Loading...
Loading...
Found 2,408 Skills
Comprehensive methodology for auditing and exploiting TLS/SSL implementations and misconfigurations across network services and mobile applications. Covers protocol downgrade attacks including POODLE (CVE-2014-3566) against SSLv3 CBC padding, DROWN (CVE-2016-0800) cross-protocol attack leveraging SSLv2 export ciphers to decrypt TLS sessions, and FREAK (CVE-2015-0204) forcing RSA export-grade key exchange. Addresses BEAST (CVE-2011-3389) exploiting CBC IV predictability in TLS 1.0, CRIME (CVE-2012-4929) and BREACH targeting TLS-level and HTTP-level compression oracles respectively, and Heartbleed (CVE-2014-0160) for OpenSSL memory disclosure. Covers certificate validation bypass techniques for applications with improper hostname verification or chain validation, certificate pinning bypass using Frida and Objection for mobile application interception, HSTS bypass via NTP manipulation and subdomain exploitation, TLS 1.3 0-RTT replay attacks against non-idempotent endpoints, mutual TLS (mTLS) authentication attacks including client certificate theft and relay, and Certificate Transparency log monitoring for reconnaissance. Primary tooling includes testssl.sh for comprehensive TLS auditing, sslyze for Python-integrated scanning, sslscan for quick cipher enumeration, and tlsx for high-speed TLS probing at scale. Maps to CWE-295 (Improper Certificate Validation), CWE-319 (Cleartext Transmission of Sensitive Information), and CWE-757 (Selection of Less-Secure Algorithm During Negotiation).
Debugs failed, crashing or hung Pathways on Cloud workloads (JAX training or inference on Cloud TPU in GKE, run as a JobSet, PathwaysJob or LeaderWorkerSet). Reads Cloud Logging for every Pathways container (user workload, IFRT proxy, pathways-rm, pathways-worker, colocated Python sidecar), node kernel logs and GKE events, then reports the earliest real error, the root cause and a fix. Use when a Pathways workload fails to start, crashes, restarts or stops making progress, or shows errors such as IFRT proxy connection failures, DEADLINE_EXCEEDED lost connection to peer, host OOM kills, ImagePullBackOff, or JAX and Pathways version mismatches. Don't use for GKE workloads that don't use Pathways, or for creating clusters or deploying new Pathways workloads.
Use when testing local web applications using Playwright. Triggers include requests to verify frontend functionality, debug UI behavior, capture browser screenshots, view browser logs, or test any web application interactively. Write native Python Playwright scripts for all web application testing tasks.
Generate and validate 2D DXF drawings from Python ezdxf sources — profiles, outlines, gaskets, panels, flat patterns, laser/plasma/waterjet cut layouts.
Create, change and debug openQA tests and review openQA results. Use whenever the user mentions openQA, o3, os-autoinst, isotovideo, testapi calls such as assert_script_run or assert_screen, needles, a job URL such as openqa.opensuse.org/tests/123, an openQA job group or build, soft-failures, force_result or verification runs, or asks why an openQA job failed, how to write, schedule, run or fix an openQA test or review a test PR, or to review or label openQA results. Tests: os-autoinst test modules in Perl or Python, YAML schedules, test data, pull requests to os-autoinst-distri-opensuse or a custom test distribution. Results: triage a failed, incomplete or timed-out job from its logs, sweep a job group or build, classify product bug vs test issue vs infrastructure, draft bug reports and job comments whose bugrefs, labels and carry-over openQA parses. Not for OBS package build failures, maintenance-update validation with mtui, plain bug-tracker work, other CI systems or general Perl questions.
Checks whether this computer still trusts the compromised eMudhra certificate chains from the October 2026 incident, and removes that trust everywhere it can. Covers the system trust store, curl, git, every Python with its pip and certifi, Node.js, Java, Go, uv, rustup, Deno, Homebrew, WSL distributions, and lock files, on macOS, Windows, and Linux (Debian/Ubuntu, Fedora/RHEL, Arch, NixOS). Fixes what needs no admin rights, walks the user through one admin script in their own terminal, and re-checks. Asks before every action, labels each one as vetted or improvised, backs up everything it changes, and keeps an undo log. Use when someone asks whether their machine is affected by the eMudhra certificate compromise, asks to remove trust in the compromised eMudhra certificates, mentions the emSign or AAA Certificate Services intermediates or emudhra.we-have-a-problem.com, or invokes /remediate-emudhra-on-my-machine.
Phân việc dạng ĐỒ THỊ PHỤ THUỘC trên PLAN.md — trả lời 5 câu hỏi (task này cần việc gì · cái gì chạy song song · phụ thuộc vào gì · tồn tại để làm gì trong graph · liên hệ graph cũ) bằng tool tất định, dispatch theo lớp topo có KHOÁ + lease + generation, state lưu bền append-only (events.jsonl), 2 file python vẽ (1 graph / atlas 2D mọi graph), mọi câu trả lời của model gắn nhãn chắc|gợi-ý|không-biết + nguồn, audit bịa=0. Gọi khi user nói "orca-graph", "graph phân việc", "task nào song song", "phụ thuộc gì", "vẽ graph task", "dispatch theo graph", "/orca-graph".
Use when an agent works in an open Blender scene through the Scenario for Blender extension's local MCP server (scenario-blender on 127.0.0.1:9876): connecting Claude Code, Cursor, Claude Desktop or Codex to Blender, the headless scenario_blender command, quoting and generating Scenario images, PBR materials, 3D meshes, video, audio or 360 environments from the scene, capturing the viewport or selected meshes as references, placing saved results, Render Video camera paths, or execute_python.
Use ACE-Step and ACE-Step 1.5 for local or hosted AI music generation, including text-to-music, lyrics-to-song, instrumental beds, covers, repainting, stem/track extraction, track completion, LoRA personalization, REST/Python/Gradio workflows, rights review, and music integration for video, ads, games, and social content.
Converts NetBox device-type and module-type definitions (the netbox-community devicetype-library format, also published via the NetBox Data Exchange / NDX) into Infrahub object templates as Infrahub object YAML, using a bundled Python converter driven by a schema mapping profile. TRIGGER when: importing NetBox device types or module types, exporting device types from a running NetBox instance, building object templates from vendor device models, converting line cards / PSUs / transceivers from NetBox module types into Template* objects, re-running a conversion after changing the mapping profile, debugging a wrong or failed conversion. DO NOT TRIGGER when: importing CSV/TSV data (use infrahub-importing-data), authoring schemas from scratch (use infrahub-managing-schemas), writing ordinary object data files (use infrahub-managing-objects), or setting up continuous two-way replication with a live NetBox (that is infrahub-sync, a separate product; a one-off export of device types is in scope here).
Creates, modifies and manages Infrahub object data YAML files for populating infrastructure instances — devices, locations, organizations, and modules. TRIGGER when: creating device instances, populating data files, defining locations or organizations, adding infrastructure objects, modifying or extending an existing data file, updating attribute values or relationship links on objects already defined in a data file, debugging why an object fails to load. DO NOT TRIGGER when: designing or modifying schemas, including changing an attribute or relationship definition on a node kind (use infrahub-managing-schemas), writing Python checks/generators, querying live data.
Add Weave tracing to Python or TypeScript agents and LLM applications. Use when asked to instrument model calls, tools, or agent turns with Weave.