gabrielmoreira
- 21k skills
- 0 followers
- 17 repo stars
- 2 weeks ago last updated
- ▌ Performing Cloud Forensics Investigation · gabrielmoreira bundleCollect and analyze cloud forensic evidence using AWS CLI, Azure CLI, or gcloud to snapshot volumes, capture instance metadata and security group configurations, and preserve cloud-native logs (CloudTrail, Activity Log, Audit Log). Use when investigating a suspected breach in AWS, Azure, or GCP, tracing unauthorized access through API logs, or analyzing a compromised VM, container, or serverless function.
- ▌ Performing Dynamic Analysis With Any Run · gabrielmoreira bundlePerform interactive dynamic malware analysis using the ANY.RUN cloud sandbox to detonate samples, observe real-time execution behavior, interact with malware prompts such as dialogs and CAPTCHAs, and capture process trees, network traffic, and system changes. Use when a suspicious file or URL needs live, interactive behavioral detonation in a cloud sandbox rather than static analysis alone.
- ▌ Performing Log Source Onboarding In Siem · gabrielmoreira bundlePerform structured log source onboarding into SIEM platforms (Splunk, Elastic, Sentinel, QRadar, or similar) by prioritizing sources with a tiered value framework, configuring collectors, building parsers, normalizing fields to a common schema (e.g. CIM), and validating data quality. Use when planning or executing the integration of new log sources — such as Active Directory, firewalls, EDR, VPN, DNS, or cloud audit logs — into a SIEM for security monitoring and detection.
- ▌ Performing Physical Intrusion Assessment · gabrielmoreira bundleConduct authorized physical penetration testing against facilities, server rooms, and restricted areas using tailgating, RFID badge cloning, lock bypassing, rogue network device deployment, and security-guard procedure testing. Use as part of a full-scope red team engagement to evaluate physical security controls and their path to network access, always under signed client authorization.
- ▌ Performing Privilege Escalation On Linux · gabrielmoreira bundleGuides manual enumeration and automated tooling to escalate from a low-privilege Linux user to root by exploiting misconfigurations, vulnerable services, kernel exploits, and weak permissions, mapped to MITRE ATT&CK. Use during authorized red team engagements or penetration tests once initial low-privilege access on a Linux host is obtained and root-level access is needed.
- ▌ Securing Remote Access To Ot Environment · gabrielmoreira bundleDesigns and configures secure remote access to OT/ICS environments for operators, engineers, and vendors: jump server architecture, multi-factor authentication, session recording, privileged access management, vendor access controls, and IEC 62443 / NERC CIP-005 compliance. Use when designing OT remote access architecture or configuring a jump server with privileged access management.
- ▌ Validating Backup Integrity For Recovery · gabrielmoreira bundleValidates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable/air-gapped backups for silent corruption or tampering.
- ▌ Validating Tpm Measured Boot Attestation · gabrielmoreira bundleVerifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote/tpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware/kernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.
- ▌ Redteam Subdomain Takeover Detail Pack · gabrielmoreiraDomain routing and boundary guidance for authorized subdomain takeover testing, including dangling CNAME records, NS takeover, and cloud service takeover paths such as S3, Azure, and Heroku. Use when a task belongs to the subdomain takeover domain and needs scope, evidence, pivot, or exit criteria.
- ▌ Threejs Raymarched Space Effects · gabrielmoreira bundleBuild raymarched space phenomena in Three.js. Use for black-hole lensing, accretion disks, wormhole throat transits, curved-ray and null-geodesic integration, lensed celestial spheres, procedural star fields and galactic skies, relativistic-looking distortion, bounded volumetric structures, and GPU effects that need controlled numerical integration.
- ▌ Syncfusion Maui Toolkit Date Picker · gabrielmoreira bundleImplements Syncfusion .NET MAUI DatePicker (SfDatePicker) control for date selection. Use when implementing date pickers, adding date selection UI, or working with SfDatePicker control. Covers date picker appearance customization (headers, footers, columns), date formatting (20+ predefined formats), date restrictions (min/max dates, blackout dates), and picker modes (Dialog, RelativeDialog).
- ▌ Syncfusion Maui Toolkit Time Picker · gabrielmoreira bundleImplements Syncfusion .NET MAUI TimePicker (SfTimePicker) control. Use when implementing time selection, time picker controls, or time input UI in .NET MAUI. This skill covers installation, configuration, time formats (14 predefined formats), picker modes (Dialog/RelativeDialog), intervals, time restrictions, looping, events, and customization.
