热门技能
当前社区里最受关注、增长最快的技能。
ethical-hacking-methodology
Sekolah76
"Master the complete penetration testing lifecycle from reconnaissance through reporting. This skill covers the five stages of ethical hacking methodology, essential tools, attack techniques, and professional reporting for authorized security assessments."
captcha-solver
Sekolah76
Universal local sidecar anti-bot & captcha solver (Cloudflare Turnstile, Aliyun 2.0, Arkose FunCaptcha, Akamai, BotGuard, PerimeterX, DataDome, AWS WAF, reCAPTCHA, hCaptcha).
security-arsenal
Sekolah76
Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table. Use when you need specific payloads for XSS/SSRF/SQLi/XXE/NoSQLi/command injection/SSTI/IDOR/path-traversal/HTTP smuggling/WebSocket/MFA bypass, bypass techniques, or to check if a finding is submittable. Also use when asked about what NOT to submit.
api-fuzzing-bug-bounty
Sekolah76
"Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors."
bug-bounty-disclosure
Sekolah76
Skill end-to-end buat authorized/good-faith bug bounty & coordinated vulnerability disclosure ke developer atau pemilik projek — untuk SEMUA jenis bug (web, API, infra, mobile, cloud, smart contract/web3, agent/LLM), crypto maupun non-crypto. Pakai skill ini setiap kali user mau triase & verifikasi temuan, bikin PoC, NYARI kontak dev/owner (security.txt, SECURITY.md, GitHub, WHOIS, on-chain, sosmed), dan KIRIM laporan via email — baik target punya program bug bounty terdaftar (HackerOne/Immunefi/dll) maupun proyek tanpa program resmi. Trigger juga kalau user nyebut "report bug ke dev", "disclosure", "lapor kerentanan", "cari kontak owner projek", "kirim report email", "responsible disclosure", "bug bounty" — walau ga eksplisit bilang "skill". Sisi disclosure jalan buat proyek apapun; dasar pengetesan harus sah/good-faith.
entry-point-analyzer
Sekolah76
Analyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by access level (public, admin, role-restricted, contract-only), and generates structured audit reports. Excludes view/pure/read-only functions. Use when auditing smart contracts (Solidity, Vyper, Solana/Rust, Move, TON, CosmWasm) or when asked to find entry points, audit flows, external functions, access control patterns, or privileged operations.
encrypting-and-decrypting-data
Sekolah76
Validate encryption implementations and cryptographic practices. Use when reviewing data security measures. Trigger with 'check encryption', 'validate crypto', or 'review security keys'.
evidence-packager
Sekolah76
Assemble a reproducible, minimal, tamper-evident evidence bundle for a security finding, preserving provenance and separating observed facts from interpretation.
code-injection-detector
Sekolah76
Code Injection Detector - Auto-activating skill for Security Fundamentals. Triggers on: code injection detector, code injection detector Part of the Security Fundamentals skill category.
attack-chain-web2
Sekolah76
Web2 attack chain plugin — apply Web2 trust boundaries and composition rules on top of attack-chaining-core for authorized testing of web apps, APIs, identity, cloud, and internal services.
web-exploit-test
Sekolah76
Localhost-only, stdlib evidence verifier: scan, JWT matrix, race controls.
attack-chain-web3
Sekolah76
Web3 attack chain plugin — apply Web3 state, economic, cryptographic, and consensus semantics on top of attack-chaining-core for authorized testing of smart contracts, DeFi, bridges, wallets, and validators.
threejs-materials
CloudAI-X
Three.js materials - PBR, basic, phong, shader materials, material properties. Use when styling meshes, working with textures, creating custom shaders, or optimizing material performance.
agentconnect-setup
agentconnect-md
Guide users through installing, configuring, and verifying the complete self-hosted AgentConnect OSS stack as an interactive tutorial. Use for Docker Compose setup, local no-auth evaluation, the bundled local Logto overlay, Logto Cloud authentication, Cloudflare Tunnel or reverse-proxy exposure, custom production domains, initial administrator bootstrap, daemon connection, deployment Google/Slack/GitHub Apps, public URLs, startup options, upgrades, or setup troubleshooting.
ruanzhu-kit
CatCatUncle
生成中国软件著作权登记（软著）全套申请材料——页数写死的程序鉴别材料 PDF、文档鉴别材料（说明书）PDF，以及在线表单逐字段可复制的填写清单。当用户提到「软著」「软件著作权」「版权登记」「程序鉴别材料」「文档鉴别材料」「源程序前30页后30页」时使用。
notebooklm
roomi-fields
This skill should be used when the user wants to query their Google NotebookLM notebooks for citation-backed, source-grounded answers, or manage notebooks, sources, and Studio content (audio, report, video, infographic, presentation, data table, flashcards, quiz, mind map). It drives the @roomi-fields/notebooklm-mcp engine — via the notebooklm MCP tools when they are available in the session, otherwise via its HTTP REST API — and covers Google login, citation formats, the daily-quota-aware batch/ingestion pattern, and source discovery.
lint-review
marin-community
Run the read-only infra/lint PR reporter only when invoked by CI or explicitly requested; do not select it for the commit workflow's fix-and-respond review.
rulesync
dyoshikawa
Generates and syncs AI rule configuration files (.cursorrules, CLAUDE.md, copilot-instructions.md) across 20+ coding tools from a single source. Use when syncing AI rules, running rulesync commands, importing or generating rule files, or managing shared AI coding configurations.
profile-training
marin-community
Profile a named JAX, Levanter, or Marin run, or investigate a measured startup, compilation, initialization, or throughput bottleneck.
wandb-reporting
marin-community
Publish W&B runs, reports, or artifacts only when explicitly requested or required for a requested experiment's dense numeric results.
review-grant
marin-community
Review an explicitly identified marin-iac grant PR that edits IAM data or a deploy-target module, confirm its decrypted principals and roles, then apply only the confirmed grant.
scrub-experiment-issue-tldrs
marin-community
Run the experiment-issue TL;DR scrub only from its scheduler or an explicit request for that scrub.
write-ops-log
marin-community
Publish a tagged Echo record after every incident, then link its canonical URL from the associated pull request or issue.
query-finelog
marin-community
Query Finelog logs and telemetry for Iris tasks, workers, profiles, training, vLLM, and cross-cluster forwarding. Use for schema discovery, SQL, memory or CPU summaries, hub-versus-regional comparisons, counter semantics, and query-performance diagnosis.