Skills en tendència
Els skills que estan guanyant popularitat a la comunitat.
image-to-code
Leonxlnx
Elite website image-to-code skill for Codex. For visually important web tasks, it must first generate the design image(s) itself, deeply analyze them, then implement the website to match them as closely as possible. In Codex, it must prefer large, readable, section-specific images instead of tiny compressed boards, generate fresh standalone images for sections or detail views instead of cropping old ones, avoid lazy under-generation, avoid cards-inside-cards-inside-cards UI, and keep the hero clean, spacious, readable, and visible on a small laptop.
claude-code-plugins
melodic-software
"Verify the biome-format hook's runtime prerequisites and configuration for this repository. Use when: 'set up biome-format', 'configure biome-format', 'is biome-format working', formatting silently isn't happening, or the hook reported a missing prerequisite. Actions: check (read-only verification, default) apply (resolve what check found). Re-runnable and safe."
claude-code-plugins
melodic-software
"Prints the operator's read-only morning view of the current GitHub repo in one pass: open counts per queue label, merge-ready PRs, parked decisions with their RECOMMENDED lines, and loop-lane telemetry freshness. Use when: 'morning brief', 'morning view', 'ops dashboard', 'what needs attention', 'daily standup view', 'operator morning pass', 'queues and merge-ready'. Never mutates issues, PRs, labels, or comments."
claude-code-plugins
melodic-software
"Build a source-backed AI industry briefing from official vendor publications, configured RSS feeds, GitHub releases, reputable secondary reporting, and user-supplied URLs. Use when: 'ai briefing', 'ai news', 'what's new in AI', 'catch me up on AI', 'prep for AI meeting', 'AI roundup', or 'generate AI slides'."
Clarify a dense artifact into something you can act on
melodic-software
"Faithfully clarify a dense, decision-heavy message so the reader can act on it. Chunk it into one-decision-at-a-time, define the session's own jargon, and surface exactly what the reader must decide, with operative terms quoted verbatim and no loss of precision. Decision-dense content gets an HTML decision table with numbered rows. Use when: 'make this clear', 'clarify this', 'help me digest this', 'break this down', 'I can't parse this', 'what am I actually deciding here', 'this is a wall of text'. Empty argument targets the previous assistant response. This changes STRUCTURE, not altitude and not medium. A lossy plain-language drop is education:explain (if installed) instead; a picture explainer (a diagram, ELI5) is education:eli5 (if installed). Sibling to adhd:shape, a standing session-wide posture; this is a one-shot reshape of one artifact."
claude-code-plugins
melodic-software
"Scan a codebase for module-level friction (shallow modules, seam leaks, locality gaps), report candidates as HTML, interview the selected candidate with a Design-It-Twice branch, and hand off the agreed shape. Use when: 'improve architecture', 'find deepening opportunities', 'shallow modules', 'Ousterhout deepening', 'design it twice', 'compare alternative interfaces', 'make code more testable', 'make code more AI-navigable', 'find refactoring opportunities', 'codebase friction', 'module seams', 'locality'. Skip when: a cross-dimension ask ('what should we improve', 'highest-impact improvement', or 'find improvements') routes to /improvement:find; also skip mechanical tidying, diff review, architecture-rule enforcement, or root-cause debugging."
Shape output for an ADHD reader
melodic-software
"Shape the assistant's output for a reader with ADHD, and anyone who wants action-first, low-friction responses. Lead with the concrete next action, number multi-step work, restate state across turns, cap and rank lists, give concrete time estimates, make wins visible, and cut preamble, recap, and closers. Use when: 'ADHD-friendly', 'action-first', 'give me the structured version', 'lead with what to do', 'cut the preamble', or when the user invokes it to set that output shape for the session. Once invoked, applies to every response for the rest of the session. This is a STANDING posture over future responses; to reshape one dense message already on screen (chunk it one-decision-at-a-time, define its jargon, surface the decisions) without changing the session style, that is the one-shot sibling adhd:clarify. Skip when the user wants a full narrative explanation (it stays long) or a destructive action needs confirmation (safety wins over brevity)."
context7-cli
melodic-software
Use the ctx7 CLI to fetch library documentation, manage AI coding skills, and configure Context7 MCP. Activate when the user mentions "ctx7" or "context7", needs current docs for any library, wants to install/search/generate skills, or needs to set up Context7 for their AI coding agent.