- ▌ Tactical Ddd · gabrielmoreira bundleDetects anemic domain models, validates and refactors them into rich domain models, and enforces tactical DDD patterns (Entities, Value Objects, Aggregates, Domain Services, Domain Events). Use when the user asks to validate, review, or check domain models or DDD code; detect anemia; refactor domain objects; improve encapsulation; or mentions terms like "anemic model", "rich domain", "aggregate", "value object", "domain event", "ubiquitous language", "is this good DDD", "does this follow DDD", or "check my domain". Do NOT use for module or service boundary design, architectural decomposition, strategic DDD context mapping, or code outside the domain layer (DTOs, controllers, infrastructure adapters).
- ▌ Cloudbase Declarative Deploy · gabrielmoreiraCloudBase declarative deployment from a cloudbaserc config (声明式部署, 配置式部署, cloudbaserc 部署) through the deployApply / deployPlan MCP tools. Use when deploying database, functions, app, hosting, or gateway resources described in cloudbaserc.json/yaml as a single desired-state config, when a user wants a dry-run plan before applying, or when handling multi-environment deploys via mode / envOverrides. Covers plan-then-apply flow (deployPlan dry-run → deployApply confirm=true), envId resolution priority, only/skip filtering, concurrency, and continueOnError. Prefer deployPlan before deployApply; do not confuse with per-resource tcb CLI deploy or single-function deploy.
- ▌ Cloudbase Wechat Integration · gabrielmoreiraCloudBase WeChat integration guide for Mini Program WeChat Pay, Mini Program virtual payment (虚拟支付, wx.requestVirtualPayment), Official Account JSAPI Pay, Native QR-code Pay, Official Account OAuth, openid handling, payment callbacks, and CloudBase Integration Center generated functions. This skill should be used when users ask to add, debug, or extend WeChat payment, virtual payment, or official-account flows on CloudBase.
- ▌ Cairo Vulnerability Scanner · gabrielmoreiraScans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects.
- ▌ Ima Skill · gabrielmoreira bundle统一的 IMA OpenAPI 技能,支持笔记管理和知识库操作。 当用户提到知识库、资料库、笔记、备忘录、记事,或者想要上传文件、添加网页到知识库、 搜索知识库内容、搜索/浏览/创建/编辑笔记时,使用此 skill。 即使用户没有明确说"知识库"或"笔记",只要意图涉及文件上传到知识库、网页收藏、 知识搜索、个人文档存取(如"帮我记一下"、"搜一下知识库里有没有XX"),也应触发此 skill。
- ▌ Agents Swarm Orchestration · gabrielmoreiraCoordinates multi-agent execution across subagents, teams, and workflows. Use when planning dependency-aware fan-out, verifier passes, runtime selection, or Loop Engineering.
- ▌ AI Product Operating Model · gabrielmoreiraDesigns operating models for AI in product teams. Use when planning platform ownership, provider strategy, data boundaries, evals, or sensitive-data controls.
- ▌ Data Analytics Engineering · gabrielmoreiraBuilds analytics engineering layers for metrics, contracts, and BI-ready models. Use when shaping dbt or SQLMesh marts, metric governance, lineage, or data quality.
- ▌ Foundations Control Theory · gabrielmoreiraControl-theory primitives for PID, MPC, Kalman, stability, anti-windup, dead-time, breakers, and limits. Use when tuning autoscaling, retries, or agent loops.
- ▌ Software Email Engineering · gabrielmoreiraDesigns transactional email systems and send infrastructure. Use when implementing resets, receipts, deliverability controls, templates, or inbound email handling.
- ▌ Auditing GCP Iam Permissions · gabrielmoreiraAuditing Google Cloud Platform IAM permissions to identify overly permissive bindings, primitive role usage, service account key proliferation, and cross-project access risks using gcloud CLI, Policy Analyzer, and IAM Recommender.
- ▌ Bypassing Restricted Shells · gabrielmoreiraEscaping restricted shells (rbash, rksh, lshell), chroot jails, and language sandboxes (Lua, Python) during authorized engagements, plus bypassing command filters and bad-character / WAF restrictions to obtain arbitrary command execution from a constrained shell environment.
