jeremylongshore 的 Agent Skills（质量 Top 25）
jeremylongshore 在公开仓库中共收录了大量 Skills，下面是质量分最高的 25 条，已标注许可证与安全规则命中情况。
- 1
adk-agent-builder
Build production-ready agents with Google’s Agent Development Kit (ADK): scaffolding, tool wiring, orchestration patterns, testing, and optional deployment to Vertex AI Agent Engine.
- 2
agency-os
Notion-as-source-of-truth dispatch board. One Tasks database, one Hub page, one page per Corpus, one page each for General Guidance and Resources. The skill mutates Notion via the Notion MCP (`mcp__*__notion-*` tools); only `references/not…
- 3
agent-safety-preflight
Agent Safety Preflight helps Claude inspect a local repository before making AI-agent-assisted edits. It produces a compact Green, Yellow, or Red risk receipt from local files only, with special attention to destructive shell patterns, cre…
- 4
analyzing-tls-config
This skill audits a target's TLS posture against current best practice (NIST SP 800-52r2, Mozilla TLS Configuration Guidelines, PCI DSS v4.0 Req 4.2.1.1). It reports specific findings — not "your TLS is weak" but "your server negotiated TL…
- 5
auditing-cors-policy
CORS misconfiguration is one of the most common middle-severity findings in web bug bounties. The browser-enforced rules are subtle, the failure modes are silent (the wrong cors response just works until an attacker weaponizes it), and the…
- 6
auditing-npm-dependencies
Modern Node.js applications pull in hundreds of transitive packages through a single `npm install`. The ratio of direct-to-transitive dependencies on a typical app is around 1:50 — install 30 packages, end up with 1,500. Every one of those…
- 7
auditing-python-dependencies
PyPI hosts north of 500,000 packages, with several thousand new releases every day. The package-install model is identical to npm in the relevant ways: a `pip install` resolves a transitive graph, runs each package's `setup.py` (which exec…
- 8
checking-http-security-headers
HTTP response headers are the cheapest defense-in-depth layer most web apps ship. Each header closes one specific attack class — HSTS forces HTTPS, CSP blocks script injection, X-Frame-Options blocks clickjacking, etc. Missing headers don'…
- 9
checking-license-compliance
License compliance is a security concern only in the indirect sense that an unintended license obligation can force you to release proprietary source code, retroactively invalidate a customer contract, or render an M&A transaction infeasib…
- 10
clickhouse-core-workflow-a
Design ClickHouse tables with correct engine selection, ORDER BY keys, partitioning, and codec choices for analytical workloads. This skill covers the four schema decisions that determine query speed and storage cost — engine, sort key, pa…
- 11
composing-vulnerability-report
After cluster 1-4 scan skills run, each one produces a Findings file. A typical engagement ends up with eight to twenty such files across the different skill categories. The customer wants ONE vulnerability report — comprehensive, deduplic…
- 12
confirming-pentest-authorization
Penetration testing is computer access. Without explicit authorization from the owner of the system under test, that access is a crime — Computer Fraud and Abuse Act in the US, Computer Misuse Act in the UK, equivalent laws everywhere else…
- 13
contribute
Local-only OSS contribution workflow. The skill itself is the system — there is no separate CLI binary, dashboard, or cloud backend. State lives in three places:
- 14
coreweave-gpu-cost-leak-hunter
> **Community-contributed.** Not affiliated with, endorsed by, or sponsored by > CoreWeave, Inc. CoreWeave is a registered trademark of CoreWeave, Inc.
- 15
coreweave-gpu-node-forensics
> **Community-contributed.** Not affiliated with, endorsed by, or sponsored by > CoreWeave, Inc. CoreWeave is a registered trademark of CoreWeave, Inc. > "NVIDIA" and "Xid" are trademarks of NVIDIA Corporation; Xid semantics are > cited fr…
- 16
databricks-bundle-medic
The deploy + infrastructure spine of the pack. Databricks Asset Bundles (DAB) is immature tooling — the replacement for the deprecated `dbx`, with a moving bug list across CLI versions — and the infrastructure operations around a deploy (e…
- 17
databricks-cluster-forensics
The operational SRE spine of the pack — what a Databricks engineer reaches for at 2 AM when the compute layer is broken or unexplained. It correlates a cluster's live event stream across API surfaces to name the failure with its **actual e…
- 18
databricks-cost-leak-hunter
Audits a Databricks workspace for real-dollar cost leaks — idle compute, jobs on the wrong SKU, overprovisioned clusters, and the Photon premium paid without the speedup — then emits a CFO-grokkable, dollar-ranked FinOps remediation report.
- 19
databricks-streaming-guardian
The data-ops spine of the pack. Delta Lake, Liquid Clustering, Structured Streaming, and DLT each ship a different set of foot-guns that fire most visibly when production data flows through them at scale — and most of them are documented p…
- 20
defining-pentest-scope
A pentest scope is a list of permission boundaries. Get it wrong and you either (a) miss real exposure by failing to test something the customer expected covered, or (b) probe something you weren't allowed to touch and turn the engagement…
- 21
detecting-debug-endpoints
Modern web stacks ship rich introspection by default. Spring Boot Actuator exposes `/actuator/env` (every environment variable), `/actuator/heapdump` (a live heap snapshot that contains credentials), `/actuator/jolokia` (JMX bean invocatio…
- 22
detecting-directory-listing
Web servers can be configured to auto-generate an HTML index page when a request hits a directory without a matching default file (no `index.html` / `index.php` / etc.). The auto-generated page lists every file in the directory. This is by…
- 23
detecting-eval-exec-usage
Dynamic-code-execution APIs (CWE-95 Eval Injection) let an application interpret a string as code at runtime. If the string contains anything user-controllable, the application has handed the attacker arbitrary code execution.
- 24
detecting-exposed-secrets-files
The single highest-value pentest probe per HTTP request. A `.git/config` disclosure leaks repo URL + credentials embedded in remote URLs. A `.env` disclosure leaks every API key the app has. A `backup.sql` disclosure leaks the entire datab…
- 25
detecting-insecure-deserialization
Insecure deserialization (CWE-502, OWASP A08:2021) is the highest- severity injection class in many language stacks because it directly maps to RCE. Pickle, Java serialization, PHP unserialize, and BinaryFormatter all execute object-constr…