Latest Agent Skills

Working effectively with JSON data structures.

Safe patterns for evolving database schemas in production with decision trees and troubleshooting guidance.

GraphQL query language and runtime for APIs enabling clients to request exactly the data they need with strongly-typed schemas and single endpoint architecture.

Prisma ORM for TypeScript - Type-safe database toolkit with schema-first development, auto-generated client, migrations, relations, and Prisma Studio

Kysely type-safe SQL query builder - End-to-end type safety from schema to queries, migrations, transactions, plugins

PM-invocable protocol for Cargo publish and release operations in the trusty-tools Rust monorepo: semver rules, 10-step release sequence, macOS codesign safety, and cross-crate dependency ordering

Pyright fast Python type checker from Microsoft with VS Code integration and strict type checking modes

SQLAlchemy Python SQL toolkit and ORM with powerful query builder, relationship mapping, and database migrations via Alembic

Comprehensive guide for developing on EspoCRM - metadata-driven CRM with service layer architecture

Phoenix operations and deployment: releases, runtime configuration, clustering, libcluster, telemetry/logging, secrets, assets, background jobs, and production hardening on the BEAM.

OpenRouter unified AI API - Access 200+ LLMs through single interface with intelligent routing, streaming, cost optimization, and model fallbacks

ANTI-PATTERN - Example showing violations of self-containment (DO NOT COPY)

Comprehensive verification workflow before merging changes to production.

Comprehensive web application testing patterns with Playwright selectors, wait strategies, and best practices

Creates elaborate, multi-component HTML artifacts using React, Tailwind CSS, and shadcn/ui, then bundles them into a single self-contained HTML file.

Tailwind CSS component library providing semantic class names for 50+ components with built-in themes, dark mode, and customization for rapid UI development.

Advanced Tauri event patterns for bidirectional communication, streaming data, window-to-window messaging, and custom event handling

pytest - Python's most powerful testing framework with fixtures, parametrization, plugins, and framework integration for FastAPI, Django, Flask

Best practices for documenting APIs and code interfaces, eliminating redundant documentation guidance per agent.

shadcn/ui component library for React with Tailwind CSS - copy-paste accessible components with full code ownership

Axum (Rust) web framework patterns for production APIs: routers/extractors, state, middleware, error handling, tracing, graceful shutdown, and testing

Python asyncio - Modern concurrent programming with async/await, event loops, tasks, coroutines, primitives, aiohttp, and FastAPI async patterns

LinkedIn automation via the Linked API CLI - fetch profiles, search people and companies, send messages, manage connections, create posts, react, comment, and run Sales Navigator and custom workflows. Use when the user wants to interact with LinkedIn.

Local LLM operations with Ollama on Apple Silicon, including setup, model pulls, chat launchers, benchmarks, and diagnostics.

Systematic workflow for verifying bug fixes to ensure quality and prevent regres...

Reliably drive the GitHub gh CLI for issue, PR, and label operations in automation and subagent environments, with pre-flight verification so you never fabricate a success or a fake issue URL.

Core VB.NET patterns, type safety, modern language features

Tailwind CSS utility-first framework for rapid UI development with responsive design and dark mode

tRPC end-to-end type-safe APIs for TypeScript with React Query integration and full-stack type safety

Catches type errors before runtime using static type checking with gradual typing, strict mode, and Protocol support for Python projects.

Distributed task queue system for Python enabling asynchronous execution of background jobs, scheduled tasks, and workflows across multiple workers with Django, Flask, and FastAPI integration.

Framework for writing concise 3P (Progress, Plans, Problems) team updates for executives and stakeholders

Core Next.js patterns for App Router development including Server Components, Server Actions, route handlers, data fetching, and caching strategies

Production gRPC in Go: protobuf layout, codegen, interceptors, deadlines, error codes, streaming, health checks, TLS, and testing with bufconn

DSPy declarative framework for automatic prompt optimization treating prompts as code with systematic evaluation and compilers

Guide for creating effective skills

Next.js 16 migration guide (async request APIs, "use cache", Turbopack)

MongoDB - NoSQL document database with flexible schema design, aggregation pipelines, indexing strategies, and Spring Data integration

Xquik X data automation API - Use REST or MCP for tweet search, user lookup, follower exports, media downloads, monitors, webhooks, giveaway draws, and confirmation-gated X actions.

