Product & Planning

simota Skill

Verifying spec compliance: extracts ACs from specs, adversarially checks conformance, generates BDD scenarios and traceability matrices. Use when impl must be proven to match a PRD/SRS/AC.

simota Skill

Converting a supplied prompt into an executable specification: detects vague quality/quantity/explanation/style/design/technical/judgment wording, role and persona theater, and self-contradiction, then replaces each with a numeric bound, an observable behavior, or a scorable criterion — with a per-term ledger of what changed and what stayed open. Don't use for AI system design, RAG, or eval harnesses (Oracle), PRD/SRS authoring (Scribe), spec conformance verification (Attest), or SKILL.md normalization (Gauge).

simota Skill

Planning releases and reporting delivery work from GitHub PR history. Use when versioning, CHANGELOGs, rollout or rollback plans, engineering metrics, retrospectives, or stakeholder reports are needed.

simota Skill

Authoring standalone and cross-team specifications: PRD/SRS/HLD/LLD, staged L0-L4 unified packages, BDD acceptance criteria, and traceability. Use for technical or multi-audience documentation; not implementation or architecture decisions.

shuvonsec Bundle

Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaining (IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth), bypass tables (SSRF IP bypass, open redirect bypass, file upload bypass), language-specific grep (JS prototype pollution, Python pickle, PHP type juggling, Go template.HTML, Ruby YAML.load, Rust unwrap), and reporting (7-Question Gate, 4 validation gate

golbin Bundle

Create or update a lean, user-centered living Product Requirements Document through repeated drafting and subtraction. Use when defining a feature or interface, planning root-cause or architectural work, revising implementation as discoveries emerge, handling legacy migration, or removing speculative scope and unnecessary design detail.

prospeda Skill

AI-powered B2B sales workflow. Research prospects, generate outreach, create content, handle objections, prep discovery calls. Use when asked to "research a company", "write a cold email", "handle an objection", or "prep for a call".

jdrhyne Bundle

Read, search, draft, create, or update Jira work. Use only with explicit Jira or Atlassian context, a Jira URL, or a Jira-style issue key such as PROJ-123; generic mentions of an issue, ticket, sprint, or backlog are not sufficient.

openlair Bundle

Use when a quest needs problem framing, literature scouting, dataset or metric clarification, or baseline discovery before deeper work.

bitjaru Bundle

Turn a product brief and optional references into three distinct creative directions, a human-selected StyleSeed interaction plan, generated image/video asset jobs, a working UI prototype, and a verified prototype-first showcase reel. Use for client concepts, app interaction exploration, trendy but coherent UI direction, reference discovery and synthesis, or any request that needs more than one static screen.

kayforkind Skill

Writes a bite-sized, copy-pasteable implementation plan to .hermes/plans/ with no code execution. Use when the user says plan, /plan, break down, or wants a roadmap before coding. Not for GOAL.md autonomous loops (goal) or immediate implementation. Do not run mutating commands, commits, or installs while planning.

nrwl Skill

Generate code using nx generators. INVOKE IMMEDIATELY when user mentions scaffolding, setup, structure, creating apps/libs, or setting up project structure. Trigger words - scaffold, setup, create a new app, create a new lib, project structure, generate, add a new project. ALWAYS use this BEFORE calling nx_docs or exploring - this skill handles discovery internally.

open-gsd Skill

Multi-phase management — add, insert, remove, or edit phases in ROADMAP.md (roadmap phase CRUD)

shiwenwen Skill

Use when the user mentions 飞书 / Feishu / Lark workspace operations: docx (云文档) read/write, bitable (多维表格) records / views / dashboards, drive (云盘) upload/download, wiki (知识库) link resolution, approval (审批) instance create/cancel/query, calendar (日历) event create/list/update + attendees, contact (联系人) user/department lookup, hire (招聘) job/talent/application listing. Trigger on phrases like 'OKR 周报', '把这份文档发到飞书云盘', '给团队拉个评审会议', '查 [姓名] 的联系方式', '撤销那条审批', '/wiki 链接', or any request that mentions a feishu / lark URL / token (doxcn.../bascn.../wikcn.../boxcn.../om_...).

rlaope Skill

[omh] Hermes CTO Loop workflow: roadmap, PM, technical tradeoffs, risk, delivery, release, and follow-up operating cadence. Use when the user says: cto-loop, cto loop, cto, cto pm, pm dev qa security ops, roadmap technical tradeoffs, technical tradeoff, delivery risk.

