Latest Agent Skills

对一个软件项目或源码仓库进行全面调研，输出一份结构化的中文调研报告，让对项目不熟悉的人能够同时理解"它做什么"和"它怎么实现"。当用户说"调研这个项目 / 分析这个代码库 / 给我一份项目分析报告 / 我要全面理解这个项目 / 帮我看看这个仓库 / onboarding 一下 / 这个项目的整体架构是什么 / 给我梳理下这个源码"等等，或者把一个不熟悉的代码目录交给你并希望你给出全局认识时，必须使用本 skill。即使用户没有显式说"调研报告"，只要意图是"帮我搞懂一个完整的代码库 / 项目"，就应当触发。但本 skill 仅针对"全局理解 / 架构调研 / onboarding"场景：若用户只是要做 code review、定位某个 bug、评审某处具体实现、做性能或安全诊断，不要触发本 skill。

从一份或多份现有配置抽取可审阅的 agent-config.yaml，并跨 Windows、Linux、macOS 与 WSL 声明式同步 Codex ~/.codex/config.toml 和 Claude Code ~/.claude/settings.json。用于导入、去重、解决冲突、剔除配置项、初始化、检测、校验、渲染、预览差异、应用、检查状态或诊断；不用于凭据、登录状态、项目级配置、~/.claude.json、skills、agents、hooks 或 MCP 配置。

把一件用户自己答不出来的事，变成一份交给别人填的问卷（Markdown 文档），可异步发出也可开会一起填。只访谈"发送"本身——发给谁、要拿回什么——问题则对准收件人知道而用户不知道的那段缺口。

当用户明确要求“解决当前 merge / rebase / cherry-pick 冲突、提交代码、创建 commit、把改动分批提交并 push、推送当前分支”时使用。进行中的冲突要先识别 Git 操作和双方原始意图，逐 hunk 做语义合并并运行项目检查，再经用户确认继续操作；普通改动要检查敏感信息与异常差异，拆成可运行、可审查、可回滚的原子提交后确认提交和推送。不得自动发起或中止 merge / rebase / cherry-pick，不得强推或随意改写已发布历史。不要用于普通改动尚未完成或验证失败、只想查看 Git 状态，或要创建 PR 的场景。

当要在开始一段开发、或并行多个任务前，建立隔离的 git 工作区（worktree）以免污染当前工作区时使用——如"开个 worktree、隔离工作区、并行任务各自隔离"。通常由 execute-task 在执行前调用。先锁定 expected base，再选择能保证该基线的创建方式，并在创建后验证 HEAD。不要用于：不需要隔离的小改动、收尾/合并/清理（那是 finish-branch）、非 git 仓库。

当一段改动已经写完、要在收尾或合并前对它做一次独立审查时使用——如"审一遍这条分支、review 这次改动、这批代码有没有问题、帮我把关再合"。先把 BASE..HEAD 生成一份审查包一次读完，再按 correctness / readability / architecture / security / performance 五轴加测试质量逐项判定，输出带 file:line 的 Critical / Important / Minor 分级 findings。composable 层能力单元，通常由 execute-task 在整体验收时调用。不要用于：改动还没写完、只想跑测试、要的是动手修复而不是审查、评审需求或技术方案本身。

当一段开发完成，要给当前分支 / worktree 收尾时使用——如"收尾、把这个分支收掉、开发完了怎么处理、合并还是留着"。通常由 execute-task 执行完后调用。先只读预检状态，再清除本次开发遗留的调试代码、跑最终测试，然后给出合并/本地保留/创建 PR/丢弃选项；提交、合并、推送、删除与移除工作树都交用户拍板。不要用于：开发还没完、建立工作区（那是 setup-worktree）。

当用户已有确认过的开发任务清单（理想来自 split-task），要把它逐个落地成实现 + 测试 + 提交，并经验收确认真的做完时使用——如"执行任务、把 tasks 做掉、按任务清单开始编码、实现这些任务、推进开发"。不要用于：任务还没拆（先 split-task）、技术方案没定（先 make-design）、行为没钉死（先 write-spec）、想法还模糊（先 refine-idea）、只做单个改动的红绿闭环（那是 tdd）、只做一次代码审查（那是 review-changes）、单纯调试某个 bug、代码评审。

