Top Agent Skills

Architectural decision-making framework. Requirements analysis, trade-off evaluation, ADR documentation. Use when making architecture decisions or analyzing system design.

Persistent cross-session memory management. Enables agents to remember user preferences, project conventions, and past decisions across different sessions using a structured MEMORY.md index and topic files.

Mobile-first design thinking and decision-making for iOS and Android apps. Touch interaction, performance patterns, platform conventions. Teaches principles, not fixed values. Use when building React Native, Flutter, or native mobile apps.

Database design principles and decision-making. Schema design, indexing strategy, ORM selection, serverless databases.

SEO fundamentals, E-E-A-T, Core Web Vitals, and Google algorithm principles.

Testing patterns and principles. Unit, integration, mocking strategies.

Lint and Validate Skill

Automatic agent selection and intelligent task routing. Analyzes user requests and automatically selects the best specialist agent(s) without requiring explicit user mentions.

React and Next.js performance optimization from Vercel Engineering. Use when building React components, optimizing performance, eliminating waterfalls, reducing bundle size, reviewing code for performance issues, or implementing server/client-side optimizations.

Production deployment principles and decision-making. Safe deployment workflows, rollback strategies, and verification. Teaches thinking, not scripts.

Node.js development principles and decision-making. Framework selection, async patterns, security, and architecture. Teaches thinking, not copying.

Performance profiling principles. Measurement, analysis, and optimization techniques.

PC and console game development principles. Engine selection, platform features, optimization strategies.

Use to build PNAS's Data Availability Statement and deposition plan — mandatory deposition of data in an approved repository at submission, accession numbers/DOIs, public + archived code, and materials sharing. "Available on request" is not sufficient for primary data.

Use before any writing to stress-test whether a result clears Science's (AAAS) desk-reject filter — broad significance and general interest across disciplines. Decides Science vs Science Advances vs a specialist journal before you invest in prose.

Use when planning an ATC (ACM SIGOPS Annual Technical Conference, formerly USENIX ATC) campaign end to end — running the year backward from the early-June deadline through the two review rounds, the rebuttal, conditional-acceptance shepherding, the post-acceptance artifact evaluation, and the ACM Open Access camera-ready for the November Hong Kong conference.

Use when planning an IROS project timeline from venue fit through the spring paper deadline, the separate video deadline, the summer review silence, the June notification, the July camera-ready, IEEE Xplore publication, registration, and presentation, with backward-planning offsets for a real-robot paper on the fall IEEE/RSJ calendar.

Use when auditing a KDD submission for readiness in either cycle, covering Research vs ADS track declaration, OpenReview profile completeness for all authors, the ACM sigconf 8-content-page budget, double-blind checks, in-paper artifact references, resubmission declarations, and desk-reject triggers specific to ACM SIGKDD.

Use as the entry point for any Mind (philosophy journal) article. Routes to the right Mind sub-skill based on where you are in the lifecycle and whether the piece is an article, discussion note, book review, or critical notice. Mind is analytic philosophy — argument, not data — so the router's first job is to confirm there is a sharp thesis and a sound argument. It dispatches; it does not draft content.

Use after NEJM reviews arrive — often including a dedicated statistical reviewer and an editor letter — to triage the decision, answer statistical comments rigorously, and draft a point-by-point response that quotes each comment, the response, and the revised manuscript text. Do not run before the main text is actually revised.

Use when deciding which nejm-* sub-skill to invoke next, or when sequencing a clinical manuscript from significance test through response to reviewers for The New England Journal of Medicine. Routes — it does not replace — the specialized skills.

Use when planning an NSDI campaign across the spring and fall deadlines — sequencing abstract and paper gates, notification waits, one-shot revision windows, artifact evaluation, and the May symposium — so a networked-systems project always knows which of the two yearly gates it is really building toward.

Use to write the PNAS abstract — a single self-contained paragraph of ~250 words, quantified and accessible to a broad scientific audience. Distinguishes the abstract (what/how/found, for scientists) from the Significance Statement (why-it-matters, for everyone). Late-stage polish.

