Developer publishes alpha-skills: 8 reusable AI agent skills and first MCP server on npm

·1 views

A developer has released alpha-skills, a collection of eight installable AI agent skills and a first Model Context Protocol (MCP) server, published on npm under the package Alpha018/alpha-skills. The project was created to address recurring technical debt caused by repeatedly solving the same problems without a reusable, shareable solution. The skills are organized into three categories: external for third-party APIs, local for homelab and custom workflows, and general for cross-cutting utilities. Included skills cover areas such as NestJS authentication, advanced NestJS patterns, GraphQL, NextDNS API integration, code search workflows, Claude Code configuration, and Obsidian note organization. Each skill can be installed individually via a dedicated npx command, allowing developers to adopt only what they need.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

JWT 'kid' Parameter Flaw Enables SQL Injection and Path Traversal Attacks

A security vulnerability in how servers process the JSON Web Token 'kid' header parameter allows attackers to manipulate key selection without breaking cryptography. Because the RFC defines no required format or character restrictions for 'kid', most libraries pass the raw value directly to database queries or file reads without sanitization. In the SQL injection variant, an attacker injects a UNION payload to make the server use an attacker-chosen HMAC key, then re-signs a forged token that passes verification. In the path traversal variant, injecting a sequence like '../../../../dev/null' causes the server to read an empty file, letting the attacker sign tokens with a predictable null-byte key. The vulnerability is rated CVSS 7.5 High, requires no prior authentication, and fully compromises authentication integrity.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Four Major WebSocket Frameworks Leave Origin Validation Off by Default, Enabling CSWSH

Cross-Site WebSocket Hijacking (CSWSH) exploits a gap in the Same-Origin Policy, allowing attackers to establish a persistent, bidirectional, authenticated channel by tricking a logged-in user's browser into initiating a WebSocket connection to a malicious page. Unlike standard HTTP requests, the WebSocket upgrade bypasses CORS preflight entirely, sending session cookies cross-origin without restriction — a deliberate protocol design dating back to RFC 6455. Four of the five dominant WebSocket frameworks ship with Origin validation disabled by default, leaving applications exposed unless developers explicitly enable the check. Real-world consequences have been severe: CVE-2020-25095 enabled unauthentiated remote code execution on LogRhythm, CVE-2023-0957 led to full Gitpod account takeover, and CVE-2024-51775 exposed Apache Zeppelin data to unauthenticated remote attackers. Security researchers trace the recurring vulnerability to an engineering culture where WebSocket endpoints are added to cookie-authenticated apps without applying the same CSRF-era protections already in place for HTTP routes.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds Rust-based version bump tool claiming 10,000x speed over Python

A developer rebuilt the popular bump-my-version CLI tool in Rust after finding the Python original took a full second to increment a single version number. The new tool, called bump2version 0.2.0, automates updating version strings across multiple files such as Cargo.toml, package.json, and CHANGELOG.md in a single operation. It uses pure-Rust git integration via the gix library, avoiding subprocess calls entirely, and enforces memory safety with no unsafe code. Beyond a standalone CLI, the project exposes bindings for Python and Node.js, making the same Rust core accessible across three ecosystems. The developer acknowledged receiving outside assistance with parts of the system design during the project.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Passwordless Auth Exposes Tokens in Logs, Headers, and Email Forwarding Chains

Security researchers have highlighted how passwordless authentication methods such as magic links and TOTP, despite being designed to reduce phishing risk, introduce multiple new attack surfaces. Magic link tokens embedded in GET request URLs are routinely captured in server access logs from nginx, Apache, and CDN proxies, where they remain readable until log rotation. A critical vulnerability, CVE-2026-39912 (CVSS 9.1), exposed over 7,000 instances of V2Board by returning auth tokens directly in HTTP response bodies without requiring authentication. Browser Referer headers can leak tokens to third-party analytics platforms, while email security gateways may silently consume single-use tokens during URL prefetching scans. Additionally, attackers who briefly gain inbox access can plant silent forwarding rules that continue delivering future magic link tokens even after a password reset, leaving no failed login alerts for the application to detect.

0 comments Read more at DEV Community