Top Agent Skills

Applies safe Home Assistant rules for automations, templates, integrations, entity behavior, startup states, and validation.

Routes ambiguous review or planning to one leaf workflow. Do not use for a clear code, security, UI, architecture, or migration review.

Routes ambiguous security work to one leaf skill. Do not use when a specific security review or fix is already clear.

Analyzes repeated agent failures or noisy routing and proposes evidence-backed changes to instructions, skills, gates, or runbooks.

Use only when simplicity, assumption checks, dead-code avoidance, or overengineering resistance is requested. Do not use by default.

Fixes one security finding with the smallest safe patch, regression coverage, and verification.

Validates rendered UI with browser or Playwright screenshots after implementation, redesign, responsive changes, or visual regressions.

Reviews authorized diffs for auth, input, filesystem, network, secrets, parsers, injection, CI/CD, and supply-chain regressions.

Runs read-only parallel review of a PR, branch, commit, or diff across bugs, security, tests, maintainability, performance, and UI.

Merges agent or review outputs into one deduplicated, evidence-linked, severity-ranked actionable report.

Extracts tokens, typography, spacing, component states, assets, layout, responsive rules, and interactions from a UI reference.

Triages CVEs and advisories for affected versions, reachability, exploitability, upgrades, and validation.

Checks desktop, tablet, and mobile UI for overflow, clipping, navigation, grid, canvas, and breakpoint regressions.

Reviews parsers, deserialization, uploads, archives, YAML/JSON/XML/pickle, paths, templates, SSRF, and unsafe loaders.

Checks how well a Linear cycle is prepared. Reports per-person load in working days against available days, tickets with no estimate, tickets nobody is assigned to, oversized tickets that need splitting, work that did not finish last cycle, on-call rotation cost, and how groomed the backlog behind the cycle is. Invoke when the user says "cyclotic", "cyclotic prep", "cyclotic prep next", "cyclotic review", "cyclotic init", "cyclotic configure", "cyclotic for" a person's name, "cyclotic show cards", "cyclotic list tickets", "cyclotic explain" a person's name, or adds "-v" or "verbose" to any of those. Also invoke when the user asks whether a cycle or sprint is ready, who is over or under capacity, what carried over from last cycle, which tickets still need estimates, how the backlog looks going into planning, what is in the cycle and at what sizes, or how one person's load adds up. Read-only against Linear.

Audits source code for observability gaps — missing telemetry, poor observability practices, and code structure that resists instrumentation — then emits a ranked, bounded finding list. Invoke when the user says "observablip this", "observablip `pkg/foo`", "audit observability", "review telemetry", "find missing spans", "audit o11y on this PR", "review my logging", or "is this instrumented well enough?". Read-only; never edits files.

当要用测试先行的方式落地一段行为改动时使用——如"用 TDD 实现这个功能、先写测试再写实现、红绿循环推进、修 bug 先写复现测试"。在约定 seam 上一次一个行为走红→绿→验证，并当场把命令与输出落盘成可核对的执行记录。composable 层能力单元，通常由 execute-task 在每个任务内调用。不要用于：给已写完的实现事后补测试、只跑测试不改代码、纯定位 bug 不改行为、代码评审、任务拆分。

当用户已有确认过的技术设计（理想来自 make-design），要在编码前把它拆成可独立验收、带依赖与验证方式的开发任务清单时使用——如"拆任务、把技术方案拆成开发任务、生成 tasks、列实现任务清单、把设计落地成可执行任务"。不要用于：技术方案还没定（先 make-design）、行为还没钉死（先 write-spec）、想法还模糊（先 refine-idea）、写具体实现代码或逐行施工单、调试、代码评审。

当用户想测试或复盘某个 skill 的实际执行效果时使用——如“测一下这个 skill”“看看 agent 是否按 skill 执行”“生成 skill 覆盖率或溯源报告”。在隔离沙箱中发起一次 headless 盲测，逐步骤溯源并产出中文复盘报告。不要用于编写新 skill、调试业务代码、代码审查，或复盘当前会话已经发生的执行。

在要求写结构化的 spec、规格文档、行为规格或验收标准时使用。

当用户已有确认过的开发任务清单（理想来自 split-task），要把它逐个落地成实现 + 测试 + 提交，并经验收确认真的做完时使用——如"执行任务、把 tasks 做掉、按任务清单开始编码、实现这些任务、推进开发"。不要用于：任务还没拆（先 split-task）、技术方案没定（先 make-design）、行为没钉死（先 write-spec）、想法还模糊（先 refine-idea）、只做单个改动的红绿闭环（那是 tdd）、只做一次代码审查（那是 review-changes）、单纯调试某个 bug、代码评审。

当一段开发完成，要给当前分支 / worktree 收尾时使用——如"收尾、把这个分支收掉、开发完了怎么处理、合并还是留着"。通常由 execute-task 执行完后调用。先只读预检状态，再清除本次开发遗留的调试代码、跑最终测试，然后给出合并/本地保留/创建 PR/丢弃选项；提交、合并、推送、删除与移除工作树都交用户拍板。不要用于：开发还没完、建立工作区（那是 setup-worktree）。

