Latest Agent Skills

OWASP security guidelines and Top 10 vulnerabilities USE WHEN: user mentions "OWASP", "security audit", "vulnerability scan", asks about "injection", "XSS", "CSRF", "access control", "authentication security" DO NOT USE FOR: OWASP Top 10:2025 specific - use `owasp-top-10` instead

JaCoCo Java code coverage tool USE WHEN: user mentions "JaCoCo", "Java coverage", "code coverage", asks about "coverage threshold", "jacoco-maven-plugin", "coverage report", "LINE coverage", "BRANCH coverage" DO NOT USE FOR: JavaScript/TypeScript coverage - use Vitest skill, SonarQube analysis - use `sonarqube` skill, test execution - use testing skills

ESLint - pluggable JavaScript/TypeScript linter USE WHEN: user mentions "ESLint", "JavaScript linting", ".eslintrc", asks about "eslint config", "linting rules", "eslint plugins", "flat config" DO NOT USE FOR: Biome - use `eslint-biome` skill, TypeScript-specific - use `typescript-eslint` skill, code quality principles - use `quality-common`

Universal code quality principles applicable to all languages. Covers Clean Code, SOLID, complexity metrics, and quality standards. USE WHEN: user mentions "clean code", "SOLID", "code smells", "refactoring", "complexity", asks about "cyclomatic complexity", "cognitive complexity", "code review", "maintainability" DO NOT USE FOR: language-specific linting - use ESLint/Biome skills, security - use OWASP skills, testing - use testing skills

JVM performance profiling with Java Flight Recorder (JFR), jcmd, and GC analysis. Use for identifying bottlenecks and memory issues. USE WHEN: user mentions "Java profiling", "JFR", "JVM performance", asks about "Java Flight Recorder", "jcmd", "heap dump", "GC tuning", "thread dump", "Java memory leak" DO NOT USE FOR: Node.js/Python profiling - use respective skills instead

Prisma ORM for Node.js/TypeScript. Covers schema definition, migrations, and type-safe queries. Use when working with Prisma. USE WHEN: user mentions "prisma", "schema.prisma", "prisma migrate", "prisma generate", "prisma studio", "@prisma/client", asks about "how to define models in prisma", "prisma relations", "prisma transactions", "type-safe database queries" DO NOT USE FOR: raw SQL queries - use `database-query` MCP; Drizzle ORM - use `drizzle` skill; TypeORM - use `typeorm` skill; SQLAlchemy - use `sqlalchemy` skill

rustls — modern, safe TLS implementation in pure Rust. Drop-in replacement for OpenSSL/native-tls in Rust apps. No C dependencies — perfect for mobile cross- compile and embedded targets. Covers ClientConfig + ServerConfig, certificate verification with webpki-roots, mTLS, custom verifier (cert pinning), ALPN negotiation (HTTP/2, HTTP/3), session resumption, integration with hyper + reqwest + tokio. USE WHEN: user mentions "rustls", "ClientConfig", "ServerConfig", "webpki-roots", "rustls-pemfile", "rustls cert pinning", "rustls mTLS", "rustls Tokio", "rustls hyper" DO NOT USE FOR: OpenSSL specifics - use OpenSSL skill (or platform TLS) DO NOT USE FOR: Apple/Windows native TLS - use platform-specific skills DO NOT USE FOR: Tor anonymous transport - use `network/arti` DO NOT USE FOR: TLS protocol theory - use OWASP / RFC docs

Flutter cross-platform development with Dart. Widgets, state management (Riverpod, BLoC), navigation, platform channels, and production patterns. USE WHEN: user mentions "Flutter", "Dart", "flutter widget", "Riverpod", "BLoC", "flutter build", "pubspec.yaml" DO NOT USE FOR: React Native - use `react-native`; Expo - use `expo`; native iOS/Android

NATS cloud-native messaging system. Covers Core NATS, JetStream persistence, and request/reply patterns. Use for lightweight, high-performance microservices communication. USE WHEN: user mentions "nats", "jetstream", "cloud-native messaging", "request/reply", "subject wildcards", asks about "lightweight messaging", "microservices communication", "nats streaming" DO NOT USE FOR: complex routing - use `rabbitmq`; AWS-native - use `sqs`; Azure-native - use `azure-service-bus`; JMS compliance - use `activemq`; persistent queues only - use dedicated broker

