Loading...
Loading...
Found 2,044 Skills
Convert Markdown documents to professionally styled DOCX (Word) files with python-docx. Handles CJK/Latin mixed text, fenced code blocks, tables, blockquotes, cover pages, TOC field, watermarks, and page numbers. Supports multiple color themes matching any2pdf (Warm Academic, Nord, GitHub Light, etc.) and is battle-tested for Chinese technical reports. Use this skill whenever the user wants to turn a .md file into a styled Word document, generate an editable report from markdown, or create a DOCX from markdown content — especially if CJK characters, code blocks, or tables are involved. Also trigger when the user mentions "markdown to docx", "md2docx", "any2docx", "md转word", "md转docx", "生成word", or asks for an "editable document" from markdown source.
Deep-dive offensive methodology for dependency confusion and namespace attacks across all major package ecosystems. Covers npm scope confusion exploiting the gap between public and private scoped packages and .npmrc misconfigurations where registry mappings fail to pin internal scopes exclusively. Addresses PyPI namespace attacks through --extra-index-url resolution ordering, NuGet feed priority exploitation when multiple package sources are configured without clear directives, Maven and Gradle repository ordering where artifact resolution traverses repositories sequentially, Go module proxy abuse through GOPROXY misconfiguration, Ruby gems namespace squatting, and Docker image tag confusion with unqualified image references. Provides complete proof-of-concept methodology using safe callbacks including DNS canary via interactsh or Burp Collaborator and HTTP beacon with no destructive payload. Covers reconnaissance techniques for discovering internal package names through GitHub repository analysis, error message harvesting, JavaScript source map extraction, lock file parsing, job postings mentioning internal tools, and package manifest inspection. Directly references and builds upon Alex Birsan's seminal 2021 dependency confusion research. Each ecosystem section includes registry-specific exploitation mechanics, configuration vulnerabilities, and defensive countermeasures for engagement reporting.
Use when the user is working on the optional Next.js storefront for Spree 6 (the customer-facing store in `apps/storefront/`, github.com/spree/storefront) — adding a page, customizing checkout, fetching products, multi-region URLs, the wholesale/B2B portal, transactional emails from webhooks, storefront tests, or integrating any frontend with the Store API via `@spree/sdk`. Common phrasings include "customize storefront", "Next.js storefront", "frontend changes", "PDP", "product page", "cart", "checkout flow", "order confirmation page", "@spree/sdk", "publishable key", "country/locale URLs", "wholesale portal", "storefront emails", "webhook route". Provides the storefront architecture, the @spree/sdk integration model, and the storefront-vs-backend decision tree.
Cut a release of a Rust workspace: bump the version, tag it, publish the crates to crates.io, and write GitHub release notes carrying sample code for new API and a migration for every breaking change. Use when the user wants to release, cut a version, bump to X.Y.Z, or publish to crates.io.
Guide for connecting Infisical to an identity provider for human login and user provisioning. Covers Google and GitHub SSO (free), SAML 2.0 and OIDC (paid) with Okta, Azure/Entra ID, JumpCloud, Google, Auth0, Keycloak, PingOne, GitLab, LDAP login, SCIM user and group provisioning with Okta/Azure/JumpCloud/PingOne/PingFederate, SAML and OIDC group membership mapping, SCIM group to organization role mappings, the mandatory email domain verification prerequisite, SSO enforcement and its effect on password signup, and the /login/admin break-glass portal. Use this skill when someone asks about: Infisical SSO, SAML login, OIDC login, Okta or Azure AD integration, SCIM provisioning, syncing identity provider groups into Infisical, enforcing SSO, or being locked out after enabling SSO. For HUMAN login and user provisioning. Not for machine identity auth methods, including OIDC and LDAP for workloads (infisical-setup), nor for roles and permissions (infisical-access-control).
Guide for creating and managing Infisical App Connections — the reusable authenticated links between Infisical and third-party services that Secret Syncs, Secret Rotations, PKI certificate authorities, PKI Syncs, and Secret Scanning data sources all depend on. Covers all 83 connection types and their exact auth methods (AWS assume-role vs access-key, GitHub OAuth vs GitHub App vs PAT, Azure OAuth vs client-secret vs certificate, GCP service account impersonation, and more), platform-managed credentials, Gateway-routed connections for private networks, and connection-level credential rotation. Use this skill when someone asks about: App Connections, connecting Infisical to AWS/GCP/Azure/GitHub, 'connection not found' when creating a sync, which auth method a connection needs, reusing a connection across syncs, or 'how do I authenticate Infisical to a third-party service'. This is Infisical authenticating OUTWARD to a third party. Not for machine identities, which are workloads authenticating INTO Infisical (infisical-setup).
How published videos are doing on YouTube, and what to learn from it. Views, likes, comments and subscribers per video, plus watch time, retention and traffic sources (Shorts feed, search, external) with the Analytics scope, saved as snapshots so trends show; GitHub traffic beside it to see whether YouTube sends people to the repo. Use when asked how a video or the channel is doing, which title, cover or genre worked, whether to make more of something, or for a weekly stats check.
Research an Elixir/Phoenix topic on the web. Searches ElixirForum, HexDocs, blogs, and GitHub. Uses efficient markdown conversion.
Convert Markdown documents to professionally typeset PDF files with reportlab. Handles CJK/Latin mixed text, fenced code blocks, tables, blockquotes, cover pages, clickable TOC, PDF bookmarks, watermarks, and page numbers. Supports multiple color themes (Warm Academic, Nord, GitHub Light, Solarized, etc.) and is battle-tested for Chinese technical reports. Use this skill whenever the user wants to turn a .md file into a styled PDF, generate a report PDF from markdown, or create a print-ready document from markdown content — especially if CJK characters, code blocks, or tables are involved. Also trigger when the user mentions "markdown to PDF", "md2pdf", "any2pdf", "md转pdf", "报告生成", or asks for a "typeset" or "professionally formatted" PDF from markdown source.
Use when Godot 4.7 work must run without a mouse or at scale: batch import of hundreds of GLB props or an AI image-to-3D art drop, naming rules, import presets and post-import scripts, editor plugins, EditorScript and @tool, EditorImportPlugin, GUT or gdUnit4 tests in CI, a GitHub Actions export workflow, GDExtension basics, or a Godot MCP server; also when --import is slow, textures stay uncompressed, tests pass locally but CI fails, or an export ships test folders.
Receive and verify inbound webhooks from providers like Stripe, GitHub, Twilio, Slack, or Shopify and deliver them to a local or private service without exposing that service to the public internet. Verify signatures at the edge with no app code; route third-party callbacks to a service behind a firewall, including regulated (HIPAA/PCI) environments or a centralized webhook gateway shared across teams. Use when the user needs to receive, test, or debug webhooks locally, wants signature verification without writing it, or must route callbacks to a private service.
Explore a codebase to find opportunities for architectural improvement, focusing on making the codebase more testable by deepening shallow modules. Use when user wants to improve architecture, find refactoring opportunities, consolidate tightly-coupled modules, or make a codebase more AI-navigable.