvanhornEvery Google Search Console feature you'd reach for, plus an offline SQLite cache that powers period compare, quick... Trigger phrases: `search console performance for example.com`, `quick wins for sc-domain:example.com`, `cannibalization audit on this site`, `compare last 28 days to prior period in GSC`, `why did traffic drop on this property`, `which pages are decaying`, `use google-search-console`, `run gsc`.pp-hackernewsmvanhornHacker News from your terminal — with a local SQLite store, snapshot history, and agent-native output no other HN tool has. Trigger phrases: `check hacker news`, `search hn`, `what is hn saying about`, `diff the hn front page`, `pulse on hn`, `look up hn user`, `hn who is hiring`, `hn top stories`, `use hackernews`, `run hackernews`.pp-linearmvanhornOffline-capable, agent-native Linear CLI with SQLite-backed sync, FTS5 search, cross-cycle comparison, project... Trigger phrases: `what's on my Linear plate today`, `Linear sprint plan for the team`, `Linear cycle comparison`, `Linear burndown for the project`, `which Linear milestone is at risk`, `stale Linear issues`, `clean up the Linear test tickets I created`, `use linear-pp-cli`, `run linear-pp-cli`.pp-scrape-creatorsmvanhornEvery Scrape Creators endpoint across 28 platforms, with credit-aware comment mining and a local corpus no other Scrape Creators tool has. Trigger phrases: `find which platforms a creator is on`, `pull the comments and replies from this post`, `monitor a brand's ads`, `search creator transcripts for a keyword`, `how many credits would this sweep cost`, `use scrape creators`, `run scrape-creators`.pp-weather-goatmvanhornUse this skill whenever the user asks about weather, forecasts, temperature, rain, storms, severe weather alerts, air quality, pollen, UV, or wants an activity recommendation (can I walk / bike / hike / commute / drive given the weather). Weather CLI powered by Open-Meteo (global, no auth, unlimited) + NWS (US severe weather). No API key. Triggers on phrasings like 'what's the weather', 'is it going to rain today', 'any storms coming', 'should I bike to work', 'how's the air quality', 'compare Npp-wikipediamvanhornPrinting Press CLI for Wikipedia. Wikipedia REST API. Get article summaries, search, browse related topics, and access on-this-day events. No...pp-x-twittermvanhornOffline-searchable X/Twitter CLI and MCP surface for archiving posts, resolving links, monitoring mentions, composing threads, publishing Articles, and searching synced bookmarks. Trigger phrases: `search X for`, `archive tweets about`, `show me the X thread for`, `monitor my X mentions`, `post a thread to X`, `use x-twitter`, `run x-twitter-pp-cli`.pp-yahoo-financemvanhornEvery Yahoo Finance endpoint plus a SQLite portfolio, covered-call screener Trigger phrases: `quote AAPL`, `options on TSLA`, `what's my portfolio doing`, `dividend income this year`, `screen for value stocks`, `daily market briefing`, `use yahoo-finance`, `run yahoo-finance`.pp-youtubemvanhornA self-maintained competitor-monitoring machine for YouTube: the read surfaces that matter for market and competitor research plus a local databank of channel histories, snapshots, comments, and packaging assets - market data hours old, not weeks. Trigger phrases: `monitor my youtube competitors`, `which competitor videos are gaining views right now`, `find fresh breakout videos in a niche`, `youtube packaging and thumbnail analysis data`, `mine youtube comments for audience signal`, `new niche dokie-ai-pptmyzy-aiAI presentation generator. Create professional HTML slides through conversation. Triggers: create/edit PPT, presentation, slides, deck, keynote, pitch deck, quarterly report, product intro, training materials, roadshow, work report. Core: requirement analysis, outline generation, theme selection, HTML slide generation, local preview.app-intentsn0anWrites and reviews Swift App Intents code that exposes app actions and data to Siri, Shortcuts, Spotlight, widgets, Control Center, and Apple Intelligence. Use when adding AppIntent, AppEntity, OpenIntent, AppShortcutsProvider, EntityQuery, Focus Filters, AssistantEntity/AssistantIntent schemas, on-screen awareness, LongRunningIntent/CancellableIntent, EntityCollection, SyncableEntity, AppIntentsTesting, or when wiring SwiftData/networked data into intents.swift-format-stylen0anWrites and reviews Swift FormatStyle code, replacing legacy Formatter subclasses and C-style String(format:) with modern .formatted() APIs. Use when formatting numbers, dates, durations, measurements, lists, names, byte counts, or URLs.n8n:content-designn8n-ioProduct content