Product & Planning

composiohq Skill

BluOS CLI (blu) for discovery, playback, grouping, and volume.

dtsong Skill

Use when systematically discovering edge cases for proposed features using structured enumeration techniques. Covers input boundary analysis, state combinations, concurrency scenarios, temporal edge cases, and permission edge cases. Do not use for security threat analysis (use threat-model) or infrastructure failure discovery (use failure-mode-analysis).

dtsong Bundle

Use this skill when connecting AI or LLMs to data platforms. Covers MCP servers for warehouses, natural-language-to-SQL, embeddings for data discovery, LLM-powered enrichment, and AI agent data access patterns. Common phrases: "text-to-SQL", "MCP server for Snowflake", "LLM data enrichment", "AI agent access". Do NOT use for general data integration (use data-integration) or dbt modeling (use dbt-transforms).

sugatoray Bundle

Performs a SOC 2 Type II readiness gap analysis against AICPA Trust Services Criteria. Auto-invoked when discussing SOC 2 compliance, audit preparation, or security program maturity. Walks through all Common Criteria (CC1-CC9) plus selected additional criteria, identifies gaps, and produces a remediation roadmap with evidence requirements and 90-day action plan.

sugatoray Skill

Conducts access review and entitlement audit against CIS Controls v8 (Controls 5, 6) and NIST SP 800-53 AC family. Auto-invoked when reviewing entitlement certifications, orphaned accounts, role explosion, segregation of duties violations, or quarterly access recertification campaigns. Produces findings with severity, framework mapping, and remediation roadmap.

sugatoray Skill

Performs a HIPAA Security Rule compliance review against all Administrative, Physical, and Technical Safeguards defined in 45 CFR Part 164, Subpart C. Auto-invoked when discussing healthcare data security, ePHI protection, HIPAA audit readiness, or business associate compliance. Evaluates required and addressable implementation specifications, identifies gaps, and produces a remediation roadmap aligned to HHS enforcement priorities.

sugatoray Skill

Performs an ISO 27001:2022 gap analysis against the full ISMS requirements (Clauses 4-10) and all 93 Annex A controls reorganized into four themes. Auto-invoked when discussing ISO 27001 certification readiness, ISMS implementation, or Statement of Applicability development. Identifies control gaps, scores implementation maturity, and produces a remediation roadmap aligned to the 2022 revision structure.

sugatoray Skill

Executes a structured incident response workflow based on NIST SP 800-61 Rev 2 and the SANS Incident Handler's Handbook. Auto-invoked when the user reports a security incident, asks how to respond to a breach, or needs help with incident classification, containment decisions, stakeholder notification, or evidence preservation. Produces an incident response plan with severity determination, containment decision tree, communication templates, and escalation criteria.

sugatoray Skill

Performs a NIST Cybersecurity Framework 2.0 assessment across all six functions (Govern, Identify, Protect, Detect, Respond, Recover) and their categories and subcategories. Auto-invoked when discussing cybersecurity maturity, risk posture evaluation, or NIST CSF alignment. Develops current and target organizational profiles, assesses maturity tiers, maps informative references, and produces a prioritized improvement roadmap.

sugatoray Skill

Performs a Zero Trust Architecture maturity assessment against NIST SP 800-207 and the CISA Zero Trust Maturity Model v2. Evaluates all five CISA ZT pillars (Identity, Devices, Networks, Applications & Workloads, Data) across maturity stages. Covers microsegmentation readiness, continuous verification, and produces a pillar-by-pillar maturity scorecard with remediation roadmap.

chanw-research Skill

Turn a refined research proposal or method idea into a detailed, claim-driven experiment roadmap. Use after `research-refine`, or when the user asks for a detailed experiment plan, ablation matrix, evaluation protocol, run order, compute budget, or paper-ready validation that supports the core problem, novelty, simplicity, and any LLM / VLM / Diffusion / RL-based contribution.

chanw-research Skill

Workflow 1: Full idea discovery pipeline. Orchestrates research-lit → idea-creator → novelty-check → research-review to go from a broad research direction to validated, pilot-tested ideas. Use when user says "找idea全流程", "idea discovery pipeline", "从零开始找方向", or wants the complete idea exploration workflow.

shawnpang Skill

When the user needs to define a product feature, write a product requirements document, or translate an idea into a structured spec.

shawnpang Skill

When a founder needs demo scripts, discovery call frameworks, objection handling, RFP/RFI responses, competitive feature matrices, POC planning, or closing playbooks. Activate for sales calls, demo prep, talk tracks, bid responses, competitor comparisons, or pre-sales engineering.

shawnpang Skill

When the user needs to organize product initiatives into a prioritized, time-sequenced plan with outcomes and dependencies.

shawnpang Skill

When the user wants to find Slack groups, Discord servers, Reddit communities, forums, or online communities where their target audience hangs out. Also use when the user mentions "where to promote", "find communities", "community marketing", or "distribution channels".

