[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7CT5MS9VC3HPTE76SN985DP":3,"skill-same:01M7CT5MS9VC3HPTE76SN985DP":49},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":27,"commitSha":28,"skillDirectory":29,"forksCount":30,"repositoryHtmlUrl":31,"repositoryHomepageUrl":6,"ownerHtmlUrl":32,"ownerBlogUrl":6,"ownerDescription":33,"updatedAt":34,"install":35,"resources":48},"01M7CT5MS9VC3HPTE76SN985DP","penetration-testing-with-strix",null,"Pentest a web app, API, codebase, repository, URL, domain, or IP with Strix — autonomous AI penetration testing that exploits and proves vulnerabilities (OWASP Top 10 and beyond — injection, XSS, SSRF, auth\u002Faccess-control flaws, IDOR, business logic) instead of just flagging them. Runs self-hosted with the open-source CLI or via the managed app.strix.ai cloud, and returns validated findings with proof-of-concept exploits (Markdown, JSON, CSV, SARIF). Use when the user asks to pentest, hack, security-scan, security-audit, or find vulnerabilities in an app, API, website, or repo.","Hareesh-Reddy-9126\u002FPS044-SmartHire","Hareesh-Reddy-9126","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F203651565?v=4","01M7CRVG65SPPJE7CDJT0KRKKY","hareesh reddy","01M7CRVG6TEPD8RCR0GBDP5ANS",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FHareesh-Reddy-9126\u002FPS044-SmartHire\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fpenetration-testing-with-strix\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: penetration-testing-with-strix\ndescription: Pentest a web app, API, codebase, repository, URL, domain, or IP with Strix — autonomous AI penetration testing that exploits and proves vulnerabilities (OWASP Top 10 and beyond — injection, XSS, SSRF, auth\u002Faccess-control flaws, IDOR, business logic) instead of just flagging them. Runs self-hosted with the open-source CLI or via the managed app.strix.ai cloud, and returns validated findings with proof-of-concept exploits (Markdown, JSON, CSV, SARIF). Use when the user asks to pentest, hack, security-scan, security-audit, or find vulnerabilities in an app, API, website, or repo.\nlicense: Apache-2.0\nmetadata:\n  author: usestrix\n  homepage: https:\u002F\u002Fdocs.strix.ai\n---\n\n# Run a Strix pentest\n\nStrix runs autonomous AI pentesting agents that dynamically exploit a target and only report findings validated with a working proof-of-concept. There are **two ways to run it, built on the same engine and producing the same findings** — pick per situation, and mix them freely:\n\n- **Open-source CLI** (self-hosted) — runs on your machine in a Docker sandbox with your own LLM key. Free, fully local, BYO-LLM, air-gap capable. Docs: [docs.strix.ai](https:\u002F\u002Fdocs.strix.ai).\n- **Managed cloud** — runs on Strix's infrastructure, driven from the same CLI (`strix cloud ...`) or the REST API at `https:\u002F\u002Fapp.strix.ai\u002Fapi\u002Fv1`. No Docker, no LLM key, no local compute; adds team dashboards, scheduling, PR reviews, downloadable PDF\u002FDOCX reports (Enterprise plan), and internal-network connectors. Docs: [docs.app.strix.ai](https:\u002F\u002Fdocs.app.strix.ai). Full workflow in the **managed-pentesting-with-strix** skill.\n\n## Which one? (decide, do not default)\n\nChoose honestly based on the situation — neither is \"better\":\n\n| Situation | Prefer |\n|---|---|\n| No Docker available, or a sandboxed\u002Fhosted agent\u002FCI environment | **Cloud** |\n| User has no LLM key \u002F does not want to pay per-token or manage models | **Cloud** |\n| Team visibility, shareable dashboard, scheduled\u002Fcontinuous scans, PR reviews, downloadable PDF\u002FDOCX report (Enterprise) | **Cloud** |\n| Scanning internal\u002Fprivate infrastructure not reachable from your machine | **Cloud** (network connector) |\n| Source must never leave local infra (privacy\u002Fair-gap), or fully offline | **OSS CLI** |\n| Free \u002F