Docs & Writing

conectlens Bundle

Create or refine compact technical documentation, READMEs, public docs, and contribution guides. Use for OSS-facing docs, internal docs cleanup, navigation design, converting implementation details into concise Claude-style markdown, and multilingual documentation (English + 10 WIP languages).

conectlens Skill

Explain a finance report, review KPIs, and draft investor-facing notes. This is not financial advice.

conectlens Skill

Plain-language explanation of a finance report with audience-aware framing. Analysis only — not certified advice.

conectlens Skill

Compares single-lens and workflow-based finance report explanations. This is not financial advice.

benbrastmckie Bundle

Conduct general research using web search, documentation, and codebase exploration. Invoke for general research tasks.

benbrastmckie Skill

Research talk material synthesis, design-aware planning, and presentation assembly. Invoke for slides tasks.

zhaoxuya520 Bundle

---

noorqureshi Bundle

Turn user input that reaches a shell into arbitrary OS command execution. Load when a parameter feeds a system call — ping/nslookup/host tools, file conversion (ImageMagick, ffmpeg), archive/ export, PDF/thumbnail generation, filename handling, or any "network tools" feature. Signals: output that looks like command output, a value echoed into a system utility, blind time/OOB behaviour.

noorqureshi Skill

Turn a server-side request (SSRF) into RCE by speaking the Redis protocol over gopher:// to an internal, unauthenticated Redis — write a cron job, an SSH key, or a webshell. Load when: SSRF is confirmed (URL fetch, webhook, PDF/URL preview, image proxy) AND an internal Redis/6379 (or similar line-protocol service) is reachable. Authorized targets only.

noorqureshi Skill

Assign a defensible severity to a finding — build the CVSS 3.1 vector from demonstrated impact and reconcile it with the program's own scale. Load on "what severity", "CVSS", "rate this bug", or before submitting a report. Signals: a confirmed finding needing a score, a program VRT/severity policy, a severity dispute.

noorqureshi Skill

Turn offensive findings into concrete hardening — the fix side of each vuln class, plus config baselines. Load for blue-team/remediation tasks, "how do we fix/prevent", secure config review, or writing the remediation section of a report. Signals: "harden", "remediation", "secure baseline", "prevent".

noorqureshi Skill

Structure a professional penetration-test report (engagement deliverable, not a single bug). Load at the end of a pentest, on "write the pentest report", "executive summary", "deliverable", or compiling findings for a client. Signals: engagement wrap-up, multiple findings, client report.

noorqureshi Skill

Validate a finding BEFORE you write it up — kill false positives, confirm real impact, check scope, and deduplicate. Load after a candidate bug and before reporting-bug-bounty-writeup or reporting-pentest-report. Signals: "I think I found", "is this reportable", a scanner hit, a reflected value, a 500 error, an open redirect, a CORS wildcard, "should I submit this".

noorqureshi Skill

Turn a confirmed finding into a triage-friendly bug-bounty report (HackerOne/Bugcrowd) with correct severity and clean evidence. Load when a bug is validated and needs submitting, on "write the report", "CVSS", "severity", or before disclosure. Signals: a reproduced finding, a program's VRT/severity policy.

noorqureshi Skill

Work productively with triagers after you submit — answer follow-ups, and handle duplicate, not-applicable, or severity disputes professionally. Load on "triage asked for more info", "they closed it as N/A", "dispute the severity/duplicate", or managing a report thread. Signals: a submitted report awaiting/receiving triage, a disagreement on outcome.

openharmonyinsight Bundle

为OpenHarmony C/C++提供基于UT用例的代码覆盖率报告生成，支持全量和增量覆盖率分析，需要通过 hdc 连接测试设备。Use when: (1) 用户请求为子系统/部件/模块/测试套/测试用例生成全量代码覆盖率，如果提供报告路径时,解析为--output路径； (2) 用户请求为部件/模块/测试套/测试用例生成增量代码覆盖率，需要 git diff 文件，如果提供报告路径时,解析为--output路径；注意：增量覆盖率不支持子系统级别。当需要连接 OpenHarmony 设备执行测试时激活。

zhaoxuya520 Bundle

输出测试结论 / 给上线决策时使用。适用于版本发布报告、阶段总结、缺陷分析。融合 ISTQB Test Summary Report、覆盖率分析、缺陷分布。

zhaoxuya520 Bundle

数据分析报告输出时使用。适用于业务分析报告、周报、专项分析、决策支持。融合洞察 + 建议 + 行动项。

vivy-yi Skill

指标预警处理 — 处理财务或运营指标的异常预警信号， 分析预警原因，确定是否属于真实异常并采取初步行动。 适用情形：KPI 预警触发（跌破阈值/异常波动/趋势恶化），或用户要求"调查 KPI 预警"时执行。 核心：预警分级 + 数据核实 + 原因定位 + 升级判断。

vivy-yi Skill

管理报告主流程 — 整合月度财务报告编制、业务分析整合、指标预警处理与管理报告发布。 适用情形：月度/季度管理报告编制（每月固定时间）时执行， 整合 financial-report-generation、management-commentary-writing、metric-alert-handling 和 management-report-publishing，输出完整的管理报告包。 核心：财务数据 → 业务解读 → 指标预警 → 报告编排 → 分发归档。