wanghaisheng Skill

Communicate accessibility decisions, requirements, and value to stakeholders who aren't accessibility specialists. Use when presenting accessibility work to leadership, product managers, engineers, or anyone who needs to understand why accessibility decisions matter. Triggers on: stakeholder, business case, justify accessibility, explain accessibility, leadership, executive, ROI, why accessibility, cost of accessibility, persuade, convince, accessibility presentation.

wanghaisheng Skill

Track and manage accessibility debt — known accessibility issues that have been deferred. Use when managing a backlog of accessibility issues, planning remediation, or when accessibility problems are accumulating faster than they're being fixed. Triggers on: accessibility debt, tech debt, known issues, backlog, deferred, we'll fix it later, remediation, accessibility backlog, accumulating issues, regression.

alecs5am Skill

Run an autonomous, issue-driven development loop over Ralphy itself — the same cadence as a focused maintainer session: pick the open `notes/issues/`, order them by dependency, then for each issue dispatch a scoped sub-agent, review its diff, run the real gates, and commit + push to main before moving to the next. Sequential by default (one agent at a time) so changes never collide on shared files. Default scope is ALL open issues with a safety limit of 25; the user can widen the scope or raise the limit in their prompt. Pauses for the user only at genuine decision forks and before any paid generation or irreversible/outward-facing action. USE WHEN the user types `/dev-loop`, says "work through the issues", "run the dev loop", "grind the backlog", "implement all the open issues", "keep going through notes/issues until done", or after `/dev-issues` has filed a batch they now want executed. DO NOT FIRE for a single issue (just implement it), for content/video production, or when there are no open issues to exec

alecs5am Skill

Manage Ralphy's `notes/` capture inbox (`ideas/`, `issues/`, `decisions/`) — the only dev tracker for Ralphy itself; there is no separate roadmap board. Two jobs: (1) CAPTURE — turn a tagged thought into a correctly-shaped, correctly-placed note (an idea, an issue, or a decision); (2) COLLISION-CHECK — before filing anything new, search the inbox for an existing entity that already covers it, and update that instead of spawning a duplicate. For the `notes/issues/` backlog itself — decomposing a brain-dump into issues, executing them, moving them across `done/`/`deprecated/` — defer to the `dev-issues` skill (filing/shaping) and `dev-loop` (execution); this skill keeps `ideas/` + `decisions/` capture plus the cross-inbox collision check. USE WHEN the user types `/dev-tasks`, says "log this idea", "file a note", "capture this", "record this decision", "what's in the inbox", "is there already a note/idea for X", "promote this note", or drops a half-formed idea mid-dev-session for safekeeping. See body for ALSO F

aws-samples Bundle

ECS environment reconnaissance and discovery. Detects compute and capacity providers, task definitions, deployment configuration, auto scaling, networking, security posture, observability, and IaC/CI-CD tooling. Use when someone asks about their ECS environment, wants to describe a cluster, inspect a service, or document task definitions — even without naming the skill. Applies to Amazon ECS, not Amazon EKS (use eks-recon). Discovers current state only — does not score, audit, or design. Skip for operational audits and GREEN/AMBER/RED scoring (ecs-operation-review), deployment-model design, launch-type selection, and ECS best practices (ecs-architect), deployment strategy design and CI/CD engineering (ecs-devops), GPU/ML workloads (ecs-genai), security and compliance (ecs-security), cost/TCO (ecs-cost-intelligence, once available), observability design (ecs-observability), and replatform/migration (ecs-modernize, once available).

aws-samples Bundle

Security and compliance guidance for Amazon ECS — "ECS was unable to assume the role", task role vs execution role, iam:PassRole, confused-deputy aws:SourceArn trust, Fargate vs EC2 shared responsibility, injecting Secrets Manager/SSM secrets (trailing-colon JSON-key gotcha), readonlyRootFilesystem / non-root / drop capabilities, ECS Exec governance, security-group-per-task, VPC endpoint policies, GuardDuty ECS Runtime Monitoring, ECR Inspector scanning, image signing, Fargate FIPS, or PCI/HIPAA/FedRAMP. Walks a discovery-driven 7-layer stack plus the AWS-canonical baseline and a 30/60/90 roadmap. Trigger even if "compliance" is never said — any ECS hardening, task-trust fix, or secrets-injection qualifies. Skip for EKS/Kubernetes (eks-security), GenAI/GPU security (ecs-genai), App Runner/Lambda, auditing a live estate's operational posture (ecs-operation-review — "audit my ECS security posture" matches both), or account-level security with no ECS angle.

aws-samples Bundle

Use when choosing and architecting an Amazon ECS deployment model for a NEW workload — Fargate vs ECS on EC2 vs Managed Instances vs Express Mode vs ECS Anywhere/External — plus capacity-provider strategy, task sizing, awsvpc/ENI density, networking, service parameters, and launch-type or topology migration (EC2 launch type to capacity providers/Managed Instances; Service Discovery to Service Connect). Also the shared ECS best-practices corpus. Triggers include "which ECS launch type", "Fargate or EC2", "should I use Managed Instances", "migrate off EC2 launch type", "App Mesh to Service Connect", "migrate off App Runner". Skip for existing-app replatform (ecs-modernize); auditing a live estate (ecs-operation-review); cost/TCO (ecs-cost-intelligence); inventory (ecs-recon); security (ecs-security); deployment/CICD (ecs-devops); observability (ecs-observability); GPU/ML design AND GPU launch-type choice (ecs-genai); Kubernetes/EKS (eks-design); Terraform generation of a settled design (use ecs-build).