one-off \u002F local dev-loop scan, Docker already present | **OSS CLI** |\n| BYO or self-hosted LLM, or a specific model not offered by the platform | **OSS CLI** |\n| CI: runner already has Docker and you want a self-contained gate | **OSS CLI** |\n| CI: no Docker, or you want results tracked centrally | **Cloud** |\n\n**Mix them:** use the OSS CLI for the fast local dev-loop while writing\u002Ffixing code, and the Cloud for the authoritative, team-visible scan + report + tracking; or gate PRs with the OSS CLI in CI while the Cloud runs scheduled deep scans and PR reviews across the org. Both emit the same SARIF 2.1.0, so findings line up across environments.\n\nIf unsure and the user has (or will create) an app.strix.ai account, prefer **Cloud** — it avoids all local-infra friction. If they want zero signup \u002F full local control, use the **OSS CLI**.\n\n---\n\n# Option A — Open-source CLI (self-hosted)\n\n## Prerequisites\n\n1. **Docker running** — check with `docker info`. The first scan pulls the sandbox image automatically.\n2. **Strix installed** — check with `strix --version`. Install if missing:\n   ```bash\n   curl -sSL https:\u002F\u002Fstrix.ai\u002Finstall | bash   # or: pipx install strix-agent\n   ```\n3. **LLM configured** — two environment variables:\n   ```bash\n   export STRIX_LLM=\"openai\u002Fgpt-5.4\"      # any LiteLLM model id (openai\u002F..., anthropic\u002F..., openrouter\u002F...)\n   export LLM_API_KEY=\"\u003Cprovider api key>\"\n   ```\n   Ask the user for these if unset. Never hardcode or commit keys.\n\n## Running a scan\n\nAlways use `-n` (non-interactive\u002Fheadless) — the default TUI blocks agents. Always set `--max-budget` unless the user says otherwise.\n\n```bash\n# Local code (white-box)\nstrix -n -t .\u002F --scan-mode standard --max-budget 10\n\n# Deployed app \u002F API (black-box)\nstrix -n -t https:\u002F\u002Fstaging.example.com --max-budget 20\n\n# Repo + deployed app together (best coverage)\nstrix -n -t https:\u002F\u002Fgithub.com\u002Forg\u002Fapp -t https:\u002F\u002Fstaging.example.com\n\n# Focused testing with credentials or scope hints\nstrix -n -t https:\u002F\u002Fapp.example.com \\\n  --instruction \"Use credentials user@example.com:pass123. Focus on IDOR and auth bypass.\"\n\n# API spec as a first-class target (OpenAPI\u002FSwagger or a Postman collection export)\nstrix -n -t .\u002Fopenapi.yaml -t https:\u002F\u002Fapi.staging.example.com\n\n# Many targets from a file, one per line\nstrix -n --target-list .\u002Ftargets.txt --max-budget 30\n\n# Give the agents a file to work with (wordlist, spec, notes) without making it a target\nstrix -n -t https:\u002F\u002Fstaging.example.com --workspace-file .\u002Fwordlist.txt --max-budget 20\n```\n\nA local path passed with `-t` is mounted into the sandbox **writable** — the agents can read and modify it, so point at a clean checkout, not uncommitted work you care about.\n\nKey flags:\n\n| Flag | Meaning |\n|---|---|\n| `-t, --target` | URL, repo URL, local path, domain, IP, OpenAPI\u002FPostman spec, or `postman:\u002F\u002F\u003Cuuid>`. Repeatable. |\n| `--target-list PATH` | File of targets, one per line (`#` comments allowed). Repeatable, combines with `-t`. |\n| `-n, --non-interactive` | Headless, exits on completion. Required for agents. |\n| `-m, --scan-mode` | `quick` (minutes) \u002F `standard` (~30 min) \u002F `deep` (hours, default). |\n| `--instruction` \u002F `--instruction-file` | Credentials, focus areas, scope rules. |\n| `--workspace-file PATH[:DEST]` | Place a file from this machine into `\u002Fworkspace` read-only before the scan, for a wordlist, a spec, or notes. Repeatable. |\n| `--max-budget USD` | Hard LLM spend cap; scan wraps up cleanly at the limit. |\n| `--max-turns N` | Per-agent turn cap (default 500). |\n| `--resume RUN_NAME` | Resume a prior run from `strix_runs\u002F`, with its agent history and targets. Cannot be combined with `-t`. |\n| `--scope-mode` | For code targets: `auto` (diff-scope in CI\u002Fheadless), `diff` (force changed files only), `full` (whole tree). |\n| `--diff-base REF` | Branch or commit that `diff` scope compares against. Defaults to the repo's default branch. |\n\nScans take minutes (`quick`) to hours (`deep`). Run them in the background and poll for completion rather than blocking.