安全
安全审查、认证、权限和风险检查
Skills 列表
agentwallet
Wallets for AI agents with x402 and MPP payment signing, referral rewards, and policy-controlled actions.
frames-engineering
configuring-connections
Configure Celigo connections and iClients -- credential and configuration objects that authenticate to external systems. Use when creating or editing connections, choosing auth methods, setting up OAuth, managing iClients (shared credential stores), or troubleshooting connectivity.
celigoconfiguring-guardrails
Configure Celigo guardrail resources -- safety and compliance checks that validate data flowing through integrations. Use when creating or editing guardrails for PII detection, content moderation, or AI-based evaluation rules.
celigo
tigris-security-access-control
Use when configuring CORS, rotating access keys, setting bucket policies, or securing Tigris storage — covers key lifecycle, roles, CORS rules, presigned URL security, audit checklist
tigrisdatatigris-sdk-guide
Use when choosing between Tigris-native SDKs and AWS S3-compatible SDKs — covers which SDK to use per language, CLI preference, and when AWS SDKs are the only option
tigrisdata
ace-step
通过 `runcomfy` CLI 在 RunComfy 上使用 ACE Step 生成、修补和扩展音乐。ACE Step 是 StepFun-AI 的开源权重音乐基础模型——基于标签的作曲（流派、情绪、乐器）、支持多语言歌词和段落标记、5 秒到 4 分钟的立体声输出，每秒 $0.0002–0.0003（比 ElevenLabs Music 便宜约 27 倍）。四个端点：ACE Step 文本转音频（默认）、ACE Step 1.5 文本转音频（50+ 语言歌词、改进的结构化歌词处理）、ACE Step 音频修补（在现有音轨内重新生成时间范围）、ACE Step 音频扩展（在现有音轨前后扩展）。触发词包括 "ace step"、"ace-step"、"acestep"、"ACE music"、"open music model"、"cheap AI music"、"inpaint audio"、"audio inpaint"、"extend music"、"audio outpaint"、"lengthen track"、"music with tags" 或任何明确要求使用 ACE Step 生成或编辑音乐的请求。
doany-aiai-music
通过 `runcomfy` CLI 在 RunComfy 上生成 AI 音乐——一个智能路由，覆盖音乐模型目录。路由到 ElevenLabs AI 音乐生成（高级 44.1 kHz 立体声人声曲目，5 秒–5 分钟，$0.0083/秒）和 ACE Step / ACE Step 1.5（StepFun-AI 开放权重，标签驱动作曲，多语言歌词，$0.0002–0.0003/秒，约便宜 27 倍），以及 ACE Step 音频修补（在现有曲目内重新生成时间范围）和 ACE Step 音频外延（在曲目前后扩展）。根据用户的实际意图选择正确的模型——高级人声片段、廉价背景音乐库、多语言流行歌曲、修复糟糕的副歌、将 30 秒草稿延长为 2 分钟剪辑——并提供每个模型的文档化提示模式以及最小的 `runcomfy run` 调用。触发词包括“生成音乐”、“制作歌曲”、“AI 音乐”、“背景音乐”、“器乐曲目”、“配乐”、“广告曲”、“主题音乐”、“免版税音乐”、“作曲”、“带歌词的音乐”、“扩展音乐”、“修复这首歌”、“修补音乐”或任何明确的生成或编辑音乐的请求。
doany-ai
ai-music
通过 `runcomfy` CLI 在 RunComfy 上生成 AI 音乐——一个智能路由，覆盖音乐模型目录。路由到 ElevenLabs AI 音乐生成（高级 44.1 kHz 立体声人声轨道，5 秒–5 分钟，$0.0083/秒）和 ACE Step / ACE Step 1.5（StepFun-AI 开放权重，标签驱动作曲，多语言歌词，$0.0002–0.0003/秒，约便宜 27 倍），以及 ACE Step 音频修补（在现有轨道内重新生成时间范围）和 ACE Step 音频外延（在轨道前后扩展）。根据用户的实际意图选择正确的模型——高级人声片段、廉价背景音乐库、多语言流行歌曲、修复糟糕的副歌、将 30 秒草稿延长为 2 分钟剪辑——并提供每个模型的文档化提示模式以及最小的 `runcomfy run` 调用。触发词包括“生成音乐”、“制作歌曲”、“AI 音乐”、“背景音乐”、“器乐轨道”、“配乐”、“广告曲”、“主题音乐”、“免版税音乐”、“作曲”、“带歌词的音乐”、“扩展音乐”、“修复这首歌”、“修补音乐”，或任何明确要求生成或编辑音乐的请求。
runcomfy-comace-step
通过 `runcomfy` CLI 在 RunComfy 上使用 ACE Step 生成、修补和扩展音乐。ACE Step 是 StepFun-AI 的开源音乐基础模型——基于标签的作曲（流派、情绪、乐器）、支持多语言歌词和段落标记、5 秒到 4 分钟立体声输出、每秒 $0.0002–0.0003（比 ElevenLabs Music 便宜约 27 倍）。四个端点：ACE Step 文本转音频（默认）、ACE Step 1.5 文本转音频（50+ 语言歌词、改进的结构化歌词处理）、ACE Step 音频修补（在现有曲目内重新生成时间范围）、ACE Step 音频扩展（在现有曲目前后扩展）。触发词包括 "ace step"、"ace-step"、"acestep"、"ACE music"、"open music model"、"cheap AI music"、"inpaint audio"、"audio inpaint"、"extend music"、"audio outpaint"、"lengthen track"、"music with tags" 或任何明确要求使用 ACE Step 生成或编辑音乐的请求。
