AI & ML

securitytalent Bundle

Bug bounty hunting workflow and report writing expertise. USE WHEN user mentions bug bounty, vulnerability report, HackerOne, Bugcrowd, PoC creation, severity assessment, CVSS scoring, responsible disclosure, or needs help writing security reports. Provides templates and workflow guidance.

securitytalent Bundle

Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends AI capabilities with specialized knowledge, workflows, or tool integrations.

securitytalent Bundle

Perform pre-execution security audits of untrusted codebases through static analysis. Use when analyzing a codebase for potential malicious behavior, supply chain risks, or security vulnerabilities before local execution. Triggered by requests like "analyze this project for security risks", "audit this code before running", "check if this codebase is safe", or similar security review requests.

securitytalent Skill

Reconnaissance and methodology playbook. Use when mapping assets, discovering endpoints, fingerprinting technology, and building a structured testing plan for a new target.

securitytalent Bundle

Passive traffic analyzer that examines captured HTTP traffic (HAR, Caido JSON, Burp XML) to identify potential Broken Access Control (BAC) and Insecure Direct Object Reference (IDOR) vulnerabilities. USE WHEN user mentions analyze traffic, check for IDOR, BAC analysis, analyze HAR, analyze Caido, broken access control, or IDOR scan.

securitytalent Bundle

LLM prompt injection playbook. Use when testing AI/LLM applications for direct injection, indirect injection via RAG/browsing, tool abuse, data exfiltration, MCP security risks, and defense bypass techniques.

arronkler Bundle

Run a small agent swarm (3-8 workers) through Herdr for large tasks that one agent cannot hold in context — goal decomposition into an ownership-split task tree, merge queue with neutral arbitration, shared decision log, field guide memory, hidden benchmarks. Use when the user wants a swarm, fan-out implementation of a big spec, multi-agent build from a spec, or says swarm/蜂群. Built strictly on top of the herdr-dispatch skill.

arronkler Bundle

Dispatch peer coding agents through Herdr using assign, handoff, and send_message. Use when inside a Herdr pane and the user wants Claude, Codex, Pi, omp, Grok Build, Cursor, or another CLI worker spawned, tasked, collected, or followed up. Triggers include herd-dispatch, assign a worker, handoff to Codex, send_message to a pane, fan-out agents, peer review across CLIs, grok-build worker, cursor-agent model.

gh-howard Skill

在本机（8×RTX 3090 服务器）用 conda 为新项目建独立环境、安装与驱动匹配的 GPU 版 PyTorch 并验证 CUDA。每遇到一个需要 GPU 的新项目（训练/推理）时默认调用；也适用于重装 torch、排查 CUDA Error 304、确认模型是否跑在 GPU 上。

cristianmartinez Bundle

Turn an approved feature definition and solution architecture into an executable, dependency-aware delivery plan. Use after product and architecture decisions are settled to plan slices, task packets, model routing, rollout, and verification; produces planning rather than code changes or post-build assessment.

securitytalent Bundle

Detect, validate, and exploit OTP (one-time password) brute-force vulnerabilities in phone/email verification, MFA, password-reset, and transaction-confirmation flows. Use when a target issues numeric one-time codes (4-8 digits via SMS/email), when OTP verification endpoints appear unthrottled, when reviewing authentication or account-recovery code, or when assessing rate limiting on verification APIs. Produces PoC scripts, response-oracle analysis, CVSS scoring, and remediation guidance.

securitytalent Bundle

Detect, audit, and validate stack buffer overflows caused by incorrect bounds arithmetic in string formatting and memory copy operations (snprintf, swprintf, sprintf, strncpy, memcpy) writing into fixed stack buffers where the size argument is not decremented as the destination pointer advances. Use when auditing C/C++ network protocol serializers, URL/URI builders, message formatters, IPC serialization, or logging routines concatenating attacker-controlled fields. Reproduces HackerOne

securitytalent Bundle

Detect SSRF filter bypasses and URL-parsing inconsistencies caused by malformed URL syntax — triple-slash (http:///host/path), backslashes, encoded delimiters, userinfo, numeric IP forms, IPv4-mapped IPv6. Use when reviewing URL validation, hostname allowlists, SSRF protections, redirect handling, or any code that parses user-supplied URLs (curl/libcurl CURLU, WHATWG URL, Python urllib, Node, Go, Java). Reproduces and extends HackerOne

securitytalent Bundle

JSA - JavaScript Security Analyzer

securitytalent Bundle

ASN and IPv4 range reconnaissance using bgp.he.net. USE WHEN user mentions ASN lookup, find IP ranges, company IP space, BGP reconnaissance, owned IP addresses, network footprint, OR wants to discover what IP ranges a company owns. Searches bgp.he.net free-form, extracts ASNs and IPv4 prefixes.

