Results for “file-read”

14 skills

Enforces a read-only rule for filesystem junctions and symlinks, blocking writes, deletes, and git commits that resolve outside the current project root.

testing-for-xxe-injection-vulnerabilities

Discover and exploit XML External Entity injection vulnerabilities to read server files, perform SSRF, and exfiltrate data during authorized penetration tests.

24.6k · bundle

performing-directory-traversal-testing

Test web applications for path traversal vulnerabilities that allow reading or writing arbitrary files on the server by manipulating file path parameters.

24.6k · bundle

Runs an evidence-first, read-only workflow over large codebases via an external JSONL REPL server, retrieving only minimal file slices and greps to produce cited architecture and audit reports.

driver-qualification-file

Use this skill when the user asks about Driver Qualification Files (DQF) — what must be in a DQ file under 49 CFR 391, retention periods, what's required pre-hire vs ongoing, document expiration tracking, audit-readiness for driver files, common DQF deficiencies that auditors find, or how to handle missing documents on existing drivers. Always cite the specific subsection of 49 CFR 391.

Detect and exploit Server-Side Request Forgery vulnerabilities by identifying user-controlled URL parameters, testing for internal service access, cloud metadata endpoints, and file scheme reads, with bypass techniques for common filters.

More results

Scaffold the local env file with required variable stubs from .env.example and code, open it for the user to fill, and verify completeness by key names only — never reading secret values

Perform thorough code reviews on files or pull requests, checking for bugs, security vulnerabilities, performance issues, and style violations. Use when the user requests code review or provides relevant inputs for this workflow.

exploiting-insecure-data-storage-in-mobile

Identifies and exploits insecure local data storage vulnerabilities in Android and iOS mobile applications, including unencrypted databases, world-readable files, and plaintext credential storage.

24.6k · bundle

当一段改动已经写完、要在收尾或合并前对它做一次独立审查时使用——如"审一遍这条分支、review 这次改动、这批代码有没有问题、帮我把关再合"。先把 BASE..HEAD 生成一份审查包一次读完，再按 correctness / readability / architecture / security / performance 五轴加测试质量逐项判定，输出带 file:line 的 Critical / Important / Minor 分级 findings。composable 层能力单元，通常由 execute-task 在整体验收时调用。不要用于：改动还没写完、只想跑测试、要的是动手修复而不是审查、评审需求或技术方案本身。

code-simplification

Simplify application code for clarity without changing behavior — refactor after tests pass, reduce nesting and duplication, match project conventions. Load when refactoring for readability, cleaning up after a feature ships, or when code review flags complexity. Also triggers on "simplify this code", "code simplification", "make this easier to read", "reduce complexity", "refactor for clarity". Not for compress/split/prune-skill (skill-library files). Pairs with technical-debt-audit.

Launches four parallel read-only sub-agents to review a git diff or file scope for regressions, security risks, performance issues, and contract gaps, then aggregates findings into a prioritized fix path.

Audits source code for observability gaps — missing telemetry, poor observability practices, and code structure that resists instrumentation — then emits a ranked, bounded finding list. Invoke when the user says "observablip this", "observablip `pkg/foo`", "audit observability", "review telemetry", "find missing spans", "audit o11y on this PR", "review my logging", or "is this instrumented well enough?". Read-only; never edits files.

validate-skills

Run a fast, read-only health check across all skills in the library and produce a structured quality report — without modifying anything. Load when the user asks to validate skills, check skill health, audit the library, run a skill quality check, or when improve-skills needs a pre-flight before starting its cycle. Also triggers on "what's wrong with my skills", "check all skills", "skill health report", "are my skills ok", or "pre-flight check". Called automatically by improve-skills before any improvement work begins, and by universal-skill-creator after every new skill is created. Never modifies any file — only reads and reports.