bookforge-ai

@bookforge-ai source repo

236 skills
0 followers
1 week ago last updated

▌
Replication Strategy Selector · bookforge-ai bundle
Choose a replication topology (single-leader, multi-leader, or leaderless) and configure it correctly — including sync vs. async mode, quorum parameters (w + r > n), and consistency guarantees. Use when designing replication for a new system, configuring quorum values for Cassandra/Riak/DynamoDB, deciding how to handle multi-leader write conflicts, or comparing PostgreSQL/MySQL streaming replication vs. CouchDB multi-leader vs. Cassandra leaderless for your architecture. Also use for: selecting a conflict resolution strategy (last-write-wins vs. version vectors); designing multi-datacenter replication; choosing between WAL shipping, logical replication, and statement-based replication log formats. For diagnosing an existing replication failure (failover gone wrong, lag spike, quorum misconfiguration, split brain), use replication-failure-analyzer instead. For consistency model selection (eventual vs. causal vs. linearizable), use consistency-model-selector instead. For partitioning strategy, use partitioning-

1 install
▌
Architecture Quantum Analyzer · bookforge-ai bundle
Analyze a system's architecture quanta — independently deployable units with distinct quality attribute needs. Use this skill whenever the user needs to determine if their system should be monolith or distributed, is analyzing deployment boundaries, evaluating which parts of a system need different scalability/reliability/performance characteristics, decomposing a monolith, or asking "should this be one service or many?" — even if they don't use the term "quantum."

1 install
▌
Product Team Health Diagnostic · bookforge-ai bundle
Diagnose why a product team or organization is slow, not innovative, or delivering poor outcomes. Use when a leader or team observes slow velocity, lack of innovation, poor product quality, feature factory behavior, or team dysfunction — and needs root causes and a prioritized fix list. Also use when a new product leader is assessing an organization, when a CEO or board says teams are too slow, or when someone says 'why are we not shipping faster?', 'engineering and design aren't collaborating', 'we ship but nothing moves the needle', or 'I need to assess team health before proposing changes.' Scores 42 diagnostic criteria across team behaviors, innovation capacity, velocity killers, and design integration. Produces a severity-ranked report with a composite health score and remediation priorities. For culture-level issues (innovation vs. execution quadrant), use product-culture-assessment. For process-level waterfall diagnosis, use product-process-dysfunction-diagnosis.

1 install
▌
Authentication Security Assessment · bookforge-ai
Systematically assess web application authentication mechanisms for design flaws and implementation vulnerabilities. Use this skill whenever: testing the login security of a web application; auditing authentication for unauthorized access risk; evaluating password policy strength or brute-force resistance; checking whether login failure messages leak usernames (user enumeration); testing credential transmission over HTTP vs HTTPS; reviewing password change or forgotten password flows for logic flaws; assessing "remember me" cookie security; testing multistage login mechanisms for stage-skipping or cross-stage credential mixing; reviewing source code or HTTP traffic for fail-open logic or insecure credential storage; performing a penetration test or security code review of any user authentication system. Covers HTML forms-based, HTTP Basic/Digest, and multifactor authentication. Maps to OWASP Testing Guide (OTG-AUTHN-*) and CWE-287 (Improper Authentication), CWE-521 (Weak Password Requirements), CWE-307 (Impro

1 install
▌
Secure Deployment Pipeline · bookforge-ai
Secure a software deployment pipeline against supply chain attacks from benign insiders (mistakes), malicious insiders, and external attackers: map pipeline threats to mitigations using the three-adversary threat model, generate binary provenance requirements for each build stage, define provenance-based deployment policies with choke-point enforcement, design verifiable build architecture (trusted build service, rebuild service, or hybrid), and produce a staged hardening roadmap with breakglass controls. Use when assessing supply chain security for a CI/CD pipeline, implementing binary provenance to trace artifact origins, designing deployment policies that verify what is deployed rather than who initiated deployment, hardening build infrastructure against insider threats, or establishing breakglass procedures that remain auditable. Requires secure-code-review as a prerequisite control (code review is the first mitigation layer against malicious or accidental code changes before they enter the pipeline). Pro

1 install
▌
Security Incident Recovery · bookforge-ai
Use when you need to recover from a security incident, build an incident recovery plan, execute post-breach remediation, rotate credentials after a breach, scope attacker impact across systems, build a recovery checklist, decide when to eject an attacker vs. continue observing, or run a post-incident postmortem with short-term and long-term action items.

