Top Agent Skills

Code review guidelines covering code quality, security, and best practices.

Review UI code for Web Interface Guidelines compliance. Use when asked to "review my UI", "check accessibility", "audit design", "review UX", or "check my site against best practices".

Multiplayer game development principles. Architecture, networking, synchronization.

Use to build Cell's data and code deposition plan and the Data and Code Availability statement that lives inside STAR Methods Resource Availability — approved repositories, accessions/DOIs at submission, and Cell's three-bullet availability format with Mendeley Data as Elsevier's default.

Use when planning an ASE (IEEE/ACM Automated Software Engineering) research-track campaign backward from the deadline, through abstract registration, the double-anonymous submission, the early-rejection gate, rebuttal, the criteria-bound revision round, artifact evaluation, and the camera-ready in both IEEE Xplore and the ACM Digital Library.

Use when planning an ESEC/FSE project timeline from venue fit through paper registration, submission, the journal-style Major Revision round, artifact evaluation, PACMSE camera-ready, and presentation, with backward-planning offsets for an empirical-SE paper and honest handling of the single-annual-deadline cycle and cycle-hopping.

RSS Workflow

Use to lock the single narrative arc before drafting — converts a set of correct results into one Cell-shaped story that runs hypothesis → mechanism → significance, not a list of experiments.

Use when auditing an ATC (ACM SIGOPS Annual Technical Conference, formerly USENIX ATC) submission for HotCRP readiness — the paired two-page extended abstract plus full paper, the two-column 12/6-page budget, the double-blind anonymity sweep, ACM Open Access publication, and desk-reject triage before the early-June AoE cutoff.

Use when auditing an ACM CHI Papers submission for PCS readiness, covering the September full-paper deadline, the anonymized single-column template, word-count norms instead of page limits, subcommittee designation, supplementary and video upload, anonymization of external links, and CHI's desk-reject triage before upload.

Use when planning a CSCW submission timeline end to end — the PACMHCI journal model, the retired fixed cycles versus the rolling 2027+ pathway, Revise-and-Resubmit rounds that span months, and back-planning so an acceptance lands before the conference-year presentation cutoff.

Use when running an ECCV campaign end to end — the even-year calendar from February registration to the September conference, the retargeting triangle to CVPR and ICCV seen from the ECCV seat, where the 2026 cycle stands today, and backward planning a 2028 submission from the March deadline.

Use when planning an HPCA project timeline from venue fit through the two-step July registration and paper gate, the autumn review wait, the single rebuttal/revision window, notification, IEEE camera-ready, artifact evaluation, and the February/March talk, with backward-planning offsets for a hardware-evaluated paper.

Use when planning an ICDT (International Conference on Database Theory) campaign end to end, running the two-submission-cycle calendar backward from a chosen cycle deadline through abstract registration, the first-cycle revision round, LIPIcs camera-ready, and presentation at the co-located EDBT/ICDT event.

Use when auditing an ACM IMC submission for HotCRP readiness, covering the paper-registration step, the acmart template with BBL upload, the full/short page limits, double-blind anonymity including vantage-point details, the mandatory Ethics section, the artifact-availability declaration, cycle choice, and desk-reject triage before the AoE cutoff.

Use when deciding which jama-* sub-skill to invoke next, or when sequencing a clinical manuscript from scope check through revision for JAMA (Journal of the American Medical Association). Routes — does not replace — the specialized skills.

Use to convert references to NEJM's Vancouver / ICMJE numbered style — numbered in order of appearance, limited author lists then et al., NLM journal abbreviations, and a capped reference count. Late-stage style pass.

Use when planning a PLDI campaign across its annual clock — backward-planning from the November deadline through winter reviewing, the February response window, March notification, post-acceptance artifact evaluation, PACMPL production, and the June conference, with owners for each deliverable.

