majiayu000
- 75k skills
- 0 followers
- 567 repo stars
- 3 weeks ago last updated
- ▌ Sdd Implement · majiayu000 bundleTask implementation skill for spec-driven workflows. Reads specifications, identifies next actionable tasks, and creates detailed execution plans. Use when ready to implement a task from an existing spec - bridges the gap between planning and coding.
- ▌ Select Agents · majiayu000 bundleDetermine risk level and select appropriate stakeholder agents for a task
- ▌ Session Index · majiayu000 bundleSearch, analyze, and synthesize across all your Claude Code sessions. Ask "what did I try last time?" and get answers with resume links.
- ▌ Todo Tracking · majiayu000 bundleBranch-scoped task system for persistent task management across sessions.
- ▌ Tool Just CLI · majiayu000 bundleThis skill should be used when the user asks to "create a justfile", "write just recipes", "configure just settings", "add just modules", "use just attributes", "set up task automation", mentions justfile, just command runner, or task automation with just.
- ▌ Using Pm Team · majiayu000 bundle10 pre-dev workflow skills + 3 research agents organized into Small Track (4 gates, <2 days) and Large Track (9 gates, 2+ days) for systematic feature planning with research-first approach.
- ▌ Vulture Sweep · majiayu000 bundleCircle high above the issue board, spotting what's dead (implemented but not closed), what's decaying (stale/outdated), and what needs consolidation. The vulture descends, cleans up the carcass, and leaves the backlog healthy. Use when your issue board needs hygiene—closing completed work, consolidating fragments, and removing decay.
- ▌ Af Quality Process · majiayu000 bundleUse when validating documentation quality, running quality checks, or auditing documentation freshness. Covers validation scripts, git-aware incremental checks, stale doc detection, and repair workflows.
- ▌
- ▌ Audit Agent Native · majiayu000 bundleRun comprehensive agent-native architecture review with scored principles
- ▌ Benefits And Leave · majiayu000 bundleDesigns and runs employee benefits and leave — health and retirement plans, leave policy, cost and renewal, and the administration that keeps them compliant. Use this to design or review a benefits package, prepare for a renewal, write leave policy, handle a leave request, or decide what benefits are worth their cost.
- ▌ Ce Deadcode Hunter · majiayu000 bundleIdentify unreachable or non-contributing source code and separate true dead code from merely untested reachable paths, with Test Quality Method Option A/B/C routing.
- ▌ Ce Devils Advocate · majiayu000 bundleAdversarially challenge cleanup and test proposals for hidden risk, weak evidence, and coverage or behavior regressions, including Option A/B/C focus-specific risks.
- ▌ Code Quality Audit · majiayu000 bundleUse when checking code quality, running security audits, testing coverage, finding SOLID/DRY violations, or setting up quality tools. Use when user says "audit this code", "check security", "run PHPStan", "code quality", "find violations", "SOLID check", "DRY check", "test coverage", "lint this", "security review", "is this production ready", "check for vulnerabilities", "code review", "grade this code". Supports Drupal (PHPStan, PHPMD, Psalm, Semgrep, Trivy, Gitleaks via DDEV) and Next.js (ESLint, Jest, Semgrep, Trivy, Gitleaks). Use proactively before deployment or after significant code changes.
- ▌ Codereview Roasted · majiayu000 bundleBrutally honest code review in the style of Linus Torvalds, focusing on data structures, simplicity, and pragmatism. Use when you want critical, no-nonsense feedback that prioritizes engineering fundamentals over style preferences.
- ▌ Csharp Code Review · majiayu000 bundleMaster C# and .NET code review patterns including async/await, LINQ optimization, dependency injection, Entity Framework, and null safety. Use PROACTIVELY when reviewing C#/.NET PRs.
- ▌
- ▌ Dependency Checker · majiayu000 bundleAnalyzes the Agent Alchemy plugin ecosystem to detect dependency issues across all plugin groups
- ▌ Enterprise Harness · majiayu000 bundleOrchestrator-facing mechanical gate with 10 checks. Runs after builder returns code, before merge. Builder cannot see or game these checks. Produces PASS/FAIL verdict with exact failure details. Use as the final quality gate before shipping.