1 install
▌
Risk Storming Facilitator · bookforge-ai bundle
Plan and facilitate collaborative risk storming sessions for architecture teams. Use this skill whenever the user wants to run a risk identification workshop, organize a risk storming exercise, plan a collaborative risk assessment session, facilitate architecture risk discovery with a team, prepare a risk workshop agenda, coordinate group risk identification, or run a team-based architecture risk review. Also triggers when the user mentions "risk storming," "collaborative risk session," "team risk workshop," "group risk identification," wants to prepare pre-work materials for a risk meeting, or asks "how should I run a risk session with my team?" — even if they don't use the exact term "risk storming."

1 install
▌
Influence Principle Selector · bookforge-ai bundle
Identify which of Cialdini's 6 influence principles to apply for a persuasion scenario. Use when someone asks "which persuasion tactic should I use?", "how do I make this more persuasive?", "what's the best influence strategy for this situation?", or "which Cialdini principle applies here?" Also use for: persuasion audit of marketing copy, sales email, or landing page; choosing between reciprocity vs scarcity vs social proof for a campaign; mapping a persuasion scenario to compliance psychology; diagnosing why content isn't converting; identifying influence tactics being used against you in a negotiation; evaluating ethical boundaries of a persuasion approach. Applies Cialdini's master taxonomy of 6 principles (reciprocity, commitment, consistency, social proof, liking, authority, scarcity) plus contrast principle and cross-principle interaction rules to produce a scored, rationale-backed recommendation. Classifies practitioners as ethical (real evidence) vs exploitative (manufactured triggers). Works on mark

1 install
▌
Customer Discovery Program · bookforge-ai
Design a customer discovery program to achieve product-market fit for a significant new product or market expansion. Use when launching a new product, entering a new market segment, redesigning a product for a different customer segment, or when someone asks 'how do we find product-market fit?', 'how do we get reference customers?', or 'are we stuck in a sales-driven fragmentation spiral?' Also use when the team is unsure if they have achieved product-market fit, when scaling sales feels premature, or when checking whether the Sean Ellis test applies. Produces a complete program plan: single target market definition, recruitment criteria for 6 reference customers, co-development relationship structure, and product-market fit definition by product type (B2B, platform/API, consumer, internal). Not for small features or minor improvements — use value-testing-technique-selection for those.

1 install
▌
Product Culture Assessment · bookforge-ai bundle
Assess the product culture of a company or team across innovation capacity and execution strength. Use when a leader, founder, or product manager wants to understand where the organization sits on the innovation-execution spectrum and which cultural gaps to address. Also use when someone asks 'do we have a strong innovation culture?', 'why does our team ship fast but feel uncreative?', 'how do we build a culture like Amazon or Netflix?', 'are we a feature factory?', or 'I need to assess our product culture before proposing changes.' Scores 14 culture attributes (7 innovation + 7 execution), places the organization in one of four quadrants (Dreamers, Factories, Elite, Stalled), and produces a prioritized 90-day improvement roadmap. For diagnosing specific team-level dysfunctions (velocity, design integration, behaviors), use product-team-health-diagnostic instead. For waterfall process issues, use product-process-dysfunction-diagnosis instead.