- ▌ Performing Macos Red Teaming · gabrielmoreiraConducting red team operations against macOS fleets during authorized engagements by abusing MDM platforms (JAMF, Kandji), MDM enrollment trust, Active Directory integration, the macOS Keychain, OneLogin/SSO-linked external services, and Safari auto-open behavior to move laterally and establish command-and-control across managed Macs.
- ▌ Pentesting Imap · gabrielmoreiraTesting IMAP services (default ports 143 cleartext, 993 IMAPS) for weak/default credentials and brute force, NTLM info disclosure, cleartext credential exposure, capability enumeration, and authenticated mailbox access/data extraction via raw IMAP commands and curl during authorized engagements.
- ▌ Pentesting Ipmi · gabrielmoreiraTesting IPMI / BMC out-of-band management interfaces (default 623/UDP, sometimes TCP) for the cipher-zero authentication bypass, RAKP password-hash retrieval, anonymous/default BMC credentials, cleartext password storage, and host takeover via KVM/SOL during authorized engagements.
- ▌ Pentesting Ldap · gabrielmoreiraTesting LDAP / LDAPS directory services (389, 636, and Global Catalog 3268/3269) including Active Directory during authorized engagements. Covers anonymous/null bind enumeration, naming-context discovery, user/group/computer extraction with ldapsearch and netexec, credentialed domain dumping (ldapdomaindump, windapsearch, BloodHound), cleartext credential sniffing, writable-attribute abuse (sshPublicKey), and harvesting bind creds from client configs.
- ▌ Pentesting Pop3 · gabrielmoreiraTesting POP3 services (default ports 110 cleartext, 995 POP3S) for weak/default credentials and brute force, NTLM info disclosure, cleartext credential exposure, capability enumeration, and authenticated mailbox retrieval/data extraction via raw POP3 commands during authorized engagements.
- ▌ Pentesting Smtp · gabrielmoreiraTesting SMTP services (default ports 25, 465/SSL, 587/submission) for open relays, user enumeration (VRFY/EXPN/RCPT), NTLM info disclosure, weak/no authentication, SPF/DKIM/DMARC spoofing gaps, Secure Email Gateway bypass, and SMTP smuggling during authorized engagements.
- ▌ Pentesting Snmp · gabrielmoreiraTesting SNMP services (default 161/UDP for agents, 162/UDP for traps, 10161/10162 over TLS/DTLS) for default/guessable community strings, sensitive MIB/OID data harvesting, writable rwcommunity strings, and SNMP-to-RCE via NET-SNMP-EXTEND-MIB during authorized engagements.
- ▌ Pentesting Tftp · gabrielmoreiraTesting TFTP services (default port 69/UDP) for unauthenticated file read/write, default path enumeration (no directory listing), exposure of device configuration files and ROM/firmware images, and arbitrary upload during authorized engagements.
- ▌ Pentesting Voip · gabrielmoreiraTesting VoIP / SIP infrastructure (default 5060/UDP+TCP, 5061/TLS, RTP media on high UDP ports) for endpoint and extension enumeration, REGISTER/digest credential cracking, unauthenticated INVITE toll fraud, SIP Digest Leak, RTP eavesdropping, and Asterisk PBX misconfiguration abuse during authorized engagements.
- ▌ Deepseek Harness · gabrielmoreiraLet the OpenCode host delegate code review, development, and research tasks to DeepSeek Harness.
- ▌ Sentry Issue Investigation · gabrielmoreiraInvestigate a Sentry issue from bounded event, stack, tag, environment, release, and timeline evidence before proposing a code change.
- ▌ Beads Workflow · gabrielmoreira bundleConvert markdown plans into beads with dependencies using br CLI. Use when creating task graphs, polishing beads before implementation, or bridging planning to agent swarm execution.
- ▌ Agent Evaluation · gabrielmoreiraTesting and benchmarking LLM agents including behavioral testing, capability assessment, reliability metrics, and production monitoring—where even top agents achieve less than 50% on real-world benchmarks
- ▌ Agent Governance · gabrielmoreiraPatterns for adding safety, trust, and policy enforcement to AI agent systems -- control which tools agents can call, what content they process, and maintain accountability through audit trails.
- ▌ RAG Architecture · gabrielmoreiraBuild retrieval-augmented generation systems that ground LLMs in your data.
