github-pr-merge
Merges GitHub Pull Requests after validating pre-merge checklist. Use when user wants to merge PR, close PR, finalize PR, complete merge, approve and merge, or execute merge. Runs pre-merge validation (tests, lint, CI, comments), confirms with user, merges with proper format, handles post-merge cleanup.
github-pr-review
Handles PR review comments and feedback resolution. Use when user wants to resolve PR comments, handle review feedback, fix review comments, address PR review, check review status, respond to reviewer, verify PR readiness, review PR comments, analyze review feedback, evaluate PR comments, assess review suggestions, or triage PR comments. Fetches comments via GitHub CLI, classifies by severity, applies fixes with user confirmation, commits with proper format, replies to threads.
privacy-guard
Prevents private infrastructure details (node hostnames, internal project names, local usernames and personal emails, absolute home paths, private and VPN IP ranges) from leaking into public repositories through commits, PRs, docs or release artifacts. Use when working in a public or soon-to-be-public repo, before commits or releases, when writing deployment docs for an OSS project, or when the user asks to "set up the privacy guard", "install privacy-guard", "check for leaks", "protect this public repo". Bootstraps a pre-commit hook backed by a gitignored local denylist plus gitleaks.
apk-bugbounty
Android APK static analysis for bug bounty hunting. Decompiles APKs with BOTH Jadx AND Apktool for maximum coverage. Analyzes secrets, exported components, WebViews (Taint Analysis), deep links, Firebase, Native Libs, IPC abuse, and business logic flaws. Every finding MUST have concrete evidence and real exploit impact.
js-code-analysis
Specialized JavaScript/TypeScript static analysis for bug bounty hunting. Covers Node.js, Express.js, Next.js, NestJS, Fastify, and modern frameworks. Uses AST-grep and Grep tool to find high-impact vulnerabilities (RCE, SSRF, SQLi, SSTI, Prototype Pollution, JWT, DOM XSS, GraphQL, ReDoS, CORS, CSRF) via strict Source-to-Sink Taint Analysis. Every finding MUST have concrete evidence.
security-audit
Comprehensive security code audit using multi-phase analysis (Setup → Architecture → STRIDE → Code Review → Dependencies/Config → Report). Parallelized subagent orchestration with integrated scripts. Use when asked to perform security review, vulnerability assessment, code audit, pentest code review, find security bugs, or analyze code for vulnerabilities. Optimized for bug bounty hunting and AppSec with concrete evidence and exploitability validation.
tmux-pilot
Drive tmux from an AI agent — sessions, windows, panes, send commands, capture output, poll agents, browser-like workflow. Cross-platform (Linux/macOS/WSL). Use when the user wants to control terminal layout, launch parallel agents, run commands in background panes, orchestrate multi-pane workflows, or mentions tmux automation.
web3-audit
Smart contract security audit for Immunefi bug bounty. Analyzes Solidity contracts on EVM chains using Slither + Foundry. Covers access control, reentrancy, DeFi economic exploits (flash loans, oracle manipulation, MEV), protocol-specific logic (lending, DEX, bridges, vaults), and generates Foundry fork PoCs. Every finding MUST have concrete evidence, invariant violation proof, and USD impact estimate.
web-browser
Allows to interact with web pages by performing actions such as clicking buttons, filling out forms, and navigating links. It works by remote controlling Google Chrome or Chromium browsers using the Chrome DevTools Protocol (CDP). When Claude needs to browse the web, it can use this skill to do so.
xp
Extreme Programming adapted for AI-human pair development. Use when the user says "/xp", "follow XP", "pair with me", mentions agile/YAGNI/TDD/simple-design, or wants to build features incrementally with feedback loops and clear human-AI roles.
party
Build creative particle effects, generative art, interactive physics scenes, and production integrations with @cazala/party across WebGPU and CPU. Use when creating or tuning simulations, composing modules, spawning shape/text/image particles, translating Party playground demos into code, optimizing performance, or authoring custom modules.
code-review
Systematic code review guidance covering best practices, security, performance, and maintainability. Use when reviewing code, checking PRs, or analyzing code quality.
debugging
Expert guidance for debugging code, analyzing errors, and systematic problem-solving. Use when troubleshooting bugs, understanding error messages, or investigating unexpected behavior.
documentation
Expert guidance for writing clear, comprehensive documentation including READMEs, API docs, docstrings, and technical guides. Use when creating or improving documentation.
frontend-design
Expert guidance for creating production-grade, distinctive frontend interfaces. Use when designing UIs, choosing aesthetics, or building memorable web experiences.
git-workflow
Expert guidance for Git workflows, branching strategies, and version control best practices. Use when managing repositories, resolving conflicts, or establishing team workflows.
langchain-agents
Expert guidance for building LangChain agents with proper tool binding, memory, and configuration. Use when creating agents, configuring models, or setting up tool integrations in LangConfig.
langconfig-builder
Complete guide for building agents and workflows in LangConfig. Use when users need help configuring nodes, connecting agents, setting up tools, or designing multi-agent systems within the LangConfig platform.