- ▌ Exunit Code Review · majiayu000 bundleReviews ExUnit test code for proper patterns, boundary mocking with Mox, and test adapter usage. Use when reviewing _test.exs files or test helper configurations.
- ▌ Fec Validation Fix · majiayu000 bundleUse when running existing project validation commands and fixing failures after code changes, including lint, type-check, unit/integration test, build, CI, or local script failures. Do not use when the task is to design or author new component/E2E tests; Chinese triggers include 验证, 检查失败, 修复失败, CI 失败.
- ▌
- ▌ General Vs Special · majiayu000 bundleEvaluates whether interfaces are appropriately general-purpose. Use when the user asks to check interface generality, when a module has if-branches or parameters serving only one caller, when getters/setters expose internal representation, or when an interface is over-specialized. Checks general-purpose design, special-general mixture, and defaults.
- ▌ Github Code Review · majiayu000 bundleComprehensive GitHub code review with AI-powered swarm coordination
- ▌ Gitlab Code Review · majiayu000 bundlePerforms comprehensive code reviews of GitLab merge requests, analyzing code quality, security, performance, and best practices. Use when the user says "review" or "code review" or asks to review merge requests or analyze branch changes before merging.
- ▌ Green Mirage Audit · majiayu000 bundleUse when reviewing test suites, after test runs pass, or when user asks about test quality
- ▌ Information Hiding · majiayu000 bundleChecks for information leakage across module boundaries. Use when the user asks to check information hiding, when modules seem to change together, when implementation details leak across boundaries, or when structure follows execution order rather than knowledge ownership. Detects temporal decomposition and false encapsulation.
- ▌ Interface Validate · majiayu000 bundleВалидация командного интерфейса 1С. Используй после настройки командного интерфейса подсистемы для проверки корректности
- ▌ Lora Qlora Recipes · majiayu000 bundleConfigure LoRA and QLoRA supervised fine-tuning with current best-practice hyperparameters. Use when writing or reviewing a LoRA/QLoRA training configuration, choosing rank/alpha/target modules, or deciding between LoRA, QLoRA, and full fine-tuning.
- ▌ Macros Code Review · majiayu000 bundleReviews Rust macro code for hygiene issues, fragment misuse, compile-time impact, and procedural macro patterns. Use when reviewing macro_rules! definitions, procedural macros, derive macros, or attribute macros.
- ▌ Narrow Bare Rescue · majiayu000 bundleNarrow bare `rescue _ ->` / `rescue e ->` so UndefinedFunctionError, KeyError, and typos propagate instead of being swallowed. Use for auditing rescues, secure-coding review, exception review, refactoring error handling in Elixir.
- ▌ Nestjs Maintenance · majiayu000 bundle- Backend code, config, or dependencies changed and quality gates must be revalidated.
- ▌ Nextjs Code Review · majiayu000 bundleProvides comprehensive code review capability for Next.js applications, validates Server Components, Client Components, Server Actions, caching strategies, metadata, API routes, middleware, and performance patterns. Use when reviewing Next.js App Router code changes, before merging pull requests, after implementing new features, or for architecture validation. Triggers on "review Next.js code", "Next.js code review", "check my Next.js app".
- ▌ Nw Review Workflow · majiayu000 bundleDetailed review process, v2 validation checklist, and scoring methodology for agent definition reviews
- ▌ PPTX Quality Gates · majiayu000 bundleUse when validating or repairing an editable PPTX deck for geometry, accessibility, native editability, source lineage, and OOXML package integrity.
- ▌ PPTX Slide Auditor · majiayu000 bundleAudit a PowerPoint presentation for layout issues, text overflow, visual hierarchy problems, and consistency gaps. Use when asked to review a slide deck, check a presentation before a meeting, audit slides for layout problems, or QA a deck before sharing. Produces a slide-by-slide report with issues ranked by severity and specific fixes. Best used with Claude Opus 4.7 or newer for reliable slide-level vision analysis.