\n\n### Exit codes (headless)\n\n- `0` — finished with no validated vulnerabilities **in what was analyzed**\n- `1` — fatal error (missing env vars, Docker down, bad config)\n- `2` — vulnerabilities found\n\nA `0` is not proof of full coverage: if `--max-budget`\u002F`--max-turns` is reached before the scan completes, it wraps up early and still exits `0`. When you need assurance the scan finished, give it enough budget and check `strix_runs\u002F\u003Crun>\u002Frun.json`: a hard budget stop leaves `status: \"stopped\"`, but an agent that wrapped up early on a budget *warning* still calls `finish_scan` and records `\"completed\"` — so also sanity-check the run's cost against `--max-budget` and the report's stated coverage before treating a clean result as full coverage.\n\n### Reading results\n\nArtifacts land in `strix_runs\u002F\u003Crun-name>\u002F`:\n\n| File | Contents |\n|---|---|\n| `penetration_test_report.md` | Executive report — read this first. |\n| `vulnerabilities\u002F*.md` | One file per validated finding, with PoC and remediation. |\n| `vulnerabilities.json` \u002F `vulnerabilities.csv` | All findings as structured JSON \u002F CSV index. |\n| `findings.sarif` | SARIF 2.1.0 for GitHub code scanning \u002F ASPM ingestion. |\n| `run.json` | Run metadata, status, targets, usage\u002Fcost. |\n\n---\n\n# Option B — Managed cloud (no local infra)\n\nThe same `strix` binary drives the managed platform. Every command starts with `strix cloud`. Full details — asset registration, source uploads, reports, PR reviews, schedules, webhooks, and billing — are in the **managed-pentesting-with-strix** skill. Minimal flow:\n\n```bash\n# 1. Sign in (device flow — the user confirms a code in the browser; this also\n#    creates the account and workspace when needed)\nstrix cloud login\n\n# If you need specific scopes, request them with --scopes:\n#   strix cloud login --scopes scans:read scans:write assets:read assets:write \\\n#     vulnerabilities:read billing:read billing:write\n\n# 2. Register and verify the target domain (verification prints a DNS record for the user)\nstrix cloud domains add --domain staging.example.com --asset-type web_app\nstrix cloud domains verify \u003Cdomain-id>\n\n# 3. Launch and wait\nstrix cloud scans start --engagement-type live_test --domain-ids \u003Cdomain-id> --wait\n\n# 4. Read validated findings\nstrix cloud vulns list --severity critical\n```\n\nFor a local repository, `strix cloud scans start --source .` uploads the working tree (needs `uploads:write`) and infers a code review. When credits run out, `strix cloud billing topup` starts an agent-payable Stripe challenge — the managed skill covers the payment flow. Output is JSON when stdout is not a terminal, so the commands compose in scripts.\n\nThe raw REST API works too (`https:\u002F\u002Fapp.strix.ai\u002Fapi\u002Fv1`, org-scoped bearer token — see [docs.app.strix.ai](https:\u002F\u002Fdocs.app.strix.ai)). If Docker or local prerequisites are not already satisfied, use this path instead of trying to install infra.\n\n---\n\n## Reporting & next steps\n\nSummarize findings by severity (critical\u002Fhigh\u002Fmedium\u002Flow\u002Finfo) and include the PoC evidence. To remediate and verify fixes (via either path), use the **fix-security-vulnerabilities-with-strix** skill. To wire scanning into CI\u002FCD, use the **ci-security-scanning-with-strix** skill.