unoplatform Skill

Build, test, and maintain the Uno DevServer (CLI tool, RemoteControl Host, MCP proxy, add-in discovery). Use when working under src/Uno.UI.DevServer.Cli, src/Uno.UI.RemoteControl.Host, or src/Uno.UI.RemoteControl.DevServer.Tests, or on DevServer CLI commands, the MCP proxy, IDE channel, or add-in resolution.

xjtulyc Skill

Dispatch biomedical research and data analysis tasks to Claude Code with K-Dense Scientific Skills. Use this skill when the user asks to run any bioinformatics, genomics, drug discovery, clinical data analysis, proteomics, multi-omics, medical imaging, or scientific computation task. Also use for literature search (PubMed, bioRxiv), pathway analysis, protein structure prediction, or scientific writing tasks.

gabrielmoreira Bundle

Local Scanpy pipeline for single-cell RNA-seq QC, optional doublet detection, clustering, marker discovery, optional CellTypist annotation, optional latent downstream mode from integrated.h5ad/X_scvi, and optional dataset-level plus within-cluster contrastive marker analysis from raw-count .h5ad or 10x Matrix Market input.

first-fluke Bundle

Market research skill for pain-point extraction, trend detection, competitor positioning, and discovery across community sources (Reddit, X, YouTube, TikTok, HN, Polymarket, GitHub, arXiv, Techmeme, Bluesky, web and more). Delegates research to the always-latest mvanhorn/last30days engine via `oma market run`, adds oma's detect-trap preflight, intent-auto SWOT / Porter's 5F / PESTEL framing, and a single LAW-compliant brief. Use for market research, pain point analysis, trend detection, competitor research, user complaints, voice-of-customer, 시장조사, 사용자 페인, 트렌드, 경쟁구도.

gabrielmoreira Bundle

Tech debt assessment that identifies, classifies, and prioritizes maintainability problems — helping teams build a refactoring roadmap — drawing on twelve classic engineering books. Triggers when: user asks about tech debt, refactoring priorities, what to clean up first, or asks "why is this so hard to change?", "what should we fix first?", or "how do I justify refactoring to management?". Do NOT trigger for: server health checks, HTTP /health endpoints, Kubernetes probes, database health, or application uptime — "health" in those contexts is infrastructure, not code quality. Also not for single-function refactoring questions.

kayforkind Skill

Converts syllabi, past papers, or notes into an Easy-to-Medium-to-Hard High Score Roadmap plus flashcards, predicted papers, and readiness checks. Use when students ask for exam prep, revision plans, question prediction, or mock papers. Not for sitting a live exam or unrelated homework tutoring; never reverse the Easy then Medium then Hard study order.

openlair Bundle

Multi-source ML dataset discovery. Search HuggingFace Hub, OpenML, GitHub, and paper cross-references for datasets relevant to a research task. Use when asked to "find datasets for", "search ML datasets", "what datasets exist for", or "discover training data for".

tobihagemann Skill

Load code-style and task-specific skills, make the change described by the current context, then run post-implementation QA. Use for ad-hoc changes when no plan file or improvements backlog governs the work, and when the user asks to "just implement", "implement directly", "implement without a plan", or "apply the change".

gabrielmoreira Skill

Serenity-style "Chokepoint Theory" applied to AI supply chains. Identifies physically irreplaceable bottleneck suppliers — small-cap near-monopolies buried 4–7 layers deep — whose capacity constraints force violent repricing when demand outgrows supply. Uses a 5-factor scoring model (Concentration, Irreplaceability, Qualification Gate, Discovery Gap, Demand Tension) to screen and rank candidates. This is AlphaGBM's independent reading of Serenity (@aleabitoreddit)'s publicly shared methodology — NOT affiliated with or endorsed by Serenity. Triggers: "chokepoint analysis", "AI supply chain bottleneck", "find the shiso leaf", "Serenity-style screen", "which small-caps own the bottleneck", "InP substrate play", "co-packaged optics chokepoint", "irreplaceable supplier in AI buildout", "supply chain concentration risk"

gabrielmoreira Bundle

Bioconductor package discovery, workflow recommendation, setup inspection, and starter code generation grounded in official Bioconductor containers and BiocManager.

aibot88 Bundle

Network reconnaissance and security auditing using Nmap for port scanning, service enumeration, and vulnerability detection. Use when: (1) Conducting authorized network reconnaissance and asset discovery, (2) Enumerating network services and identifying running versions, (3) Detecting security vulnerabilities through NSE scripts, (4) Mapping network topology and firewall rules, (5) Performing compliance scanning for security assessments, (6) Validating network segmentation and access controls.