1 install
▌
Product Okr Implementation · bookforge-ai bundle
Design and implement an OKR (Objectives and Key Results) system for product teams. Use when transitioning away from feature roadmaps to outcome-based planning, setting up OKRs for a product organization, replacing quarterly roadmaps with business objectives, aligning multiple teams to shared goals, or when someone asks 'how do we set up OKRs?' Also use when diagnosing OKR cascade failures, structuring high-integrity commitments to stakeholders, establishing OKR scoring standards, running quarterly OKR planning cycles, or scaling OKRs to 25+ teams. Covers the 12 OKR rules, scoring rubric, functional cascade anti-patterns, and a 6–12 month roadmap-to-outcomes transition plan. Not for diagnosing team health or culture — use product-team-health-diagnostic or product-culture-assessment instead.

1 install
▌
Application Logic Flaw Testing · bookforge-ai
Test web application business logic for vulnerabilities that automated scanners cannot detect. Use this skill when: performing a penetration test or security assessment and automated tools have been run but logic-layer coverage is still needed; testing multistage workflows (checkout, account creation, approval flows, insurance applications) for stage-skipping or cross-stage parameter pollution; probing authentication and password-change functions for parameter-removal bypasses (deleting existingPassword to impersonate an admin); testing numeric business limits for negative-number bypass (submitting -$20,000 to avoid approval thresholds); probing discount or pricing logic for timing flaws (add items to qualify, remove before payment); investigating whether shared code components allow session object poisoning across unrelated application flows; hunting for encryption oracles where a low-value crypto context can be used to forge high-value tokens; probing search functions that return match counts as side-channe

1 install
▌
Xss Detection And Exploitation · bookforge-ai
Detect, exploit, and remediate cross-site scripting (XSS) vulnerabilities across all three varieties — reflected, stored, and DOM-based — in web applications under authorized security testing. Use when conducting penetration tests or security assessments that require identifying XSS entry points, constructing context-aware payloads, bypassing input filters, and producing evidence for remediation.

1 install
▌
Legacy Code Symptom Router · bookforge-ai bundle
Diagnose any legacy-code situation in plain language and route to the right technique. Use as the FIRST skill when a developer has a vague or specific complaint about a codebase — 'I have to change this but there are no tests', 'this method is huge', 'can't test this class', 'library is killing us', 'changes take forever', 'don't know where to start', 'overwhelmed', 'inherited this mess'. Activates for 'legacy code', 'untested code', 'where do I start', 'what should I do with this code', 'help me plan a refactor', 'I'm stuck with legacy', 'how do I change X safely', 'symptom triage'. Dispatches to technique-specific skills.

1 install
▌
Consistency Model Selector · bookforge-ai bundle
Choose the correct consistency model (linearizability, causal consistency, or eventual consistency) for each operation in a distributed system, and select the matching implementation mechanism. Use when designing a new distributed data system, deciding whether ZooKeeper or etcd is needed for coordination, evaluating whether two-phase commit is appropriate for cross-node transactions, debugging correctness violations (stale reads, split-brain, uniqueness constraint failures), or distinguishing linearizability from serializability. Also use when applying the CAP theorem correctly (beyond the "pick 2 of 3" oversimplification), selecting total order broadcast as a consensus primitive, evaluating 2PC failure modes and lock-holding cost, or assessing whether causal consistency is sufficient in place of linearizability. Produces a per-operation consistency recommendation with replication mechanism, ordering guarantee, and — when consensus is needed — protocol selection (Raft, Zab, Paxos) with documented failure mode

1 install
▌
Data Integration Architect · bookforge-ai bundle
Design the integration architecture for systems with multiple specialized data stores (Postgres, Elasticsearch, Redis, data warehouses) that must stay in sync. Use when deciding how data flows between components, avoiding dual writes, reasoning about correctness across system boundaries (idempotency, end-to-end operation identifiers), choosing between Lambda and Kappa architecture, or applying the "unbundling databases" pattern to compose specialized tools instead of relying on a single monolith. Trigger phrases: "how do I keep Postgres and Elasticsearch in sync?", "should I use CDC or event sourcing to propagate data?", "how do I avoid dual writes across microservices?", "my downstream systems are going out of sync — how do I fix the architecture?", "how do I design derived data pipelines?", "what is the system of record pattern?", "how do I integrate OLTP with a search index and an analytics warehouse?", "how do I design for end-to-end idempotency?". This is the capstone skill for data systems design — it s