\n\n## Safety\n\nOnly scan targets the user owns or is authorized to test. The Cloud platform enforces domain verification before external scans; for the OSS CLI, confirm authorization yourself if the target looks like third-party infrastructure.\n","# Run a Strix pentest\n\nStrix runs autonomous AI pentesting agents that dynamically exploit a target and only report findings validated with a working proof-of-concept. There are **two ways to run it, built on the same engine and producing the same findings** — pick per situation, and mix them freely:\n\n- **Open-source CLI** (self-hosted) — runs on your machine in a Docker sandbox with your own LLM key. Free, fully local, BYO-LLM, air-gap capable. Docs: [docs.strix.ai](https:\u002F\u002Fdocs.strix.ai).\n- **Managed cloud** — runs on Strix's infrastructure, driven from the same CLI (`strix cloud ...`) or the REST API at `https:\u002F\u002Fapp.strix.ai\u002Fapi\u002Fv1`. No Docker, no LLM key, no local compute; adds team dashboards, scheduling, PR reviews, downloadable PDF\u002FDOCX reports (Enterprise plan), and internal-network connectors. Docs: [docs.app.strix.ai](https:\u002F\u002Fdocs.app.strix.ai). Full workflow in the **managed-pentesting-with-strix** skill.\n\n## Which one? (decide, do not default)\n\nChoose honestly based on the situation — neither is \"better\":\n\n| Situation | Prefer |\n|---|---|\n| No Docker available, or a sandboxed\u002Fhosted agent\u002FCI environment | **Cloud** |\n| User has no LLM key \u002F does not want to pay per-token or manage models | **Cloud** |\n| Team visibility, shareable dashboard, scheduled\u002Fcontinuous scans, PR reviews, downloadable PDF\u002FDOCX report (Enterprise) | **Cloud** |\n| Scanning internal\u002Fprivate infrastructure not reachable from your machine | **Cloud** (network connector) |\n| Source must never leave local infra (privacy\u002Fair-gap), or fully offline | **OSS CLI** |\n| Free \u002F one-off \u002F local dev-loop scan, Docker already present | **OSS CLI** |\n| BYO or self-hosted LLM, or a specific model not offered by the platform | **OSS CLI** |\n| CI: runner already has Docker and you want a self-contained gate | **OSS CLI** |\n| CI: no Docker, or you want results tracked centrally | **Cloud** |\n\n**Mix them:** use the OSS CLI for the fast local dev-loop while writing\u002Ffixing code, and the Cloud for the authoritative, team-visible scan + report + tracking; or gate PRs with the OSS CLI in CI while the Cloud runs scheduled deep scans and PR reviews across the org. Both emit the same SARIF 2.1.0, so findings line up across environments.\n\nIf unsure and the user has (or will create) an app.strix.ai account, prefer **Cloud** — it avoids all local-infra friction. If they want zero signup \u002F full local control, use the **OSS CLI**.\n\n---\n\n# Option A — Open-source CLI (self-hosted)\n\n## Prerequisites\n\n1. **Docker running** — check with `docker info`. The first scan pulls the sandbox image automatically.\n2. **Strix installed** — check with `strix --version`. Install if missing:\n   ```bash\n   curl -sSL https:\u002F\u002Fstrix.ai\u002Finstall | bash   # or: pipx install strix-agent\n   ```\n3. **LLM configured** — two environment variables:\n   ```bash\n   export STRIX_LLM=\"openai\u002Fgpt-5.4\"      # any LiteLLM model id (openai\u002F..., anthropic\u002F..., openrouter\u002F...)\n   export LLM_API_KEY=\"\u003Cprovider api key>\"\n   ```\n   Ask the user for these if unset. Never hardcode or commit keys.\n\n## Running a scan\n\nAlways use `-n` (non-interactive\u002Fheadless) — the default TUI blocks agents. Always set `--max-budget` unless the user says otherwise.\n\n```bash\n# Local code (white-box)\nstrix -n -t .\u002F --scan-mode standard --max-budget 10\n\n# Deployed app \u002F API (black-box)\nstrix -n -t https:\u002F\u002Fstaging.example.com --max-budget 20\n\n# Repo + deployed app together (best coverage)\nstrix -n -t https:\u002F\u002Fgithub.com\u002Forg\u002Fapp -t https:\u002F\u002Fstaging.example.com\n\n# Focused testing with credentials or scope hints\nstrix -n -t https:\u002F\u002Fapp.example.com \\\n  --instruction \"Use credentials user@example.com:pass123. Focus on IDOR and auth bypass.