Python logging with the standard library logging module and structlog. Covers log levels, handlers, formatters, structured logging, and production best practices for FastAPI/Django applications. USE WHEN: user mentions "python logging", "fastapi logging", "django logging", asks about "how to log in python", "python logging module", "logging configuration python" DO NOT USE FOR: Node.js logging - use `nodejs-logging` instead, Java logging - use `slf4j` or `logback`, structlog-specific - use `structlog` skill for deep dive

Node.js logging with Winston, Pino, and built-in console. Covers structured logging, log levels, transports, async logging, and production best practices for Express/NestJS applications. USE WHEN: user mentions "node.js logging", "express logging", "nestjs logging", asks about "how to log in node", "winston vs pino", "node logging best practices" DO NOT USE FOR: Python logging - use `python-logging` instead, Java logging - use `slf4j` or `logback`, Browser logging - different environment and APIs

Rust systems programming language. Covers ownership, borrowing, lifetimes, async/await, error handling, and Cargo. Use for high-performance backend systems. USE WHEN: user mentions "rust", "ownership", "borrowing", "lifetimes", asks about "borrow checker", "cargo", "traits", "Result type", "async rust", "tokio" DO NOT USE FOR: Actix/Axum/Rocket frameworks - use framework-specific skills DO NOT USE FOR: WASM - use WebAssembly-specific skill DO NOT USE FOR: Tauri - use `tauri` skill instead

Java language (17+). Covers modern features, patterns, and best practices. Use when writing Java applications, Spring Boot backends, or enterprise systems. USE WHEN: user mentions "java", "records", "sealed classes", "streams", asks about "pattern matching", "switch expressions", "Optional", "collections", "generics" DO NOT USE FOR: Spring Boot specifics - use `backend-spring-boot` skill instead DO NOT USE FOR: Lombok annotations - use `lombok` skill instead DO NOT USE FOR: MapStruct - use `mapstruct` skill instead

Deno runtime for TypeScript/JavaScript. Covers permissions, standard library, testing, and Deploy. Use for secure, TypeScript-native backend development. USE WHEN: user mentions "deno", "permissions", "Deno.serve", asks about "deno test", "deno deploy", "standard library", "top-level await", "npm compatibility" DO NOT USE FOR: Node.js runtime - use `nodejs` skill instead DO NOT USE FOR: Fresh/Oak frameworks - use framework-specific skills DO NOT USE FOR: Language syntax - use `typescript` skill

Microsoft SQL Server T-SQL procedural language. Covers stored procedures, functions, triggers, error handling, and SQL Server-specific features. Use for SQL Server database server-side programming. USE WHEN: user mentions "tsql", "T-SQL", "SQL Server procedures", "SQL Server functions", "TRY...CATCH", "THROW", "sp_executesql", "SSMS" DO NOT USE FOR: basic SQL Server SQL - use `sqlserver` instead, PostgreSQL - use `plpgsql` instead, Oracle - use `plsql` instead

Nx build system and monorepo tools. Advanced task orchestration, generators, and plugins. Use for complex enterprise monorepos with multiple technologies. USE WHEN: user mentions "Nx", "nx.json", "Nx monorepo", "Nx generators", asks about "Nx workspace", "affected commands", "module boundaries" DO NOT USE FOR: Turborepo (use turborepo skill), simple monorepos (Turborepo is simpler), single-package projects

RGB protocol: client-side validated smart contracts on Bitcoin + Lightning. Schema-driven contracts, AluVM (RGB VM), rgb-lightning-node for LN integration. USDT-on-RGB rollout. USE WHEN: building RGB contracts, integrating RGB Lightning, comparing with TAP.

BOB (Build on Bitcoin): hybrid Bitcoin/Ethereum L2 using OP Stack + Bitcoin security. Bridges to Bitcoin via threshold signatures + zk-proofs. USE WHEN: building cross-chain Bitcoin/Ethereum apps, evaluating BOB hybrid model.

