Results for “eval”

Captures WPA/WPA2 handshakes and performs offline password cracking using aircrack-ng, hashcat, and dictionary attacks during authorized wireless security assessments to evaluate passphrase strength and wireless network security posture.

Evaluates Google Cloud workloads against the Well-Architected Framework security pillar, identifies security requirements, and provides actionable recommendations for IAM, network security, data protection, and operational security.

Perform runtime iOS app security assessments using Objection and Frida to inspect keychain, filesystem, and memory, bypass client-side protections, and evaluate data storage, network, and authentication controls during authorized penetration tests.

Assesses organizational readiness for post-quantum cryptography migration per NIST FIPS 203/204/205 standards, performs cryptographic inventory scanning, evaluates hybrid TLS configurations, and validates CRYSTALS-Kyber and CRYSTALS-Dilithium readiness.

Verifies claims, articles, screenshots, and URLs through source-grounded analysis with an evidence ledger, source credibility evaluation, and manipulation detection. Supports quick checks, full fact-check cards, two-source comparisons, and prebunking in multiple languages and policy contexts.

Use to push call recordings into Rulebase over the REST API when the phone system has no native connection, in reviewed batches with a dry-run plan, resume and audit log. Trigger for "upload calls to Rulebase", "import call recordings", "backfill our call history into Rulebase", "get XCally calls into Rulebase", "Rulebase isn't seeing our calls", or bulk-ingesting audio for QA evaluation.

Use to verify that the chain from conversation to evaluation to decision is complete and reconstructible, so a QA score or a customer outcome can be explained months later. Trigger for "can we prove why this decision was made", "is our audit trail complete", "reconstruct how this score was produced", evidencing an AI-assisted decision, or an auditor asking how a conclusion was reached.

Reverse-engineers a federal RFP we received — given the SOW/PWS and evaluation criteria already in the Theseus KG, reconstructs the CO's hidden decision tree (upstream `sow-pws-builder` 6 scope blocks + 3 intake answers), surfaces hot buttons, ghost language, discriminator hooks, missing-section signals, and CPFF-form / Section-5 / QASP / Key-Personnel traps. USE WHEN the user asks "what scope decisions did the CO already make?", "reverse engineer this RFP", "what hot buttons are hiding in this PWS?", "where are the discriminator hooks?", "did they pick CPFF completion or term form?", "anything suspiciously missing?", or any variant of decoding CO intent. Pulls `requirement`, `deliverable`, `proposal_instruction`, `evaluation_factor`, `clause`, `performance_standard` from the active workspace KG and emits a JSON envelope feeding `proposal-generator`. DO NOT USE FOR proposal prose (`proposal-generator`), pricing (`price-to-win`), clause audit (`compliance-auditor`), or sub SOW (`subcontractor-sow-builder`).

Systematic methodology for auditing the Hermes Skills Hub (and external sources) to identify gaps, overlaps, redundancies, and conflicts when building a skill library for any project. Covers browsing, targeted searching, cross-referencing with web/GitHub, comparing candidates against existing inventory, verifying install safety, and planning installation order. Use when starting a new project and assembling tools, or when evaluating whether to add external skills beyond what's currently installed.

Use to push back-office work into Rulebase over the REST API so it can be evaluated like a conversation, with a dry-run plan, idempotent external ids and an audit log. Trigger for "send our back-office work to Rulebase", "push work items", "QA our operations team", "get case work into Rulebase", disputes or KYC queues with no customer on the line, or duplicate work items appearing after a re-run.

Live developer experience audit. Uses the browse tool to actually TEST the developer experience: navigates docs, tries the getting started flow, times TTHW, screenshots error messages, evaluates CLI help text. Produces a DX scorecard with evidence. Compares against /plan-devex-review scores if they exist (the boomerang: plan said 3 minutes, reality says 8). Use when asked to "test the DX", "DX audit", "developer experience test", or "try the onboarding". Proactively suggest after shipping a developer-facing feature. (gstack) Voice triggers (speech-to-text aliases): "dx audit", "test the developer experience", "try the onboarding", "developer experience test".

Run a comprehensive code review on local source files. Use this skill when the user asks to review, audit, inspect, evaluate, or check code, even if they never use the word "review." Does not post comments to GitHub pull requests — use post-code-review-to-pr for that. Does not analyze architectural structure or module boundaries — use architectural-analysis for that. Does not explain code or a PR to build understanding before reviewing — use code-overview for a written overview, or code-walkthrough to be paced through it one step at a time. Does not capture feedback on Han's own skills — use han-feedback for that.

Produce a standalone test plan by analyzing code for test coverage gaps and edge cases. Use when you need to create, generate, or draft a test plan for a branch, need to analyze test coverage, or need to identify what tests to write for specific files or directories. Does not produce a plain-language plan for a person to run tests by hand — use manual-test-planning for that. Does not write test code — use tdd to implement behavior test-first. Does not refine existing plans — use iterative-plan-review. Does not review code quality, security, or style — use code-review for full code review. Does not evaluate architectural testability or structural coupling — use architectural-analysis for architectural assessment.

Perform a structured audit of a codebase covering security, code quality, performance, dependencies, architecture, and testing hygiene, then produce a prioritized findings report. Use this skill whenever the user asks for a code review, code audit, security review, codebase assessment, "look over this repo", "what's wrong with this codebase", legacy-code triage, pre-acquisition technical due diligence, or any request to systematically evaluate the health of a project. Trigger even when the user is casual ("can you eyeball my repo?") — this skill imposes the structure that ad-hoc review misses. This skill audits a whole repository at a point in time — for reviewing a diff or PR use the built-in code-review skill; for security checks on pending changes use security-review.