Use when planning a SODA (ACM-SIAM Symposium on Discrete Algorithms) campaign end to end — backward-planning to the July AoE deadline, SODA's seat in the theory calendar between STOC and FOCS deadlines, the September rebuttal and October decision, satellite deadlines (ALENEX, SOSA), and the January conference.

Use when planning a STOC (ACM Symposium on Theory of Computing) project calendar — backward planning to the early-November deadline, the STOC/FOCS alternating two-deadline year that theory groups schedule around, full-version and camera-ready milestones, and the June TheoryFest endpoint.

Use when designing or auditing the evaluation of an ASE (IEEE/ACM Automated Software Engineering) paper, covering real subject systems, fair runnable tool baselines, task-matched effectiveness metrics, ablations that isolate a learned component, oracle and correctness validation, contamination-aware LLM handling, and provenance for mining.

Work ZenTao bugs/tasks end to end, manage task lifecycle and hours, or read a linked story as development context: fetch details, handle the user's request, verify changes, and ask before committing or writing back to ZenTao. Supports single items and sequential batches. Use when the user references ZenTao (禅道) bugs, tasks, stories, requirements, task status, or task hours.

Summarize a contributor's Git history, a provided work log, or both into a concise, review-friendly self-evaluation for quarterly, semi-annual, or promotion cycles.

严格细致判断与评分故事文本，从市场潜力、创新属性、内容亮点维度分析质量。适用于小说初筛选、多维度评估打分

Build and maintain a persistent markdown wiki that an LLM updates on the user's behalf, usually inside an Obsidian vault or git-tracked notes repo. Use when raw sources such as web articles, papers, meeting notes, transcripts, screenshots, or past analyses need to be turned into an interlinked knowledge base with immutable source files, LLM-written wiki pages, `index.md`, `log.md`, schema rules in `AGENTS.md` or `CLAUDE.md`, source summaries, query notes, and recurring lint passes. Triggers on: llm-wiki, personal wiki, obsidian wiki, research vault, knowledge base, source ingest, persistent notes, wiki maintenance, source summaries, query filing.

Convert plans/specs into independently-grabbable vertical slice issues (HITL or AFK classification)

Operate and extend barretlee/agent-pulse, the evidence-backed AI industry intelligence system: inspect source catalog and lifecycle, collect and normalize signals, bind evidence, cluster Events, evaluate system health, generate Scout hypotheses, export the privacy-safe public site, and verify release gates. Use when the user asks to run, configure, debug, extend, or explain Agent Pulse, its collectors, Control Room, narratives, Scout, or GitHub Pages output. Triggers on: agent-pulse, Agent Pulse, evidence-backed intelligence, source catalog, signal collection, Event clustering, source audit, Scout opportunity, public export, weekly brief, or AI industry intelligence pipeline.

Initializes bug bounty hunt workspaces, logs vulnerability findings with severity and evidence, and enriches them throughout a session.

Provides a complete deep-dive into Cross-Site Scripting (XSS) with exact payloads and bypass techniques for every PortSwigger lab variant, from apprentice to expert level.

Detect and exploit Cross-Site Request Forgery vulnerabilities by testing for missing or predictable CSRF tokens, absent SameSite cookie attributes, and JSON endpoints accepting text/plain Content-Type, with payloads and bypass techniques for security testing.

Detect and exploit Server-Side Request Forgery vulnerabilities by identifying user-controlled URL parameters, testing for internal service access, cloud metadata endpoints, and file scheme reads, with bypass techniques for common filters.

Generate a NullPointer Studio styled PDF penetration test report from findings.json, producing a professional dark-themed PDF with executive summary, risk dashboard, per-finding cards, and remediation summary.

Performs a white-box source code security review structured around OWASP ASVS 5.0, mapping attack surfaces, tracing data flows, and chaining into downstream penetration testing and threat modeling skills.