- ▌ Kdp Publishing · gabrielmoreiraAmazon KDP self-publishing specs — cover requirements, interior formatting, spine formulas, ink options, and pricing tiers
- ▌
- ▌ Cloudflare Email Service · gabrielmoreiraImplement or troubleshoot Cloudflare Email Sending and Email Routing integrations and their delivery configuration.
- ▌ Source Command Track Mentions · gabrielmoreira bundleSearch for new online mentions of the Claude Code Ultimate Guide or Florian Bruniaux's public project portfolio and update the relevant tracker
- ▌ Roblox Studio Workflow · gabrielmoreira bundleModify living Roblox Studio projects safely: inspect Explorer and execution locations, preserve existing structure, reuse modules/remotes, create meaningful Instances, apply Attributes and CollectionService tags, test server/client and multiple devices, inspect Output, and remove experiments/debug objects. Use when an agent edits a place or rbxl/rbxlx/Rojo project, operates in Studio, adds Scripts/LocalScripts/ModuleScripts, or must verify a Roblox change in context.
- ▌
- ▌ Kiro Verify Completion · gabrielmoreiraVerify completion and success claims with fresh evidence. Use before claiming a task is complete, a fix works, tests pass, or a feature is ready for GO.
- ▌ Analyzing Marketing Campaign · gabrielmoreiraAnalyze weekly marketing campaign performance data across channels. Use when analyzing multi-channel digital marketing data to calculate funnel metrics (CTR, CVR) and compare to benchmarks, compute cost and revenue efficiency metrics (ROAS, CPA, Net Profit), or get budget reallocation recommendations based on performance rules.
- ▌ Hyperflow · gabrielmoreiraUse when applying Hyperflow's orchestration doctrine in Codex, Antigravity, Grok, or another single-agent surface. Auto-invoke for non-trivial engineering work: build, implement, add, refactor, debug, fix, review, audit, plan, scope, design, brainstorm, ship, or deploy. Trigger with /hyperflow:hyperflow, "use hyperflow", "apply the doctrine", or automatically on any task-shaped message.
- ▌ Atlas Report · gabrielmoreiraRender agent findings as a styled HTML report in the browser. Use when asked for "full report", "detailed report", "show in browser", or when CLI output exceeds the 40-line budget.
- ▌ Cortex Model · gabrielmoreiraBuild an ML pipeline — from data to trained model to serving endpoint. Use when asked to "build ML model", "train a model", "prediction pipeline", "classification", or "regression".
- ▌ Cortex Recon · gabrielmoreiraML reconnaissance — inventory all models, pipelines, data sources, and monitoring. Use when asked "what ML do we have", "model inventory", or "ML assessment".
- ▌ Deal Pricing · gabrielmoreiraDesign pricing strategy and packaging — tiers, value metrics, enterprise pricing, freemium design, and pricing page copy. Use when asked to "design our pricing", "should we change our price", "how do we package the product", or "what should we charge enterprise".
- ▌ Draft Review · gabrielmoreiraUsability review — evaluate an existing flow or UI against usability heuristics, flag friction points, and recommend fixes. Use when asked to "review the UX", "usability audit", "what's wrong with this flow", "UX feedback", "critique this design", or "why are users dropping off here".
- ▌ Echo Segment · gabrielmoreiraUser segmentation and persona creation from mixed data sources — analytics, CRM, support tickets, reviews, or any combination. Use when asked to "build personas", "who are our users", "segment our users", "create user profiles", "define user archetypes", or "who is the target user".
- ▌ Flux Migrate · gabrielmoreiraBuild zero-downtime database migrations — forward SQL, rollback SQL, deployment sequence. Use when asked to "write migration", "schema change", "add column", "rename table", "drop column", or "migrate safely".
- ▌ Form Palette · gabrielmoreiraUse when asked to generate a color palette, create industry-matched colors, or pick colors for a product type. Examples: "color palette for fintech", "healthcare app colors", "SaaS brand colors"
- ▌ Helm Arbiter · gabrielmoreiraScope arbitration — resolve disagreements between product and engineering on what is in or out of scope, with a decision log and escalation path. Use when asked to "resolve this scope disagreement", "arbitrate between product and eng", "scope is creeping", "we can't agree on what's in scope", or "help us decide what to cut".