runcomfy-com
find-the-original-image
Reverse image search across Yandex, Google Lens, Bing Visual Search, TinEye and Baidu to find where a picture came from and who published it first. Use when reverse image searching, identifying a photo, face, logo, product, uniform or building, tracing a profile picture or avatar, finding the oldest copy of an image, checking whether a photo is stock or a repost, or reverse-searching a video by keyframes. Applies to romance and investment scam investigation, fake-profile and synthetic-identity detection, disinformation and media verification, counterfeit and brand-infringement work, and insurance claim review. Reference at useosint.com/skills/find-the-original-image.
useosintis-this-photo-real
Verify whether an image or video is authentic, original and correctly captioned — provenance checks, error level analysis, noise and JPEG compression analysis, clone and copy-move detection, lighting and shadow consistency, C2PA Content Credentials, deepfake and AI-generation tells, and the honest limits of AI-detector tools. Use when fact-checking a photo or video, checking for a deepfake or AI-generated image, spotting manipulation, or testing whether footage is recycled or miscaptioned. Applies to KYC and onboarding fraud, insurance claim review, disinformation analysis, and evidence admissibility. Reference at useosint.com/skills/is-this-photo-real.
useosintwhat-leaked-about-you
Check and interpret data-breach exposure for an email, username, phone or name using Have I Been Pwned, the Pwned Passwords k-anonymity range API, DeHashed, IntelX and Snusbase. Use when checking breach or leak exposure, finding which services an account was registered with, interpreting a combolist or credential dump, assessing credential compromise, or auditing your own leaked personal data. Applies to incident response and account-takeover triage, executive and VIP protection, pre-employment and vendor risk screening, and personal privacy audits. Reference at useosint.com/skills/what-leaked-about-you.
useosintinvestigate-without-getting-made
Investigator OPSEC — threat-model who might notice you, control your attribution surface across IP, ASN, browser and TLS fingerprint, timing and logged-in accounts, separate research identity from real identity, build and age a sockpuppet research persona, and choose between VPN, residential proxy and Tor. Use when setting up a research account, avoiding tipping off a subject, worrying about LinkedIn profile-view leakage, needing a burner phone or email, or hardening a research VM or browser profile. Applies to covert due diligence, insider-threat investigation, source protection in journalism, and law-enforcement online work. Reference at useosint.com/skills/investigate-without-getting-made.
