Product & Planning

hybridlabor-api Skill

Updates tdmcp docs and roadmap for newly shipped or newly merged capabilities. Use when asked to update docs, update the roadmap, reconcile release docs, document new features, sync docs with CHANGELOG/package release, refresh cookbook examples after a feature wave, re-run/continue/fix a docs-roadmap pass, or check whether docs/ROADMAP.md is current. Runs a sub-agent workflow: release audit -> roadmap/docs edit + cookbook sync -> QA.

hybridlabor-api Skill

Study a merged or shipped tdmcp implementation and extract reusable learnings: code improvements, runtime/UX lessons, test gaps, docs updates, roadmap items, and harness changes. Use when the user asks to learn from a completed feature/project/PR/build, analyze what can be improved from an implementation, or turn a real installation experience into actionable tdmcp improvements. This is a post-implementation learning harness; it does not replace tdmcp-pipeline for building or tdmcp-quality-audit for broad repo audits.

fluxonlab Skill

Map requirements (PRD/user stories/AC) to comprehensive test coverage using a traceability matrix (RTM). Outputs coverage gaps, risks, test levels, prioritization, automation candidates, and change-impact notes. Designed for QA/Test Architect workflows.

kyrie66nb Skill

Discover research ideas.

kyrie66nb Skill

idea discovery robot workflow.

maxrave-dev Skill

Counting entities encountered for the first time means taking MIN over the entity's whole history and asking whether that minimum lands inside the window — the natural version, which filters to the window and then groups, calls every entity new. Covers why the wrong query passes its first test, why the window belongs in HAVING rather than WHERE, what an unbounded scan needs from the index, and how a retention prune quietly redefines "ever". Use when a "new this period" figure tracks the distinct count exactly, when discovery rate is implausibly close to 1, or before writing any first-seen query.

modu-ai Bundle

제품 기획 문서(PRD·기능 명세서)와 AI 도입 전략 보고서를 만들어 드립니다. 다음과 같은 요청 시 사용하세요: - "PRD 작성해줘" - "기능 명세서 만들어줘" - "AI 도입 전략 보고서 써줘" - "제품 기능 우선순위 정리해줘" - "디지털 전환 로드맵 수립해줘" 기획 의도와 요구사항을 검토 가능한 문서로 정리하고, ai-slop-reviewer·korean-humanize으로 마무리할 수 있습니다. [책임 경계] 정부·지원사업 신청서는 moai-consultant:consult-gov-grant, R&D·연구비 과제는 moai-tutor:education-grant-writer로 라우팅

modu-ai Bundle

프로젝트 로드맵·마일스톤 계획과 전략적 제휴(MOU) 초안, ESG 지속가능성 감사·DEI 전략 문서를 만들어 드립니다. 다음과 같은 요청 시 사용하세요: - "로드맵 정리해줘" - "마일스톤 계획 세워줘" - "MOU 초안 작성해줘" - "ESG 지속가능성 감사 해줘" - "DEI 정책 도입 로드맵 설계해줘" - "분기별 마일스톤과 담당자 정리해줘" 일정·리소스·파트너십·지속가능성 계획을 실행 가능한 문서로 정리하고, ai-slop-reviewer·korean-humanize으로 마무리할 수 있습니다. [책임 경계] 운영 케이던스(주간보고·스탠드업·회고·OKR 추적)는 moai-pm, 본 스킬은 제품 발견·로드맵/마일스톤 기획

modu-ai Bundle

한국 팀의 주간 비즈니스 리뷰(WBR) 보고서 자동 생성 스킬입니다. 일일 노트·완료 태스크·KPI 데이터를 입력받아 임원/팀 두 버전(격식체/구어체)으로 작성합니다. Notion·Linear·Asana·Slack MCP가 가용하면 자동 데이터 fetch, 없어도 자유 텍스트 입력 fallback. 다음과 같은 요청 시 반드시 이 스킬을 사용하세요: - "주간보고 작성", "WBR 준비", "이번 주 한 일 정리" - "주간 회의 자료", "위클리 리포트", "주간 업무 보고" - "임원 주간보고", "팀 주간보고" [책임 경계] 제품 발견·로드맵/마일스톤 기획은 moai-coworker:collab-roadmap, 본 스킬은 운영 케이던스(주간보고)

modu-ai Skill

목표를 막연한 다짐이 아니라 실천 가능한 계획으로 바꿔주는 스킬입니다. '신년 목표 세워줘', '12주 계획법으로 쪼개줘', '만다라트 만들어줘', '개인 OKR', '목표를 실천으로'처럼 말하면 됩니다. 12주 계획·만다라트·개인 OKR 등으로 목표를 잘게 나누고 주간 루틴까지 연결해, "세웠는데 안 하는" 목표를 줄여줍니다.