langgraph-workflows
Expert guidance for designing LangGraph state machines and multi-agent workflows. Use when building workflows, connecting agents, or implementing complex control flow in LangConfig.
mcp-builder
Comprehensive guide for creating Model Context Protocol (MCP) servers. Use when building MCP servers, integrating external APIs, or creating tool interfaces for LLMs.
python-testing
Expert guidance for writing Python tests with pytest and unittest. Use when writing tests, debugging test failures, or improving test coverage for Python projects.
security-review
Comprehensive security code review covering OWASP Top 10, authentication, authorization, and secure coding practices. Use when reviewing code for vulnerabilities or implementing security features.
webapp-testing
Expert guidance for testing web applications using Playwright and other testing frameworks. Use when testing UIs, automating browser interactions, or validating web app behavior.
docx-processor
处理 Word 文档，支持读取、分析、总结和转换 docx 文件
excel-processor
处理 Excel 文件，支持读取、分析、统计和导出 xlsx 数据
feishu-doc-to-dev-spec
读取飞书云文档（支持多个链接），解析文档中的文本、表格、图片等内容，根据用户选择的开发语言和存储结构，将产品需求文档转换为研发开发需求文档
file-to-article-generator
解析用户上传的文件（PDF/Word/图片），提取文本内容和图片并保存到本地，使用图像识别能力理解图片内容，根据文件内容和用户需求判断文章类型（品牌动向/产品动态/政策规则/营销战役/客户证言/行业资讯），使用不同prompt生成Markdown格式的文章，使用Markdown语法引用图片，确保配图与文章内容契合，并对生成结果进行质量打分。适用于需要从现有文档生成各类品牌和产品内容的场景，如品牌报道、产品发布、政策公告、营销宣传、客户案例等。
infographic-creator
基于给定文字内容创建精美信息图。当用户请求创建信息图时使用。
infographic-item-creator
Generate or update infographic Item components for this repo (TypeScript/TSX in src/designs/items). Use when asked to design, implement, or modify data item visuals, layout logic, or registerItem composites.
infographic-structure-creator
Generate or update infographic Structure components for this repo (TypeScript/TSX in src/designs/structures). Use when asked to design, implement, or modify structure layouts (list/compare/sequence/hierarchy/relation/geo/chart), including layout logic, component composition, and registration.
infographic-syntax-creator
Generate AntV Infographic syntax outputs. Use when asked to turn user content into the Infographic DSL (template selection, data structuring, theme), or to output `infographic <template>` plain syntax.
infographic-template-updater
Update template catalogs and UI prompts after adding new infographic templates (src/templates/*.ts), including SKILL.md template list, site gallery template mappings, and the AIPlayground prompt list.
meeting-summary
生成结构化的会议纪要，包含议题摘要、决策事项和行动项
multi-chart-draw
支持多种图表类型的绘制工具，包括思维导图、流程图、数据可视化图表、数学函数图等；可根据用户需求生成 Mermaid、ECharts、Mindmap、DrawIO、GeoGebra 等格式的图表，并导出为 PNG、SVG、HTML 等格式
prompt-optimizer
Prompt engineering expert that helps users craft optimized prompts using 57 proven frameworks. Use when users want to optimize prompts, improve AI instructions, create better prompts for specific tasks, or need help selecting the best prompt framework for their use case.
weekly-report-to-annual
从飞书邮箱读取周报邮件，根据年度报告模板生成年度总结报告
supabase-audit-auth-config
Analyze Supabase authentication configuration for security weaknesses and misconfigurations.
supabase-audit-authenticated
Create a test user (with explicit permission) to audit what authenticated users can access vs anonymous users. Detects IDOR, cross-user access, and privilege escalation.
supabase-audit-auth-signup
Test if user signup is open and identify potential abuse vectors in the registration process.
supabase-audit-auth-users
Test for user enumeration vulnerabilities through various authentication endpoints.
supabase-audit-buckets-list
List all storage buckets and their configuration to identify the storage attack surface.
supabase-audit-buckets-public
Identify storage buckets that are publicly accessible and may contain sensitive data.
supabase-audit-buckets-read
Attempt to list and read files from storage buckets to verify access controls.
supabase-audit-functions
Discover and test Supabase Edge Functions for security vulnerabilities and misconfigurations.
supabase-audit-realtime
Test Supabase Realtime WebSocket channels for unauthorized subscriptions and data exposure.
supabase-audit-rls
Test Row Level Security (RLS) policies for common bypass vulnerabilities and misconfigurations.
supabase-audit-rpc
List and test exposed PostgreSQL RPC functions for security issues and potential RLS bypass.
supabase-audit-tables-list
List all tables exposed via the Supabase PostgREST API to identify the attack surface.
supabase-audit-tables-read
Attempt to read data from exposed tables to verify actual data exposure and RLS effectiveness.
supabase-detect
Detect if a web application uses Supabase by analyzing client-side code, network patterns, and API endpoints.
Page 642 of 1694 · 84687 results