useosint
oss-license-strategy
Chooses an open-source project's license and contribution policy as one decision - permissive vs weak, strong or network copyleft, dependency-driven compatibility constraints, DCO vs CLA vs nothing, dual licensing and open core, source-available options (BUSL, FSL, Elastic License, SSPL), and the fork risk of relicensing. Use whenever someone asks which license to pick, whether MIT, Apache-2.0, GPL or AGPL fits, whether to require a CLA or a DCO sign-off, how to relicense an existing project, whether AGPL really protects against cloud providers, or which LICENSE, SPDX and NOTICE files to ship - even if they only voice a legal worry. Not what the company open-sources at all - use samber/developer-relations-skills@open-source-company-strategy. Never legal advice.
sambeross-governance
Chooses and documents an open-source project's governance model - decision rights, maintainer roles and promotion, voting and consensus rules, conflict escalation, succession, trademark and asset control, and whether to join a foundation or fiscal host. Use whenever someone asks who decides in their project, wants to write or fix a GOVERNANCE.md, is adding or removing maintainers, worries about bus factor or a single-vendor-controlled project, faces a deadlocked or contested decision, or is preparing a foundation donation - even if they only say the project has no rules. Covers solo, company-backed and multi-vendor projects. Not license, CLA or DCO choice - use samber/developer-relations-skills@oss-license-strategy. Never legal advice.
sambeross-issue-triage
Designs an issue and pull-request triage system a maintainer team can sustain - response targets sized against real capacity, the label taxonomy, intake cuts through structured forms and off-tracker routing, a separate security-report path, triage duty assignment, and the closing, staleness and volume-gating policy. Use whenever someone says "our issue tracker is out of control", "design an issue triage process", "set up labels for our repo", "we have 900 open issues", "should we run a stale bot", "PR backlog nobody reviews", "triage rotation", or "we are drowning in AI-generated reports" - even if they only say maintenance is overwhelming. Not good-first-issue curation - use samber/developer-relations-skills@oss-contributor-onboarding.
samberdocs-code-sample-standards
Defines the policy every code sample in developer documentation must meet and audits an existing sample corpus against it, returning a ranked fix queue. Use whenever the user mentions docs code samples, code snippets in documentation, runnable examples, examples that no longer compile, copy-paste failures, snippet drift after an API change, testing docs examples in CI, SDK snippet parity across languages, sample maintenance ownership, or asks why the examples in their docs do not work - even if they only say the docs are broken. Covers sample anatomy, copy-paste and security safety, execution tiers, single-sourcing from tested code, and language parity. Not for writing a quickstart page - use samber/developer-relations-skills@developer-quickstart-guide.
samberdeveloper-live-demo-design
Engineers a technical demo so it survives the stage - risk triage, the fidelity tier it should run at, independently enterable checkpoints, a one-command environment reset, offline mode, a recorded fallback and rehearsed recovery lines, shipped as a demo runbook with a pre-flight checklist. Use whenever the user mentions a live demo, live coding, demo reliability or a fallback plan, "my demo broke on stage", whether to demo live or pre-record, a demo environment reset, a clean demo laptop, a demo profile or a panic button, or is preparing a talk, workshop, webinar or launch stream containing a demo - even if they only say "I'm nervous about the demo" or "what if I share the wrong screen". Not the talk's structure - use samber/developer-relations-skills@tech-talk-outline.
samberapi-auth-key-management
Design the API-key authentication surface a platform issues to its own API consumers - key format with prefix+checksum conventions, hashed (irretrievable) vs encrypted (retrievable) storage, zero-downtime rotation with dual-key overlap, least-privilege scoping, individual vs org vs service-account ownership, self-service key dashboard behavior, and SOC 2 / PCI-DSS 4.0 lifecycle governance. Use whenever the user mentions API keys, secret keys, key prefixes, key rotation, key scoping, or revoking keys after an employee departure - even if they never say "API key management". Provider side only, not consuming another vendor's API. Do NOT use for OAuth authorization-server design - use samber/developer-platform-skills@oauth2-provider-design instead.