securitytalent Bundle

Static analysis for JavaScript files targeting security vulnerabilities. USE WHEN user says 'analyze js', 'scan javascript', 'find sinks', 'js security', 'analyze these js files', OR user starts Claude in a folder with JS files and wants security analysis. Extracts URLs, paths, sources, sinks, postMessage handlers, secrets, and more.

securitytalent Bundle

OSINT Enrich

securitytalent Bundle

Subdomain enumeration with Light and Full workflows, plus intelligent target prioritization. USE WHEN user mentions subdomain enumeration, find subdomains, subdomain recon, recon, reconnaissance, quick subdomain scan, fast recon, full recon, prioritize targets, OR wants to enumerate attack surface. Light = subfinder only (fast). Full = all tools (comprehensive). Both include optional prioritized reporting.

reaperinvest Skill

Writes complete business plans with executive summary, market analysis, revenue model, and financial projections. Use when a user is starting a new venture, seeking funding, pivoting their business, or needs a structured plan to guide strategic decisions.

alphasafal Bundle

Reviews a proposed system or service architecture before implementation begins — requirements, API design, data model, storage, consistency, caching, queues/events, scaling, failure modes, security, observability, deployment, and cost. Use when evaluating a design doc, RFC, or proposed architecture for a new system/service, or when asked "does this design hold up," "what could go wrong with this architecture," or "review this system design." Do not use once implementation is already underway and the question is about the code itself (use production-code-review), or for reviewing an existing, already-built system's structure (use repo-architect).

neevcloudai Skill

Build on NeevCloud sandboxes from TypeScript or Python with the official SDKs — create sandboxes, write files, run commands and processes, expose a port to get a public preview URL, and control outbound network access. Use when writing application or agent code against NeevCloud rather than driving it from a shell.

agustafson Bundle

Run TDD as a pair of context-isolated agents - a Tester who writes failing tests and reviews adversarially, an Implementer who scaffolds interfaces and fills in behavior - through gated red-green-refactor cycles. Works in Claude Code and any Agent Skills-compatible harness. Use when the user wants pair TDD, tester/implementer or driver/navigator agents, separate test-writing and implementation agents so tests are not shaped by implementation plans, serial TDD with subagents, red-green-refactor discipline enforced by gates, or invokes /tdd-pair.

nikkiwei129 Bundle

Monitor Tibo's public Codex quota-reset signals with a local zero-model-usage prefilter, then assess and notify when a new post suggests an upcoming reset or explicitly announces a reset. Use for Codex reset early warnings, low-usage monitoring, candidate review, or setting up a 15-minute local check. Do not use for ordinary account reset dates.

reaperinvest Skill

Builds financial models for startups with revenue drivers, cost assumptions, and sensitivity analysis. Use when creating detailed financial models for fundraising or planning.

yuanhao667 Bundle

从具体产品场景和业务决策出发，分阶段协助完成评测目标卡、覆盖矩阵与评测集、评分方法选择和可执行Rubric。用户要开展模型、Prompt、Agent或Skill的选型、上线验收、版本迭代评测，或希望把模糊的“测一下”变成可执行评测方案时使用；不负责试标校准、正式批量评分或最终评测报告。

yuanhao667 Bundle

当用户需要根据 GEO 关键词、公司家底表、客户档案、E-E-A-T 证据、行业数据和来源清单生成中文 GEO 文章初稿、文章 Brief、三层 Prompt 或可发布 Markdown 成稿时使用。适用于“关键词到科普、测评、口碑推荐榜、选购指南、行业分析、年度盘点、采购决策文章”的实操写稿流程。

reaperinvest Skill

Plans membership site content libraries, tier structures, pricing, drip schedules, and retention strategies. Use this skill when a creator or coach wants to build recurring revenue through a membership model, needs to design tier levels, or is planning content delivery for a subscription community.

