DevOps & Infra

lennetech Bundle

Analyzes software projects to extract technology stack, architecture, features, API surface, testing strategy, UI/UX patterns, security measures, and performance optimizations. Produces structured, evidence-based reports where every claim is backed by a source code reference. Also detects how the application is started (scripts, Docker, database requirements) and enumerates all pages and views for screenshot planning. Outputs a structured report that feeds directly into SHOWCASE.md creation and screenshot automation. Activates when analyzing a project for showroom showcases, portfolio entries, project documentation, or when a user asks what a project does or how it is built. NOT for creating or publishing showcases (use creating-showcases). NOT for platform development (use generating-nest-servers).

jovermier Skill

Activate when using Hasura CLI commands in a self-hosted Docker environment, including migrations, metadata management, and console access via docker exec.

0x0pointer Skill

Deep OSINT reconnaissance using the MITRE ATT&CK Reconnaissance framework. Email harvesting with SMTP verification, subdomain takeover detection, certificate transparency mining, Shodan/Censys intelligence, Wayback Machine historical analysis, social media profiling, cloud storage enumeration, document metadata extraction, DNS history, credential leak checks, and passive infrastructure mapping. Uses theHarvester, amass, dnsrecon, fierce, dnstwist, dmitry, whatweb, wafw00f, exiftool, metagoofil, smtp-user-enum, swaks, waybackurls, subfinder, and crt.sh. Pure reconnaissance — no active exploitation. Produces: confidence-scored findings, infrastructure diagram, employee roster, email pattern confirmation, subdomain takeover candidates. Chains into /pentester for active testing.

0x0pointer Skill

SAML, enterprise SSO, SCIM, and deep JWT security testing. Covers XML signature wrapping (XSW1-8), ds:Signature stripping and comment-injection (canonicalization) attacks, signature-exclusion / unsigned-assertion acceptance, golden SAML (forged assertions from a stolen IdP signing key), IdP-initiated SSO abuse and unsolicited-response replay, SAML assertion XXE, RelayState open-redirect/injection, and audience/recipient/NotOnOrAfter validation gaps. Plus SCIM provisioning abuse: JIT auto-provisioning role injection, active=true reactivation, PATCH privilege escalation, and cross-tenant user creation. And deep JWT: alg confusion (RS256 to HS256), alg:none, kid SQL/path-traversal injection, jku/x5u header SSRF, embedded jwk header key injection, and weak-secret brute force. Uses jwt_tool, xmllint, python, and manual http payloads. Chains from /pentester or /web-exploit; into /post-exploit and /cloud-identity-federation on takeover or federated-role access.

0x0pointer Bundle

White-box source code security review structured around OWASP ASVS 5.0 (346 requirements, 17 chapters). Reads application source to build a security-aware knowledge base for downstream skills. Covers: tech stack ID, route/endpoint mapping, auth architecture, dangerous function patterns with full source-to-sink taint analysis (incl. trust-boundary crossing), SSRF, IaC review, dependency/supply-chain analysis, non-human identity (OWASP NHI Top 10), business-logic and workflow-integrity checks, ASVS compliance mapping, and LLM integration security (prompt injection, tool abuse, output handling, RAG poisoning, MCP patterns). When LLM/AI usage is detected, reviews OWASP LLM Top 10 patterns and chains into /ai-redteam for live testing. Chains into /pentester, /threat-modeling, /web-exploit, /api-security, /cloud-security, /analyze-cve, /supply-chain, /cloud-identity-federation, /business-logic, /credential-audit, and /ai-redteam for targeted, informed assessment.

marttp Skill

Use when user needs .NET Core development help. Examples: "build a .NET minimal API", "implement clean architecture in .NET", "set up AOT compilation", "configure EF Core", "build cloud-native .NET microservices"

marttp Skill

Use when user needs Spring Boot development help. Examples: "build a Spring Boot microservice", "implement Spring Security with JWT", "set up Spring Cloud Gateway", "configure reactive WebFlux", "integrate Kafka with Spring"

marttp Skill

Use when user needs Kubernetes help. Examples: "set up a production Kubernetes cluster", "configure RBAC and network policies", "implement GitOps with ArgoCD", "troubleshoot pod failures", "optimize resource usage"

ottawacloudconsulting Bundle

Run CDK validation, security scanning, build, test, and deployment. Use when the user asks to test CDK code, validate CDK configurations, run CDK checks, or deploy CDK to a dev environment. Triggers on requests like "test cdk", "validate my cdk", "run cdk checks", "deploy cdk to dev", or "/test-cdk". Handles TypeScript CDK projects with cdk.json and package.json. Do NOT use for CDK synth-only workflows, Python CDK projects, non-CDK TypeScript testing, or staging/production deployments.