Use when deciding which pnas-* sub-skill to invoke next, or when sequencing a manuscript from significance test through reviewer rebuttal for PNAS (Proceedings of the National Academy of Sciences). Routes — it does not replace — the specialized skills.

Use when planning an ACM SoCC project timeline from venue fit through the two-round abstract+paper deadlines, the rebuttal, notification, camera-ready, and presentation, with backward-planning offsets for a cloud-systems measurement paper and honest handling of the two-rounds-per-year cadence and the no-cross-round-resubmission rule.

Use when planning a UIST cycle end to end — the late-March abstract and paper deadlines, the ten-week build-freeze before video production, the rebuttal window, conditional acceptance, the July camera-ready, adjunct-track parallel lanes, and the November conference — with owners and risk buffers.

Use when designing or auditing experiments for an ACL paper, covering tuned LLM baselines, multi-dataset and multilingual evaluation, statistical significance and variance, human evaluation with agreement reporting, contamination and prompt-sensitivity controls, ablations, and error-analysis expectations in NLP reviewing.

将文本分割成指定大小的块，保持语义完整性。适用于长文本批处理、将文本分割为可处理的片段

编排和协调大情节点与详细情节点的一键生成工作流。适用于长篇故事的结构化分析、需要模块化智能体协作的复杂任务

从思想性、艺术性、观赏性三维度评估影视剧本并打分。适用于剧本开发质量评估、修改方向确定、项目立项前审查

Score Analyzer

阅读理解小说文本，总结成流畅的故事大纲。适用于小说初筛选、生成500-800字故事大纲

分析故事题材类型，提炼创意元素与故事特色。适用于识别题材定位、提炼创意、分析市场受众

分析故事人物关系，识别类型、特点及发展变化。适用于深度理解人物关系网络、分析关系对情节推动作用、为情节设计提供关系支撑

Install, initialize, verify, and troubleshoot RTK (Rust Token Killer) for AI coding agents. Use when you need to reduce shell-command token output, confirm that the correct `rtk` binary is installed, choose between Homebrew, install.sh, or Cargo installation, wire `rtk init` for Claude Code, Codex, Gemini CLI, Cursor, Copilot, Windsurf, Cline, or OpenCode, or use compact wrappers such as `rtk git status`, `rtk read`, `rtk grep`, `rtk test`, `rtk lint`, and `rtk gain`. Triggers on: rtk, rust token killer, token saver cli, rtk init, rtk gain, codex rtk, gemini rtk, opencode rtk, claude hook token reduction.

Drive Soup (`soup-cli`), a CLI-first tool for fine-tuning and post-training LLMs with one YAML config and one command — SFT, DPO/GRPO/ORPO/SimPO/KTO, QLoRA/DoRA/LoRA+, layer streaming for 4-8 GB GPUs, eval-gated training, and serving. Use when the user wants to `soup init`/`soup train` a model, pick a training method or quantization scheme, estimate cost/memory before training, fine-tune on a small local GPU, migrate a config from Axolotl/LLaMA-Factory/Unsloth, or serve/merge/push a trained adapter. Triggers on: "soup-cli", "soup train", "soup init", "fine-tune an LLM locally", "QLoRA on a laptop GPU", "layer streaming", "soup advise", "soup autopilot", "DPO/GRPO/ORPO training", "merge LoRA adapter".

Routing-first Fabric operator skill for reusable named AI transforms over stdin, files, transcripts, notes, logs, and cleaned web text. Use when the user wants Fabric patterns, custom pattern packs, shell-pipe composition, or `fabric --serve` workflows — not generic one-off chat prompting, repo-aware coding, or fully deterministic automation.

Fast, accurate code search for AI agents using ~98% fewer tokens than grep+read. Indexes any local or remote repository in under a second (~250ms on CPU, no GPU or API key needed). Supports natural-language and symbol queries, semantic similar-code discovery, and MCP server integration for Claude Code, Codex, Cursor, and OpenCode. Python library available for programmatic use. Triggers on: semble, code search, semantic code search, semble search, token-efficient search, find code, code search mcp, agent code search, semble find-related, semble savings.