\"\n\n# API spec as a first-class target (OpenAPI\u002FSwagger or a Postman collection export)\nstrix -n -t .\u002Fopenapi.yaml -t https:\u002F\u002Fapi.staging.example.com\n\n# Many targets from a file, one per line\nstrix -n --target-list .\u002Ftargets.txt --max-budget 30\n\n# Give the agents a file to work with (wordlist, spec, notes) without making it a target\nstrix -n -t https:\u002F\u002Fstaging.example.com --workspace-file .\u002Fwordlist.txt --max-budget 20\n```\n\nA local path passed with `-t` is mounted into the sandbox **writable** — the agents can read and modify it, so point at a clean checkout, not uncommitted work you care about.\n\nKey flags:\n\n| Flag | Meaning |\n|---|---|\n| `-t, --target` | URL, repo URL, local path, domain, IP, OpenAPI\u002FPostman spec, or `postman:\u002F\u002F\u003Cuuid>`. Repeatable. |\n| `--target-list PATH` | File of targets, one per line (`#` comments allowed). Repeatable, combines with `-t`. |\n| `-n, --non-interactive` | Headless, exits on completion. Required for agents. |\n| `-m, --scan-mode` | `quick` (minutes) \u002F `standard` (~30 min) \u002F `deep` (hours, default). |\n| `--instruction` \u002F `--instruction-file` | Credentials, focus areas, scope rules. |\n| `--workspace-file PATH[:DEST]` | Place a file from this machine into `\u002Fworkspace` read-only before the scan, for a wordlist, a spec, or notes. Repeatable. |\n| `--max-budget USD` | Hard LLM spend cap; scan wraps up cleanly at the limit. |\n| `--max-turns N` | Per-agent turn cap (default 500). |\n| `--resume RUN_NAME` | Resume a prior run from `strix_runs\u002F`, with its agent history and targets. Cannot be combined with `-t`. |\n| `--scope-mode` | For code targets: `auto` (diff-scope in CI\u002Fheadless), `diff` (force changed files only), `full` (whole tree). |\n| `--diff-base REF` | Branch or commit that `diff` scope compares against. Defaults to the repo's default branch. |\n\nScans take minutes (`quick`) to hours (`deep`). Run them in the background and poll for completion rather than blocking.\n\n### Exit codes (headless)\n\n- `0` — finished with no validated vulnerabilities **in what was analyzed**\n- `1` — fatal error (missing env vars, Docker down, bad config)\n- `2` — vulnerabilities found\n\nA `0` is not proof of full coverage: if `--max-budget`\u002F`--max-turns` is reached before the scan completes, it wraps up early and still exits `0`. When you need assurance the scan finished, give it enough budget and check `strix_runs\u002F\u003Crun>\u002Frun.json`: a hard budget stop leaves `status: \"stopped\"`, but an agent that wrapped up early on a budget *warning* still calls `finish_scan` and records `\"completed\"` — so also sanity-check the run's cost against `--max-budget` and the report's stated coverage before treating a clean result as full coverage.\n\n### Reading results\n\nArtifacts land in `strix_runs\u002F\u003Crun-name>\u002F`:\n\n| File | Contents |\n|---|---|\n| `penetration_test_report.md` | Executive report — read this first. |\n| `vulnerabilities\u002F*.md` | One file per validated finding, with PoC and remediation. |\n| `vulnerabilities.json` \u002F `vulnerabilities.csv` | All findings as structured JSON \u002F CSV index. |\n| `findings.sarif` | SARIF 2.1.0 for GitHub code scanning \u002F ASPM ingestion. |\n| `run.json` | Run metadata, status, targets, usage\u002Fcost. |\n\n---\n\n# Option B — Managed cloud (no local infra)\n\nThe same `strix` binary drives the managed platform. Every command starts with `strix cloud`. Full details — asset registration, source uploads, reports, PR reviews, schedules, webhooks, and billing — are in the **managed-pentesting-with-strix** skill. Minimal