- ▌ Helm Handoff · gabrielmoreiraUse when a product brief is finalized and ready to hand off to the engineering team, or when asked to send a brief to Apex, kick off engineering work, or start development on a product spec. Examples: "hand this off to engineering", "send brief to Apex", "start building this", "kick off dev on this spec".
- ▌ Ink Calendar · gabrielmoreiraBuild a content calendar — editorial plan, publishing cadence, topic assignment, and distribution workflow. Use when asked to "build a content calendar", "plan our content for the quarter", "how often should we publish", or "create an editorial schedule".
- ▌ Keep Onboard · gabrielmoreiraOptimize customer onboarding — map the activation sequence, identify drop-off points, design the aha moment, and produce the onboarding email sequence. Use when asked to "fix onboarding", "improve activation", "time-to-value is too slow", or "customers aren't getting started".
- ▌ Lens Metrics · gabrielmoreiraProduce a complete metrics definition doc — metric name, formula, data source, segmentation, SQL or event tracking spec, and what good/bad looks like. Given a product area, outputs the full metrics spec. Use when asked to "define KPIs", "metrics framework", "what should we measure", "north star metric", or "instrument this feature".
- ▌ Lumen Abtest · gabrielmoreiraA/B test design — produce an experiment spec with hypothesis, primary metric, MDE, sample size, run time, and decision rule. Also determines when NOT to A/B test and what to do instead. Use when asked to "design an A/B test", "should we test this", "experiment design", "how do we know if this works", "what's the sample size", or "set up an experiment".
- ▌ Lumen Funnel · gabrielmoreiraUse when asked to analyze a funnel, find where users drop off, diagnose low conversion or activation rates, design a metrics framework, set up OKRs, or measure whether a feature is working. Examples: "analyze our funnel", "why is activation low", "where are users dropping off", "design OKRs for this quarter", "is this feature working", "set up metrics for this launch".
- ▌ Pave Catalog · gabrielmoreiraBuild a service catalog — schema, starter entries, and governance model. Produces what information to capture per service, how it's maintained, and where it lives. Use when asked to "service catalog", "what services do we have", "catalog our services", "service inventory", or "who owns what".
- ▌ Proof Design · gabrielmoreiraDesign QA audit — red flags, severity classification, visual quality scorecard. Use when asked to "QA the design", "check visual quality", "design review before launch", "visual bugs", "design audit", or "does this look right".
- ▌ Relay Deploy · gabrielmoreiraSet up a complete deployment configuration — Dockerfile, deployment manifest, environment config, and rollback procedure. Use when asked about "deployment setup", "how do I deploy this", "deployment strategy", or "rollback plan".
- ▌ Spine Design · gabrielmoreiraProduce a system design doc — components, data flow, decisions made, tradeoffs, failure modes. Not a list of options. An actual design with calls made. Use when asked for "system design for", "architect this", "how should we build", or "design the backend".
- ▌ Dolt MCP Vcs · gabrielmoreiraUniversal Dolt version-control workflow. Step 0 auto-detects what kind of Dolt stack is present — every make and model (classic Dolt repo, live dolt sql-server on its ACTUAL bound port, bd embedded store, Doltgres, DoltLite single-file DB, DumboDB) — and emits a ready-to-use connection descriptor, then routes to work: DoltHub visibility diagnosis (no remote configured), the bd dolt remote add plus push fix, the JSONL throttle and rapid-write-race safe pattern, and expert agents for sync, epic-closure audits, dependency mapping, and recovery. Use when working with any Dolt database, detecting a Dolt flavor, connecting to a Dolt store, when beads are not showing in DoltHub, taming dolt server sprawl, auditing bead epics, or recovering from a bd or Dolt incident. Trigger with "/dolt-mcp-vcs", "/beads-dolt" (the former name, still accepted), "what kind of dolt is this", "my beads aren't showing in DoltHub", or "audit my bead epics".