当用户提出一个想法或诉求时，通过对话挖掘真实意图、明确边界，提炼成清晰、可执行的概念。

当用户已有确认过的行为规格（理想来自 write-spec），要在编码前把技术问题问清楚、比较方案、锁定技术决策——技术选型、架构、数据模型、接口契约、错误处理、测试策略——并沉淀成可 review 的技术设计依据时使用。不要用于：行为/需求还没钉死（先 write-spec）、想法还模糊（先 refine-idea）、任务拆解或实现计划（那是下游 split-task）、调试或代码评审。

在要求写结构化的 spec、规格文档、行为规格或验收标准时使用。

当用户想测试或复盘某个 skill 的实际执行效果时使用——如“测一下这个 skill”“看看 agent 是否按 skill 执行”“生成 skill 覆盖率或溯源报告”。在隔离沙箱中发起一次 headless 盲测，逐步骤溯源并产出中文复盘报告。不要用于编写新 skill、调试业务代码、代码审查，或复盘当前会话已经发生的执行。

当用户已有确认过的技术设计（理想来自 make-design），要在编码前把它拆成可独立验收、带依赖与验证方式的开发任务清单时使用——如"拆任务、把技术方案拆成开发任务、生成 tasks、列实现任务清单、把设计落地成可执行任务"。不要用于：技术方案还没定（先 make-design）、行为还没钉死（先 write-spec）、想法还模糊（先 refine-idea）、写具体实现代码或逐行施工单、调试、代码评审。

补充上下文，用更简单、明确的中文重新解释。

针对明确问题查阅高可信一手来源，并将带逐项引用的结论保存为仓库内单个 Markdown 调研文件。用于用户要求调研技术主题、核实文档、API、规范或源码事实，或希望把资料阅读工作委托给后台 agent；不用于完整代码库架构调研、无需落盘的简短事实回答或代码评审。

Grilling

当要用测试先行的方式落地一段行为改动时使用——如"用 TDD 实现这个功能、先写测试再写实现、红绿循环推进、修 bug 先写复现测试"。在约定 seam 上一次一个行为走红→绿→验证，并当场把命令与输出落盘成可核对的执行记录。composable 层能力单元，通常由 execute-task 在每个任务内调用。不要用于：给已写完的实现事后补测试、只跑测试不改代码、纯定位 bug 不改行为、代码评审、任务拆分。

Audits source code for observability gaps — missing telemetry, poor observability practices, and code structure that resists instrumentation — then emits a ranked, bounded finding list. Invoke when the user says "observablip this", "observablip `pkg/foo`", "audit observability", "review telemetry", "find missing spans", "audit o11y on this PR", "review my logging", or "is this instrumented well enough?". Read-only; never edits files.

Reviews pull requests and local diffs against Google's eng-practices code review guide (design, complexity, tests, naming, comments, style, consistency, documentation, every-line, context) and emits a ranked, principle-tagged finding list with rich local diff rendering. Optional follow-up step posts selected findings as a GitHub PR review. Invoke when the user says "googly-eyes this PR", "review by the canon", "principled code review", "Google-style review", "review this CL", or pastes a PR URL and asks for a code review. 👀

Produces durable, structured documentation in codebases with sparse docs — readable by humans and agents alike. Two invocation modes — `survey` proposes a doc plan; `draft` writes one specific doc end-to-end with a factcheck-then-persona review gate. Triggered by phrases like "doxcavate this repo", "doxcavate the X", "doxcavate `runbook-deploy`", "what should be documented?", "document this code", "write a how-it-works for X", or any request to inventory or write project documentation.

Checks how well a Linear cycle is prepared. Reports per-person load in working days against available days, tickets with no estimate, tickets nobody is assigned to, oversized tickets that need splitting, work that did not finish last cycle, on-call rotation cost, and how groomed the backlog behind the cycle is. Invoke when the user says "cyclotic", "cyclotic prep", "cyclotic prep next", "cyclotic review", "cyclotic init", "cyclotic configure", "cyclotic for" a person's name, "cyclotic show cards", "cyclotic list tickets", "cyclotic explain" a person's name, or adds "-v" or "verbose" to any of those. Also invoke when the user asks whether a cycle or sprint is ready, who is over or under capacity, what carried over from last cycle, which tickets still need estimates, how the backlog looks going into planning, what is in the cycle and at what sizes, or how one person's load adds up. Read-only against Linear.