Ark protocol: VTXOs (Virtual Transaction Outputs) batched off-chain with periodic on-chain settlement. ARKADE (Ark Labs) is the first mainnet implementation. ASP (Ark Service Provider) coordinates rounds; users keep unilateral exit. USE WHEN: building Ark integrations, evaluating Ark vs Lightning, designing batched payment flows.

GSAP Skill

xUnit.net testing framework with Fact, Theory, fixtures, DI, and mocking with Moq and NSubstitute. Covers .NET testing best practices. USE WHEN: user mentions "xUnit", ".NET testing", "Fact", "Theory", "InlineData", "Moq", "NSubstitute", "C# unit test" DO NOT USE FOR: NUnit - use `nunit`, Vitest - use `vitest`, Jest - use `jest`, Playwright - use `playwright`

NUnit testing framework with TestCase, SetUp/TearDown, assertions, and parameterized tests for .NET applications. USE WHEN: user mentions "NUnit", "TestCase", "TestFixture", "NUnit assertions", "NUnit parameterized tests", ".NET NUnit" DO NOT USE FOR: xUnit - use `xunit`, MSTest, JavaScript testing frameworks

JUnit 5 testing framework with Mockito integration. Covers unit tests, mocking, and Spring Boot test integration. USE WHEN: user mentions "junit", "java test", "mockito", asks about "@Test", "@Mock", "@InjectMocks", "unit test java", "spring boot test" DO NOT USE FOR: Integration tests with containers - use `testcontainers`; REST API tests - use `rest-assured`; E2E tests - use Selenium; JavaScript/TypeScript - use `vitest` or `jest`

GDPR compliance implementation. Data subject rights (access, deletion, portability), consent management, data processing records, PII handling, and privacy by design patterns. USE WHEN: user mentions "GDPR", "data privacy", "right to be forgotten", "data deletion", "consent management", "PII", "data subject request", "privacy policy", "cookie consent" DO NOT USE FOR: authentication - use auth skills; encryption - use `cryptography`; audit logging - use `audit-logging`

Server-Sent Events for real-time server-to-client streaming. Express, Fastify, FastAPI, Spring WebFlux SSE implementations. Event streams, reconnection, and EventSource API. USE WHEN: user mentions "SSE", "Server-Sent Events", "EventSource", "event stream", "text/event-stream", "live feed", "streaming updates" DO NOT USE FOR: bidirectional communication - use `socket-io`; WebRTC - use `webrtc`; LLM streaming - use AI SDK skills

Reranking retrieved documents with cross-encoders and LLM rerankers. Cohere Rerank v3, Voyage rerank-2, BGE reranker, ColBERT late interaction, Jina reranker. Cost and latency tradeoffs, top-K in / top-N out strategy. USE WHEN: user mentions "rerank", "reranker", "cross-encoder", "Cohere Rerank", "Voyage rerank", "BGE reranker", "ColBERT", "Jina reranker", "bi-encoder" DO NOT USE FOR: initial retrieval - use `advanced-retrieval` or `hybrid-search`; query rewriting - use `query-transformations`; agent decisions - use `agentic-rag`

Knowledge-graph-augmented retrieval. Entity and triple extraction, graph construction (Neo4j, LlamaIndex PropertyGraphIndex), hierarchical community summarization (Microsoft GraphRAG), personalized PageRank (HippoRAG), multi-hop traversal retrieval, and hybrid graph + vector pipelines. USE WHEN: user mentions "GraphRAG", "HippoRAG", "knowledge graph RAG", "entity extraction", "multi-hop reasoning", "Neo4j RAG", "LlamaIndex property graph", "LangChain graph retriever", "triple extraction", "community summarization" DO NOT USE FOR: vanilla vector RAG - use `rag-patterns`; multimodal inputs - use `multimodal-rag`; production indexing ops - use `rag-production`; hallucination checks - use `rag-guardrails`

Amazon SQS managed message queue service. Covers standard and FIFO queues, dead-letter queues, and integration patterns. Use for AWS-native serverless and microservices architectures. USE WHEN: user mentions "sqs", "aws queues", "fifo queue", "lambda trigger", "sns to sqs", asks about "aws messaging", "serverless queues", "standard queue", "visibility timeout" DO NOT USE FOR: event streaming - use `kafka` or AWS Kinesis; Azure-native - use `azure-service-bus`; GCP-native - use `google-pubsub`; on-premise - use `rabbitmq` or `activemq`; complex routing - use `rabbitmq`