Official Anthropic SDK for Claude AI with chat, streaming, function calling, and vision capabilities

Build production Rust CLIs with Clap: subcommands, config layering, validation, exit codes, shell completions, and testable command surfaces

ONNX Runtime in Rust via the `ort` crate (2.x): loading sessions, configuring CPU/CoreML/CUDA execution providers, tensor I/O with ndarray, async-safe spawn_blocking wrapping, global thread-pool init, and debugging provider/opset issues

Working with Excel files programmatically.

HTTP request smuggling and desynchronization testing. Use when front proxies, CDNs, or load balancers disagree with the origin on message framing (Content-Length vs Transfer-Encoding), on HTTP/2→HTTP/1 translation, or when exploring client-side desync via browser fetch pipelines.

Execute advanced evasion by injecting malicious code into the memory space of a legitimate, suspended process (Process Hollowing). This skill details techniques to bypass static and dynamic analysis by masking malicious activity behind trusted processes like svchost.exe or explorer.exe.

Detects weak reverse engineering and tampering protections in mobile apps (Android/iOS). Trigger on: root detection bypass, jailbreak detection bypass, Frida detection, debugger detection, anti-debugging, ptrace, sysctl, emulator detection, code obfuscation absent, debug symbols present, get-task-allow, ProGuard disabled, R8 disabled, string encryption, integrity check, file tampering, repackaging, dynamic instrumentation, runtime hook, Magisk hide, Magisk, frida-server, objection bypass, signing verification, apk resign. Covers MASVS-RESILIENCE-1/2/3/4.

Heap exploitation playbook. Use when targeting ptmalloc2/glibc heap vulnerabilities including UAF, double free, overflow, off-by-one/null, and leveraging tcache/fastbin/unsortedbin attacks for arbitrary write or code execution.

Exploit SSRF vulnerabilities in AWS EC2-hosted applications to extract IAM credentials and User Data from the Instance Metadata Service, including techniques for bypassing basic filters against IMDSv1.

Exploit misconfigurations in AWS Cognito, specifically focusing on unauthorized identity pool access, user pool self-registration issues, and privilege escalation via custom attributes to access broader AWS infrastructure.

Systematically extract hidden system prompts, core directives, and invisible context intentionally concealed within Large Language Model (LLM) applications. This skill utilizes targeted linguistic engineering and boundary manipulation to bypass prompt opacity.

Execute and analyze AI Data Poisoning attacks. By subtly injecting malicious or targeted misinformation into an LLM's training or fine-tuning dataset, an attacker can covertly manipulate the model's future outputs, implant backdoors, or enforce biases without altering the model architecture.

Detect and exploit session fixation (WSTG-SESS-01, WSTG-SESS-03) and session exposure (WSTG-SESS-04) by testing whether the server issues a new session token post-authentication, whether pre-login tokens remain valid after login, and whether session IDs are transmitted over HTTP or included in GET parameters. Analyze token randomness via Burp Sequencer. Test JSESSIONID, ASP.NET Forms Auth cookies. Tools: OWASP ZAP, Burp Suite Repeater/Sequencer, JHijack.

Essential fuzzing payloads: SQL injection, command injection, special characters. Curated essentials for vulnerability testing.

Active Directory and network lateral movement assessment. Pass-the-hash, pass-the-ticket, Kerberoasting, AS-REP roasting, NTLM relay, SMB relay, WMI/WinRM/PSRemoting abuse, constrained/unconstrained delegation, RBCD, cross-trust exploitation, and pivoting. Uses impacket, netexec, enum4linux-ng, smbmap, smbclient, bloodhound-python, Responder, ntlmrelayx, mitm6, and ldap-utils. Chains from /post-exploit or /credential-audit.

Entry P1 category router for file access and upload workflows. Use when testing download endpoints, file paths, local file inclusion, upload flows, preview pipelines, archive extraction, or storage and sharing boundaries.

PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques

Authentication and credential security assessment. Tests password brute-force, credential stuffing, password spraying, default credential testing, credential harvesting, lockout analysis, MFA bypass, OAuth/OIDC abuse, session token entropy, Kerberos attacks, and intelligent wordlist generation. Uses hydra, john, ncrack, medusa, cewl, crunch, netexec, impacket, kerbrute, and nuclei default-login templates. Covers OWASP A07:2021 Identification and Authentication Failures.

Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques

Exploit Active Directory environments using Pass-the-Hash (PtH). This skill details how to authenticate to remote systems using the NTLM hash of a user's password instead of the plaintext password, enabling lateral movement and privilege escalation without cracking hashes.

Exploit Active Directory replication privileges (DS-Replication-Get-Changes) to perform a DCSync attack, allowing an attacker to impersonate a Domain Controller and extract password hashes (like the krbtgt hash for Golden Tickets) without code execution on a DC.