aibot88 Bundle

Issue-driven development orchestrator. Turns improvement intent into a well-specified, bilingual issue set; clusters issues into milestones that map 1:1 to semver versions; enforces branch, commit, and PR conventions (GitHub Flow — `<type>/<issue-N>-<slug>`, Conventional Commits, mandatory PR template, rebase-first merge); generates changelog entries and release notes deterministically from closed issues; leaves a durable audit trail for the next AI session. Direct-call only — not part of the /vibesubin parallel sweep. Two tracks — **GitHub track** (default) on GitHub with authenticated `gh` CLI; **PRD track** on any other host, using local markdown files under `docs/release-cycle/vX.Y.Z/` as the durable audit trail. Operator picks at Step 1.5. Every external mutation follows preview → confirm → mutate; created resources carry idempotency markers so re-runs noop instead of duplicating.

aibot88 Bundle

[REQUIRED] Comprehensive description of what this skill does and when to use it. Include: (1) Primary functionality, (2) Specific use cases, (3) Security operations context. Must include specific "Use when:" clause for skill discovery. Example: "SAST vulnerability analysis and remediation guidance using Semgrep and industry security standards. Use when: (1) Analyzing static code for security vulnerabilities, (2) Prioritizing security findings by severity, (3) Providing secure coding remediation, (4) Integrating security checks into CI/CD pipelines." Maximum 1024 characters.

aibot88 Bundle

Web2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL crawling (katana, waybackurls, gau), directory fuzzing (ffuf), JS analysis (LinkFinder, SecretFinder), continuous monitoring (new subdomain alerts, JS change detection, GitHub commit watch). Use when starting recon on any web2 target or when asked about asset discovery, subdomain enum, or attack surface mapping.

aibot88 Bundle

n8n credential types, REST API credential management, HTTP Request node authentication, predefinedCredentialType vs genericCredentialType, httpCustomAuth JSON format, credential creation via API, credential testing, credential type discovery, OAuth flows, and service-specific credential schemas. Auto-triggers on n8n credential, httpCustomAuth, predefinedCredentialType, genericCredentialType, credential API, credential test, OAuth, and HTTP Request auth tasks.

aibot88 Bundle

Provides methods to interact with Home Assistant REST API for entity discovery, state retrieval, and service calls including authentication, entity patterns, service calls, and state queries. Use when working with Home Assistant integrations, controlling devices, querying sensor data, or automating Home Assistant operations.

aibot88 Bundle

Adversarially re-review a PM artifact, recommendation, or AI-generated critique that already exists. Use as a second pass after another skill (pm-evaluator, pm-prd-drafter, pm-decision-coach, pm-value-hypothesis-tester) has produced output, or on any external AI output the user wants pressure-tested before deferring to it. Plays the role of a hostile exec, skeptical board member, or competing PM — looking for what the first pass missed, what bias it brought, and what would not survive a real review. Returns the three load-bearing holes, what's already strong enough to keep, and the specific re-writes that would close the gaps.

aibot88 Bundle

Build TAM databases from scratch using a 7-phase methodology (Source Discovery → Keyword Expansion → Config → Collection → Dedup → Exclusion → Enrichment hand-off). Triggers "tam map", "build tam", "total addressable market", "scrape industry", "map the market", "build a lead database", "venue partnerships tam", "labs tam", "residential tam", "installer tam". Entity-routed — Nites residential (Google Maps ZIP), Supply installer (SAM.gov + Houzz + state license dbs), Labs venue partnerships (Spider.cloud + AI Ark + Discolike + IcyPeas + BlitzAPI + Prospeo + MillionVerifier). Phase 4.5 cross-workspace EB exclusion is MANDATORY (HARD-FAIL on either workspace unreachable). Phase 5 enrichment is pluggable per ADR-008. Distinct from `list-building` (BC-2717 — assumes a TAM already exists via dbt audience views).

aibot88 Bundle

Use telnet to interact with IoT device shells for pentesting operations including device enumeration, vulnerability discovery, credential testing, and post-exploitation. Use when the user needs to interact with network-accessible shells, IoT devices, or telnet services.

aibot88 Bundle

按照规范编写产品需求文档（PRD）。当用户要求撰写、完善、重构、评审或补全 PRD、产品需求文档、功能需求说明、需求规格、功能清单、流程图说明、埋点需求、非功能性需求时使用。

aibot88 Bundle

Automated alert system for key events in drug discovery. Use for tracking competitor milestones, clinical trial updates, regulatory decisions, and publications of interest. Keywords: alerts, monitoring, tracking, notifications, competitive intelligence