Integrations & APIs

noorqureshi Skill

Break API authentication: token handling, key leakage, weak session/JWT, and no-auth endpoints. Load on REST/GraphQL APIs using API keys, Bearer tokens, HMAC signing, or basic auth. Signals: `Authorization` headers, api_key params, tokens in URLs, /v1 vs /v2 auth drift.

noorqureshi Skill

Clickjacking / UI redress — frame a target so a victim's clicks hit hidden actions. Load when a page allows framing (no X-Frame-Options / frame-ancestors), on state-changing one-click actions, or "clickjacking". Signals: missing framebusting headers, sensitive buttons, OAuth consent, account settings.

noorqureshi Skill

Open redirect — abuse a redirect param to send users to attacker sites, and chain it (OAuth token theft, SSRF filter bypass, phishing). Load on params like redirect=, next=, url=, return=, callback=, dest=, or a 30x Location built from input. Signals: `?returnUrl=`, login redirects, OAuth `redirect_uri`.

noorqureshi Skill

Mine JavaScript for endpoints, params, secrets, and hidden functionality. Load on SPAs, heavy JS apps, after crawling, or "analyze the JS". Signals: bundled JS (webpack/main.*.js), API calls in JS, source maps, /static/js, front-end frameworks.

noorqureshi Skill

Inject into Neo4j Cypher queries to bypass auth, exfiltrate graph data, and reach SSRF/RCE. Load when user input reaches a Cypher query (Neo4j-backed app, GraphQL/REST over a graph DB) — a login, search, or filter that builds `MATCH (n {prop:'<input>'})`. Signals: Neo4j/Bolt (7687), `MATCH`/ `RETURN` in errors, `neo4j` cookies/stack traces, apoc procedures, a graph-backed search field.

noorqureshi Skill

A fast, ordered methodology for assessing an API end to end — REST/GraphQL/gRPC/SOAP — so nothing gets skipped. Load when the target is an API (or recon found one), on "test this API", "checklist", methodology triage, or to confirm coverage before reporting. Signals: /api, swagger/openapi.json, GraphQL /graphql, gRPC, JSON/XML endpoints, a mobile/SPA backend.

noorqureshi Skill

Abuse deep links / custom URL schemes / intents for redirect, token theft, and reaching internal screens. Load on custom schemes (myapp://), App Links/Universal Links, exported activities, or "open in app". Signals: intent-filters in the manifest, WebView loading deep-link params, OAuth redirect via a custom scheme.

noorqureshi Skill

Find secrets and internal detail an organisation leaked to public code — GitHub/GitLab repos, gists, and commit history. Load during recon of a named org, on "github dorks", "leaked secrets", "find API keys", or when employees/repos are in scope. Signals: a company GitHub org, developer usernames, an internal domain to grep for.

noorqureshi Skill

Reverse client-side request signing / obfuscated JS so you can replay and fuzz a protected API outside the browser. Load when requests carry a computed guard you must reproduce: an X-Signature / X-Sign / sign / hmac / _s / token header or body field, a nonce+timestamp, a "signature invalid" 401, encrypted request bodies, or minified/webpack/WASM/JSVMP signer code.

openharmonyinsight Bundle

Use when generating unit tests for ETS/ArkTS static API classes in OpenHarmony graphic_3d module, when adding new test cases for MaterialETS, CameraETS, SceneETS or similar wrapper classes, or when setting up test environment for GTest-based ETS unit tests

openharmonyinsight Bundle

对 ArkUI 公共 UI API 与 Android（Compose/View）和 iOS（SwiftUI/UIKit）进行可审计的能力与规格竞品分析。 适用于接口设计评审、能力补齐、Android/iOS 与 ArkUI 迁移评估、API 对标和 capability gap analysis， 覆盖触摸/指针输入、键盘快捷键、手势、组件、布局、状态和动画。要求锁定作用域与版本，以 interface_sdk-js 为 ArkUI 公共接口权威源，优先引用 Android/iOS 官方文档，区分等价关系，并输出带逐项证据、影响和优先级建议的报告。

openharmonyinsight Skill

Web 领域 JS 引擎专家。关注 V8 引擎性能、JIT 编译、内存管理、WebAssembly、JS API 绑定等。作为专家团成员参与 ArkWeb 需求头脑风暴讨论。

zhaoxuya520 Bundle

设计 API 版本管理和兼容变更策略时使用。适用于公开 API、SDK、长期维护项目。优先使用 Stripe 版本策略 + 兼容/不兼容变更分类 + 弃用流程。

zhaoxuya520 Bundle

测试后端接口时使用。适用于 REST/GraphQL/RPC 接口测试、契约验证、API 集成测试。融合契约测试、Postman/REST Assured、OpenAPI 校验。