- ▌ Pr Threads Address · majiayu000 bundleReview all unresolved PR review threads, address them by making necessary code changes, and commit the changes appropriately.
- ▌ Pr Threads Resolve · majiayu000 bundleBulk resolve unresolved PR review threads. Useful after manually addressing threads or after using /pr-threads-address.
- ▌ Vibe Production Mindset · majiayu000 bundleSets quality expectations for implementation — "imagine this serves 1 million users." Checks for observability, error handling, input validation, graceful degradation.
- ▌ Python Code Review · majiayu000 bundleReviews Python code for type safety, async patterns, error handling, and common mistakes. Use when reviewing .py files, checking type hints, async/await usage, or exception handling.
- ▌ Python Type Safety · majiayu000 bundlePython type safety with type hints, generics, protocols, and strict type checking. Use when adding type annotations, implementing generic classes, defining structural interfaces, or configuring mypy/pyright.
- ▌ Recommending Rules · majiayu000 bundleAnalyzes codebase to find gaps in rule coverage and suggests rule improvements. Compares codebase against all indexed rules to identify missing standards. Use when setting up new projects or reviewing rule coverage.
- ▌ Review Aggregation · majiayu000 bundleGuidance on combining findings from multiple review agents into actionable recommendations
- ▌ Review Correctness · majiayu000 bundleAnalyze code for bugs and correctness problems using strict determination criteria. Returns structured findings without applying fixes. Use when the user asks to "review correctness", "scan my code for bugs", "find bugs in my changes", "look for bugs", "check for bugs", or "run a correctness review".
- ▌ Review For Quality · majiayu000 bundleComprehensive code quality review through expert perspectives (Sandi Metz, Jeremy Evans, Kent Beck, Avdi Grimm, Gary Bernhardt). Updates docs/quality_review.md with findings.
- ▌ Review Outside Box · majiayu000 bundleZoom out and find whole classes of performance, bug, or anti-pattern issues hiding in plain sight
- ▌ Review Plan Shells · majiayu000 bundleReview plan shells against their source spec: launches an internal shell review and `/peer-review` in parallel and returns combined findings. Use when the user asks to "review my plan shells", "review my shells", "check my plan shells", "critique my shells", or wants shell feedback before implementation.
- ▌ Review Prompt Plan · majiayu000 bundleReview a prompt plan against its source spec: launches an internal prompt plan review and `/peer-review` in parallel and returns combined findings. Use when the user asks to "review my prompt plan", "review my prompts", "check my prompt plan", "critique my prompts", or wants prompt plan feedback before implementation.
- ▌ Review Rust Memory · majiayu000 bundleReview and enforce Rust memory optimization patterns. Use when writing, reviewing, or debugging Rust code for memory efficiency. Covers allocation reduction, data layout, string handling, collection sizing, Copy-on-Write, arena allocation, stack vs heap tradeoffs, zero-copy parsing, memory profiling, and leak prevention.
- ▌
- ▌ Skill Quality Eval · majiayu000 bundleValidate and audit quality of AI agent slash commands (.claude/commands/*.md) — checks YAML frontmatter, description length, jargon detection, directive language, and duplicate detection. Use when creating, editing, or auditing project commands and skills. Run proactively after adding new commands.
- ▌ Spec Bugfix Verify · majiayu000 bundleBugfix verification phase - tests, quality checks, fix confirmation
- ▌ Spec Kit Checklist · majiayu000 bundleUse when a Spec Kit feature has `spec.md` and you need a requirements-quality checklist (clarity, completeness, consistency, measurability, coverage), not implementation/runtime test cases.
- ▌ Specs Code Cleanup · majiayu000 bundleProvides final code cleanup after task review approval. Removes debug logs, temporary comments, dead code, optimizes imports, and improves readability. Use when asked to clean up code, polish, finalize, tidy up, remove technical debt, or prepare code for completion after review. Not for refactoring logic or fixing bugs—focused solely on cosmetic and hygiene cleanup.