SLF4J - Simple Logging Facade for Java. Standard logging API that abstracts underlying implementation (Logback, Log4j2). Provides parameterized logging and MDC support. USE WHEN: user mentions "slf4j", "java logging api", "parameterized logging", asks about "how to log in Java", "logger facade", "MDC in java", "logging best practices java" DO NOT USE FOR: Logback configuration - use `logback` instead, Log4j2 configuration - use Log4j2 skill, Node.js logging - use `winston` or `pino` instead, Python logging - use `python-logging` instead

Modern C++ (C++17/20/23) language and standard library. Covers RAII, move semantics, smart pointers, templates, concepts, ranges, coroutines, modules, std::expected, std::format, std::span, std::string_view. USE WHEN: user mentions "C++", "modern C++", "C++17/20/23", "RAII", "smart pointers", "templates", "concepts", "ranges", "move semantics", "std::expected", "std::span", "coroutines", "modules", "STL" DO NOT USE FOR: C (use a C-specific skill), C# (use `csharp`), Objective-C++, Carbon, kernel/no-exception subset (use `cpp-systems`)

Bun JavaScript runtime. Fast all-in-one toolkit with bundler, test runner, package manager. Use when working with Bun projects or considering Node.js alternatives. USE WHEN: user mentions "bun", "bun test", "bun build", asks about "Bun.serve", "bun install", "SQLite in Bun", "bunx", "performance comparison" DO NOT USE FOR: Node.js runtime - use `nodejs` skill instead DO NOT USE FOR: Hono/Elysia frameworks - use framework-specific skills DO NOT USE FOR: Language syntax - use `typescript` or `javascript` skills

Tauri framework for building cross-platform desktop applications with Rust backend and web frontend. Covers architecture, IPC commands, plugins, bundling, code signing, and security best practices. USE WHEN: user mentions "Tauri", "Rust desktop app", asks about "Tauri commands", "Tauri plugins", "Tauri IPC", "Rust + Svelte/React", "lightweight desktop app", "Tauri bundling", "Tauri security" DO NOT USE FOR: Electron applications - use `electron` skill instead

Jest testing framework. Covers unit tests, mocking, and snapshots. Use for testing React and Node.js projects. USE WHEN: user mentions "jest", "jest test", "snapshot test", asks about "jest.fn", "jest.mock", "toMatchSnapshot", "React testing" DO NOT USE FOR: E2E tests - use `playwright` or `cypress`; Vite projects - use `vitest` instead; React component testing alone - combine with `testing-library`

Arti — pure-Rust implementation of the Tor anonymity network, by Tor Project. Embeddable Tor client (no system Tor daemon needed), provides SOCKS proxy and programmatic API for connecting to .onion services or routing clearnet traffic through Tor. Used by privacy-respecting wallets (BHODL-style), messenger apps, and any Rust app needing anonymity. Ships as library (arti-client crate) or standalone CLI. USE WHEN: user mentions "arti", "Tor in Rust", "embedded Tor", "arti-client", "Tor circuit Rust", "onion service Rust", "TorClient", "BridgeConfig", "PreferredRuntime" DO NOT USE FOR: Bitcoin Core + Tor configuration - use `bitcoin/privacy/tor` DO NOT USE FOR: Browsing via Tor Browser - end-user tool, not dev DO NOT USE FOR: TLS configuration - use `network/rustls`

Pino - extremely fast and low overhead Node.js logger with JSON-native structured logging. 10x faster than Winston. Optimized for high-performance APIs and production environments. USE WHEN: user mentions "pino", "fast logging", "high performance logging", "fastify logging", asks about "fastest node.js logger", "JSON structured logging", "low overhead logging" DO NOT USE FOR: Winston logging - use `winston` instead, Python logging - use `python-logging` instead, Complex transport requirements - use `winston` instead