zhaoxuya520 Bundle

输出 OpenAPI 契约和 Mock 服务时使用。适用于 API 设计的最后一步、给前端/后端/QA 的交付。优先使用 OpenAPI 3.1 + Mock 数据覆盖所有路径 + 详细的下游交接清单。

zhaoxuya520 Bundle

设计 Webhook 和异步 API 时使用。适用于事件订阅、长任务、第三方集成。优先使用 HMAC 签名 + event_id 去重 + 重试策略 + 异步任务状态查询。

zhaoxuya520 Bundle

设计 API 错误码和错误结构时使用。适用于错误响应规范、调用方错误处理、调试可观测。优先使用 RFC 7807 Problem Details + 业务错误码 + 调用方处理建议。

zhaoxuya520 Bundle

设计 API 认证鉴权和权限矩阵时使用。适用于多角色系统、租户隔离、字段级权限。优先使用 OAuth 2.0 / JWT + RBAC + 资源归属检查。

zhaoxuya520 Bundle

设计具体 API 端点时使用。适用于资源建模后的下一步、列端点清单、HTTP 方法和状态码选择。优先使用 RFC 7231 HTTP 语义 + GitHub REST 命名规范。

zhaoxuya520 Bundle

设计请求和响应结构时使用。适用于字段定义、校验规则、响应格式。优先使用 JSON:API 风格 + 字段稳定性 + 完整校验规则。

zhaoxuya520 Bundle

设计幂等接口和重试策略时使用。适用于支付、扣减、订单、关键写操作。优先使用 Idempotency-Key + 业务去重键 + 并发冲突处理（ETag/版本号）。

zhaoxuya520 Bundle

把业务对象建模为 REST 资源时使用。适用于 API 设计起点、复杂业务对象抽象、资源关系定义。优先使用 REST 资源模型 + 集合/单资源/子资源/动作四种模式。

zhaoxuya520 Bundle

设计数据库实体、表结构、字段类型和约束时使用。适用于新业务建模、API 契约落库、已有表结构重构和 ER 设计。融合 DDD 实体识别 + 关系范式 + 业务约束 + 演进策略。

zhaoxuya520 Bundle

设计列表接口的分页、筛选、排序、搜索时使用。适用于所有列表 API。优先使用 cursor 分页（大数据）或 offset 分页（小数据）+ 统一筛选/排序规范。

zhaoxuya520 Bundle

---

eugenelim Bundle

Read Linear Issues and Projects via the GraphQL API. Supports fetching individual issues (title, description, identifier, sub-issues, owning project), fetching all issues in a project, verifying credentials, and executing confirmed refresh write-back actions through work-intake. Use when you want to read Linear work items to create briefs or catch up a brief with changes.

eugenelim Bundle

Use when generating an OpenAPI 3.1 API contract from requirements, user stories, or domain models. Applies a pluggable API standard (Zalando by default) as hard constraints to produce complete, validated YAML specs ready for code gen, test gen, mocks, and SDKs. Activate for tasks involving API design, REST contract authoring, or OpenAPI spec creation.

eugenelim Bundle

Use when authoring an AsyncAPI event contract from requirements, user stories, or domain models. Applies a pluggable event-design standard (Zalando by default) as hard constraints and composes a swappable message envelope (CloudEvents by default) to produce a complete, validated AsyncAPI document for an event stream you produce or own. Activate for event-driven API design, event/message contract authoring, or AsyncAPI spec creation. Author only when the feature produces or owns the event type, not when it merely consumes one.

kumaran-is Bundle

This skill provides patterns and templates for NestJS 11.x with Fastify, Prisma ORM, and TypeScript 5.x development. It should be activated when creating NestJS modules, controllers, services, DTOs, guards, interceptors, or tests.

plamentsv Skill

Trident Api Reference

majesticlabs-dev Skill

Build Django applications with models, views, forms, templates, REST APIs, and modern Django 5.x patterns.

majesticlabs-dev Skill

Build FastAPI applications with async patterns, Pydantic validation, dependency injection, and modern Python API practices.

majesticlabs-dev Bundle

Generate and edit images using Google's Gemini API. Supports text-to-image, image editing, multi-turn refinement, and composition from multiple reference images.

antgroup Bundle

Scrape employee data from a logged-in SAP SuccessFactors browser session using browser automation. Use when: user provides an employee ID and wants employee details (name, email, department, manager, etc.) scraped directly from the SuccessFactors UI — NOT via OData/API. Requires the user to have SuccessFactors open and logged in via Chrome with the OpenClaw Browser Relay extension attached. Triggers on: "get employee name", "look up employee", "scrape SF", "find employee in SuccessFactors", or any request combining an employee ID with SuccessFactors data lookup.

antgroup Bundle

Generate adult images, artistic nudes, glamour photography, and fantasy art using the each::sense API with safety checker disabled

antgroup Bundle

Generate adult video content using each::sense API with safety checker disabled