artwist-polyakov Bundle

Поиск в Яндексе через Yandex Cloud Search API v2 с содержательными выдержками найденных страниц (smart snippets) — материал для ответа, а не только ссылки. Синхронный и асинхронный режимы, кэш результатов. Triggers: yandex search api, поиск в яндексе, выдача яндекса, serp яндекс, парсинг выдачи, smart snippets, смарт-сниппеты, инфоконтексты, выдержки страниц, найди в яндексе, что пишут в рунете.

0x0pointer Skill

Exploit validation and exploitation using Metasploit Framework. Runs in a dedicated Docker container (separate from Kali). Validates CVEs discovered by nuclei, nikto, or other scanners with actual exploit modules. Covers exploit selection, payload configuration, exploitation, and post-exploitation pivoting. Uses msfconsole, msfvenom, and the Metasploit module database. Chains from /pentester, /analyze-cve, or /post-exploit when exploitable CVEs are confirmed.

0x0pointer Skill

Software supply-chain and CI/CD security assessment. Covers dependency confusion (internal/private package names that resolve on public registries — extracted from package.json, requirements.txt, pom.xml, go.mod, Gemfile, .csproj), typosquatting and namespace hijacking, lockfile integrity and resolved-URL tampering, malicious install hooks (npm postinstall, pip setup.py, gem extensions), and unmaintained/abandoned-package takeover risk. Plus CI/CD pipeline review: GitHub Actions / GitLab CI / CircleCI misconfigurations — pull_request_target abuse, unpinned action SHAs, secrets leaked in logs, over-broad OIDC trust, and poisoned pipeline execution (PPE, direct and indirect). Assesses SLSA provenance gaps. White-box first: reads manifests, lockfiles, and workflow YAML from a local codebase. Uses semgrep, trufflehog, and registry probes. Chains from /codebase or /pentester; into /analyze-cve for confirmed vulnerable versions and /cloud-security when a pipeline holds cloud OIDC trust.

0x0pointer Skill

Cloud security posture assessment for AWS, Azure, and GCP. Tests IAM privilege escalation paths, public storage exposure, serverless attack surface, database exposure, logging gaps, container registry security, and cloud-specific attacks. Both authenticated (with cloud credentials) and unauthenticated (external) modes. Uses nuclei cloud templates, Prowler, ScoutSuite, manual IMDS/metadata probing, and deep AWS/Azure/GCP CLI enumeration. Produces: cloud architecture diagram, attack path map, findings per category, compliance mapping (SOC 2, PCI DSS 4.0, HIPAA, CIS), PoCs for confirmed exploits. Chains into /gh-export for issue filing.

0x0pointer Skill

Post-exploitation workflow. Covers privilege escalation (Linux SUID/sudo/kernel, Windows UAC/service/token), persistence assessment, local enumeration, credential harvesting, and pivot preparation. Structured workflows for Linux and Windows targets using impacket, netexec, john, linpeas/winpeas, and standard Kali tools. Includes kernel exploit reference tables, GTFOBins exploitation chains, Potato attack selection, Docker/container escapes, DLL hijacking, SSH key harvesting, credential recovery from memory, and Windows token manipulation. Chains from /pentester or /credential-audit when access is obtained.

rajbos Skill

Load token usage data from Azure Table Storage for faster iteration and analysis in chat conversations

coreindustries Skill

Generate or update CI/CD pipeline configuration for the current stack.

0x0pointer Bundle

Android app security assessment structured on OWASP MASVS 2.0 / MASTG. Static analysis of an APK (MobSF, jadx, apktool, dex2jar, mobsfscan): hardcoded secrets, weak/broken crypto, insecure data storage, exported activities/services/providers/receivers, android:allowBackup, cleartext traffic & network-security-config, WebView addJavascriptInterface bridges, insecure deeplinks/intent redirection, missing FLAG_SECURE, tapjacking, root/anti-Frida detection, vulnerable third-party SDKs, Firebase/cloud-config leaks. Dynamic analysis (opt-in, needs a device) via Frida/objection: SSL-pinning bypass, runtime keystore/shared-prefs/SQLite dumps, traffic capture, deeplink & IPC abuse. Chains from /pentester and /codebase; into /api-security for backend endpoints, /web-exploit for injection, /post-exploit on device RCE, /ai-redteam on an embedded LLM.

