认证鉴权

missing-rate-limiting-anti-pattern

igbuend

"Security anti-pattern for missing rate limiting (CWE-770). Use when generating or reviewing API endpoints, authentication systems, or public-facing services. Detects absence of request throttling enabling brute force, credential stuffing, and DoS attacks."

log-entity-actions-pattern

igbuend

Security pattern for implementing security logging and audit trails. Use when designing logging systems for security events, implementing non-repudiation, creating audit trails, or addressing security monitoring and incident response needs. Addresses "Entity repudiates action request" problem.

long-long-run

huahuadeliaoliao

Use when a task needs a persistent session-bound runtime for long-running execution, project exploration, recovery, monitoring, or continued progress toward one main objective while still handling temporary user interruptions.

limit-request-rate-pattern

igbuend

Security pattern for implementing rate limiting and throttling. Use when protecting against brute-force attacks, DoS/DDoS mitigation, preventing resource exhaustion, or limiting API abuse. Addresses "Entity absorbs excessive resources" problem.

insufficient-randomness-anti-pattern

igbuend

"Security anti-pattern for insufficient randomness vulnerabilities (CWE-330). Use when generating or reviewing code that creates security tokens, session IDs, encryption keys, nonces, or any security-critical random values. Detects use of Math.random() or predictable seeds."

message-authentication-code-pattern

igbuend

Security pattern for implementing Message Authentication Codes (MACs) to ensure data integrity and origin authentication. Use when implementing HMAC, CMAC, or other MAC algorithms, verifying message integrity, authenticating message origin with shared secrets, or when non-repudiation is NOT required. Specialization of Cryptographic action pattern.

xianyu-reply-cy

CY-CHENYUE

闲鱼自动回复助手，通过 Playwright 驱动真实 Chrome 浏览器监控闲鱼网页版消息并自动回复买家咨询。 当用户说"开始闲鱼自动回复"、"监控闲鱼消息"、"闲鱼客服"、"闲鱼回复"时触发。

grepai-mcp-tools

yoanbernabeu

Reference for all GrepAI MCP tools. Use this skill to understand available MCP tools and their parameters.

tg-ingest

rohunvora

Primary Telegram interface. Full-featured CLI for message export, DM management, group sync, contact scoring, and thread state. Use when user mentions "telegram", "tg", "@username", or telegram-specific terms. Triggers: "telegram messages", "export telegram", "telegram DMs", "telegram groups", "sync telegram", "@username messages", "telegram contacts". This is STANDALONE - do not defer to unified-messages for telegram operations.

e-commerce

miles990

E-commerce platforms, payment processing, and shopping cart patterns

security-practices

miles990

OWASP Top 10, authentication, and secure coding practices

application-patterns

miles990

Common application development patterns and implementations

grepai-search-advanced

yoanbernabeu

Advanced search options in GrepAI. Use this skill for JSON output, compact mode, and AI agent integration.

swift-study

ITlearning

Interactive Swift/iOS tutor with two modes. Classic explains first, Mastery uses a predict-first Core Loop with gates.

writing-plans

CodingCossack

Structured implementation planning for multi-step development tasks. Use when you have a spec or requirements and need to break work into executable steps.

supabase-auth

Nice-Wolf-Studio

Manage authentication and user operations in Supabase. Use for sign up, sign in, sign out, password resets, and user management.

qiskit-hardware

tondevrel

Advanced sub-skill for Qiskit focused on executing circuits on physical quantum processing units (QPUs). Covers IBM Quantum Runtime, error mitigation techniques (TREX, ZNE), hardware-aware transpilation, and low-level pulse control (OpenPulse).

opencode-acp-control

bjesuiter

Control OpenCode directly via the Agent Client Protocol (ACP). Start sessions, send prompts, resume conversations, and manage OpenCode updates.

Security Checklist

yebot

Security review checklist for features and changes

in-product-messaging

SkeneTechnologies

When the user wants to design in-product messages -- including tooltips, banners, modals, slideouts, or notification bells -- without annoying users. Also use when the user says "in-app messages," "product announcements," "nudges," "contextual help," or "message frequency." For upgrade prompts specifically, see paywall-upgrade-cro. For feature launches, see feature-adoption.

growth-modeling

SkeneTechnologies

When the user wants to build quantitative growth models -- including loop-based models, sensitivity analysis, revenue forecasting, or unit economics. Also use when the user says "growth forecast," "revenue model," "CAC LTV," "growth projections," or "financial model." For growth loops, see growth-loops. For PLG metrics, see plg-metrics.

plg-strategy

SkeneTechnologies

When the user wants to assess PLG readiness, design a product-led growth strategy, choose between freemium and free trial, evaluate PLG maturity, or plan a hybrid PLG + sales model. Also use when the user says "should we do PLG," "PLG vs sales-led," "growth motions," "PLG audit," or "go-to-market strategy." For specific mental models, see plg-mental-models. For growth loop design, see growth-loops.

codex-Skills

mosif16

writing-plans

abudhahir

Use when you have a spec or requirements for a multi-step task, before touching code