Generates specific, implementable fixes for each vulnerability finding, producing code patches, configuration changes, dependency updates, and IaC fixes with before/after code and verification steps.

AI/LLM red-team assessment using the OWASP LLM Top 10 (2025) + OWASP AI Testing Guide (AITG v1, Nov 2025) frameworks, plus OWASP MCP Top 10 runtime testing for agentic/MCP targets. Tests prompt injection, jailbreaks, system prompt leakage, sensitive data extraction, excessive agency, improper output handling, model extraction, content bias, evasion, membership inference, MCP token exposure, MCP command injection, and more. Uses four tools in combination: FuzzyAI (single-turn jailbreak fuzzing), PyRIT (multi-turn orchestrated attacks), Garak (probe-based vulnerability scanning), and promptfoo (plugin-based red-team evaluation). Each tool covers different OWASP categories; running them together gives systematic coverage. Includes a conditional MCP reconnaissance phase and a post-access AI infrastructure phase (chained from /post-exploit). Produces: OWASP LLM Top 10 + AITG + MCP coverage matrix, findings per category, architecture diagram of the AI system, PoCs for confirmed exploits. Chains into /gh-export for

Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques

Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques

Comprehensive LLM security testing prompts for bias detection, data leakage, alignment testing, and adversarial prompt resistance.

Identify and exploit Insecure Direct Object Reference (IDOR) or Broken Object Level Authorization (BOLA) vulnerabilities specifically within GraphQL APIs. This skill focuses on manipulating node IDs, changing variables, and utilizing aliases to access unauthorized data.

Exploit Document Object Model (DOM) Based Cross-Site Scripting (XSS) vulnerabilities. Unlike Reflected or Stored XSS, the attack payload is executed purely on the client-side as a result of modifying the DOM environment, often without the payload ever reaching the backend server.

SQL injection occurs when untrusted user input is interpolated directly into database queries, allowing attackers to alter query logic. Detect via single-quote errors, boolean-based blind responses (AND 1=1 vs AND 1=2), time-delay payloads (SLEEP, WAITFOR), UNION column enumeration, and error messages from MySQL, Oracle, MSSQL, PostgreSQL. Tools: sqlmap, sqlbftools, Burp Suite, wfuzz with SQLi fuzz strings.

Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques

Utilize Shodan, the search engine for Internet-connected devices, to discover exposed assets, vulnerable ports, default credentials, and specific infrastructure configurations using advanced search queries (dorks).

Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques

Complete PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques

PortSwigger deep-dive with exact payloads for every lab variant including zero-day techniques

Essential fuzzing payloads: SQL injection, command injection, special characters. Curated essentials for vulnerability testing.

Execute and analyze AI Data Poisoning attacks. By subtly injecting malicious or targeted misinformation into an LLM's training or fine-tuning dataset, an attacker can covertly manipulate the model's future outputs, implant backdoors, or enforce biases without altering the model architecture.

Exploit SSRF vulnerabilities in AWS EC2-hosted applications to extract IAM credentials and User Data from the Instance Metadata Service, including techniques for bypassing basic filters against IMDSv1.

Advanced Tauri event patterns for bidirectional communication, streaming data, window-to-window messaging, and custom event handling

Anki spaced repetition learning system reference. Covers the science of SRS and SM-2 algorithm, card design principles, optimal deck settings, FSRS scheduler, study workflow, essential add-ons, custom templates, filtered decks, and AnkiConnect API.

Track, analyze, and manage music and audio files from the command line. Use when organizing playlists, converting formats, or analyzing metadata.

Chai BDD/TDD assertion library reference for JavaScript testing. Covers expect/should/assert styles, deep equality, type checks, string/array/object matchers, error assertions, chai-as-promised, chai-http for API testing, sinon-chai, and custom assertions.

Cors reference tool. Use when working with cors in devtools contexts.

Csrf reference tool. Use when working with csrf in devtools contexts.