Automatically rig 3D models with UniRig (VAST-AI-Research, SIGGRAPH'25) — predict a skeleton, predict skinning weights, and merge the rig back onto the original mesh. Use when the user wants auto-rigging for .obj/.fbx/.glb/.gltf/.dae/.vrm assets, a skeleton or skin weights for a character or creature, a UniRig environment prepared on a CUDA machine, batch rigging of a model directory, or an honest comparison between UniRig, SkinTokens, Tripo, Mixamo, AccuRig, and Blender Rigify. Triggers on: unirig, auto rig, auto-rigging, 3D rigging, skeleton prediction, skinning weights, rig a character, armature generation, rigged glb, rigged fbx, bone weights.

Design domain-specific agent teams, define specialized agents, and generate the skills they use. Use when you need to decompose a complex project into coordinated multi-agent teams, choose the right architecture pattern (pipeline, fan-out/fan-in, expert pool, producer-reviewer, supervisor, hierarchical delegation), generate .claude/agents/ and .claude/skills/ files, or validate and iterate on generated harnesses. Triggers on: harness, build a harness, design agent team, agent team architecture, multi-agent skill generation, set up harness, harness engineering, domain agent team, harness for this project.

Turn a weak/cheap "Flash" model into a "Pro" performer by wrapping HKUDS UpSkill — captures agent session failures, has a strong Teacher model analyze them and draft a skill, then validates it against the weak Student model in a closed Ralph Loop (up to 3 rounds) before storing it for automatic reuse. Use when the user wants to install UpSkill, run `/upskill-init`, `/upskill-configure`, `/upskill-build`, `/upskill-run`, `/upskill-list`, `/upskill-status`, `/upskill-mode`, `/upskill-model`, `/upskill-remove`, or `/upskill-uninstall`, wants a cheap model to perform closer to a Pro model without switching, or wants a good session (success or failure) distilled into a validated skill. Triggers on: upskill, up-skill, flash to pro, teacher student distillation, ralph loop skill validation, distill agent failures into skills. Routes skill-quality ratcheting to `skill-autoresearch`, scaffolding to `write-a-skill`, and spec-compliance rewrites to `skill-standardization`.

Create or refresh hierarchical AGENTS.md documentation for Claude Code, Codex/OMX, Gemini, and Antigravity/OMA projects, preserving manual notes while excluding runtime state such as root .omc, .omx, .survey, .codex, and generated build folders.

Drive Graphify from its CLI to build, refresh, query, export, and serve a durable code/corpus knowledge graph. Use when the user wants `.graphify/GRAPH_REPORT.md`, `graph.json`, `graph.html`, `graphify update`/`summary`/`query`/`path`/`explain`/`tree`, change-aware review context, git-hook or watch-based refresh, a stdio MCP graph server, or an install into jeo, jeopi, gjc, opencode, Claude, Codex, or Gemini. Also covers the honest structural fallback when native extraction is empty or misleading. Route simple locate/reference work to `codebase-search`, narrative knowledge-base work to `llm-wiki`, and project-memory handoff to `opencontext`. Triggers on: graphify, graphify update, graphify query, knowledge graph CLI, GRAPH_REPORT.md, graph.json, codebase graph, graph refresh, graphify install, graphify serve, review context, affected flows.

Free offline desktop video/image compression (Tauri+React) — batch compress, trim/split, convert formats, embed subtitles. Install: brew install --cask codeforreal1/tap/compresso

Install and route through OpenSpace, the skill management layer for AI agents, so a host agent can retrieve/rank/load the right SKILL.md out of this jeo-skills catalog (~150 installed skills), then evaluate skill quality from real execution evidence and evolve skills via FIX/DERIVED/CAPTURED updates. Covers install-as-skill-finder, retrieve-a-skill, evaluate-quality, evolve-skills, and local-first hub share/import. Triggers on: openspace, skill finder, skill retrieval, find the right skill, rank skills, skill discovery, skill quality, evolve skill, FIX DERIVED CAPTURED, skill hub, openspace-mcp, DiscoverSkills, skill-discovery, delegate-task.