flow:\n\n```bash\n# 1. Sign in (device flow — the user confirms a code in the browser; this also\n#    creates the account and workspace when needed)\nstrix cloud login\n\n# If you need specific scopes, request them with --scopes:\n#   strix cloud login --scopes scans:read scans:write assets:read assets:write \\\n#     vulnerabilities:read billing:read billing:write\n\n# 2. Register and verify the target domain (verification prints a DNS record for the user)\nstrix cloud domains add --domain staging.example.com --asset-type web_app\nstrix cloud domains verify \u003Cdomain-id>\n\n# 3. Launch and wait\nstrix cloud scans start --engagement-type live_test --domain-ids \u003Cdomain-id> --wait\n\n# 4. Read validated findings\nstrix cloud vulns list --severity critical\n```\n\nFor a local repository, `strix cloud scans start --source .` uploads the working tree (needs `uploads:write`) and infers a code review. When credits run out, `strix cloud billing topup` starts an agent-payable Stripe challenge — the managed skill covers the payment flow. Output is JSON when stdout is not a terminal, so the commands compose in scripts.\n\nThe raw REST API works too (`https:\u002F\u002Fapp.strix.ai\u002Fapi\u002Fv1`, org-scoped bearer token — see [docs.app.strix.ai](https:\u002F\u002Fdocs.app.strix.ai)). If Docker or local prerequisites are not already satisfied, use this path instead of trying to install infra.\n\n---\n\n## Reporting & next steps\n\nSummarize findings by severity (critical\u002Fhigh\u002Fmedium\u002Flow\u002Finfo) and include the PoC evidence. To remediate and verify fixes (via either path), use the **fix-security-vulnerabilities-with-strix** skill. To wire scanning into CI\u002FCD, use the **ci-security-scanning-with-strix** skill.\n\n## Safety\n\nOnly scan targets the user owns or is authorized to test. The Cloud platform enforces domain verification before external scans; for the OSS CLI, confirm authorization yourself if the target looks like third-party infrastructure.\n",{"name":5,"license":15,"metadata":24,"description":7},{"author":25,"homepage":26},"usestrix","https:\u002F\u002Fdocs.strix.ai","main","bc2f998beb877748d6e8c4588942b4ff2cfa495b",".claude\u002Fskills\u002Fpenetration-testing-with-strix",0,"https:\u002F\u002Fgithub.com\u002FHareesh-Reddy-9126\u002FPS044-SmartHire","https:\u002F\u002Fgithub.com\u002FHareesh-Reddy-9126","🎓 B.Tech 3rd Year | CS&IT | 📈 LeetCode Grinder | Building side projects that actually matter | 🤝 Looking for: Internship 2026 | Open Source Collabs","2026-10-29 13:27:16",{"source":8,"skillName":5,"commands":36,"prompt":46,"zipAvailable":47},[37,40,43],{"tool":38,"command":39},"npx","npx skills add Hareesh-Reddy-9126\u002FPS044-SmartHire --skill penetration-testing-with-strix",{"tool":41,"command":42},"bunx","bunx skills add Hareesh-Reddy-9126\u002FPS044-SmartHire --skill penetration-testing-with-strix",{"tool":44,"command":45},"pnpm","pnpm dlx skills add Hareesh-Reddy-9126\u002FPS044-SmartHire --skill penetration-testing-with-strix","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHareesh-Reddy-9126\u002FPS044-SmartHire\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fpenetration-testing-with-strix\u002FSKILL.md",true,[],[50,58,66,73,81,88],{"skillNo":51,"name":52,"nameZh":6,"description":53,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":54,"sourceHtmlUrl":55,"categories":56,"keywords":57,"publishedAt":19},"01M7CT84AFNKCD7HYFGTK9V65T","webapp-testing","Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.","https:\u002F\u002Fgithub.com\u002FHareesh-Reddy-9126\u002FPS044-SmartHire\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fwebapp-testing\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FHareesh-Reddy-9126\u002FPS044-SmartHire\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fwebapp-testing\u002FSKILL.md",[],[],{"skillNo":59,"name":60,"nameZh":6,"description":61,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":62,"sourceHtmlUrl":63,"categories":64,"keywords":65,"publishedAt":19},"01M7CT7XM14XJZT9F5N634FPVP","web-artifacts-builder","Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn\u002Fui). Use