- ▌ Stakeholder Review · majiayu000 bundleUse when a deliverable needs structured stakeholder sign-off before finalization—runs the pre-read, feedback-type alignment, and conflict-resolution protocol.
- ▌ Subsystem Validate · majiayu000 bundleВалидация подсистемы 1С. Используй после создания или модификации подсистемы для проверки корректности
- ▌ Suede Rights Audit · majiayu000 bundleFind the rights gaps before packaging: ownership, splits, samples, provenance, metadata, licensing readiness, royalties, and intake blockers.
- ▌ Techspec Validator · majiayu000 bundlePhase 2.5 — Automatic TechSpec validation after generation. Verifies file paths exist, checks interface consistency, detects breaking changes, validates new dependencies, and verifies PRD→TechSpec coverage. Generates techspec-validation.md in the state directory.
- ▌ Validate Agents Md · majiayu000 bundleValidate AGENTS.md files for structural completeness, operational contract coverage, neutrality, and repository alignment.
- ▌ Verification Suite · majiayu000 bundlePlan structure validation, phase completeness checks, reference integrity verification, and artifact existence confirmation. Provides the structured verification layer ensuring GSD artifacts are well-formed and complete.
- ▌
- ▌
- ▌ Verify Persistence · majiayu000 bundleVerify persistence.xml configuration before git push. Use before pushing code to ensure persistence.xml uses environment variables instead of hardcoded JNDI names. Prevents QA deployment failures.
- ▌ Business Logic · majiayu000 bundleHunt business logic flaws — race conditions, workflow state bypass, parameter pollution affecting logic, coupon/discount abuse, refund logic, multi-step process bypass, integer overflow, negative quantities, double-spend. Use when looking for non-CVE bugs that require understanding the app's intended workflow.
- ▌ HTTP Smuggling · majiayu000 bundleHunt HTTP Request Smuggling (CL.TE, TE.CL, TE.TE, H2.CL, H2.TE, downgrade smuggling). Use when target is behind a reverse proxy / load balancer / CDN and you want to test for desync attacks that bypass front-end security controls.
- ▌ Abp Authorization · majiayu000 bundleABP permission system - PermissionDefinitionProvider, [Authorize] attribute, CheckPolicyAsync, IsGrantedAsync, ICurrentUser, IPermissionManager, multi-tenancy side. Use when working with permissions, authorization, role-based access, or security in ABP projects.
- ▌ Af Audit Security · majiayu000 bundleAudit security posture and configure vulnerability scanning for projects. Use when running OWASP compliance checks, managing secrets, or adding dependency scanning to CI pipelines.
- ▌ AI Agent Security · majiayu000 bundleSecure AI agents against prompt injection, tool abuse, and data exfiltration with defense-in-depth controls.
- ▌ API Auth Nextauth · majiayu000 bundleAuth.js (NextAuth v5) authentication patterns - configuration, providers, session strategies, middleware, database adapters, role-based access, Edge compatibility
- ▌ API Bypass Layers · majiayu000 bundleMulti-layer security architecture for API bypass (superadmin/developer). Covers authentication layers, authorization, team context, RLS policies, and three-layer bypass validation. Use this skill when implementing admin bypass features or validating security architecture.
- ▌ API Rate Limiting · majiayu000 bundleImplements API rate limiting using token bucket, sliding window, and Redis-based algorithms to protect against abuse. Use when securing public APIs, implementing tiered access, or preventing denial-of-service attacks.
- ▌ Azure Payment Hsm · majiayu000 bundleExpert knowledge for Azure Payment Hsm development including troubleshooting, best practices, decision making, architecture & design patterns, security, and configuration. Use when designing Payment HSM VNets/FastPath, payShield Manager access, HA/DR topologies, SKUs, or traffic inspection, and other Azure Payment Hsm related development tasks. Not for Azure Dedicated HSM (use azure-dedicated-hsm), Azure Key Vault (use azure-key-vault), Azure Cloud Hsm (use azure-cloud-hsm), Azure Security (use azure-security).
- ▌ Claude Tob Review · majiayu000 bundleTrail of Bits security skills analysis for Solidity contracts. Use for deep smart contract security review with invariant suggestions.
