3,639 skills found · Page 75 of 122
uphiago / js-secrets-extractionAnalyze JS bundles and source maps for hardcoded secrets, API keys, JWTs, and internal endpoints
uphiago / origin-ip-discoveryDiscover origin IPs behind CDN/WAF via favicon hash, DNS history, and SSL certs.
uphiago / hunt-broken-function-level-authHunt broken function-level authorization via verb drift, route shadowing, and transport gaps.
uphiago / hunt-information-disclosureHunt error leakage, DVCS exposure, source maps, config files, and differential oracles.
uphiago / google-dorks-catalogHigh-precision Google dorks for exposed configs, secrets, and credentials -- real-world validated
uphiago / subdomain-takeover-huntDetect and verify subdomain takeover via dangling CNAME to unclaimed services.
uphiago / vhost-enumerationDiscover hidden virtual hosts via Host header fuzzing and SSL certificate parsing.
uphiago / hunt-metrics-exposureHunt public /metrics, /health, and actuator endpoints leaking AI usage, DB pools, and operational intelligence.
AI-Builder-Club / crabbox-setupScaffold an isolated CLOUD dev box per agent (via crabbox + Daytona) for any codebase — the parallel-safe counterpart to dev-local-setup. Each agent gets its own full stack (own DB + dev server) and an in-box browser for e2e, so concurrent loops never collide on ports/state.
AI-Builder-Club / agent-context-auditAudit a repo's agent context — CLAUDE.md files, codebase docs, skills, and tool/MCP designs — against Anthropic's Claude 5 context-engineering guidance ("unhobbling": Anthropic cut ~80% of Claude Code's system prompt with no eval loss).
AI-Builder-Club / verifier-setupSet a repo up to prove engineering-task work actually works before it ships. Investigates the repo, ensures a one-command dev stack (`dev-local`) exists, asks whether verification runs locally or in a sandbox (crabbox), confirms/installs the driver (the `playwright-cli` skill for web by default).
AI-Builder-Club / open-agent-teamsDelegate tasks to ANY CLI agent (claude, codex, aider, ...) running in a detached tmux session, with a race-safe done-signal protocol and multi-turn iteration
AI-Builder-Club / new-loopSpin up a new loop (domain) in a file-based knowledge base — bootstrap the substrate if it's missing, gather the loop's charter, scaffold domains/<loop>/README.md, then do ONE real test run and record it in the loop's Timeline and LOG.md
GanyuanRan / receiving-code-reviewUse when receiving code review feedback before implementing suggestions, especially when feedback is unclear, risky, disputed, or technically questionable.
GanyuanRan / requesting-code-reviewUse when requesting independent code review, after implementation slices, before merging high-risk work, or when verification exposes evidence, baseline, architecture, compatibility, or retirement uncertainty.
GanyuanRan / using-git-worktreesUse when a coding task needs a concurrent checkout, unrelated dirty state blocks safe branch switching, or the user or repository explicitly requires a worktree.
GanyuanRan / verification-before-completionUse when about to claim work is complete, fixed, passing, verified, release-ready, or ready to commit, merge, publish, or hand off.
GanyuanRan / goal-framingUse when the user explicitly sets an Aegis goal with /aegis-goal, Aegis goal:, or asks to define goal, success evidence, stop condition, or task boundaries before work.
GanyuanRan / update-aegisUse when the user says `aegis:update`, asks to update or upgrade an installed Aegis method-pack, wants the latest Aegis version, or asks whether Aegis is current on this host.
GanyuanRan / executing-plansUse when executing a written implementation plan across sessions or with review checkpoints. Small or single-slice plans stay inline. For same-session independent tasks, use subagent-driven-development instead.
GanyuanRan / long-task-continuationUse when a task is multi-step, may span context resets or sessions, uses subagents, or risks losing state before completion.
GanyuanRan / finishing-a-development-branchUse when verified work needs integration or cleanup of an existing task-created branch/worktree, or the user explicitly requests merge, PR, or branch lifecycle handling.
reticlehq / reticleInstall, instrument and verify this running web app from the inside (DOM, network, routing, console and framework state) instead of screenshots or guessing. Drives one real flow end to end and returns a verdict with the file:line to fix
reticlehq / install-and-verifyVerify that a web app change actually works by driving the running app from the inside (DOM, network, routing, console, framework state) instead of screenshots or guessing.
reticlehq / verify-cli-runProve that a command-line tool actually did what it said, instead of trusting its exit code and its output. Snapshots the filesystem before and after, names the expected consequence in advance, and returns one of four verdicts with what could not be seen.
reticlehq / verify-language-switchProve a language switch translates what the user sees, keeps what they had already typed, and is still in force after a reload
reticlehq / verify-unattendedInstall, instrument and verify a web app end to end without pausing for a human. Use in an autonomous or goal-mode agent, in CI, or in any client that asks for approval on every command: it never says "restart your client" or "open a browser", because it takes a route that needs neither.
reticlehq / verify-form-validationCheck that a form actually rejects bad input: the error message renders, the submit button stays disabled, and no request goes out
reticlehq / replay-user-flowsTurn a user journey you just clicked through into a saved regression check that re-runs deterministically, with no model in the loop and no test code to write
reticlehq / verify-keyboard-accessVerify that every interactive control on a page can take keyboard focus and that its primary action fires from the keyboard rather than only the mouse, and say plainly that Tab order cannot be verified today