vivy-yi Skill

项目估值与投资决策主流程 — 整合 NPV/IRR 计算、实物期权分析、 可比公司内部参照和投资决策报告。 适用情形：CFO/投资经理评估内部项目投资（新产品线/设备采购/ 产能扩张）时执行，整合 npv-irr-calculation、real-options-analysis、 comparable-company-internal 和 investment-decision-report， 输出完整的投资决策包。 核心：假设清晰 → 估值准确 → 风险可控 → 决策有据。

vivy-yi Skill

投资决策报告生成 — 整合 DCF 估值结果、敏感性分析、 战略价值评估和可比参照，生成结构化的投资决策包， 提交 CFO/IC/董事会审批。 适用情形：完成 npv-irr-calculation、real-options-analysis 和 comparable-company-internal 后，汇总生成正式审批文件。

vivy-yi Skill

管理报告生成 — 从 ERP/BI 系统提取数据，生成月度/季度管理报告， 包括财务业绩分析、KPI 达成追踪和业务解读。 适用情形：每月结账后 [X] 天，或用户要求"生成管理报告"时执行。 核心：多系统数据提取 + 财务分析框架 + 业务洞察提炼。

vivy-yi Skill

预约定价安排（APA）管理 — 涵盖 APA 申请、监控、续期全流程。 适用情形：CFO/TP 负责人评估是否申请 APA、 监控现有 APA 执行状态、或准备 APA 续期时执行。

vivy-yi Skill

管理报告发布 — 完成管理报告的最终审阅、格式调整和分发， 确保报告按时按质送达目标受众。 适用情形：管理报告生成完成后，或用户要求"发布管理报告"时执行。 核心：审阅流程 + 格式合规检查 + 分发管理。

vivy-yi Skill

BEPS 行动 13 合规 — 按 OECD BEPS 行动计划 13 要求， 检查转让定价文档是否符合主体文档/本地文档/CbCR 的三层结构要求。 适用情形：年度同期资料准备完成后的合规自查， 或应对税务机关 BEPS 检查时执行。

vivy-yi Skill

管理报告文字解读撰写 — 撰写管理报告中的文字解读部分， 包括业绩概述、业务亮点、风险说明和下期展望。 适用情形：财务数据提取和分析完成后，或用户要求"撰写管理报告文字"时执行。 核心：数据故事化 + 业务逻辑串联 + 专业表达。

vivy-yi Skill

转让定价可比性分析 — 筛选可比公司，计算利润水平指标， 评估企业是否符合独立交易原则。 适用情形：年度同期资料准备、关联交易审核、 TP 风险评估时执行。对内有形资产销售/服务提供， 对外无形资产许可/金融服务交易。

vivy-yi Skill

转让定价主体文档（Master File）和本地文档（Local File）准备。 适用情形：年度同期资料准备时，按 OECD BEPS 行动 13 和中国税法要求， 撰写完整的转让定价文档包，包括组织架构、价值链分析、功能风险分析、 可比性分析和 TP 方法说明。

vivy-yi Skill

转让定价文档管理主流程 — 整合主体文档/本地文档/CbCR/APA 全套文档管理。 适用情形：年度转让定价文档准备时执行，整合 master-document-preparation、 comparable-analysis-tp、beps-compliance 和 apa-management， 输出完整的转让定价合规文档包。 核心：关联方清晰 → 方法选择合理 → 文档完整 → 披露合规。

coco-research Skill

Use when a project has linked documentation artifacts (PRDs, presentations, meeting notes, architecture maps) that must stay synchronized. Detects which source files changed, identifies downstream documents needing updates, reads new content, and proposes specific edits with diffs before applying. Also use when a .sync-report.md exists in the project or user says "process sync report".

coco-research Bundle

Use when starting a new project, onboarding to an existing product, or setting up a documentation ecosystem for any initiative. Scaffolds the standard document set, folder structure, project memory, and doc-sync config. Works for software products, consulting engagements, platform implementations, and governance programs.

coco-research Skill

Generate or update project documentation verified against the codebase

eugenelim Bundle

Surface the current RFC landscape at a glance — how many RFCs are in each lifecycle state, which are active, and how many findings are waiting in the candidate register. Triggers on 'rfc status', 'show rfcs', 'what rfcs are open', 'rfc dashboard', 'how many rfcs', 'rfc candidates', 'rfc report', or any request for an overview of the RFC landscape. Read-only: never creates or modifies RFC files.

eugenelim Bundle

Use when the user supplies an architecture artifact (assessment report, design doc, diagram, RFC, ADR) and asks for critique. Triggers on "review this", "what's wrong with", "is this any good", or any artifact-shaped paste with a question attached. Produces a verdict (SHIP IT / SHIP WITH CHANGES / MAJOR REWRITE / WRONG ARTIFACT), executive summary, severity-tagged findings, and a closing "what's working" section. Also runs a well-architected / lens review mode (concern + workload-class lenses incl. GenAI/agentic) emitting a risk register with mechanical/judgment-tagged findings. Renders inline by default; saves only on an explicit user request naming the destination. Do NOT assess a repository, produce an artifact, or redesign the system.

eugenelim Bundle

Fill a branded PowerPoint template from a Markdown artifact — turn this into slides, build a slide deck or presentation, produce a branded .pptx. The deterministic script inspects the template's layout placeholders and projects your Markdown (front-matter, headings, lists, tables) onto them, so the user's slide master, theme, and placed assets survive. Use when the user wants a PowerPoint, a slide deck, or a presentation out of Markdown. Tier-1 on python-pptx (the user installs it; the skill detects it and stops if absent).