Java logging with SLF4J facade, Logback, and Log4j2 implementations. Covers configuration, log levels, structured logging, async logging, and production best practices for Spring Boot applications. USE WHEN: user mentions "java logging", "spring boot logging", "slf4j setup", asks about "how to log in java", "logback vs log4j2", "java logging best practices" DO NOT USE FOR: Node.js logging - use `nodejs-logging` instead, Python logging - use `python-logging`, Kotlin-specific logging - similar but has nuances

Go programming language. Covers goroutines, channels, interfaces, error handling, and modules. Use for building concurrent, high-performance backend services. USE WHEN: user mentions "go", "golang", "goroutines", "channels", asks about "concurrency", "select statement", "interfaces", "error handling", "go modules" DO NOT USE FOR: Gin/Fiber/Echo frameworks - use framework-specific skills DO NOT USE FOR: GORM - use ORM-specific skill DO NOT USE FOR: gRPC - use API design skills

Expo framework for React Native. Managed and bare workflows, Expo Router, EAS Build/Submit/Update, config plugins, and Expo SDK modules. USE WHEN: user mentions "Expo", "expo-router", "EAS Build", "expo-cli", "app.json", "expo-config-plugin", "Expo Go" DO NOT USE FOR: bare React Native without Expo - use `react-native`; Flutter - use `flutter`

Azure cloud services SDK integration. Azure Functions, Cosmos DB, Blob Storage, Service Bus, Azure AD (Entra ID), and Key Vault. Node.js and .NET SDKs. USE WHEN: user mentions "Azure", "Azure Functions", "Cosmos DB", "Blob Storage", "Service Bus", "Azure AD", "Entra ID", "Key Vault", "Azure SDK" DO NOT USE FOR: AWS services - use `aws`; GCP services - use `gcp`; Terraform for Azure - use `terraform`

Google Cloud Platform SDK integration. Cloud Functions, Firestore, Cloud Storage, Pub/Sub, BigQuery, and Cloud Run. Node.js and Python client libraries. USE WHEN: user mentions "GCP", "Google Cloud", "Cloud Functions", "Firestore", "Cloud Storage", "Pub/Sub", "BigQuery", "Cloud Run", "Firebase" DO NOT USE FOR: AWS services - use `aws`; Azure services - use `azure`; Firebase Auth - use auth skills

AWS SDK integration for Node.js (v3) and Python (boto3). Core services: S3, Lambda, DynamoDB, SQS, SNS, CloudWatch, IAM. Configuration, credentials, and production patterns. USE WHEN: user mentions "AWS", "Amazon Web Services", "Lambda", "DynamoDB", "SQS", "SNS", "CloudWatch", "IAM", "boto3", "aws-sdk" DO NOT USE FOR: S3 file operations - use `cloud-storage`; SQS messaging patterns - use `sqs`; Azure/GCP - use respective skills

Pythinker WebBridge lets AI control the user's real browser — navigate, click, type, read, screenshot, and interact with any website using the user's actual login sessions. Use this skill whenever the user wants to interact with websites, automate browser tasks, scrape web content, or perform any action requiring a real browser. Also use when the user mentions "browser", "webpage", "open URL", "screenshot", or asks to read/interact with any website. Use even for simple-sounding browser requests — the daemon handles all complexity.

Apply an approved sub-skill grouping by moving user-specified skills into a parent bundle, with timestamped backups of every modified directory.

Analyze the available skill set and recommend candidate groups that could be consolidated into sub-skill bundles. Read-only — proposes a plan, does not move files.

Discover and reorganize the skill inventory into hierarchical sub-skill bundles. Use when the user asks to review, group, or consolidate skills into a parent bundle.

Invoke a registered skill from the current skill listing. BLOCKING REQUIREMENT: when a skill from the listing matches the user's request, you MUST call this tool (not free-form text). Do not re-invoke a skill to repeat work already done: if a `<skill-loaded>` block for it with the same `args` is already present in the conversation, follow those instructions directly instead of calling the tool again. Do call the tool again when you need the skill with different arguments — the loaded block was expanded with the earlier `args` and will not reflect new inputs.

