Autenticació
Autenticació i autorització
msgraph
codemie-ai
Work with Microsoft 365 services via the Graph API — emails, calendar events, SharePoint sites, Teams chats, OneDrive files, OneNote notebooks, contacts, and org chart. Use this skill whenever the user asks about their emails, inbox, unread messages, meetings, calendar, Teams messages or chats, SharePoint documents, OneDrive files, OneNote notes or notebooks, colleagues, manager, direct reports, or any personal/organizational Microsoft data. Invoke proactively any time the user mentions Outlook, Teams, SharePoint, OneDrive, OneNote, or wants to interact with their Microsoft 365 account. The skill uses a local Node.js CLI (msgraph.js) that handles authentication, token caching, and all API calls.
autonew
bfly123
Send /new to a provider's pane to start a new session without context injection.
mounted
bfly123
Report which CCB providers are mounted (session exists AND daemon is online). Outputs JSON.
azure-devops
OpenHands
Interact with Azure DevOps repositories, pull requests, and APIs using the AZURE_DEVOPS_TOKEN environment variable. Use when working with code hosted on Azure DevOps or managing Azure DevOps resources.
security
OpenHands
Security best practices for secure coding, authentication, authorization, and data protection. Use when developing features that handle sensitive data, user authentication, or require security review.
fastapi
srbhr
Build Python APIs with FastAPI, Pydantic v2, and SQLAlchemy 2.0 async. Covers project structure, JWT auth, validation, and database integration with uv package manager. Prevents 7 documented errors. Use when: creating Python APIs, implementing JWT auth, or troubleshooting 422 validation, CORS, async blocking, form data, background tasks, or OpenAPI schema errors.
vercel
OpenHands
Deploy and manage applications on Vercel, including preview deployments and deployment protection. Use when working with Vercel-hosted projects or configuring Vercel deployments.
smb-exploitation
blacklanternsecurity
Exploit remote SMB vulnerabilities for unauthenticated code execution on Windows hosts.
payment-integration
unclecatvn
Integrate payments with SePay (VietQR), Polar, Stripe, Paddle (MoR subscriptions), Creem.io (licensing). Checkout, webhooks, subscriptions, QR codes, multi-provider orders.
ad-persistence
blacklanternsecurity
Establishes persistent access in Active Directory environments after domain compromise. Covers DCShadow (rogue DC attribute modification), Skeleton Key (LSASS master password), custom SSP injection (credential logging via mimilib/memssp), security descriptor backdoors (WMI/WinRM/ DCOM/registry ACL modification), ADFS Golden SAML (DKM key extraction and forged SAML tokens), SID history persistence (DA SID in regular user), and certificate-based persistence (golden certificate, renewal, enrollment agent).
babysitter-codex
a5c-ai
Orchestrate complex, multi-step AI workflows with quality convergence loops, event-sourced state, and human-in-the-loop approval gates. Use when the user wants to babysit a task, orchestrate a workflow, run quality-gated development, resume a previous orchestration run, diagnose run health, plan without executing, set up a project or user profile for babysitter, or assimilate an external methodology. Also use when the user mentions "babysitter", "orchestrate", "babysit", "quality loop", or "convergence loop".
idor
blacklanternsecurity
Exploit Insecure Direct Object Reference (IDOR) and broken access control vulnerabilities during authorized penetration testing.
network-recon
blacklanternsecurity
Network reconnaissance, host discovery, port scanning, and service enumeration.
python-backend
yonatangross
"Production Python async patterns including asyncio TaskGroup, FastAPI dependency injection and middleware, SQLAlchemy 2.0 async sessions, and database connection pool tuning. Python 3.11+ runtime concerns such as ExceptionGroup, cancellation semantics, and session rollback. Use when building async services, wiring FastAPI dependencies, or tuning database connection pools. Runtime implementation layer, not the API wire contract."
analytics
yonatangross
"Query cross-project usage analytics. Use when reviewing agent, skill, hook, or team performance across OrchestKit projects. Also replay sessions, estimate costs, and view model delegation trends."
password-spraying
blacklanternsecurity
Performs password spraying against authentication services with lockout-safe techniques. Works against AD (SMB/Kerberos/LDAP), SSH, web login forms, OWA, and any service with username/password auth. Service-agnostic — the orchestrator passes target services and spray intensity tier.
trust-attacks
blacklanternsecurity
Enumerates Active Directory trust relationships and exploits them for cross-domain and cross-forest privilege escalation. Covers trust enumeration (nltest, PowerView, BloodHound), SID history injection (child domain to forest root via golden/diamond ticket with extra SIDs), inter-realm TGT forging using trust keys, cross-forest trust abuse (SID filtering bypass, RBCD, Kerberoasting via trust account), and PAM trust exploitation (shadow principals in bastion forests).
pass-the-hash
blacklanternsecurity
Authenticates to AD services using NTLM hashes, AES keys, or Kerberos tickets without cracking passwords. Covers Pass-the-Hash, Over-Pass-the-Hash, Pass-the-Key, and Pass-the-Ticket for lateral movement.
diagram-generation
BasedHardware
"Mermaid diagram generation for architecture visualization, data flow diagrams, and component relationships. Use for documentation, PR descriptions, and architectural analysis."
archive
ReScienceLab
"Archive session learnings, debugging solutions, and deployment logs to .archive/yyyy-mm-dd/ as indexed markdown with searchable tags. Use when completing a significant task, resolving a tricky bug, deploying, or when the user says \"archive this\". Maintains .archive/MEMORY.md index for cross-session knowledge reuse."
rust-symbol-analyzer
actionbook
"Analyze Rust project structure using LSP symbols. Triggers on: /symbols, project structure, list structs, list traits, list functions, 符号分析, 项目结构, 列出所有, 有哪些struct"
kerberos-roasting
blacklanternsecurity
Extracts and cracks Kerberos service tickets (Kerberoasting) and AS-REP hashes (AS-REP Roasting) for offline password recovery.
cognito
itsmostafa
AWS Cognito user authentication and authorization service. Use when setting up user pools, configuring identity pools, implementing OAuth flows, managing user attributes, or integrating with social identity providers.
freeze
bdfinst
Scope-lock file editing to a specific glob pattern. Only files matching the pattern can be edited until /unfreeze is called.