- ▌ Convex Auth Setup · majiayu000 bundleSet up Convex authentication, user mapping, authorization, and custom function wrappers for data protection.
- ▌ Convex Auth · majiayu000 bundleCore authentication patterns for Convex backends. Use when implementing auth checks in functions, storing users in database, creating auth helpers, or debugging auth issues. Works with any auth provider (Clerk, WorkOS, Auth0, etc.).
- ▌
- ▌ Crypto Compliance · majiayu000 bundleThe banned-primitive gate. Routed to when changed code hashes, signs, encrypts, derives keys, generates security-relevant randomness, configures TLS, or imports a crypto library. Rejects broken primitives, disabled TLS verification, and home-rolled crypto; the approved-primitive list lives in security-controls.md. The auth-crypto-reviewer agent is dispatched as the reviewer.
- ▌ Custom Signatures · majiayu000 bundleCreate and deploy custom IOCs, YARA rules, Sigma rules, and STIX indicators for THOR scans.
- ▌ Cyber Ir Playbook · majiayu000 bundleBuild incident response timelines and report packs from event logs. Use for detection-to-recovery reporting, phase tracking, and stakeholder-ready incident summaries.
- ▌ Dataflow Analysis · majiayu000 bundleTrack data flow between function parameters, calls, and arguments using taint analysis. Use when detecting vulnerabilities like command injection, buffer overflows, or tracing user input to dangerous functions.
- ▌ Decision Variance · majiayu000 bundleReconcile the project's architectural artifacts against the scaffold and prior decisions, then present each variance as a SMARTS analysis for the user to decide. Routed to when the user asks to arbitrate, reconcile, or consolidate architectural context, requests a variance report, mentions ADR conflicts, or asks which downstream artifacts the current state supports. Never decides alone — every arbitration is user-attributed and logged.
- ▌ Device Credential · majiayu000 bundleデバイスクレデンシャル（Device Credential）機能の開発・修正を行う際に使用。デバイスシークレット発行、JWT Bearer Grant、CIBAデバイス認証、セキュリティ実装時に役立つ。
- ▌ Df Security Audit · majiayu000 bundleScan codebase for security vulnerabilities using parallel auditor agents. Standalone — works without .planning/ state. Covers OWASP Top 10, secrets, dependency risks, auth flaws. Triggers on: "security audit", "scan for vulnerabilities", "check for secrets", "security review", "find security issues"
- ▌ Engagement Memory · majiayu000 bundleUse when recalling prior techniques at recon/weaponize, or recording a confirmed finding at report — cross-engagement pattern memory ranked by impact
- ▌ Firebase Security · majiayu000 bundleFirebase security rules patterns for Firestore and Storage. Use when writing or reviewing security rules.
- ▌ Full Triage Alert · majiayu000 bundleComplete Tier 1 triage workflow. Orchestrates the full alert triage process: check-duplicates, triage-alert, enrich-ioc for each entity, and either close (FP/BTP) or escalate (TP/Suspicious). Use for end-to-end alert processing.
- ▌ Function Analyzer · majiayu000 bundlePerform ultra-granular, per-function deep analysis to build security audit context. The sole purpose is pure context building---never identify vulnerabilities, propose fixes, or model exploits.
- ▌ Guard Users Aider · majiayu000 bundleGuardrail policy for Aider CLI: refuse catastrophic actions, require scoped approvals, and reduce secret leakage.
- ▌ Guard Users Codex · majiayu000 bundleGuardrail policy for Codex CLI: refuse catastrophic actions, require scoped approvals, and reduce secret leakage.
- ▌ Guard Users Llama · majiayu000 bundleGuardrail policy for Llama CLI: refuse catastrophic actions, require scoped approvals, and reduce secret leakage.