typesafe-ai Bundle

Build AI-powered software with TypeSafe: small units of AI intelligence you can use like programming primitives. Its System One models, including Jev, turn natural language and application state into typed judgments and probabilities that code can combine. Use when a feature needs programmable common sense, when brainstorming what AI could make possible in an app, or when an LLM prompt-and-parse step could become a structured decision. Applications include routing, ranking, extraction, verification, and interactive experiences; these are starting points, not the limits. Read live docs and cookbooks to find useful patterns and discover new combinations.

le876 Bundle

Run and monitor non-interactive local commands expected to take more than five minutes with a fresh low-effort subagent, hourly progress checkpoints, and immediate real exit-code reporting while minimizing main-thread token use. Use for long experiments, builds, analyses, training, exports, or whenever the user explicitly requests long-wait or monitor-agent execution.

talhamah56 Skill

Compact the current conversation into a single, detailed handoff message — everything that happened, why it happened, and what's left — output in a code block so it can be copy-pasted into a fresh agent session. Use when hitting context limits, switching focus, ending a work session, or partitioning a task across fresh contexts.

talhamah56 Skill

Generate a long-form Chinese interview-prep cheat sheet on a specific ML/LLM topic — formulas with derivations, from-scratch PyTorch code, comparison tables, and 25 高频面试题 (L1 必会 / L2 进阶 / L3 顶级 lab). Use when the user says '写面试 cheat sheet', '写一份 X 教程', '帮我准备 Y 面试题', '出一份 X 速查', or wants a 600-1000 line Chinese tutorial on a specific ML topic.

talhamah56 Skill

Make an AI agent run on a schedule, loop, or interval — cron, heartbeats, recurring autonomous checks. Use for "run every N minutes", "schedule a task", "run on a loop", "heartbeat". Covers external clocks (Claude Code, Codex, Pi) vs Hermes' built-in scheduler.

talhamah56 Skill

How to write effective agent skills — what to do, what not to do, anatomy, progressive disclosure, design patterns, anti-patterns, testing, security. Read this whenever a skill (Claude Skill, Agent Skill, SKILL.md) is being created, edited, reviewed, or debugged. Use when the user says "create a skill", "new skill", "update this skill", "improve a skill", "why isn't my skill triggering", or anything else involving authoring or editing SKILL.md files.

ccy123abcd Bundle

Use when you toggle VPN, agents and services by hand. One command flips the whole machine stack together — VPN, background agents, local services, model tier — from one YAML mode matrix; the watchdog repairs the current mode and never revives what you switched off (the part most setups get wrong). Use when: (1) You re-toggle the same five things by hand at every work↔game switch (2) A crash-restart must come back as the mode you are in now, not as whatever was running before it (3) Background agents should all run while you work, one or two while you game, none while you render (4) Local services should free their RAM when you need it, not when you remember (5) VPN on for work, off for low-latency gaming — and the agents must stop with it, or they ride the tunnel Python stdlib only — no pip install, no model calls, no API cost; Windows tested. Prove it first: `python templates/modes_switch.py --selftest` builds a fake stack in a temp dir and switches it end to end — your machine untouched. 中文触发:手动切工作/游戏模式太麻烦

talhamah56 Bundle

Security audit and vulnerability scanner for AI agent skills before installation. Use when: (1) evaluating a skill from an untrusted source, (2) auditing a skill directory or git repo URL for malicious code, (3) pre-install security gate for Claude Code plugins, OpenClaw skills, or Codex skills, (4) scanning Python scripts for dangerous patterns like os.system, eval, subprocess, network exfiltration, (5) detecting prompt injection in SKILL.md files, (6) checking dependency supply chain risks, (7) verifying file system access stays within skill boundaries. Triggers: "audit this skill", "is this skill safe", "scan skill for security", "check skill before install", "skill security check", "skill vulnerability scan".

talhamah56 Skill

Autonomously improve a generated paper via adversarial review (GPT-5.6-Sol xhigh when a cross-model backend is available, Claude self-review otherwise) → implement fixes → recompile, for 2 rounds. Use when user says "改论文", "improve paper", "论文润色循环", "auto improve", or wants to iteratively polish a generated paper.