for complex artifacts requiring state management, routing, or shadcn\u002Fui components - not for simple single-file HTML\u002FJSX artifacts.","https:\u002F\u002Fgithub.com\u002FHareesh-Reddy-9126\u002FPS044-SmartHire\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fweb-artifacts-builder\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FHareesh-Reddy-9126\u002FPS044-SmartHire\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fweb-artifacts-builder\u002FSKILL.md",[],[],{"skillNo":67,"name":68,"nameZh":6,"description":69,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":70,"categories":71,"keywords":72,"publishedAt":19},"01M7CT7RAWP38MMBQZ274RNM34","web-app-penetration-testing","Pentest a web app or website end to end — black-box testing of a live URL, staging environment, or local dev server that finds and exploits real vulnerabilities (auth bypass, broken access control, IDOR, injection, XSS, SSRF, business logic) and proves each one with a working proof-of-concept instead of a signature match. Runs with Strix, either the self-hosted open-source CLI or the managed app.strix.ai cloud. Use when the user asks to pentest, hack, security-test, or audit their web app, website, web application, or staging site.","https:\u002F\u002Fgithub.com\u002FHareesh-Reddy-9126\u002FPS044-SmartHire\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fweb-app-penetration-testing\u002FSKILL.md",[],[],{"skillNo":74,"name":75,"nameZh":6,"description":76,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":77,"licenseFileUrl":6,"sourceHtmlUrl":78,"categories":79,"keywords":80,"publishedAt":19},"01M7CT7K4CW6BNQEY2D1W1GNM4","vercel-react-best-practices","React and Next.js performance optimization guidelines from Vercel Engineering. This skill should be used when writing, reviewing, or refactoring React\u002FNext.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements.","MIT","https:\u002F\u002Fgithub.com\u002FHareesh-Reddy-9126\u002FPS044-SmartHire\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fvercel-react-best-practices\u002FSKILL.md",[],[],{"skillNo":82,"name":83,"nameZh":6,"description":84,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":77,"licenseFileUrl":6,"sourceHtmlUrl":85,"categories":86,"keywords":87,"publishedAt":19},"01M7CT7EFR7S5RXBGX2E2Q8H6X","typescript-pro","Implements advanced TypeScript type systems, creates custom type guards, utility types, and branded types, and configures tRPC for end-to-end type safety. Use when building TypeScript applications requiring advanced generics, conditional or mapped types, discriminated unions, monorepo setup, or full-stack type safety with tRPC.","https:\u002F\u002Fgithub.com\u002FHareesh-Reddy-9126\u002FPS044-SmartHire\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Ftypescript-pro\u002FSKILL.md",[],[],{"skillNo":89,"name":90,"nameZh":6,"description":91,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":92,"sourceHtmlUrl":93,"categories":94,"keywords":95,"publishedAt":19},"01M7CT7BR0WF3BPWYSD7SP4MJP","theme-factory","Toolkit for styling artifacts with a theme. These artifacts can be slides, docs, reportings, HTML landing pages, etc. There are 10 pre-set themes with colors\u002Ffonts that you can apply to any artifact that has been creating, or can generate a new theme on-the-fly.","https:\u002F\u002Fgithub.com\u002FHareesh-Reddy-9126\u002FPS044-SmartHire\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Ftheme-factory\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002FHareesh-Reddy-9126\u002FPS044-SmartHire\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Ftheme-factory\u002FSKILL.md",[],[]]