Universal data-source assistant. Use this skill when the user wants external structured data such as stocks, financial reports, technical indicators, A-share/HK/US markets, global macroeconomics, Chinese enterprise registry information, arXiv papers, Google Scholar results, Chinese laws/regulations and judicial cases, Wind financial data (intraday/minute quotes, funds, bonds), IMF macro datasets (FX rates, CPI, GDP forecasts), Gildata smart screening, US SEC filings (10-K/10-Q, Form 4, 13F), or S&P Capital IQ fundamentals (top holders, consensus estimates, valuation ratios). This plugin exposes tools via MCP server `plugin-pythinker-datasource_data`; call them in the flow `mcp__plugin-pythinker-datasource_data__get_data_source_desc` → `mcp__plugin-pythinker-datasource_data__call_data_source_tool`.

Use when writing or reviewing tests, or when asked how to write a good single test. Encodes the per-test rules behind the "test the contract / responsibility, not the implementation" principle — name and structure one behavior per `it`, drive through the public surface, stub only true external boundaries, control time and config via documented knobs, and keep tests clear, isolated, and refactor-resilient. The same rules drive both authoring (write mode) and auditing existing tests (review mode).

Invoke only when the user explicitly asks to review code through the "single level of abstraction / layered error handling" lens — a function does only its own layer's business logic while errors are handled above or below. The agent reports detections, raw-count measurements, and move directions. Apply only when the user explicitly requests this lens.

Use when designing or building any terminal user interface — choosing a layout paradigm, keybindings/interaction model, color system, data visualization, or motion. Framework-agnostic universal patterns that work with Ratatui, Ink, Textual, Bubbletea, or any TUI toolkit. For the repo's own pythinker-code TUI, use write-tui instead.

Use ONLY for code review and test write/review guidance in `packages/agent-core-v2` (the DI × Scope agent engine). Does NOT apply to the legacy `packages/agent-core` or to any other package — for those, do not load this skill. Groups the review and testing lenses used for agent-core-v2 — `slop` (single-level-of-abstraction / layered error-handling review, invoked only on explicit request) and `test` (contract-driven per-test rules for both authoring and reviewing tests). Apply the sub-skill that matches the task; do not apply `slop` unprompted.

Audit all git worktrees in the current project. Use when the user asks about worktree status, which branches are merged, which have uncommitted changes, or which worktrees can be safely cleaned up.

Translate and sync bilingual user documentation between docs/zh/ and docs/en/ following the source-of-truth rules in docs/AGENTS.md.

Use after a release succeeds, when maintainers need to sync apps/pythinker-code/CHANGELOG.md into docs/en/release-notes/changelog.md and docs/zh/release-notes/changelog.md, then open a PR on a dedicated branch.

Use when generating changesets in the pythinker-code repository, including package bump selection, internal package and CLI bundle handling, bump levels, major confirmation, and English changelog wording.

Use when developing in packages/agent-core-v2 (the DI × Scope agent engine) — adding or modifying a domain Service, choosing a LifecycleScope, wiring DI dependencies, splitting a domain across scopes, owning or migrating a config section, gating behavior behind an experimental flag, raising coded errors, working on the permission system, writing DI/Scope tests, porting business logic from agent-core (v1) to v2, triaging a main-branch commit against v2, or exposing a v2 domain over server-v2 while keeping the /api/v1 wire contract compatible with released clients. Self-contained guide organized by development stage (orient → design → implement → test → verify) plus align workflows for v1→v2 migration, main-branch commit triage, and server-v2 wire exposure; each file carries the rules, examples, and red lines for its step.

Use before merging a pythinker-code release PR to preview the user-facing CLI changelog in Chinese. Reads the changelog that changesets pre-generated in the release PR, then reuses sync-changelog's strip / classify / translate logic to render a Chinese preview. Writes no files.

Use when writing or modifying the pythinker-code terminal UI in apps/pythinker-code/src/tui — components, dialogs/selectors, slash commands, themes, streaming render, or the PythinkerTUI controllers. Covers the architecture, where new features go, test placement, the theme system mechanics, and the dialog interaction/visual spec (DESIGN.md).

Remove AI writing patterns from prose. Use when drafting, editing, or reviewing text to eliminate predictable AI tells.

Update Pythinker Code CLI user documentation after meaningful code changes that affect product behavior or user experience.