samberdeveloper-platform-kickoff
Before starting any developer-platform, public-API, or integration work - or whenever no other platform skill has been chosen - route the task to the right skill in samber/developer-platform-skills, or say plainly that none fits, then bootstrap or resume the project's shared platform context. Fires at every API or platform project start, at each recurring platform review, and whenever routing is unclear. Use whenever the user mentions a developer platform kickoff, a new public API program, an integration-surface roadmap, "which platform skill do I need", "where do I start with our public API", platform skill routing, or a recurring platform check-in - even if they never name a skill or ask to be routed. It spans REST, GraphQL and gRPC design, webhooks, SDKs, MCP, OAuth and API keys, rate limits, versioning, developer portals, docs, sandboxes, marketplaces, and partner strategy, so an ambiguous platform question belongs here first. Outputs a short-list and an ordered skill chain, never the design itself.
samberapp-marketplace-review
Design the operator-side review and approval process for third-party apps on a B2B SaaS marketplace - review-pipeline shape scaled to data sensitivity, permission and data-access audit checkpoints, automated pre-screening with human triage, objective re-review-on-update triggers, publish-channel hardening against supply-chain attacks, appeal paths, and a severity-tiered revocation policy. Use whenever the user mentions app review, marketplace approval criteria, third-party app permission audits, re-review after an app update, rejection appeals, or delisting and revocation - even if they never say "app review". Operator side only. Do NOT use for submitter onboarding - use samber/developer-platform-skills@partner-app-onboarding instead.
samberapi-test-mode-design
Design the test/sandbox mode of a public API platform so external integrators build and validate without touching real money, messages, or data - isolation architecture (soft test-mode toggle vs hard separate-copy sandbox), test-key prefixing, magic test values, simulated objects and personas, on-demand test events, deterministic time manipulation, reset and seeding, sandbox quotas, abuse controls, and graduation to live. Use whenever the user mentions a sandbox, test mode, test API keys, magic or dummy test values, simulated webhook events, or demo data - even if they never say "test mode". Not code-execution sandboxing or unit-test mocking. Do NOT use for partner sandbox provisioning - use samber/developer-platform-skills@partner-app-onboarding instead.
samberoauth2-provider-design
Design the OAuth2 authorization-server surface a B2B SaaS offers third-party apps - the OAuth 2.1 protocol baseline (PKCE for every client, no implicit or password grants, exact redirect matching), token TTL and refresh-rotation policy, scope taxonomy and granularity, consent-screen design with partial and incremental grants, client registration posture, and the tiered app-verification program. Use whenever the user mentions OAuth, "Sign in with X", access and refresh tokens, scopes, consent screens, PKCE, or third-party apps acting on a customer's behalf - even if they never say "OAuth provider". Issuer side only, not integrating against someone else's OAuth. Do NOT use for API-key design - use samber/developer-platform-skills@api-auth-key-management instead.
samberpublic-grpc-api-design
Design a public gRPC surface for external developers - the when-gRPC-at-all gate (most platforms keep gRPC internal and publish REST or transcoded JSON), AIP proto package and versioning conventions, buf breaking-change gates and their google.api.http blind spot, unary-by-default streaming decisions, the google.rpc.Status error model with its HTTP-mapping traps, transcoding and gateway architecture (Connect-RPC, grpc-gateway, Envoy), and external auth and TLS. Use whenever the user mentions gRPC, protobuf or .proto files, buf, Connect-RPC, grpc-gateway, or gRPC-JSON transcoding at a public edge - even if they never say "gRPC API design". Design layer only, not language-specific server implementation.
samber