Loading...
Loading...
Found 323 Skills
External recon for software supply-chain attack surface — package-namespace squatting candidates, dependency-confusion vulnerabilities, GitHub Actions injection openings, container image registry exposure, SBOM mining, internal-package-name leakage, and CI/CD configuration exposure. Reconnaissance and identification ONLY — actual package publishing / typosquat attacks are EXTERNAL-OFFENSIVE and require explicit written sign-off because they can affect the entire npm/PyPI ecosystem. Use when the target has a public GitHub org, when their build artifacts/SBOMs are reachable, when their docker images are on Docker Hub/GHCR, or when you find internal package names in their JS bundles.
Drive an open tester-army/e2e PR through conflicts, review bots, and CI until it is green with every thread handled, then label it Ready for Human Review. Use after opening a PR, or when asked to babysit, watch, monitor, check on, or get a PR green.
Track Remotion CI flakes in issue
GitHub operations via gh CLI and GitHub API: create/view/merge PRs, manage issues, query API endpoints, handle workflows in enterprise or public GitHub environments.
Professional Roblox toolchain - Studio Script Sync vs Rojo, Rokit, Wally/pesde packages, luau-lsp with sourcemaps, StyLua, selene, darklua, Lune, roblox-ts, .luaurc, git, GitHub Actions CI and Open Cloud publishing. Use when creating a Roblox repo, configuring VS Code/Cursor, adding packages, fixing sourcemap/require typing, or automating builds and deploys.
project固有のstack・framework・runtimeに合わせてquality gateと動作確認レベルを設計・実行・更新する時に使用する。
Use when pushing commits to a remote with CI, merging a PR, or when asked whether a pipeline passed, so every push and merge gets a background watcher.
Set up a new app repository for the Boring Factory end to end — create it from the app template (hachej/boring-app), set its secrets and settings, invite the expert, verify the first runs, and hand the expert their next steps. Use when the maintainer asks to create, bootstrap or set up a new app or repository for the Factory, or to connect an existing repository to it.
Inventory, classify, and pin every `uses:` reference in GitHub Actions workflows, composite actions, and reusable workflows to a verified commit SHA, then keep those pins fresh with Dependabot. Use when the user says "pin actions", "unpinned actions", "SHA pin", "supply chain for workflows", or invokes /actions-pinning. Do NOT use for permissions and injection hardening of workflow files (route to /oss-hygiene) or for CI run-time speed (route to /ci-optimize).
Triage and fix one microsoft/playwright-cli issue, or do a maintainer's task, unattended inside the Issue triage GitHub Actions workflow (.github/workflows/triage.yml), which a needs-triage, needs-triage-mac or needs-triage-win label starts, or a maintainer starts by hand with an issue, a task or both. Reproduces the issue on the runner, then leaves a verified fix proposal for the workflow to open as a draft PR, in this repo or in microsoft/playwright where the source of the CLI is, or an investigation note for it to post on the issue. Only for that workflow.
Hunt CI/CD pipeline vulnerabilities — GitHub Actions workflow injection (pull_request_target Pwnrequest + ${{ }}-into-shell), self-hosted runner poisoning, OIDC trust-policy abuse, Jenkins script-console RCE and CVE-2024-23897 file read, GitLab CI runner-token registration, Terraform state file leakage, artifact/log secret leakage, pipeline env-var disclosure. Use when target has a public GitHub/GitLab org, exposed CI dashboards (Jenkins/TeamCity/Drone/Argo), or build artifacts/images are reachable.
Manage a GitHub repository's labels as a version-controlled file and auto-label pull requests by changed path. Export current labels, diff them against a proposed `.github/labels.yml`, sync the difference (one-shot or via a scheduled workflow using one verified, SHA-pinned action), and wire path-based PR labeling with `actions/labeler` and `.github/labeler.yml`. Use when the user says "standardize labels", "sync labels", "auto-label PRs by path", "labels as code", or invokes /labels-as-code. Do NOT use for org-wide label policy across many repos — route that to /safe-settings, which reconciles labels (rename, exclude) from a central admin repo. Do NOT use for issue forms or templates — that is /oss-hygiene. Label deletions are never automatic; the skill asks for explicit authorization first.