Web & Frontend

majesticlabs-dev Skill

Design thinking principles for distinctive interfaces. Covers aesthetic direction, anti-patterns, and avoiding generic AI-generated aesthetics.

conectlens Bundle

Review LenserFight security for selected modules or scopes using architecture-aware, low-coupling, high-cohesion rules. Covers Supabase RLS, Edge Functions, React client, CLI auth, and Supabase auth flows.

conectlens Skill

Review a screenshot for UX clarity, accessibility risk, layout problems, and copy issues.

conectlens Bundle

Review Vite app performance, bundle shape, route splitting, assets, rendering cost, and caching strategy. Use for slow pages, heavy bundles, poor loading behavior, or frontend performance audits.

conectlens Skill

Use when planning or coordinating implementation of profile privacy, followers/following, restricted profile access, and account lifecycle across frontend, database, and policy layers.

conectlens Skill

Use when implementing the /lenser route, restricted profile shell, lock-state UI, follow request UX, and route-state rendering for public, private, deactivated, and deleted profiles.

zhaoxuya520 Bundle

实现表单 / 校验 / 提交 / 错误处理时使用。覆盖 React Hook Form + Zod / TanStack Form / Formik / VeeValidate / Formily / Angular Forms。融合受控/非受控 + Schema 校验 + 异步校验 + 防重复提交。

zhaoxuya520 Bundle

选择和实现状态管理方案时使用。覆盖 React (Redux Toolkit / Zustand / Jotai / Valtio / TanStack Query) / Vue (Pinia) / Angular (NgRx / Signals) / Svelte (Stores / Runes)。融合客户端状态 + 服务端状态分离。

zhaoxuya520 Bundle

实现前端测试时使用。覆盖 Vitest / Jest / React Testing Library / Vue Test Utils / Playwright / Cypress / Storybook / MSW / 视觉回归。融合测试金字塔 + a11y 测试 + 视觉测试。

zhaoxuya520 Bundle

设计和实现路由 / 导航 / 权限守卫 / 嵌套路由 / 动态路由时使用。覆盖 Next.js / React Router / TanStack Router / Vue Router / Angular Router / SvelteKit。融合文件路由 + 嵌套布局 + 守卫 + 懒加载 + 数据加载。

zhaoxuya520 Bundle

设计组件结构、拆分粒度和复用策略时使用。覆盖 React / Vue / Angular / Svelte。融合 Atomic Design + Container/Presentation + Compound Components + Headless 模式。

zhaoxuya520 Bundle

小程序开发时使用。覆盖微信/支付宝/抖音小程序 + Taro/uni-app 多端统一开发。

zhaoxuya520 Bundle

选择全栈技术栈时使用。适用于新项目启动、框架选型、Monorepo vs 分仓决策。覆盖 Next.js / Nuxt / T3 / SvelteKit / Rails / Laravel / Django。

zhaoxuya520 Bundle

优化前端性能 / 包大小 / 渲染 / 网络时使用。覆盖 Web Vitals (LCP/INP/CLS) / Bundle / Image / Code Splitting / 虚拟列表。融合性能预算 + RUM + 优化优先级。

zhaoxuya520 Bundle

前后端联调时使用。适用于 Mock → 真实切换、字段对齐、错误处理对接、Token 传递验证。融合 MSW Mock + 类型共享 + 联调清单。

zhaoxuya520 Bundle

实现可访问性（无障碍）时使用。覆盖 WCAG 2.2 AA / ARIA / 键盘导航 / 屏幕阅读器 / 颜色对比 / 焦点管理。融合 React Aria / Radix UI / Headless UI 实践 + axe-core 自动化测试。

noorqureshi Skill

Find and prove Cross-Site Scripting (reflected, stored, DOM). Load when input is echoed into HTML/JS/attributes, a search/comment/profile field renders your text, a URL param appears in the response, or a sink like innerHTML/document.write is in client JS. Signals: "search=", reflected values, error pages echoing input, Angular/React dangerouslySetInnerHTML.

noorqureshi Skill

Discover and escalate Server-Side Request Forgery. Load when the app fetches a URL you influence: webhooks, "import from URL", link/image preview, PDF/HTML render, avatar-by-URL, URL health-checks, XML/SVG parsers. Signals: params like url=, uri=, dest=, callback=, image=, feed=, or a request that reaches out on your behalf.

noorqureshi Skill

Get script to run despite a Content-Security-Policy — the step after finding an injection that CSP is blocking. Load when you have HTML/JS injection but the payload won't execute, on "CSP is blocking my XSS", or when auditing a CSP for weakness. Signals: a Content-Security-Policy header, a blocked-script console error, a reflected injection with no popup.

noorqureshi Skill

Overwrite a page's JavaScript variables using only injected HTML — no script needed. Load when a sanitizer allows tags/attributes but strips script, and the app reads config/state from the DOM or globals. Signals: HTML injection behind DOMPurify/an allowlist, client code using `window.X`, `document.getElementById(...)`, or `config.*` that could come from named elements.

noorqureshi Skill

Security review of .NET / C# code — dangerous sinks and ASP.NET pitfalls. Load when reviewing a C#/.NET codebase/PR, on .cs source in scope, or "review this .NET app". Signals: .csproj/.sln, ASP.NET (Core/MVC/WebForms), BinaryFormatter, SqlCommand, Razor Html.Raw, XmlDocument.