designer for UI copy. Use when writing, reviewing, or auditing user-facing text: button labels, error messages, tooltips, empty states, modal copy, placeholder text, confirmation dialogs, onboarding flows, or i18n strings. Also use when the user says /copy, /content, or /ux-copy.n8n:create-prn8n-ioCreates GitHub pull requests with properly formatted titles that pass the check-pr-title CI validation. Use when creating PRs, submitting changes for review, or when the user says /pr or asks to create a pull request.n8n:conventionsn8n-ioQuick reference for n8n patterns. Full docs /AGENTS.mdcadrenaiersaidaneCadrer un projet par questionnement structuré et produire ou étendre `docs/PRD.md` selon un template fixe en 8 sections (Problème, Solution, Utilisateur cible, User Stories, Critères de succès, Hors périmètre, Décisions d'implémentation, Notes complémentaires). Utilise sur /cadre, "cadre ce projet", "écris le PRD", "fais-moi un PRD", "crée le PRD", "produis le PRD", "étends le PRD", ou dès qu'il faut formaliser le cadrage d'un projet dans un document versionné. Pair naturel de /interroge (amont)designnaiersaidaneConsulte sur le système de design d'un produit et produit `docs/DESIGN.md` + un preview HTML (spécimen typo + palette + 1 mockup d'écran). Propose un système cohérent et opinioné (aesthetic, typographie, color, layout, spacing, motion) avec breakdown SAFE/RISK. Utilise sur /design, "crée le design system", "écris DESIGN.md", "design depuis zéro", "système de design", "design consultation", "fais-moi un design system", ou dès qu'il faut formaliser l'identité visuelle d'un projet. Pair naturel de illustrenaiersaidaneCree des diagrammes et visuels Excalidraw (schemas, process flows, slides, illustrations) avec rendu PNG/SVG haute resolution. Utilise quand l'utilisateur veut creer un diagramme, un schema, un visuel pour illustrer un concept — que ce soit pour une lecon, un cours, un article, une presentation, une video YouTube, une doc technique ou un slide. Aussi quand l'utilisateur mentionne 'illustre', 'Excalidraw', 'schema', 'diagramme', 'process flow', 'visuel pedagogique', 'illustration', ou veut illustinterrogenaiersaidaneQuestionnement structuré pour cadrer une feature ou brainstormer une app : une question à la fois, descend l'arbre de décision, recommandation justifiée. Utilise sur /interroge, \"aide-moi à planifier\", \"j'ai une idée de feature/app\".investiguenaiersaidaneInvestiguer méthodiquement un bug en 4 phases validées : localiser/reproduire, 3 hypothèses classées sur la cause racine, logs ciblés, fix minimal. Utilise sur /investigue, ou dès que l'utilisateur décrit un symptôme (\"ça plante quand…\", \"je vois X mais j'attends Y\", \"comportement inattendu\", \"pourquoi ça crash\", \"investigue ce bug\", \"debug ça\", \"analyse le bug\"). Ne propose jamais de fix immédiat — chaque phase s'arrête et attend une validation explicite avant de passer à la suivaplanifienaiersaidaneDécouper un PRD en phases indépendamment livrables par tranches verticales (tracer bullets), puis produire ou étendre `docs/PLAN.md` selon un template fixe (décisions architecturales + phases avec user stories, livrable, critères d'acceptation, dépendances). Utilise sur /planifie, "découpe le PRD", "fais le plan d'implémentation", "casse-moi ça en phases", "écris le plan", "étends le plan", "tracer bullets", "vertical slices", ou dès qu'il faut transformer un PRD en plan d'exécution versionné. AdevboxesnamespacelabsCreates, runs, shares, and tears down Namespace devboxes with `devbox` or `boxctl`. Use for isolated Linux or macOS environments, remote builds or tests, disposable Docker hosts, workloads exceeding local capacity, exposing `devbox.so` URLs, or working inside a devbox (`NAMESPACE_DEVBOX_WORKSPACE_DIR` is set), including keeping unattended work alive with task markers.sepiananako0129Make AI-generated writing read as human-written, in fiction and in professional prose. Repairs the narrative architecture of fiction and stories (based on StoryScope, arXiv:2604.03136); routes professional text through domain rules for release notes, announcements, PR and issue replies, code-review comments, incident postmortems, tickets, work orders, technical articles, blog posts, and long-form journalism. Four operations - write, review (diagnose AI tells without editing), refactor (minimal isepia-hemingwaynanako0129Use when a user asks to write or revise fiction in the Hemingway manner, or asks for strong de-AI on a story; applies Sepia's built-in Hemingway voice profile.sepia-recreatenanako0129Use when a user explicitly requests Sepia recreate for a full rewrite.