1 install
▌
Stream Processing Designer · bookforge-ai bundle
Design a stream processing system for unbounded, continuously arriving data. Use when choosing a message broker (Kafka vs RabbitMQ), implementing change data capture (CDC) from PostgreSQL, MySQL, or MongoDB via Debezium or Maxwell, selecting window types for aggregation (tumbling, hopping, sliding, session), joining event streams or enriching events from a table, or configuring exactly-once fault tolerance. Trigger phrases: "should I use Kafka or RabbitMQ?", "how do I sync my database to Elasticsearch in real time?", "how do I implement CDC for Postgres?", "how do I get exactly-once semantics in Flink or Kafka Streams?", "should I use Lambda or Kappa architecture?", "how do I keep derived data systems in sync without dual writes?", "how do I join two event streams?". Covers log-based vs. traditional broker selection, four window types, three join types (stream-stream, stream-table, table-table), CDC bootstrap strategy, and microbatching vs. checkpointing trade-offs. Does not apply to bounded offline datasets

1 install
▌
Architecture Risk Assessor · bookforge-ai bundle
Quantify architecture risk using a 2D risk matrix (impact x likelihood, scored 1-9) and produce structured risk assessment reports. Use this skill whenever the user asks about architecture risks, wants to evaluate risk across services or components, needs a risk matrix, mentions risk assessment, risk analysis, risk heat map, risk scoring, or asks "what are the risks?" for any architecture — even if they don't explicitly say "risk assessment." Also triggers when the user mentions unproven technology risk, scalability risk, availability concerns, security risk, data integrity risk, or wants to prioritize risks for stakeholder meetings.

1 install
▌
Reciprocity Strategy Designer · bookforge-ai bundle
Design reciprocity-based persuasion strategies and detect when reciprocity is being used against you. Use this skill when planning give and take strategies, creating lead magnets or free value offers, designing favor-first or value-first outreach, building gift-based marketing campaigns, crafting free samples or free trials, writing content marketing that creates obligation, designing negotiation openings, planning door-in-the-face or rejection-then-retreat sequences, structuring concession-based selling, responding to unsolicited gifts or favors before a pitch, evaluating whether a gift creates obligation, planning reciprocal concessions in negotiation, or defending against manipulation through uninvited debts.

1 install
▌
Incident Response Team Setup · bookforge-ai
Use when you need to set up an incident response team from scratch, design an IR team charter, define severity and priority models for incidents, create IR playbooks, build a structured testing program, design tabletop exercises, or answer "how do we build and validate our incident response capability."

1 install
▌
Marketing Message And Usp Crafting · bookforge-ai
Use this skill to craft a differentiated Unique Selling Proposition (USP), write a Problem/Solution/Proof elevator pitch, and engineer headlines that activate the 5 core emotional buying motivators. Triggers when a user asks to write a USP, unique selling proposition, craft a marketing message, build an elevator pitch, differentiate from competitors, answer 'why buy from me', write headlines, write copywriting or marketing copy, fix positioning, escape me-too marketing, stop competing on price, apply emotional marketing, target fear/love/greed/guilt/ pride in copy, identify pain points for messaging, write sales copy, or fill square #2 of the 1-Page Marketing Plan canvas. Also activates for 'quality and great service as USP', 'we offer the best service', 'how do I stand out', 'nobody knows what makes us different', 'my ads are not working', or similar messaging and positioning questions.