Exact rendered-UI feedback router → choose copy-paste review, watch-loop sync, self-driving critique, or platform setup. MCP: npx add-mcp "npx -y agentation-mcp server"

Integrate, customize, and contribute to react-bits (github.com/DavidHDev/react-bits) — the largest and most creative library of animated React components. It covers Vite, Tailwind CSS v4, Three.js/Fiber, GSAP, and Framer Motion integrations. Use when the user asks about react-bits, animated React components, jsrepo registry, or contributing new animated components to the react-bits repository.

Install, configure, and troubleshoot Citedy's game-sounds feedback audio for Claude Code and supported CLI environments. Use when a user wants coding-agent event sounds, sound-pack rotation, volume or event toggles, playback checks, custom packs, or the game-sounds CLI/plugin. Triggers on: game-sounds, coding sounds, Claude hook sounds, task-complete sound, sound pack rotation, or @citedy/game-sounds.

Routing-first visual approval gate for AI agent plans, markdown specs, and diffs. Use when a human needs to review a concrete plan before execution, inspect a targeted diff in a browser, mark up a spec/PRD/architecture note, or set up the review loop on Claude Code, Gemini CLI, Codex CLI, or OpenCode. Route planning/spec creation to `task-planning` or `ralph`, broad PR-policy review to `code-review`, rendered-UI critique to `agentation`, and fresh-session browser verification to `browser-harness`.

Operate Firebase from the terminal with `firebase-tools`: install/auth the CLI, bootstrap `firebase.json` / `.firebaserc`, run the Emulator Suite, deploy Hosting / Functions / rules / App Hosting, manage preview channels, and handle Firebase admin tasks like auth import/export, Remote Config, App Distribution, and Extensions. Use when the job is Firebase platform/project operation through the CLI. Triggers on: firebase deploy, firebase init, firebase emulators, firebase hosting, firebase functions, firebase firestore, firebase database, firebase auth import, firebase remote config, firebase app distribution, firebase extensions, firebase apphosting, firebase dataconnect, firebase cli, firebase-tools, deploy firebase, firebase preview channel, firebase login, firebase use, firebase target apply. Route backend AI workflow orchestration to `genkit` and direct in-app SDK integration to `genkit` (`client-ai-logic` mode).

Define or refactor a shared frontend UI system by establishing token governance, visual-language rules, primitive naming, and cross-product consistency before polishing individual screens.

Operate Vercel deployments including preview deploys, production deploys, staged promote flows, alias/domain management, environment variable sync, and rollback response.

Hunt Client-Side Path Traversal vulnerabilities where attacker-controlled input is concatenated into the path of a fetch() or XHR request, enabling redirection and chaining to XSS or data exfiltration.

Routes authentication and authorization testing efforts by identifying the primary attack surface — login mechanics, object authorization, browser trust boundaries, or identity protocols such as JWT/OAuth/SAML — before selecting a deeper skill.

Formats all confirmed pentest findings from findings.json into copy-pasteable GitHub issue markdown blocks, following the AppSec reporting guide template.

Inspects a skill's SKILL.md and its observations/runs.md log, identifies failure patterns, and proposes a targeted amendment to improve the skill. Trigger on: "improve this skill", "fix this skill", "update this skill", "why does X keep failing", "this skill is wrong", "add this to the skill", or automatically when observations/<skill-name>/runs.md contains 3 or more failure entries. Outputs the amendment as a diff the user can review before applying. Records the amendment rationale in observations/<skill-name>/runs.md after user confirmation.

