10 actions in 10 pieces of software · ranked by words, meaning and measured trust · 812 ms

1. 1prototype-pollution-advancedverified and signedpassport

   skillyaklang/hack-skillsrecord

   • prototype-pollution-advanced

     Advanced prototype pollution playbook — server-side RCE, client-side gadgets, filter bypasses, and detection techniques. Companion to ../prototype-pollution/ for basics. Use when you've confirmed pollution and need to escalate to code execution or find framework-specific gadgets.

2. 2prototype-pollutionverified and signedpassport

   skillyaklang/hack-skillsrecord

   • prototype-pollution

     Prototype pollution testing for JavaScript stacks. Use when user input is merged into objects (query parsers, JSON bodies, deep assign), when configuring libraries via untrusted keys, or when hunting RCE gadgets via polluted Object.prototype in Node or the browser.

3. 3prototype-patternverified and signedpassport

   skillpatternsdev/skillsrecord

   • prototype-pattern

     Teaches the prototype pattern for property sharing via the prototype chain. Use when creating many objects of the same type that should share methods or properties efficiently.

4. 4prototypeverified and signedpassport

   skillvinvcn/mattpocock-skills-zh-cnrecord

   • prototype

     构建一次性原型来回答一个设计问题。适用于用户想验证某个 state model 或 logic 是否感觉对，或探索 UI 应该长什么样时。

5. 5ce-prototypeverified and signedpassport

   skilleveryinc/compound-engineering-pluginrecord

   • ce-prototype

     Build a throwaway prototype to answer how something should work, feel, or read. Use when committing the wrong answer would be expensive to unravel and a cheap sketch cannot settle it. Not a rough visual probe during brainstorming, not for deciding what to build, not polishing a feature that already

6. 6blitzstrikeverified and signedpassport

   MCP servergit+https://github.com/shinthink/blitzstrikenpmrecord510 stars25,487 downloads/month

   • proto_pollution_probe

     Send deterministic JSON prototype-pollution payloads (__proto__ / constructor.prototype) to a target and check for a reflected canary. VERIFIED only when the canary is reflected back in the response — never from a 'payload accepted' guess. Common on Node.js/Express JSON-parsing endpoints.

7. 7prototype-fastverified and signedpassport

   skillgamedev-skills/awesome-gamedev-agent-skillsrecord

   • prototype-fast

     Build a playable prototype in about an hour to answer one question — is it fun? — with greybox primitives, a hard timebox, and explicit keep/kill criteria. Use when prototyping a mechanic, making a vertical slice or MVP, greyboxing/blockout, or judging throwaway vs keep.

8. 8html-prototypeverified and signedpassport

   skillplannotator/effective-htmlrecord

   • html-prototype

     Direct-invocation specialist for polished, responsive, self-contained HTML mockups and interactive prototypes grounded in the user's conversation, product context, and design language. Use when the user explicitly invokes html-prototype or the broad html skill routes a mockup or prototype request he

9. 9prototype-strategyverified and signedpassport

   skillowl-listener/designer-skillsrecord

   • prototype-strategy

     Choose prototype fidelity and method to match the design question and the decision at stake. Use before building a prototype. For what to test once it exists, use `test-scenario`.

10. 10advanced-promptingverified and signedpassport

    skillspences10/claude-code-toolkitrecord

    • advanced-prompting

      High-leverage prompts that challenge Claude's defaults. Use for "grill me", "prove it works", "scrap this", "what would 10x engineer do", "find ways this fails".