Cosmos SDK + EVM chain audits: see references/cosmos-sdk-chain-audit.md
Sekolah76
Smart contract security audit — 11 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, proxy, BFT/consensus/liveness), pre-dive kill signals (TVL < $500K etc), Foundry PoC template, grep patterns for each class, and real Immunefi paid examples. Use for any Solidity/Rust contract audit or when deciding whether a DeFi target is worth hunting.
triage-validation
Sekolah76
Finding validation before writing any report — 7-Question Gate (all 7 questions), 4 pre-submission gates, always-rejected list, conditionally valid with chain table, CVSS 3.1 quick reference, severity decision guide, report title formula, 60-second pre-submit checklist. Use BEFORE writing any report. One wrong answer = kill the finding and move on. Saves N/A ratio.
mobile-pentest
Sekolah76
'Mobile app pentest for bug bounty (Android APK + iOS IPA) — runtime-first workflow: install app, proxy through Burp/mitmproxy, drive the UI, capture packets, then test the API exactly like a web target; escalate to decompile (apktool/jadx) and Frida/objection only when traffic is SSL-pinned, encrypted, or absent. Covers APK/IPA decompile for hardcoded secrets + hidden API endpoints + base URLs the web app never exposes, exported-activity and deeplink intent injection, WebView addJavascriptInterface bridge abuse, SSL pinning bypass (objection patchapk / Frida CertificatePinner + checkServerTrusted hooks), OkHttp interceptor chain to recover request signing, JNI native-lib triage, and the quick apktool/grep secret + endpoint sweep. Use when the program scope includes a mobile app, when web recon dries up and you need a fresh attack surface, or when traffic is pinned and you must MitM it.'
report-writing
Sekolah76
Bug bounty report writing for H1/Bugcrowd/Intigriti/Immunefi — report templates, human tone guidelines, impact-first writing, CVSS 3.1 scoring, title formula, impact statement formula, severity decision guide, downgrade counters, pre-submit checklist. Use after validating a finding and before submitting. Never use "could potentially" — prove it or don't report.
web2-recon
Sekolah76
Web2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL crawling (katana, waybackurls, gau), directory fuzzing (ffuf), JS analysis (LinkFinder, SecretFinder), continuous monitoring (new subdomain alerts, JS change detection, GitHub commit watch). Use when starting recon on any web2 target or when asked about asset discovery, subdomain enum, or attack surface mapping.
graphql-audit
Sekolah76
GraphQL security hunting — introspection abuse, field suggestion enumeration (clairvoyance), batching DoS, IDOR via aliasing, auth bypass, injection via arguments, subscription abuse, depth/complexity bombs, and WAF bypass. Covers graphw00f fingerprinting, gqlmap, graphql-cop, and inql. Use when a target exposes a /graphql, /api/graphql, or GQL-over-HTTP endpoint.
security-arsenal
Sekolah76
Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table. Use when you need specific payloads for XSS/SSRF/SQLi/XXE/NoSQLi/command injection/SSTI/IDOR/path-traversal/HTTP smuggling/WebSocket/MFA bypass, bypass techniques, or to check if a finding is submittable. Also use when asked about what NOT to submit.
meme-coin-audit
Sekolah76
Meme coin and token security audit — rug pull detection (honeypot, hidden mint, fee manipulation, LP lock bypass), Solana SPL token analysis (freeze authority, mint authority, metadata mutability), Token-2022 extension risks (transfer hooks, permanent delegate), DEX liquidity pool attacks (sandwich amplification, LP drain, bonding curve exploits), pump.fun/Raydium/Jupiter integration risks, token_scanner.py automation, and real exploit examples from 2024-2025. Use for any token audit, rug pull assessment, meme coin security review, or pre-investment due diligence.
secret-scanner
Sekolah76
Detect exposed secrets, API keys, credentials, and tokens in code. Use before commits, on file saves, or when security is mentioned. Prevents accidental secret exposure. Triggers on file changes, git commits, security checks, .env file modifications.
subdomain-takeover
Sekolah76
Subdomain takeover detection and exploitation playbook. Use when targets have dangling CNAME/NS/MX records pointing to deprovisioned cloud resources, expired third-party services, or unclaimed SaaS tenants that an attacker can register to serve content under the victim's domain.
root-cause-analyzer
Sekolah76
Determine the minimal technical root cause of candidate security findings, separate causes from symptoms, cluster duplicates, and identify shared vulnerable abstractions.
sqlmap-database-pentesting
Sekolah76
"Provide systematic methodologies for automated SQL injection detection and exploitation using SQLMap."
windows-privilege-escalation
Sekolah76
"Provide systematic methodologies for discovering and exploiting privilege escalation vulnerabilities on Windows systems during penetration testing engagements."
pentest-commands
Sekolah76
"Provide a comprehensive command reference for penetration testing tools including network scanning, exploitation, password cracking, and web application testing. Enable quick command lookup during security assessments."
red-team-tactics
Sekolah76
"Red team tactics principles based on MITRE ATT&CK. Attack phases, detection evasion, reporting."
security-research-guardrail
Sekolah76
Independent control layer for security-research agents — prevent unsafe actions, unsupported claims, scope violations, evidence contamination, target impact, and premature reporting.