1 install
▌
Source Code Security Review · bookforge-ai
Perform a systematic white-box security review of web application source code to find exploitable vulnerabilities. Use this skill when: you have authorized access to an application's source code and need to identify security flaws faster or more thoroughly than black-box testing alone; auditing a codebase prior to launch or after a security incident; reviewing open-source or purchased software for embedded vulnerabilities; complementing an active penetration test with source-level analysis. Applies a three-phase methodology: (1) identify all user-input entry points via platform-specific source APIs — Java HttpServletRequest, ASP.NET Request.Params/Form/QueryString, PHP $_GET/$_POST/$_COOKIE/$_REQUEST, Perl CGI param(), JavaScript document.location/URL; (2) trace data flow forward to dangerous sink APIs — Runtime.exec()/Process.Start() for OS command injection, Statement.execute()/mysql_query() for SQL injection, FileInputStream/include() for path traversal, sendRedirect()/header() for open redirect, eval() fo

1 install
▌
Disaster Risk Assessment · bookforge-ai
Use when you need to assess disaster risk for a system or organization, perform structured risk analysis before disaster planning, identify which disasters to plan for, build a prioritized risk register, quantify probability and impact of failure scenarios, or answer "what disasters should we prepare for and in what order."

1 install
▌
Batch Pipeline Designer · bookforge-ai bundle
Design batch data processing pipelines for large-scale, bounded datasets processed offline. Use when building ETL workflows, processing logs or clickstream data at scale, generating ML feature pipelines or search indexes, or joining two large datasets that cannot fit in memory. Trigger phrases: "design a batch pipeline", "should I use Spark or MapReduce", "how do I join two large datasets", "build an ETL workflow", "process server logs at scale", "how do I handle skewed data in joins", "implement PageRank on a distributed graph", "design an offline processing job". Covers MapReduce vs dataflow engines (Spark, Flink, Tez), three join strategies (sort-merge, broadcast hash, partitioned hash) with selection criteria, graph processing via the Pregel/BSP model, and fault tolerance via materialization vs recomputation. Does not apply to unbounded input streams (see stream-processing-designer) or low-latency OLTP query serving. Produces a pipeline architecture recommendation with engine choice, join strategy, and fa

1 install
▌
Encoding Format Advisor · bookforge-ai bundle
Select a data encoding format (JSON, Protobuf, Thrift, or Avro) and design a schema evolution strategy that preserves backward and forward compatibility through rolling upgrades. Use when asked "should I use Protobuf or JSON?", "how do I evolve my schema without breaking old clients?", "how does Avro schema evolution work?", "what's the difference between Thrift and Protocol Buffers?", or "how do I add/remove fields without breaking compatibility?" Also use for: choosing text vs. binary encoding for internal services; checking whether a schema change breaks compatibility; diagnosing unknown field loss bugs during rolling upgrades; planning per-dataflow encoding strategy (database storage vs. REST/RPC vs. message broker). Covers five encoding families: language-specific, JSON/XML/CSV, binary JSON, Thrift/Protobuf, and Avro — with writer/reader schema reconciliation and per-dataflow-mode analysis. For data model selection (relational/document/graph), use data-model-selector instead. For message broker or stream

1 install
▌
Storage Engine Selector · bookforge-ai bundle
Select the right storage engine architecture (LSM-tree, B-tree, or in-memory) for a database workload using a 7-dimensional scored trade-off analysis. Use when evaluating RocksDB vs InnoDB vs LevelDB, diagnosing write amplification in production, choosing between write-optimized vs read-optimized storage, selecting a compaction strategy (size-tiered vs leveled), or deciding whether to skip disk with an in-memory database. Also use for: comparing Cassandra vs PostgreSQL storage internals; justifying an existing engine choice to a team; assessing whether compaction pauses are causing latency spikes. Covers LSM-tree family (LevelDB, RocksDB, Cassandra, HBase), B-tree family (PostgreSQL, MySQL InnoDB, SQLite), and in-memory stores (Redis, Memcached, VoltDB). For choosing between relational/document/graph models, use data-model-selector instead. For OLTP vs. analytics routing, use oltp-olap-workload-classifier instead. For replication topology, use replication-strategy-selector instead.

