Results for “open-redirect”

Tests OAuth 2.0 and OpenID Connect implementations for security flaws including authorization code interception, redirect URI manipulation, CSRF in OAuth flows, token leakage, scope escalation, and PKCE bypass.

Route design-generation work into the right Open Design workflow mode — prototype, deck, document, or media artifact. Use when the user needs local-first UI prototype generation, presentation deck creation, or design-system-aware HTML/PDF/PPTX artifacts via locally-installed coding agents. Supports 72 built-in design systems, 5 visual directions, 93 media prompt templates, and multi-format export. Triggers on: open-design, local design tool, prototype generation, design deck, design artifact, design agent workflow, open design prototype, design system artifact, UI prototype generation.

Hunt Client-Side Path Traversal vulnerabilities where attacker-controlled input is concatenated into the path of a fetch() or XHR request, enabling redirection and chaining to XSS or data exfiltration.

First-contact orientation for an unfamiliar codebase. Use when "I'm new to this repo", "orient me", "explain this codebase", "what does this do?", "onboard me", "first day on this project", or "catch me up on the codebase".

Upgrade Expo SDK versions and fix dependency issues with step-by-step guidance.

Analyzes a website's current design and user intent to produce a structured redesign specification, including product and design documents, a design system JSON, and a reasoning trace.

Navigate and route in Expo Router apps using file-based routes, groups, dynamic routes, Link with previews and context menus, native Stack, modals, form sheets, NativeTabs, headers, toolbars, and search bars.

Guides developers through Google Ads API quickstart: credential setup, choosing from 6 client libraries/REST, configuring environments, and running a 'retrieve campaigns' script. Troubleshoots common setup errors.

Routes Omniverse Realtime Viewer requests to focused reference documents and enforces architectural rules for building USD viewer applications.

Research the open web for enhancement opportunities (Layer 3 — Opus subagent with WebSearch + WebFetch). Topic-driven. Returns structured findings with hype tags + source URLs. Does NOT auto-implement.

Deprecated redirect skill that routes legacy 'content creator' requests to the correct specialist. Use when a user invokes 'content creator', asks to write a blog post, article, guide, or brand voice analysis (routes to content-production), or asks to plan content, build a topic cluster, or create a content calendar (routes to content-strategy). Does not handle requests directly — identifies user intent and redirects to content-production for writing/SEO/brand-voice tasks or content-strategy for planning tasks.

Route active project/repo memory requests into one honest packet: memory-layer choice, load-context, search-context, store-conclusions, setup-integration, or repo-packer route-out. Use when agents need searchable decisions, manifests, stable links, handoff notes, and small “read this first” packets across sessions. Route long-lived markdown knowledge bases to `llm-wiki`, structural graph memory to `graphify`, human-authored vault organization to note/vault skills, and one-shot repo packing to tools like Repomix, Gitingest, or Code2Prompt.

Architect C2 redirectors with nginx and Apache, derive filter rules from malleable profiles, and apply OPSEC controls for resilient red-team infrastructure.

Route any website you need to visit through markdown.new by prefixing the URL. **WHEN TO USE:** - You would normally open a website link to read content (docs, blog posts, changelogs, GitHub issues, etc.) - You need a cleaner, Markdown-friendly view for copying notes or summarizing

Oracle CLI second-model review/debug/refactor/design with selected files, dry-run token checks, API or browser engine.

MUST USE when user wants to 调研/research/搜索/search/查/找/look up anything on the internet — e.g. 全网调研 X / 帮我调研一下 X / 查一下 X / 搜搜 X / 看看大家怎么评价 X / X 上有什么讨论 / research this topic。 Also MUST USE when user mentions any platform or shares any URL/链接: 小红书/xiaohongshu/xhs, Twitter/推特/X, B站/bilibili, Reddit, Facebook, Instagram, V2EX, LinkedIn/领英/招聘/求职/jobs, YouTube, GitHub code search, 小宇宙播客, 雪球/股票行情, RSS feeds, or any web URL. 15 platforms, multi-backend routing (OpenCLI / per-platform CLIs / APIs). Zero config for 6 channels. Run `agent-reach doctor --json` to see which backend serves each platform right now. NOT for: 写报告/数据分析/翻译等内容加工（本 skill 只负责从互联网获取内容）； 发帖/评论/点赞等写操作；已有专门 skill 的平台（先用专门 skill）。 【路由方式】SKILL.md 包含路由表和常用命令，复杂场景需按需阅读对应分类的 references/*.md。 分类：search / social (小红书/推特/B站/V2EX/Reddit/Facebook/Instagram) / career(LinkedIn) / dev(github) / web(网页/文章/RSS) / video(YouTube/B站/播客)。

