ssrf-nextjs-server-actions
Identify and exploit Server-Side Request Forgery (SSRF) vulnerabilities in Next.js applications, specifically focusing on insecure server actions or API routes fetching user-controlled URLs on the server-side.
Your agent can do more. Find the skill that makes it happen.
Find your next superpower If you are an agent, refer to our llms.txt for full access.Identify and exploit Server-Side Request Forgery (SSRF) vulnerabilities in Next.js applications, specifically focusing on insecure server actions or API routes fetching user-controlled URLs on the server-side.
Server-Side Template Injection (SSTI) occurs when user input is embedded directly into a template engine (Jinja2, Twig, Freemarker, Pebble, Velocity, Smarty, Mako) and evaluated, enabling remote code execution. Detect via math expressions {{77}} returning 49, or ${77}, <%= 77 %>. Leads to full RCE via template sandbox escape, Python __class__.__mro__ traversal, and Java reflection cha…
Generate a standup update from recent activity. Use when preparing for daily standup, summarizing yesterday's commits and PRs and ticket moves, formatting work into yesterday/today/blockers, or structuring a few rough notes into a shareable update.
Fetches and displays unstarted todo issues from Linear so the user can select the next task. Updates local task tracking and provides implementation guidance.
Produces comprehensive market opportunity analysis. Includes calculations for total addressable, serviceable available, and serviceable obtainable markets.
Клиентское состояние на Zustand — слайсы, селекторы, персист, экшены; граница «что НЕ поднимать в глобальный стор». Use при проектировании или правке клиентских сторов состояния во фронтенде.
Defines selector functions alongside state slices in the chota-react-saga template. Derives loading, error, item, and current-item view data and combines slices for filtered or sorted projections.
Reports the current state of thoughts/ and context in GIVERNY.
Covers Soroban Rust contracts, Stellar CLI and client SDKs, RPC and Horizon APIs, assets, tokens, and wallet integration. Includes passkey accounts, zero-knowledge proof patterns, testing, and security for payments, tokenization, DeFi, and other financial applications.
Use when the user asks to create or revise a Google Stitch-oriented DESIGN.md or semantic design-system prompt. Do not use for implementing frontend code, generating images directly, generic UI critique, or non-Stitch design systems.
Forensic debugging for the Stoney Platform. Default mode is READ-ONLY. Proposes fixes to be implemented after authorization.
Storage management for Zephyr RTOS. Covers Non-Volatile Storage (NVS) for persistent settings, flash partition management in Devicetree, and runtime flash layout access. Trigger when implementing persistent data storage, managing flash wear leveling, or configuring device partitions.
Skills give your agent reusable instructions for a specific job. Pick one, read what it does, and bring it into your workflow.
A name only tells half the story. Search the full description and instructions to find the right fit.
Read the skill, visit its source, and see exactly what you’re adding to your agent.
Copy the install command from a skill page and run it in your project.
npx skillycli add owner/repo --skill name