1 install
▌
Architect Role Assessor · bookforge-ai bundle
Evaluate whether a software architect is fulfilling the 8 core expectations of the role and assess their technical breadth vs depth balance using the knowledge pyramid. Use this skill whenever the user asks what a software architect should be doing, questions whether they are performing the architect role correctly, wants to assess their own or someone else's architect performance, describes symptoms of role dysfunction (spending too much time coding, not attending stakeholder meetings, only recommending technologies they know, avoiding decisions), asks about transitioning from developer to architect, or encounters the Frozen Caveman anti-pattern where past experiences irrationally drive current decisions — even if they don't explicitly say "architect role" or "expectations."

1 install
▌
Influence Defense Analyzer · bookforge-ai bundle
Detect and counter manipulation attempts using Cialdini's 6 influence principles. Use when you feel pressured to comply with a request, sense a sales tactic at work, want to audit a document for manipulation, or ask "is this legitimate or am I being played?" Also use for: analyzing a sales pitch, marketing email, negotiation transcript, or contract for exploitative influence tactics; identifying which compliance trigger is being activated and whether it's real or manufactured; deciding whether to comply with a request you feel uneasy about; auditing your own persuasive content for ethical compliance; training yourself to recognize manipulation in consumer, negotiation, or organizational contexts. Applies all 6 per-principle defense protocols (reciprocity, commitment/consistency, social proof, liking, authority, scarcity) plus the epilogue meta-framework to classify practitioners as fair (real evidence) or exploitative (manufactured triggers) and prescribe a principle-specific response strategy. Works on docum

1 install
▌
Persuasion Content Auditor · bookforge-ai bundle
Audit, analyze, review, or score any persuasive content against the 6 principles of influence: reciprocity, commitment and consistency, social proof, liking, authority, and scarcity. Use when someone wants to improve their copy, check their persuasion strategy, evaluate a landing page, review a sales email, audit marketing materials, or find out which influence principles they're using or missing. Triggers on: audit my copy, review my email, is this persuasive, persuasion score, influence check, analyze my landing page, make this more persuasive, improve my conversion rate, CRO review, check my sales page, why isn't this converting, which principles am I using, what's missing from my pitch, evaluate my offer, marketing copy review, persuasion audit, influence framework review, content persuasion analysis. Input: any piece of persuasive content — sales email, landing page, marketing copy, pitch deck, product page, social ad, proposal. Output: scored audit report with per-principle ratings, evidence citations,

1 install
▌
Recovery Mechanism Design · bookforge-ai
Design recovery mechanisms for a software system or component: select the right rollback control strategy from a three-mechanism decision framework (key rotation, deny list, and minimum acceptable security version number / downgrade prevention), set rate-of-change policy that decouples rollout velocity from rollout content, eliminate wall-clock time dependencies from recovery paths, design an explicit revocation mechanism with safe failure behavior (distributing cached revocation lists rather than failing open), and provision emergency access for use when normal access paths are completely unavailable. Use when designing a new system's update or rollback architecture, reviewing an existing release pipeline for security-reliability tradeoffs, defining rollback policy for self-updating firmware or system software, designing a revocation mechanism for credentials or certificates, or planning emergency access infrastructure before an incident occurs. Output: a recovery mechanism design document with rollback cont

1 install
▌
Security Incident Command · bookforge-ai
Command and manage an active security incident from declaration through remediation handoff using the incident management framework (Google's IMAG, derived from ICS). Use when: you have a confirmed or suspected security incident and need to take command; someone says "we have a security incident" or "we may have been compromised"; you need to stand up an incident command structure with staffing roles; you are running forensic investigation and need to coordinate parallel tracks; an incident has grown large enough to require shift rotation and formal handovers; or you need to decide when investigation is complete enough to move to ejection and remediation. Distinct from incident response team setup (which designs the team and IR capability before incidents) — this skill executes the live response. Applies the seven-step incident command process: declare, staff, establish operational security, run forensic investigation loop, scale with rotation, apply the lead-rate decline signal to decide ejection timing, and