netvar1337 Skill

Use for authorized security assessment of REST, GraphQL, WebSocket, or SOAP APIs, including discovery, authentication, authorization, rate-limit, and CI/CD testing.

pavel-kravchenko Skill

Run MOFA2 (mofapy2/muon) to fuse RNA-seq, proteomics, methylation into latent factors; decompose per-view R2, interpret weights. Use for multi-omics integration, MOFA/MOFA2 analysis, or latent factor discovery.

pavel-kravchenko Skill

Run mixOmics PLS-DA/sPLS-DA/DIABLO to classify samples and pick stable biomarkers from paired RNA-seq/proteomics/methylation blocks. Use for supervised multi-omics classification or DIABLO biomarker discovery.

acaprino Skill

Detects the chicken-and-egg cycle where component A needs B ready while B needs A: cold-start hangs, deadlocks, hidden temporal coupling. TRIGGER WHEN: the target involves startup ordering, initialization sequences, bootstrap or config loading, service discovery, or migration dependencies; or the system comes up correctly only by luck. DO NOT TRIGGER WHEN: the concern is runtime flow with no initialization phase (use distributed-flow-auditor).

acaprino Skill

Adversarial auditor for structural entropy, report-only. Global mode censuses the whole codebase from .codebase-xray/ plus its own discovery pass; diff mode anchors on the changed files. TRIGGER WHEN: spawned by /abstraction-architect:audit, or as the abstraction dimension of /senior-review:team-review or /senior-review:code-review; the user asks who canonically owns a fact, policy or state, asks about missed unification or wrong abstractions, or asks whether what they just wrote already exists elsewhere. DO NOT TRIGGER WHEN: the task is implementation, security review (use senior-review:security-auditor), distributed-flow tracing (use senior-review:distributed-flow-auditor), dead-code removal (use senior-review:cleanup-auditor), or cycles, cohesion and single-file patterns (use senior-review:code-auditor and senior-review:chicken-egg-detector).

argentaios Bundle

Run a live 60-minute sales discovery call where Argent leads questioning, maps pain to agent design, and generates deployment artifacts in real time. Use when the user asks to prepare, run, or replay a demo/onboarding discovery call with a customer on Zoom/Meet/Teams.

fluxonlab Skill

Use when you need to translate product goals into acceptance checks, demo paths, and user validation criteria for a feature ready for stakeholder sign-off.

zgbrenner Skill

Use when organizing responses to written discovery — document requests, interrogatories, or requests for admission — inventorying each request verbatim into a response tracker, organizing objection candidates and privilege candidates as questions for counsel, planning collection and custodians, and drafting response shells with placeholders, without ever drafting a final objection or recommending an admit/deny.

26zl Skill

Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (prompt injection, indirect injection, ASCII smuggling, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaining, bypass tables, language-specific grep (JS prototype pollution, Python pickle, PHP type juggling, Go template.HTML, Ruby YAML.load, Rust unwrap), and reporting (7-Question Gate, validation gates, CVSS 3.1, PoC generation, submission checklist). Use for ANY bug bounty task — recon, hunting, source audit, AI testing, validation, or reporting. 中文触发词：漏洞赏金、安全测试、渗透测试、漏洞挖掘、信息收集、子域名枚举、XSS测试、SQL注入、SSRF、安全审计、漏洞报告

26zl Skill

Web2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL crawling (katana, waybackurls, gau), directory fuzzing (ffuf), JS analysis (LinkFinder, SecretFinder), continuous monitoring (new subdomain alerts, JS change detection, GitHub commit watch). Use when starting recon on any web2 target or when asked about asset discovery, subdomain enum, or attack surface mapping.

26zl Skill

Use at the start of a bug bounty engagement. Provides scope-aware recon methodology — passive enumeration, subdomain discovery, asset attribution, tech stack fingerprinting, content discovery. Respects scope and program rules. Triggers on "bounty recon", "subdomain enum", "attack surface map", "h1 recon", "bug bounty start".

