security-patterns
Implements authentication, authorization, encryption, secrets management, and security hardening patterns. Use when designing auth flows, managing secrets, configuring CORS, implementing rate limiting, or when asked about JWT, OAuth, password hashing, API keys, RBAC, or security best practices.
designing-tests
Designs and implements testing strategies for any codebase. Use when adding tests, improving coverage, setting up testing infrastructure, debugging test failures, or when asked about unit tests, integration tests, or E2E testing.
database-design
Designs database schemas, indexing strategies, query optimization, and migration patterns for SQL and NoSQL databases. Use when designing tables, optimizing queries, fixing N+1 problems, planning migrations, or when asked about database performance, normalization, ORMs, or data modeling.
error-handling
Implements error handling patterns, structured logging, retry strategies, circuit breakers, and graceful degradation. Use when designing error handling, setting up logging, implementing retries, adding error tracking, or when asked about error boundaries, log aggregation, alerting, or resilience patterns.
designing-apis
Designs REST and GraphQL APIs including endpoints, error handling, versioning, and documentation. Use when creating new APIs, designing endpoints, reviewing API contracts, or when asked about REST, GraphQL, or API patterns.
convex-backend
Convex backend development guidelines. Use when writing Convex functions, schemas, queries, mutations, actions, or any backend code in a Convex project. Triggers on tasks involving Convex database operations, real-time subscriptions, file storage, or serverless functions.
managing-git
Manages Git workflows including branching, commits, and pull requests. Use when working with Git, creating commits, opening PRs, managing branches, resolving conflicts, or when asked about version control best practices.
ffuf-web-fuzzing
Expert guidance for ffuf web fuzzing during penetration testing, including authenticated fuzzing with raw requests, auto-calibration, and result analysis
apk-bugbounty
Android APK static analysis for bug bounty hunting. Decompiles APKs with BOTH Jadx AND Apktool for maximum coverage. Analyzes secrets, exported components, WebViews (Taint Analysis), deep links, Firebase, Native Libs, IPC abuse, and business logic flaws. Every finding MUST have concrete evidence and real exploit impact.
js-code-analysis
Specialized JavaScript/TypeScript static analysis for bug bounty hunting. Covers Node.js, Express.js, Next.js, NestJS, Fastify, and modern frameworks. Uses AST-grep and Grep tool to find high-impact vulnerabilities (RCE, SSRF, SQLi, SSTI, Prototype Pollution, JWT, DOM XSS, GraphQL, ReDoS, CORS, CSRF) via strict Source-to-Sink Taint Analysis. Every finding MUST have concrete evidence.
security-audit
Comprehensive security code audit using multi-phase analysis (Setup → Architecture → STRIDE → Code Review → Dependencies/Config → Report). Parallelized subagent orchestration with integrated scripts. Use when asked to perform security review, vulnerability assessment, code audit, pentest code review, find security bugs, or analyze code for vulnerabilities. Optimized for bug bounty hunting and AppSec with concrete evidence and exploitability validation.
tmux-pilot
Drive tmux from an AI agent — sessions, windows, panes, send commands, capture output, poll agents, browser-like workflow. Cross-platform (Linux/macOS/WSL). Use when the user wants to control terminal layout, launch parallel agents, run commands in background panes, orchestrate multi-pane workflows, or mentions tmux automation.
web-browser
Allows to interact with web pages by performing actions such as clicking buttons, filling out forms, and navigating links. It works by remote controlling Google Chrome or Chromium browsers using the Chrome DevTools Protocol (CDP). When Claude needs to browse the web, it can use this skill to do so.
web3-audit
Smart contract security audit for Immunefi bug bounty. Analyzes Solidity contracts on EVM chains using Slither + Foundry. Covers access control, reentrancy, DeFi economic exploits (flash loans, oracle manipulation, MEV), protocol-specific logic (lending, DEX, bridges, vaults), and generates Foundry fork PoCs. Every finding MUST have concrete evidence, invariant violation proof, and USD impact estimate.
xp
Extreme Programming adapted for AI-human pair development. Use when the user says "/xp", "follow XP", "pair with me", mentions agile/YAGNI/TDD/simple-design, or wants to build features incrementally with feedback loops and clear human-AI roles.
project-planner
Comprehensive project planning and documentation generator for software projects. Creates structured requirements documents, system design documents, and task breakdown plans with implementation tracking. Use when starting a new project, defining specifications, creating technical designs, or breaking down complex systems into implementable tasks. Supports user story format, acceptance criteria, component design, API specifications, and hierarchical task decomposition with requirement traceability.