phuhao00 Bundle

Uncover customer jobs, pains, and gains in a structured JTBD format. Use when clarifying unmet needs, repositioning a product, or improving discovery and messaging.

phuhao00 Bundle

Plan a strategic roadmap across prioritization, epic definition, stakeholder alignment, and sequencing. Use when turning strategy into a release plan that teams can execute.

phuhao00 Bundle

Run a full discovery cycle from problem hypothesis to validated solution. Use when a team needs a structured path through framing, interviews, synthesis, and experiments.

phuhao00 Skill

Choose a prioritization framework based on stage, team context, and stakeholder needs. Use when deciding between RICE, ICE, value/effort, or another scoring approach.

phuhao00 Bundle

Run an end-to-end product strategy session across positioning, discovery, and roadmap planning. Use when a team needs validated direction before committing to execution.

fufankeji Bundle

把"多候选技术架构选型"打包成"法庭式 5 角色对抗调研"的标准化流程，用 Claude Code Agent Teams 让代言人/红队/集成评估师互相质疑，主 Claude 充当法官综合判决，最终产出架构基线决策文档。适用：多个开源项目 fork 选型、多个 SaaS/云厂商选型、多个技术栈对决（React vs Vue vs Svelte）、多个开源库选型（LangChain vs LlamaIndex）、多个架构方案选型（Monolith vs Microservices vs Serverless）、PRD 写到一半发现技术决策有争议需要 deep dive。即使用户没明确说"用 Skill"，只要任务沾边"多候选架构选型需要更严谨的对抗评估"都要调用。触发关键词：架构选型 / 技术选型 / fork 选型 / 候选对抗 / 多方案对比 / 选型纠结 / 架构决策 / 技术栈对决 / 帮我决定用 X 还是 Y / SaaS 选型 / 库选型 / 对抗调研 / architecture decision / tech selection / framework comparison / vendor evaluation / adversarial review。不用于：单一候选无对比（不需要对抗）、纯产品决策不涉技术（用 brainstorming）、已有强烈倾向只想确认（用 devil's advocate 单 agent Skill 即可，本 Skill 过重）。

grandamenium Skill

You need to build software autonomously — a new project, a major feature, or any structured development task. You will act as the 'human' supervisor for a dedicated M2C1 worker session, managing it through all 12 phases: provide the brain dump, answer discovery questions, configure tools and credentials, monitor progress via bus messages and git, validate the output, and clean up when done. Use when the work is large enough to warrant a dedicated isolated build session.

grandamenium Skill

You need to build software autonomously — a new project, a major feature, or any structured development task. You will act as the 'human' supervisor for a dedicated M2C1 worker session, managing it through all 12 phases: provide the brain dump, answer discovery questions, configure tools and credentials, monitor progress via bus messages and git, validate the output, and clean up when done. Use when the work is large enough to warrant a dedicated isolated build session.

mchittineni Bundle

AWS migration planning: the 6Rs framework (rehost, replatform, refactor, repurchase, retain, retire), discovery and wave planning, MGN server migration, DMS data cutover with CDC, and rollback criteria. Use when planning a datacenter exit or lease expiry, deciding whether a legacy monolith should be rehosted or refactored, or moving a large Oracle, SQL Server or Postgres database with minimal downtime.

mchittineni Bundle

Cloud Security Posture Management: Prowler and ScoutSuite multi-cloud audits, CIS Benchmark baselines for AWS, Azure and GCP, over-permissive IAM discovery, and exception workflow. Use when auditing an account or organization's security posture, finding unused and over-permissive permissions across hundreds of roles, preparing for a CIS or compliance review, or triaging misconfiguration findings.

vikynofebriputra-creator Bundle

Use to design and implement product UI from PRD, product goals, user flows, or existing app context. Use when the user asks to build or improve a UI, frontend screen, landing page, dashboard, component set, design-system-based interface, Figma-style brief plus implementation, brand-inspired UI, responsive layout, accessibility pass, or visual polish.

vikynofebriputra-creator Bundle

Use to write or refine a PRD after product demand is reasonably understood and before acceptance criteria, design handoff, engineering breakdown, or implementation planning. Use when the user asks for a PRD, product requirements document, scope definition, engineering-ready requirements, requirements handoff, goals and success metrics, functional requirements, non-functional needs, dependencies, risks, milestones, or open questions.

vikynofebriputra-creator Bundle

Use to turn a PRD section, user story, feature slice, or behavior description into product test scenarios and pass/fail conditions. Use when the user asks for product testing, acceptance criteria, Given/When/Then scenarios, QA-ready scenarios, pass/fail checks, edge cases, error states, non-functional acceptance checks, or story-level verification.