- ▌ Servicegraph · gabrielmoreiraThe branded entry point to ServiceGraph — use whenever the user explicitly names **ServiceGraph** — "use ServiceGraph to…", "what datasets does ServiceGraph have", "search ServiceGraph for…", "pull contacts from ServiceGraph for these domains", "how many credits do I have on ServiceGraph". ServiceGraph is a multi-dataset platform of metrics-enriched business data for founders — where to launch, who to email, who to hire. This skill explains how to drive the API (api.servicegraph.co / mcp.servicegraph.co) against ANY dataset — discover what datasets exist, discover a dataset's schema and filters, search free brief rows, and unlock contact + metric detail with credits. Dataset-agnostic by design — it discovers everything through the API at runtime. When the user describes an intent WITHOUT naming ServiceGraph (e.g. "find a PR agency in NY"), defer to the matching specific skill (find-pr-agency, find-marketing-agency, find-law-firm, …). Skip non-US firms, consumer/personal services, and individual freelancers.
- ▌ X Bug Triage · gabrielmoreiraAnalyzes public X/Twitter complaints to detect, cluster, and triage bugs with repo evidence and owner routing. Use when monitoring product health from social signals. Trigger with "/x-bug-triage" or "triage X bugs for @account". Make sure to use this skill whenever triaging bugs from X/Twitter mentions.
- ▌ Adobe Reference Architecture · gabrielmoreiraImplement Adobe reference architecture for production integrations covering Firefly Services, PDF Services, I/O Events, and App Builder with layered project layout, error boundaries, and health monitoring. Trigger with phrases like "adobe architecture", "adobe project structure", "how to organize adobe", "adobe layout", "adobe best practices".
- ▌ Anima Reference Architecture · gabrielmoreiraImplement reference architecture for Anima design-to-code automation. Use when designing a design system automation pipeline, structuring a Figma-to-React project, or planning team-scale design handoff. Trigger: "anima architecture", "design-to-code architecture", "anima project structure", "figma automation architecture".
- ▌ Apify Reference Architecture · gabrielmoreira bundleProduction-grade architecture patterns for Apify-powered applications. Use when designing scraping infrastructure, building multi-Actor pipelines, or integrating Apify into a larger system architecture. Trigger with "apify architecture", "apify best practices", "apify project structure", "scraping architecture", "apify system design".
- ▌ Apple Notes Incident Runbook · gabrielmoreiraIncident response runbook for Apple Notes automation failures. Trigger: "apple notes incident".
- ▌ Assemblyai Upgrade Migration · gabrielmoreiraAnalyze, plan, and execute AssemblyAI SDK upgrades with breaking change detection. Use when upgrading the assemblyai npm package, migrating from the old SDK, or switching between speech models (Best, Nano, Universal). Trigger with phrases like "upgrade assemblyai", "assemblyai migration", "assemblyai breaking changes", "update assemblyai SDK".
- ▌ Attio Reference Architecture · gabrielmoreiraProduction reference architecture for Attio CRM integrations -- layered project structure, sync patterns, webhook processing, and multi-environment setup. Trigger: "attio architecture", "attio best practices", "attio project structure", "how to organize attio", "attio integration design".
- ▌ Auditing Python Dependencies · gabrielmoreira bundleAudit a Python project's installed dependencies for known CVEs by wrapping pip-audit (PyPA's official vulnerability auditor) and emitting findings in the canonical penetration-tester schema. Detects vulnerable direct AND transitive packages, normalizes pip-audit's severity output via OSV severity bands, falls back to pip list --outdated when pip-audit isn't installed, and supports requirements.txt, pyproject.toml (PEP 621), Pipfile.lock, and poetry.lock as input sources. Use when: pre-merge gate on a Python project, post-incident sweep after a PyPI compromise (e.g. ctx, request-toolbelt typosquats, ultralytics 8.3.42 compromise), SOC2 evidence collection, or inheriting an unfamiliar Python codebase. Threshold: any HIGH or CRITICAL CVE in the resolved dependency tree. MODERATE / LOW reported informationally. Trigger with: "audit python deps", "pip vulnerability scan", "check pypi packages for CVEs", "pip-audit run".
- ▌ Brightdata Upgrade Migration · gabrielmoreiraAnalyze, plan, and execute Bright Data SDK upgrades with breaking change detection. Use when upgrading Bright Data SDK versions, detecting deprecations, or migrating to new API versions. Trigger with phrases like "upgrade brightdata", "brightdata migration", "brightdata breaking changes", "update brightdata SDK", "analyze brightdata version".
- ▌ Canva Reference Architecture · gabrielmoreiraImplement Canva Connect API reference architecture with best-practice project layout. Use when designing new Canva integrations, reviewing project structure, or establishing architecture standards for Canva applications. Trigger with phrases like "canva architecture", "canva project structure", "how to organize canva", "canva layout", "canva reference".