当一段改动已经写完、要在收尾或合并前对它做一次独立审查时使用——如"审一遍这条分支、review 这次改动、这批代码有没有问题、帮我把关再合"。先把 BASE..HEAD 生成一份审查包一次读完，再按 correctness / readability / architecture / security / performance 五轴加测试质量逐项判定，输出带 file:line 的 Critical / Important / Minor 分级 findings。composable 层能力单元，通常由 execute-task 在整体验收时调用。不要用于：改动还没写完、只想跑测试、要的是动手修复而不是审查、评审需求或技术方案本身。

把一件用户自己答不出来的事，变成一份交给别人填的问卷（Markdown 文档），可异步发出也可开会一起填。只访谈"发送"本身——发给谁、要拿回什么——问题则对准收件人知道而用户不知道的那段缺口。

对一个软件项目或源码仓库进行全面调研，输出一份结构化的中文调研报告，让对项目不熟悉的人能够同时理解"它做什么"和"它怎么实现"。当用户说"调研这个项目 / 分析这个代码库 / 给我一份项目分析报告 / 我要全面理解这个项目 / 帮我看看这个仓库 / onboarding 一下 / 这个项目的整体架构是什么 / 给我梳理下这个源码"等等，或者把一个不熟悉的代码目录交给你并希望你给出全局认识时，必须使用本 skill。即使用户没有显式说"调研报告"，只要意图是"帮我搞懂一个完整的代码库 / 项目"，就应当触发。但本 skill 仅针对"全局理解 / 架构调研 / onboarding"场景：若用户只是要做 code review、定位某个 bug、评审某处具体实现、做性能或安全诊断，不要触发本 skill。

Use for writing, reviewing, debugging, testing, or diagnosing Python Bayesian models built directly with PyMC, including Model, coords/dims, Data, random variables, potentials, posterior sampling, prior/posterior predictive checks, and InferenceData output. Trigger on model geometry, shape errors, divergences, sampler choice, mutable prediction data, and probabilistic validation. Do not use for Bambi formula models, NumPyro/JAX programs, ArviZ-only analysis of existing draws, deterministic optimization, or general statistics without PyMC code.

Use for writing, reviewing, debugging, or testing Python terminal presentation built with Rich, including Console streams, Text and markup safety, tables, trees, panels, progress, status, Live displays, render protocols, and deterministic output capture. Do not use for CLI argument parsing, structured logging design, browser UI, or machine-readable protocol output that must remain plain.

Use for writing, reviewing, debugging, testing, or optimizing Python CVXPY optimization models. Trigger on Variable, Parameter, Expression, Constraint, Objective, Problem, DCP, DPP, DGP, DQCP, solver selection/status, dual values, mixed-integer, cone, or repeated parametric solves. Do not use for scipy.optimize-only, PyMC inference, symbolic algebra without optimization, or hand-written solver implementations.

Use for writing, reviewing, debugging, or testing Python code that inspects, edits, extracts, validates, preserves, or generates Excel .xlsx or .xlsm workbooks. Trigger on workbook contracts, formulas and cached values, Excel Tables, defined names, OOXML parts, types and precision, macros, charts, hidden sheets, external links, and semantic workbook verification. Do not use for CSV-only work, dataframe computation with no workbook boundary, Excel UI automation, recalculation, connection refresh, or macro execution.

Use for writing, reviewing, debugging, testing, or analyzing Python SimPy discrete-event simulations. Trigger on Environment, Event, Process, timeout, Resource, PriorityResource, PreemptiveResource, Container, Store, queues, interrupts, simulation clocks, replications, or SimPy monitoring. Do not use for asyncio services, wall-clock schedulers, continuous ODE solvers, or Monte Carlo code without an event-process model.

Use for writing, reviewing, debugging, testing, or optimizing Python SymPy symbolic mathematics. Trigger on Symbol, assumptions, Expr, Eq, solve/solveset, simplify, factor, expand, calculus, matrices, exact arithmetic, lambdify, code generation, or symbolic-to-numeric conversion. Do not use for NumPy-only arrays, mpmath-only arbitrary-precision numerics, CVXPY optimization models, or parsing untrusted mathematical text.

Use for writing, reviewing, debugging, or testing Python command-line interfaces built with Typer, including typed arguments and options, command groups, callbacks, contexts, exit behavior, help, and CliRunner tests. Do not use merely for terminal styling, arbitrary business logic, a Click-only CLI, shell scripts, or invoking an existing command.

Use for writing, reviewing, debugging, testing, or validating Python mpmath arbitrary-precision numerical code. Trigger on mpf, mpc, mp.dps, workdps, interval arithmetic, high-precision quadrature, root finding, special functions, matrices, inverse transforms, or precision/convergence failures. Do not use for ordinary NumPy vectorization, SymPy symbolic manipulation, decimal currency arithmetic, or machine-float code with no precision requirement.