0x0pointer Skill

Container and Kubernetes security assessment. Tests container escape vectors, Docker/containerd socket exposure, K8s RBAC misconfigurations, pod security violations, exposed API servers, etcd access, service account token abuse, image layer secrets, private registry attacks, SSRF to metadata services, cross-namespace network bypass, CIS benchmarks, crypto miner detection, resource exhaustion, and admission controller gaps. Both external and internal (compromised pod) perspectives. Uses trivy, kube-bench, kubectl, nuclei, dive, amicontained, and docker-bench-security. Covers OWASP Kubernetes Top 10 and all 22 Kubernetes Goat attack scenarios.

0x0pointer Skill

Cloud-native identity federation attacks across AWS, Azure, and GCP. Covers OIDC CI/CD trust abuse (IAM role trust policies that trust token.actions.githubusercontent.com, GitLab, CircleCI, or Terraform Cloud with over-broad sub/aud conditions), workload-identity abuse (EKS IRSA, GKE Workload Identity, AKS pod-managed-identity — Kubernetes ServiceAccount token to AssumeRoleWithWebIdentity to cloud credentials), and the full SSRF to IMDSv2 to role to credential chain walked end to end. Also covers ECS/Fargate task-role metadata (169.254.170.2), Azure IMDS managed-identity token theft, GCP metadata service-account tokens, and cloud-credential pivoting from a shell (~/.aws/credentials, gcloud creds, kubeconfig, CI env, projected SA tokens). Taught as attack PATTERNS to reason from. Uses aws/az/gcloud CLIs, kubectl, curl, jwt_tool, and http probing. Chains from /pentester, /cloud-security, or /web-exploit (on a confirmed SSRF); into /post-exploit and /cloud-security once credentials are obtained.

coreindustries Skill

Deploy the application to target platform.

claude-world-director-mode-lite Skill

Audit project health across 7 dimensions (documentation, test coverage, security, code quality, dependencies, database, build/deploy) producing a scored report with prioritized fixes. Use for periodic checkups, before releases, or when the user runs /project-health-check.

u9401066-pubmed-search-mcp Bundle

Pipeline persistence — save, load, and reuse structured search plans. Triggers: pipeline, 管道, search plan, 搜尋計畫, 重複搜尋, saved search, 排程, schedule, workflow, DAG

u9401066-pubmed-search-mcp Skill

Cline harness for PubMed Search MCP. Triggers: pubmed search, literature search, unified_search, pipeline, fulltext, release checklist, Cline.

gapfdev Skill

Default deployment documentation gate for Apps Script/web-app projects. Use automatically on every deploy/redeploy task and whenever deployment URL/version references may change.

kenneth-liao Bundle

Research-driven self-upgrade pipeline for the Elle personal assistant. Fetches latest Claude Code features, audits Elle's architecture, plans upgrades, executes them, and verifies results. Use after Claude Code updates, when exploring new features, or periodically. Also use when the user says "let's modernize Elle", "evolve Elle", or "what Claude Code features are we missing".

aeyeops Bundle

Use when creating a new skill from scratch, modifying or improving an existing skill, packaging one for distribution, or measuring skill performance — running evals to test a skill, benchmarking skill performance with variance analysis, or optimizing a skill's description for better triggering accuracy. Covers SKILL.md frontmatter, progressive disclosure, bundled references, scripts and assets, and the eval, benchmark, and description-optimization pipeline. Trigger phrases include "create a skill", "improve this skill", "run evals on my skill", and "why isn't my skill triggering".

aeyeops Bundle

Use when the user asks about AWS CLI commands, writing AWS CLI scripts, querying AWS resources, managing AWS credentials, aws login, aws configure sso, assume role, or the credential chain; when driving S3, EC2, IAM, Lambda, VPC, RDS, DynamoDB, CloudWatch, or SSM from the command line; or when the question is JMESPath query syntax, --query versus --filters, CLI pagination, an aws cli waiter, output formatting, cross-account access, safe destructive commands, an S3 sync dry run, the aws cli pager blocking a script, or migrating from AWS CLI v1 to v2. Covers the AWS CLI v2 command surface only, not the AWS SDKs, not CloudFormation or Terraform authoring, and not Azure, which belongs to az-cli-operations.