Turn a cold dial into a conversation. A permission-based opener plus ready objection turns for "not interested," "no time," "just send me info," and "we already use X," tuned to one persona. Built for B2B SDRs and full-cycle reps, customizable to your persona, offer, and dialer. Trigger on "write a cold call opener", "give me objection responses", "handle 'not interested'", "cold call script for this persona", or any live-dial prep.

Opens a GitHub pull request targeting the main branch using the gh CLI and the repository's PR template, after verifying local checks pass.

Delegate coding to OpenCode CLI (features, PR review).

Performs free, open-source reverse engineering with Ghidra using headless or GUI modes, including decompilation, cross-references, and optional MCP workflows when IDA is unavailable.

Takes an approved plan from docs/plans/ and drives it to an open PR. Implements it by milestones, commits per milestone in the repo's style, and opens the PR against the repo's base branch. Use whenever the user approves a plan, says "ship it", "go", "start", "implement it", "do it", or asks to open a PR for already-planned work — or in Spanish "dale", "arrancá", "implementalo", "hacelo".

Turn a cold start into a warm one. Build a single orientation document for a project, account, or workspace, what it is, where things live, the decisions made so far, the open items, and the next move, so a new session or a new teammate is productive in minutes instead of days. Trigger on "get me up to speed", "onboard someone to this", "what's the context here", "brief a new session", "orient me on this account", or any cold-start on work already in motion.

Operates as an autonomous system that loads context from index files, follows goal-driven principles, and uses available agents and skills to execute decisions.

Automatically hunt for high-impact OSS contribution opportunities in trending repositories.

Derive a portable product-idea kickoff prompt from the invoking repository for use with $idea-scope-brief in a different repository. Use when a repo suggests an adjacent product, SaaS, devtool, library, workflow, or experiment worth briefing elsewhere, but the user wants an idea prompt rather than code extraction or repo creation.

curl reference tool

Commit, push, and open a pull request with a conventional commit message

Delegate coding to OpenCode CLI (features, PR review).

Automatically hunt for high-impact OSS contribution opportunities in trending repositories.

Use when searching a local NCBI EDirect archive/postings index with Boolean, title, word, or pair queries inside the `x*` local-cache workflow.

OpenClaw API gateway proxy for authenticated SaaS calls (100+ services in references/SERVICES.md). Use ONLY when making an HTTP request to a third-party service that requires the gateway's stored credentials. NOT for direct API calls with bearer tokens already in scope, NOT for monday.com (use monday-for-agents), NOT for WhatsApp (use heleni-whatsapp). Triggers: "call the X API", "fetch from <service>", "send to Slack via gateway", "use the gateway for".

Scan for OSS tool opportunities from npm gaps, GitHub trends, and developer pain points

Deep OAuth 2.0 / OpenID Connect security assessment. Covers the full attack surface: redirect_uri validation bypass (path traversal, open redirect chains, subdomain confusion, URL parsing tricks, parameter pollution, response mode switching), missing/broken state parameter CSRF, PKCE downgrade and absent-challenge attacks, implicit grant token leakage (Referer, browser history, XSS fragment theft), authorization code injection, scope escalation, client confusion attacks, mutable-claims account takeover (iss+sub confusion, email-keyed identity merging), pre-account takeover via unverified registration, OpenID Connect dynamic client registration SSRF (logo_uri, jwks_uri, sector_identifier_uri, request_uri), nonce replay, ID token validation failures, Device Code phishing flow, mobile custom URI scheme hijacking, refresh token persistence, token introspection enumeration, consent screen clickjacking, host header injection, and cross-IdP mix-up attacks. Uses KOAuth, jwt_tool, nuclei oauth templates, and manual ht