Deep API security assessment beyond surface scanning. Covers the full OWASP API Security Top 10 (2023): Broken Object Level Authorization (BOLA / IDOR), Broken Authentication, Broken Object Property Level Authorization (mass assignment + excessive data exposure), Unrestricted Resource Consumption, Broken Function Level Authorization (BFLA / vertical privilege escalation), Unrestricted Access to Sensitive Business Flows, Server-Side Request Forgery via API parameters, Security Misconfiguration, Improper Inventory Management (shadow/zombie/deprecated endpoints, v1/v2 drift), and Unsafe Consumption of third-party APIs. Works across REST, GraphQL, gRPC, SOAP, and MCP servers. Discovers APIs from OpenAPI/Swagger specs, GraphQL introspection, gRPC reflection, .well-known endpoints, JS bundles, and traffic capture. Uses kiterunner, ffuf, schemathesis, restler-fuzzer, openapi-fuzzer, graphql-cop, clairvoyance, batchql, inql, jwt_tool, postman, mitmproxy, and manual http(action="request", ...) payloads. Every techniqu

Post-exploitation workflow. Covers privilege escalation (Linux SUID/sudo/kernel, Windows UAC/service/token), persistence assessment, local enumeration, credential harvesting, and pivot preparation. Structured workflows for Linux and Windows targets using impacket, netexec, john, linpeas/winpeas, and standard Kali tools. Includes kernel exploit reference tables, GTFOBins exploitation chains, Potato attack selection, Docker/container escapes, DLL hijacking, SSH key harvesting, credential recovery from memory, and Windows token manipulation. Chains from /pentester or /credential-audit when access is obtained.

Use when the user wants to extract reusable offensive security knowledge from any source and generate a SKILL.md file. Trigger on: "distill this", "extract skill from", "turn this into a skill", "generate skill from", "convert this report/blog/book/walkthrough into a skill", or when the user pastes raw security content (bug report, pentest report, CTF writeup, blog post, ezine, book chapter) and wants it transformed into structured hunting methodology.

Entry P1 category router for reconnaissance and methodology. Use when mapping scope, discovering assets, fingerprinting technology, building endpoint inventory, and choosing the first high-value security testing path.

Application-level business logic security testing for any domain. Takes an understanding-first approach: map the intended workflows before probing them. Covers: value/quantity logic abuse (negative, zero, overflow, rounding on any numeric field), workflow and state machine bypass (skipping required steps, forcing illegal state transitions, reusing one-time tokens), trust boundary violations (BOLA horizontal/vertical, BFLA, cross-tenant access, negative ownership attacks), idempotency and replay attacks (duplicate submissions, double-spend, same-reference reuse), multi-step flow integrity (checkout, registration, approval, verification), quota and rate limit bypass, time/date manipulation, and authorization code / reference number predictability. Domain-agnostic — applies to SaaS, e-commerce, banking, gaming, social platforms, APIs, or any multi-user application with stateful workflows. Chains from /pentester; chains into /param-fuzz when boundary violations or mass assignment are confirmed.

Audits email infrastructure security by testing SPF, DKIM, DMARC, open relay, spoofing resilience, MTA-STS, TLS-RPT, and SMTP configuration using standard security tools.

Mass Assignment

Active Directory and network lateral movement assessment. Pass-the-hash, pass-the-ticket, Kerberoasting, AS-REP roasting, NTLM relay, SMB relay, WMI/WinRM/PSRemoting abuse, constrained/unconstrained delegation, RBCD, cross-trust exploitation, and pivoting. Uses impacket, netexec, enum4linux-ng, smbmap, smbclient, bloodhound-python, Responder, ntlmrelayx, mitm6, and ldap-utils. Chains from /post-exploit or /credential-audit.

Xquik X data automation API - Use REST or MCP for tweet search, user lookup, follower exports, media downloads, monitors, webhooks, giveaway draws, and confirmation-gated X actions.