- ▌ Clade Reference Architecture · gabrielmoreira bundleBuild Claude Code plugins — skills, agents, MCP servers, hooks, and slash commands. Use when working with reference-architecture patterns. The complete guide to extending Claude Code with the Anthropic plugin system. Trigger with "claude code plugin", "build a skill", "create mcp server", "anthropic plugin architecture", "claude code hooks".
- ▌ Clari Reference Architecture · gabrielmoreiraReference architecture for Clari revenue intelligence integrations. Use when designing a forecast data platform, planning Clari integration architecture, or establishing team patterns for revenue analytics. Trigger with phrases like "clari architecture", "clari data platform", "clari integration design", "clari best practices".
- ▌ Clerk Reference Architecture · gabrielmoreira bundleReference architecture patterns for Clerk authentication. Use when designing application architecture, planning auth flows, or implementing enterprise-grade authentication. Trigger with phrases like "clerk architecture", "clerk design", "clerk system design", "clerk integration patterns".
- ▌ Clickhouse Upgrade Migration · gabrielmoreira bundleUse when upgrading ClickHouse server versions or the @clickhouse/client SDK, handling breaking changes between versions, or migrating from older client libraries — covers version checks, changelog review, staged upgrade, post-upgrade validation, and rollback. Trigger with phrases like "upgrade clickhouse", "clickhouse version upgrade", "update clickhouse client", "clickhouse breaking changes", "new clickhouse version".
- ▌ Coderabbit Upgrade Migration · gabrielmoreiraUpdate CodeRabbit configuration for new features, migrate between plans, and adopt new capabilities. Use when CodeRabbit releases new features, upgrading from Free to Pro plan, or updating .coderabbit.yaml schema for new options. Trigger with phrases like "upgrade coderabbit", "coderabbit new features", "update coderabbit config", "coderabbit plan upgrade", "coderabbit changelog".
- ▌ Coreweave Deploy Integration · gabrielmoreiraDeploy inference services on CoreWeave with Helm charts and Kustomize. Use when deploying multi-model inference, managing GPU deployments at scale, or templating CoreWeave manifests. Trigger with phrases like "deploy coreweave", "coreweave helm", "coreweave kustomize", "coreweave deployment patterns".
- ▌ Coreweave Fabric Diagnostics · gabrielmoreira bundleDiagnose the most expensive silent failure on a CoreWeave multi-node GPU job: GPUDirect RDMA falling back from InfiniBand to TCP. When NCCL drops from NET/IB to NET/Socket, collectives keep running with NO error but throughput collapses (commonly 5-20x slower) while every GPU still bills at full rate — 5x the GPU bill for the same work, invisibly. Paste an NCCL_DEBUG=INFO log (and/or a pod-spec, ibstat, or all_reduce_perf output) and the bundled deterministic script verdicts whether RDMA is actually engaged, which of the three required conditions is missing, and the fix. Use when multi-node training is slow, when checking whether RDMA/InfiniBand is engaged, or when all-reduce bandwidth looks low. Trigger with "coreweave slow training", "is RDMA working", "NCCL fell back to TCP", "NET/Socket", "GPUDirect RDMA", "infiniband not used", "multi-node training slow".
- ▌ Coreweave Gpu Node Forensics · gabrielmoreira bundleTriage a dead or degraded GPU on a CoreWeave node fast — decide reschedule vs GPU-reset vs node-reboot vs RMA from an Xid code or a pasted dmesg / nvidia-smi blob, so a bad card does not silently kill a multi-day training run. Use when a GPU throws an Xid error, a node "fell off the bus", a training run stalls or NCCL hangs on one rank, or you need to know whether to replace, reset, or just reschedule. Trigger with "xid error", "gpu fell off the bus", "coreweave gpu dead", "should I RMA this GPU", "gpu node triage".
- ▌ Coreweave Performance Tuning · gabrielmoreiraOptimize CoreWeave GPU inference latency and throughput. Use when reducing inference latency, maximizing GPU utilization, or tuning batch sizes and concurrency. Trigger with phrases like "coreweave performance", "coreweave latency", "coreweave throughput", "optimize coreweave inference".