Reviews parsers, deserialization, uploads, archives, YAML/JSON/XML/pickle, paths, templates, SSRF, and unsafe loaders.

Checks desktop, tablet, and mobile UI for overflow, clipping, navigation, grid, canvas, and breakpoint regressions.

Reviews secrets, config defaults, environment variables, logs, credentials, CI secrets, and unsafe settings.

Audits external agent, skill, plugin, hook, or marketplace packs for licenses, installers, secrets, runtime state, and safe adaptation.

Triages CVEs and advisories for affected versions, reachability, exploitability, upgrades, and validation.

Extracts tokens, typography, spacing, component states, assets, layout, responsive rules, and interactions from a UI reference.

Guides module boundaries, dependency direction, and domain structure. Do not use for local edits that leave architecture unchanged.

Decomposes large modules, god files, classes, or packages in reviewable steps while preserving public APIs. Not for routine refactors.

Updates AGENTS.md after a repeated verified failure. Do not use for one-off preferences or speculative rules.

Reviews UI accessibility: keyboard, focus, semantics, labels, contrast, motion, forms, dialogs, tables, and screen readers.

Merges agent or review outputs into one deduplicated, evidence-linked, severity-ranked actionable report.

Runs read-only parallel review of a PR, branch, commit, or diff across bugs, security, tests, maintainability, performance, and UI.

Use only when the request concerns standards, responsibility, complexity, smells, naming, refactoring catalogs, or task-plan rules; not routine work.

Reviews authorization, tenant isolation, roles, ownership, row access, admin boundaries, sharing, and privilege escalation.

Reviews authorized diffs for auth, input, filesystem, network, secrets, parsers, injection, CI/CD, and supply-chain regressions.

Validates rendered UI with browser or Playwright screenshots after implementation, redesign, responsive changes, or visual regressions.

Fixes one security finding with the smallest safe patch, regression coverage, and verification.

Reviews lockfiles, installers, provenance, CI permissions, dependency confusion, artifacts, registries, and publishing.

Selects scoped architecture, backend, frontend, security, data, DevOps, QA, docs, performance, or product roles.

Use only when simplicity, assumption checks, dead-code avoidance, or overengineering resistance is requested. Do not use by default.

Analyzes repeated agent failures or noisy routing and proposes evidence-backed changes to instructions, skills, gates, or runbooks.

Plans framework, API, schema, service, package, UI, build, or infrastructure migrations with slices, rollback, and validation.

Establishes visual direction from Figma, screenshots, generated references, evidence, or an existing design system before implementation.

General implementation only when no narrower task or ecosystem skill fits. Do not combine with a clear specialist skill.

Maps domains, ownership, dependencies, entry points, tests, services, and risks before broad changes, review, migration, or handoff.

Routes ambiguous or multi-domain engineering requests to the smallest ordered skill set. Do not use for clear single-skill work or same-task follow-ups.

Routes ambiguous security work to one leaf skill. Do not use when a specific security review or fix is already clear.

Selects session runtime capabilities when tools or external evidence are required. Do not use for ordinary local repository work.

Stores verified cross-session facts, decisions, preferences, and open questions without secrets, speculation, or monitoring.

Routes ambiguous review or planning to one leaf workflow. Do not use for a clear code, security, UI, architecture, or migration review.

Use only at validation, integration, completion, release, or drift-review boundaries. Do not load for every implementation step.

Applies safe Home Assistant rules for automations, templates, integrations, entity behavior, startup states, and validation.

Implements Figma frames, selections, components, or screens in code while preserving assets, variants, tokens, and visual fidelity.

Updates technical docs for verified behavior, public contracts, commands, configuration, and operations.

Syncs implemented UI to Figma as editable layers, Code Connect mappings, components, tokens, and handoff.

Models threats for a service, feature, endpoint, integration, or architecture: assets, attackers, boundaries, flows, and abuse cases.

Builds a compact secret-safe repository pack for AI handoff, review, or large analysis; prefers Repomix when available.

Builds and validates Russian Obsidian repository wikis, architecture docs, and code/docs/ADR drift reports.

Reviews cohesion, naming, responsibility, complexity, and maintainability. Do not use as a default companion to every code change.