1 install
▌
Security Testing Strategy · bookforge-ai
Select and implement a layered security testing strategy for a codebase: design unit tests for security properties (boundary conditions, negative inputs, access control invariants), set up integration testing with non-production seed data (avoiding the production data copy anti-pattern), choose and configure dynamic analysis sanitizers (AddressSanitizer for memory corruption, ThreadSanitizer for race conditions, MemorySanitizer for uninitialized reads — with their performance cost tradeoff accounted for in CI/CD scheduling), plan fuzz testing (write effective fuzz drivers using libFuzzer/AFL, apply dictionary inputs for structured formats like HTTP/SQL/JSON, build a seed corpus, integrate continuous fuzzing via ClusterFuzz or OSS-Fuzz), and integrate static analysis at the right depth for each development stage (linters in the IDE commit loop, abstract interpretation nightly, formal methods for safety-critical paths). Use when creating a security testing plan for a new service, setting up fuzz testing for a p

1 install
▌
Plan Negotiation With Constructive Tension · bookforge-ai bundle
Build a pre-call negotiation plan using DuPont's four-step framework and sequence concessions to avoid the proactive-discount and ultimatum traps. Trigger this skill when you need to: - Plan a negotiation for a B2B sales deal before a pricing or concession conversation - Respond to a customer discount request without immediately caving on price - Counter a price reduction demand by broadening the negotiation beyond price - Structure your concession sequence so you trade low-value items first and protect margin - Avoid proactive discounting, escalating concession patterns, or ultimatum traps - Apply the DuPont four-step negotiation framework (Acknowledge & Defer → Deepen & Broaden → Explore & Compare → Concede According to Plan) - Use the Situational Sales Negotiation (SSN) pre-call planning template to score concessions before the call - Build scripted deferral language to buy time without threatening the deal - Prepare for a challenger negotiation with constructive tension - Draft a pre-call negotiation work

1 install
▌
Server Side Injection Testing · bookforge-ai bundle
Test web application back-end components for non-SQL server-side injection vulnerabilities. Use this skill when: testing for OS command injection via shell metacharacters (pipe, ampersand, semicolon, backtick) or dynamic execution functions (eval/exec/Execute); detecting blind command injection using time-delay technique (ping -i 30 loopback) when output is not reflected; probing for path traversal vulnerabilities including filter bypass via URL encoding, double encoding, 16-bit Unicode, overlong UTF-8, null byte injection, or non-recursive strip bypass; testing for Local File Inclusion or Remote File Inclusion; identifying XML External Entity (XXE) injection for local file read or Server-Side Request Forgery (SSRF); detecting SOAP injection via XML metacharacter probing; testing for HTTP Parameter Injection (HPI) and HTTP Parameter Pollution (HPP) in back-end HTTP requests; identifying SMTP injection through email header manipulation or SMTP command injection in mail submission forms. Covers detection proced

1 install
▌
Unit Test Quality Checker · bookforge-ai
Evaluate a test suite against rigorous unit-test criteria, classify test types, and choose between fake and mock objects. Use whenever a developer asks 'are these unit tests?', 'why is my test suite slow', 'should I use mocks or fakes', 'fake vs mock', 'what's wrong with my tests', 'my tests hit the database / network / filesystem', 'how do I speed up tests', 'unit vs integration', or when reviewing a codebase's test quality. Activates for 'unit test', 'fake object', 'mock object', 'test double', 'test speed', 'test isolation', 'xUnit', 'JUnit / NUnit / CppUnit', 'slow test suite', 'flaky tests', 'test pyramid'.

1 install
▌
Dos Defense And Mitigation · bookforge-ai
Design DoS-resistant systems or respond to an active denial-of-service attack. Use this skill when designing a new service and want to evaluate its attack surface and build in layered defenses, assessing whether a production system's architecture is DoS-hardened, investigating a traffic spike to determine whether it is an attack or a self-inflicted surge, detecting a client retry storm and needing to apply backoff and jitter fixes, building or reviewing a DoS mitigation system (detection + response pipeline), or deciding how to respond strategically to an ongoing attack without leaking information about your defenses to the adversary.

1 install

236 published skills · page 3 of 3