aeyeops Bundle

Use when the user asks about Lima, limactl, lima.yaml, lima start, or lima shell; wants to install Lima, configure or edit a Lima VM, create a Linux VM on a Mac, spin up an Ubuntu VM, run Docker on macOS, or run Linux on Apple Silicon. Also use for lima vmType vz, vz versus qemu, host.lima.internal, socket_vmnet, shared and bridged lima networking, virtiofs and 9p mounts, writable mounts, lima port forward, limactl edit, validate and template, Rosetta for running x86 binaries, and debugging a VM that will not start. Applies whenever Lima is mentioned even without an explicit request for help, because the vz-versus-qemu, mount-type, and network-mode choices are easy to get wrong. Apple Silicon Macs only.

aeyeops Bundle

Use when implementing a data pipeline, ETL or ELT flow, or warehouse architecture in Python - SQLAlchemy 2.0 patterns such as TypeDecorator, hybrid properties and events, Pydantic integration, API-to-database flows, custom field schema evolution, incremental sync from an external system, or multi-source integration. Covers Kimball star schemas, medallion layers, slowly changing dimension handling, the dim_, fact_, and stg_ naming conventions, orchestration with dbt, Airflow, or Dagster, and testing a pipeline. Aimed at dimensional modeling with Python and PostgreSQL, not at BI tool configuration.

aeyeops Bundle

Use when adding a macOS host (macOS 26 Tahoe and later) to a self-hosted headscale mesh as a Tailscale client, or when Tailscale on macOS misbehaves: "failed to connect to local tailscale service", Tailscale.app stuck on "Starting...", `tailscale up` hanging on "joining", a blank menu-bar icon after install, or the Homebrew cask and formula fighting over the daemon. Covers the Homebrew Cask install, the NetworkExtension permission grants, `tailscale up --login-server` with a headscale preauth key, the deep-link fallback when the CLI cannot reach the daemon, headscale's numeric `--user` id pitfall, and reach verification. Not for official Tailscale onboarding, Linux or Windows clients, or headscale server install.

arcblock Skill

One-time setup that makes a repo consumable by the agentloop skills — scaffold repo-profile, create the controlled GitHub labels, scaffold the verification gate, and preflight the environment. Run this once when onboarding a new repo to the loop-engine skills. Does NOT schedule routines (that's the repo's own infra).

arcblock Skill

One-command setup/update of an agentloop FLEET on a teammate's machine or cloud — asks a few defaulted questions, then generates/reconciles the two config files (deployment.json + repos.json) and installs the schedule. LOCAL = a crontab marker-block wiring fleet/driver.ts (one row per skill; the driver fans out to every covered repo). CLOUD = one claude routine per (repo×skill) via RemoteTrigger, batch-created from the same catalog. Idempotent — re-run to upgrade. This is the SCHEDULING side that `bootstrap` (repo adoption) deliberately leaves out. Interactive — never runs unattended.

hivellm Skill

TypeScript language rules with strict mode, testing, linting, and CI/CD best practices

arcblock Skill

Interactive one-shot setup/update of a runner's repo-declared cloud routines and durable local cron jobs, driven by the consuming repo's .claude/routines/ catalog (canonical names, base crons, prompt templates). Reconciles cloud triggers via RemoteTrigger (create-or-update by canonical name, per-runner minute stagger, per-trigger sources), prints the one-time environment prerequisites that have no API (plugin-install setup script, network access, env vars), and reconciles a crontab marker block for local routines in a dedicated worktree/clone (never the shared checkout). The generic issue-sweep/pr-sweep loop is scheduled by fleet-setup, NOT here — this skill owns everything a repo declares beyond that loop. Interactive (AskUserQuestion is core) — never run unattended.

sontek Skill

Create and validate customer- or support-facing AWS/cloud infrastructure diagrams in Mermaid. Use for "draw an infra diagram", "AWS architecture diagram", cloud flows, or debugging maps. Adds AWS shapes, colors, region tinting, legends, DLQ styling, edge labels, resource checks, and PDF export. Use draw-mermaid-diagram for other diagrams.

sontek Bundle

Create and validate Mermaid flowcharts, sequence, class, ER, state, gantt, journey, timeline, mindmap, and pie diagrams. Use for "draw a Mermaid diagram", "draw a sequence/state/ER/class diagram", "make a flowchart", or a non-infrastructure flow. Use draw-infra-diagram for AWS/cloud architecture with specialized shapes and debugging composition.