patch-diff-analyzer
Specialized in reverse-engineering compiled binaries (JARs, DLLs). Use this when the user asks to compare versions, find security fixes, or analyze binary patches.
gh-issue-sync
Manage GitHub issues locally as Markdown files. Use for triaging, searching, editing, and creating issues without leaving your editor or terminal.
subagents-orchestration-guide
Guides subagent coordination through implementation workflows. Use when orchestrating multiple agents, managing workflow phases, or determining autonomous execution mode.
documentation-criteria
Documentation creation criteria including PRD, ADR, Design Doc, and Work Plan requirements with templates. Use when creating or reviewing technical documents, or determining which documents are required.
ai-development-guide
Technical decision criteria, anti-pattern detection, debugging techniques, and quality check workflow. Use when making technical decisions, detecting code smells, or performing quality assurance.
coding-principles
Language-agnostic coding principles for maintainability, readability, and quality. Use when implementing features, refactoring code, or reviewing code quality.
implementation-approach
Implementation strategy selection framework. Use when planning implementation strategy, selecting development approach, or defining verification criteria.
integration-e2e-testing
Integration and E2E test design principles, ROI calculation, test skeleton specification, and review criteria. Use when designing integration tests, E2E tests, or reviewing test quality.
task-analyzer
Performs metacognitive task analysis and skill selection. Use when determining task complexity, selecting appropriate skills, or estimating work scale.
testing-principles
Language-agnostic testing principles including TDD, test quality, coverage standards, and test design patterns. Use when writing tests, designing test strategies, or reviewing test quality.
typescript-rules
React/TypeScript frontend development rules including type safety, component design, state management, and error handling. Use when implementing React components, TypeScript code, or frontend features.
external-resource-context
Captures and persists access methods for resources outside the repository (design source, design system, API schema, IaC source, secret store) so downstream work can reach them deterministically. Use when work depends on external resources, or when the user mentions design source, design system, API schema, IaC source, secret store, or canonical source.
llm-friendly-context
Clarifies inputs, outputs, success criteria, decisions, and unresolved conditions so downstream agents can execute without guessing. Use when writing or revising LLM-facing prompts, handoffs, planning artifacts, reviews, reports, or generated instructions.
recipe-add-integration-tests
Add integration/E2E tests to existing codebase using Design Docs
recipe-build
Execute decomposed tasks in autonomous execution mode
recipe-design
Execute from codebase analysis to design document creation
recipe-diagnose
Investigate problem, verify findings, and derive solutions
recipe-front-adjust
Adjust an already-implemented UI in-session with verification against the design source
recipe-front-build
Execute frontend implementation in autonomous execution mode
recipe-front-design
Execute from codebase analysis to frontend design document creation
recipe-front-plan
Create frontend work plan from design document and obtain plan approval
recipe-front-review
Design Doc compliance and security validation with optional auto-fixes
recipe-fullstack-build
Execute decomposed fullstack tasks with layer-aware agent routing
recipe-fullstack-implement
Orchestrate full-cycle implementation across backend and frontend layers
recipe-implement
Orchestrate the complete implementation lifecycle from requirements to deployment
recipe-plan
Create work plan from design document and obtain plan approval
recipe-prepare-implementation
Verifies the work plan is implementable end-to-end and resolves verification-lane / fixture / E2E-environment gaps before the build phase begins. Use when "implement-ready/verification readiness/lane setup/E2E environment missing" is mentioned, or before any build phase begins on a work plan whose readiness has not been preflight-checked.
recipe-reverse-engineer
Generate PRD and Design Docs from existing codebase through discovery, generation, verification, and review workflow
recipe-review
Design Doc compliance and security validation with optional auto-fixes
recipe-task
Execute tasks following appropriate rules with rule-advisor metacognition
recipe-update-doc
Update existing design documents (Design Doc / PRD / ADR) with review
test-implement
Test implementation patterns and conventions. Use when implementing unit tests, integration tests, or E2E tests, including RTL+Vitest+MSW component testing and Playwright E2E testing.
mckinsey-consultant
McKinsey顾问式问题解决系统。从商业问题出发,通过假设驱动的结构化分析方法,生成McKinsey风格研究报告和PPT。融合Problem Solving方法论、MECE原则、Issue Tree拆解、Hypotheses形成、Dummy Page设计、智能数据收集和专业PPT生成能力。
find-session
Identify a specific Claude Code conversation by its UUID and optionally pin it as a shell function for one-word resume. Use when "claude --continue" picks the wrong session, or when the user wants to reliably resume a specific past conversation across reboots.
Page 1341 of 1632 · 81584 results