- ▌ Cursor Extension Integration · gabrielmoreira bundleIntegrate VS Code extensions with Cursor IDE: compatibility, Open VSX registry, VSIX installation, conflict resolution, and essential extensions. Triggers on "cursor extensions", "cursor vscode extensions", "cursor plugins", "cursor marketplace", "open vsx", "vsix install".
- ▌ Customerio Upgrade Migration · gabrielmoreira bundlePlan and execute Customer.io SDK upgrades and migrations. Use when upgrading customerio-node versions, migrating from legacy APIs, or updating to new SDK patterns. Trigger: "upgrade customer.io", "customer.io migration", "update customer.io sdk", "customer.io breaking changes".
- ▌ Databricks Cluster Forensics · gabrielmoreira bundleDiagnose broken or unexplained Databricks compute — slow cold starts, failed cluster launches, Photon paying its premium without the speedup, DBR-upgrade landmines, and spot-interruption shuffle aborts — by correlating a cluster's live event stream across API surfaces. Use when a Databricks cluster won't start, died mid-run, is randomly slow to start, when planning a Databricks Runtime upgrade, or when a job keeps failing on spot loss. Trigger with "databricks cluster won't start", "cluster failed", "why is my cluster slow", "NPIP_TUNNEL_SETUP_FAILURE", "databricks runtime upgrade", "photon not helping".
- ▌ Deepgram Migration Deep Dive · gabrielmoreira bundleDeep dive into migrating to Deepgram from other transcription providers. Use when migrating from AWS Transcribe, Google Cloud STT, Azure Speech, OpenAI Whisper, AssemblyAI, or Rev.ai to Deepgram. Trigger: "deepgram migration", "switch to deepgram", "migrate transcription", "deepgram from AWS", "deepgram from Google", "replace whisper with deepgram".
- ▌ Detecting Database Deadlocks · gabrielmoreira bundleProcess use when you need to work with deadlock detection. This skill provides deadlock detection and resolution with comprehensive guidance and automation. Trigger with phrases like "detect deadlocks", "resolve deadlocks", or "prevent deadlocks".
- ▌ Documenso Deploy Integration · gabrielmoreira bundleDeploy Documenso integrations across different platforms and environments. Use when deploying to cloud platforms, containerizing applications, or setting up infrastructure for Documenso integrations. Trigger with phrases like "deploy documenso", "documenso docker", "documenso kubernetes", "documenso cloud deployment".
- ▌ Documenso Performance Tuning · gabrielmoreira bundleOptimize Documenso integration performance with caching, batching, and efficient patterns. Use when improving response times, reducing API calls, or optimizing bulk document operations. Trigger with phrases like "documenso performance", "optimize documenso", "documenso caching", "documenso batch operations".
- ▌ Elevenlabs Upgrade Migration · gabrielmoreira bundleUpgrade ElevenLabs SDK versions and migrate between API model generations. Use when upgrading the elevenlabs-js or elevenlabs Python SDK, migrating from v1 to v2 models, or handling deprecations across the JS package rename and model ID changes. Trigger with: "upgrade elevenlabs", "elevenlabs migration", "elevenlabs breaking changes", "update elevenlabs SDK", "migrate elevenlabs model", "eleven_v3 migration".
- ▌ Evernote Migration Deep Dive · gabrielmoreira bundleDeep dive into Evernote data migration strategies. Use when migrating to/from Evernote, bulk data transfers, or complex migration scenarios. Trigger with phrases like "migrate to evernote", "migrate from evernote", "evernote data transfer", "bulk evernote migration".
- ▌ Exa Advanced Troubleshooting · gabrielmoreiraApply advanced debugging techniques for hard-to-diagnose Exa issues. Use when standard troubleshooting fails, investigating latency spikes, or preparing evidence bundles for Exa support escalation. Trigger with phrases like "exa hard bug", "exa mystery error", "exa deep debug", "difficult exa issue", "exa latency spike".
- ▌ Figma Reference Architecture · gabrielmoreira bundleReference architecture for production Figma API integrations. Use when designing a new Figma integration, planning project structure, or establishing patterns for design-to-code pipelines. Trigger with phrases like "figma architecture", "figma project structure", "figma integration design", "figma best practices layout".
- ▌ Finta Reference Architecture · gabrielmoreiraReference architecture for fundraising operations with Finta CRM. Trigger with phrases like "finta architecture", "finta fundraising stack".