- ▌ HTTP Interceptors · majiayu000 bundleAngular 21+ functional HTTP interceptors for auth, error handling, loading states, retry logic, caching, and security best practices
- ▌ M365 Entra Attack · majiayu000 bundleMicrosoft 365 / Entra ID red-team attack chain — current 2026 reality. AADSTS code reference, user enumeration vectors (with hardening status), Smart Lockout math, Conditional Access bypass options, ROPC + SAML SSO browser flow, Burp/Playwright templates. Built from authorized red-team work where ROPC spray surfaced pre-existing lockouts and CA-blocked credentials, plus real-time external attacker activity correlation. Use for any M365/Entra credential attack, password spray, user enumeration, CA-bypass exploration, or active-attacker-detection scenario.
- ▌ N8n Impl Security · majiayu000 bundleUse when hardening n8n deployments or configuring security settings. Prevents credential leaks and unauthorized access by enforcing encryption, network isolation, and audit practices. Covers credential encryption (N8N_ENCRYPTION_KEY), execution data pruning, CORS, reverse proxy setup, SSL/TLS, task runners (N8N_RUNNERS_ENABLED), external secrets, security audit endpoint, Docker Secrets (_FILE suffix), and environment variable security. Keywords: n8n, security, encryption, SSL, reverse proxy, Docker, audit.
- ▌ Nextauth Patterns · majiayu000 bundleNextAuth.js v5の設定とカスタマイズパターンを専門とするスキル。 OAuth 2.0プロバイダー統合、データベースアダプター、セッション戦略、コールバック実装、型安全なセッション管理を提供する。 Anchors: • Web Application Security (Andrew Hoffman) / 適用: OAuth脅威モデリングとセッションセキュリティ / 目的: 安全な認証フロー設計 • NextAuth.js v5 Official Docs / 適用: プロバイダー設定とコールバック / 目的: 標準準拠の実装 Trigger: Use when implementing NextAuth.js authentication, configuring OAuth providers (Google, GitHub), integrating database adapters (Drizzle), designing session strategies (JWT or database-backed), customizing authentication callbacks, or adding role-based data to sessions. Keywords: nextauth, oauth, authentication, session, jwt, drizzle adapter, google oauth, github oauth
- ▌ Osint Methodology · majiayu000 bundleComprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments. Covers the 5-stage recon pipeline (seed discovery, asset expansion, enrichment, exposure analysis, reporting), asset-graph discipline with 29 asset types, severity rubric (CRITICAL/HIGH/MEDIUM/LOW/INFO), confidence upgrade workflows, time budgeting, asset-level triage rules, scale-based tactics, identity-fabric mapping (Entra/Okta/ADFS/Google/SAML/M365 Teams+SharePoint+OAuth), API and auth-map methodology, JavaScript deep analysis, mobile attack surface, cloud attack surface, breach×identity correlation, detectability tagging, detection-aware probing (back-off, persona rotation), read-only validator discipline, WAF/CDN bypass + origin discovery, vulnerability prioritization (CVE/EPSS/KEV), phishing infrastructure planning + pretext development, bug bounty submission templates, client deliverable templates with risk translation, threat-actor investigation (incl. RU/CN pivots), cryptocurrency tracing, ima
- ▌ Pentest Checklist · majiayu000 bundleThis skill should be used when the user asks to "plan a penetration test", "create a security assessment checklist", "prepare for penetration testing", "define pentest scope", "follow security testing best practices", or needs a structured methodology for penetration testing engagements.
- ▌ Pinpoint Security · majiayu000 bundleSecurity patterns, CSP nonces, input validation, auth checks, Supabase SSR patterns. Use when implementing authentication, forms, security features, or when user mentions security/validation/auth.
- ▌ Raven Investigate · majiayu000 bundleCross-codebase security detective that fans out parallel sub-agents to rapidly audit ANY codebase's security posture. The noir investigator of the grove. Use when auditing an unfamiliar codebase, offering security review services, or needing a comprehensive security posture assessment fast.
- ▌ Red Team Verifier · majiayu000 bundleThe Verification Agent — challenges Build Agent artifacts via independent verification. Executes tests against artifacts. Use to audit code, schematics, or firmware against requirements.
- ▌ Regulatory Review · majiayu000 bundleUse to assess regulatory applicability for products that may fall under AI regulation (EU AI Act, Article 50 transparency).