noorqureshi Skill

Context-breaking XSS polyglots and per-context payloads that fire across HTML/attribute/JS/ URL sinks in one shot. Load when confirming XSS fast, unsure of the injection context, or a single test payload should cover many contexts. Signals: reflected input, XSS triage, "polyglot".

noorqureshi Skill

Exploit apps that trust LLM output — pass model text unsanitized into XSS sinks, SQL, shell, code, or downstream calls. Load when LLM output is rendered as HTML/markdown, executed, or fed to another system. Signals: chatbot output shown with innerHTML/dangerouslySetInnerHTML, "run this code", LLM-generated queries/commands, agent output used in eval/exec.

noorqureshi Skill

Passively identify a target's full technology stack — frontend framework, backend runtime, server, CMS, CDN/WAF, cloud, and versions — from public signals, then route to the right attack skills and CVEs. Load at the start of a web/API assessment, when choosing which techniques apply, or when "what is this built with / what CVEs match". Signals: a new domain in scope, unknown stack, "fingerprint", "what framework", version-to-CVE matching.

openharmonyinsight Bundle

Use when migrating OpenHarmony/HarmonyOS ArkUI state management from V1 (@Component, @State/@Prop/@Link/@Provide/@Consume/@Watch/@Observed) to V2 (@ComponentV2, @Local/@Param/@Event/@Provider/@Consumer/@Monitor/@ObservedV2/@Trace), or assessing migration feasibility. Trigger phrases include "迁移V1到V2", "V1V2迁移", "状态管理迁移", "将@Component改为@ComponentV2", "迁移@State/@Prop/@Link到V2", "migrate V1 to V2". Provides automated analysis (component structure, dependency tracing, API version detection, V1/V2 mixing validation), step-by-step migration guidance, and post-migration validation.

openharmonyinsight Skill

Web 领域渲染引擎专家。关注 Blink 渲染流水线、DOM/CSS 解析、布局计算、绘制指令生成等。作为专家团成员参与 ArkWeb 需求头脑风暴讨论。

zhaoxuya520 Bundle

设计无障碍可访问的界面时使用。适用于满足 WCAG 标准、键盘导航、屏幕阅读器支持。优先使用 WCAG 2.2 AA 级标准 + 键盘 + 焦点 + 对比度 + ARIA。

zhaoxuya520 Bundle

配置构建工具 / 部署 / 环境管理时使用。覆盖 Vite / Turbopack / Webpack / Rspack / Vercel / Cloudflare Pages / Netlify / Docker。融合多环境配置 + CDN + Preview / Production 部署 + 回滚。

zhaoxuya520 Bundle

实现 API 调用 / 缓存 / 加载 / 错误处理 / 乐观更新时使用。覆盖 TanStack Query / SWR / RTK Query / Apollo Client / urql / Pinia Colada / Pinia Query。融合 stale-while-revalidate + 乐观更新 + Mutation + 无限加载。

zhaoxuya520 Bundle

移动端跨平台开发。覆盖 React Native / Flutter / Expo / Ionic / Capacitor / Tauri。

zhaoxuya520 Bundle

定义 UI 组件的所有状态时使用。适用于按钮、表单、列表、对话框等组件的状态完整覆盖。优先使用 8 种核心状态（默认/悬停/聚焦/禁用/加载/成功/错误/空/权限）。

zhaoxuya520 Bundle

选择和实现样式方案时使用。覆盖 Tailwind / CSS Modules / CSS-in-JS（styled-components / Emotion）/ vanilla-extract / UnoCSS / Sass。融合设计 Token + 主题 + 暗黑模式 + 响应式。

coco-research Bundle

Build and validate .arch/index.json — a committed map from each architectural component of this repository to the real directories and files that implement it, pinned to a git commit, with every path verified to exist. Also detects structural drift between that index and the current code. Use when asked to map a codebase, produce a component or code-ownership index, find which files implement a component, check whether architecture docs are stale, or detect architecture drift after a refactor. Triggers include 'map the codebase', 'component index', 'which files implement X', 'is the architecture still accurate', 'architecture drift', 'refresh the architecture index'.

coco-research Bundle

Loads full context for a React Flow (@xyflow/react) user journey mapping project. Use when working on, extending, debugging, or building features for the journey map tool. Triggers on: "journey map project", "open journey map", "work on journey map", "build user journey", "react flow journey project", "journey-map app", or any request to add features like swimlanes, emotion curves, persona nodes, touchpoints, or pain point markers.

coco-research Bundle

Create branded architecture, IT current-state, flowchart, sequence, state machine, ER/data model, timeline, swimlane, quadrant, radar/spider, loop/flywheel, nested, tree, org chart, layer stack, Venn, pyramid/funnel, bar, line, Gantt and scatter charts, high-level, process, medallion, data flow, DP integration, or DP security matrix diagrams as standalone HTML/SVG/PNG. Redraw .drawio/.drawio.png/.drawio.svg or Mermaid .mmd sources at a chosen size/detail; onboard brand tokens from a website; add semantic patterns, callouts, accessible motion, or sketchy/hand-drawn styling.

coco-research Skill

Clone any website into a pixel-perfect single-file HTML prototype. Extracts design tokens, assets, CSS computed styles, interaction patterns, and content via Playwright. Outputs a self-contained HTML file with real data injection. Use when the user wants to clone, replicate, reverse-engineer, or create a pixel-perfect copy of any website or web app. Provide one or more target URLs as arguments.