26zl Skill

IoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off), firmware acquisition (vendor portals, OTA capture, flash dump, binwalk extraction), firmware analysis (filesystem mounting, binary triage, hardcoded secrets, default credential discovery), bootloader attacks (U-Boot console, secure-boot bypass, fault injection), runtime attacks on embedded Linux/RTOS (busybox CVEs, MTD writes, /dev/mem), wireless protocol attacks (Zigbee, BLE, Z-Wave, LoRaWAN, Thread/Matter, sub-GHz), MQTT/CoAP/Modbus/BACnet/OPC-UA exploitation, mobile companion app analysis, cloud-IoT API abuse, and side-channel/glitching basics. Use for IoT pentest, smart-home assessment, ICS/OT testing, or embedded vulnerability research. Use only for authorized security research, training, or assessment.

26zl Skill

Remote Code Execution testing checklist: OS command injection, SSTI-to-RCE, deserialization RCE, file upload RCE, XXE with SSRF to RCE, RCE via dependency confusion, and CVE-based RCE patterns. Use for web app pentests and bug bounty RCE discovery. Use only for authorized security research, training, or assessment.

26zl Skill

Cross-Site Scripting testing checklist: stored/reflected/DOM/blind XSS discovery, polyglot payloads, CSP bypass, XSS filter bypass, event handler injection, DOM clobbering, mutation XSS, and impact escalation (session hijack, phishing, keylogging). Use for web app XSS testing and bug bounty. Use only for authorized security research, training, or assessment.

26zl Skill

IDOR (Insecure Direct Object Reference) testing checklist: object ID enumeration, horizontal/vertical privilege escalation, GUID predictability, indirect references via hashes, chained IDOR, and API endpoint IDOR. Use for web app pentests and bug bounty IDOR discovery. Use only for authorized security research, training, or assessment.

26zl Skill

Server-Side Request Forgery testing checklist: SSRF discovery, blind SSRF with out-of-band, cloud metadata endpoints (AWS/GCP/Azure), SSRF filter bypass techniques (IP encoding, DNS rebinding, redirect chains), and SSRF to RCE escalation. Use for web app SSRF testing and bug bounty. Use only for authorized security research, training, or assessment.

davidcastagnetoa Bundle

Mantener y priorizar el backlog de deuda técnica como parte del proceso de desarrollo

pavel-kravchenko Skill

Build PFM/PPM/PWM from TF binding sites, score/scan DNA with NumPy, pick thresholds, test motif enrichment (Fisher/BH-FDR). Use for ChIP-seq/SELEX motif scoring, IUPAC consensus, or JASPAR/HOCOMOCO matching.

pavel-kravchenko Skill

BLAST-identify unknown DNA/CDS with Biopython, QC/translate sequences, build NJ/UPGMA trees, and scan protein motifs. Use for sequence-to-discovery capstones, unknown-sequence ID, or FASTA-BLAST-tree pipelines.

pavel-kravchenko Skill

Parse SMILES/SDF with RDKit, build ChEMBL QSAR models, dock ligands with AutoDock Vina, predict ADMET/Lipinski properties. Use for compound screening, Tanimoto similarity, Rule of Five filtering.

zgbrenner Skill

Use when organizing family-law discovery requests, responses, disclosures, subpoenas, authorizations, deficiencies, and meet-and-confer items into a tracker for attorney review.

zgbrenner Skill

Use when scoping a legal-research task before any research is conducted, producing a research roadmap of statute leads, case-law areas, search terms, and source-hierarchy targets — with no citations and no analysis — so the attorney can approve the scope before authority is gathered.

leadmagic Bundle

Write investor updates that build confidence and surface help — monthly format, board deck structure, fundraising narrative, and metrics dashboards. Use when writing investor updates, preparing board meetings, or communicating with stakeholders. Triggers on: "investor update", "board deck", "monthly update", "investor communication", "fundraising update", or any stakeholder reporting.

leadmagic Bundle

Plan and execute Quarterly Business Reviews — value documentation, ROI presentation, executive alignment, and expansion roadmap. Use when preparing for QBRs, business reviews with customers, or executive stakeholder meetings. Triggers on: "QBR", "quarterly business review", "executive business review", "customer review", "value review", or any request about strategic customer meetings.

leadmagic Bundle

Orchestrate multi-threaded ABM engagement across buying committee members — stakeholder mapping, parallel plays, ghost node detection. Triggers on: "multi-thread", "stakeholder map", "buying committee", "deal mapping".

leadmagic Bundle

Translate engineering strengths into founder-led GTM: customer discovery, positioning, demos, technical proof, founder sales habits, and first repeatable motion. Use when a technical founder needs to sell, do customer interviews, explain value without feature dumping, or build GTM confidence.