Use for writing, reviewing, debugging, or testing Python JSON serialization and deserialization with orjson, including bytes/text boundaries, datetimes, dataclasses, NumPy, custom default handlers, option flags, strictness, and web/file integration. Do not use for JSON Schema validation, format-preserving JSON edits, streaming I/O frameworks, or choosing a JSON library when orjson is not requested or present.

Write, review, debug, or test Python Xarray workflows for labeled N-dimensional DataArray and Dataset operations, including coordinates, alignment, indexing, groupby, resample, rolling, weighted reduction, Dask-backed execution, and NetCDF/Zarr I/O.

Create, review, debug, test, or reproduce Python Jupyter notebooks by inspecting format, executing cells top-to-bottom in a clean kernel, and verifying outputs.

Write, debug, and test NumPyro probabilistic programs on JAX with correct shapes, PRNG keys, and inference choice.

Write, review, debug, or test Python code that parses, inspects, transforms, builds, qualifies, optimizes, formats, or transpiles SQL with SQLGlot.

Produces NetworkX code with explicit graph kind, node identity, edge multiplicity, direction, attribute schema, weight semantics, and algorithm preconditions, including testing.

Provides a structured methodology for solving nontrivial, ambiguous problems by framing outcomes, selecting evidence, routing specialists, choosing options, and verifying results.

Write, review, debug, test, or optimize Python code using the rustworkx graph library, with explicit handling of graph kind, index lifecycle, payload semantics, and algorithm result mapping.

Use for writing, reviewing, debugging, or testing Python Streamlit apps, especially rerun behavior, widget identity and callbacks, session_state, cache_data/cache_resource, forms, fragments, containers, multipage navigation, uploads/downloads, and Streamlit-hosted chart/table interaction. Do not use for standalone Plotly/Altair figure design, generic backend services, Dash apps, or deployment configuration without app code.

---

Use for writing, reviewing, debugging, migrating, or testing SQLAlchemy 2.x Core or ORM code involving Engine, Connection, Session, mapped models, select statements, transactions, pooling, results, loading, or AsyncSession. Do not use for raw database SQL with no SQLAlchemy boundary, Alembic migration design, DuckDB relations, or database administration.

Use for writing, reviewing, debugging, or testing publication-quality display tables in Python with Great Tables, including GT construction, stub and row groups, headers and spanners, labels, numeric/date formatting, targeted styles, footnotes/source notes, HTML/LaTeX/image export, and render verification. Do not use for dataframe computation, interactive data grids, charts, or plain console tables.

Use for designing, creating, reviewing, or packaging GitHub Copilot and Agent Plugins for Visual Studio Code, including plugin.json, portable skills, MCP components, client-specific agents, commands, and hooks. Do not use for a single standalone skill, ordinary VS Code extensions, or installing an unreviewed plugin.

Use for designing or reviewing resilient asynchronous HTTP call paths that combine HTTPX, Tenacity, and asyncio: client lifetime, time budgets, retry eligibility, backoff, concurrency, cancellation, and idempotency. Do not use for generic HTTPX, retry, or asyncio questions that do not cross these boundaries.

Creates, reviews, debugs, and modernizes Python project structure with deterministic tooling including pyproject.toml, uv, Ruff, Pyright, and pytest.

Use for writing, reviewing, debugging, migrating, or testing Python application configuration built with pydantic-settings. Trigger for BaseSettings, SettingsConfigDict, environment names, dotenv, secrets directories, nested settings, CLI sources, custom source precedence, and secret-safe startup configuration. Do not use for ordinary Pydantic model validation, direct os.environ access in a small script, or external secret manager administration.

Use when FastAPI request, dependency, response, or OpenAPI behavior interacts with Pydantic v2 models, validation, aliases, serialization, generics, or error contracts. Do not use for standalone FastAPI routing or standalone Pydantic models with no ASGI boundary.

Create, review, and debug GitHub Copilot reusable prompt files and slash commands in Visual Studio Code.

Create and maintain GitHub Copilot custom agents in Visual Studio Code with defined roles, tool restrictions, model selection, subagent permissions, and handoffs.

Use when symbolic mathematics must cross into NumPy vector evaluation or SciPy numerical algorithms: lambdify contracts, domains, dtypes, parameters, residuals, tolerances, and symbolic-versus-numeric verification. Do not use for work confined entirely to one of those libraries.

Sync main, rebase active worktrees, and clean up merged branches safely.

Run interactive design reasoning and create .pen files using Pencil.

Refine a ticket interactively until it is ready for planning.

> **Client dispatch**: In Codex, read `codex-runtime` and `maintain/codex.md`, execute that native procedure, and do not continue into the Claude procedure below.

Analyze a codebase with specialized agents and propose refactoring tickets.

Configure cenci's neutral project core and generate Claude/Codex adapters.

Address PR review comments by fetching, evaluating, fixing, replying, pushing, and re-requesting review.