majiayu000
- 75k skills
- 0 followers
- 567 repo stars
- 3 weeks ago last updated
- ▌ Auth Review · majiayu000 bundleReview authentication and authorization design including OAuth, JWT, token expiration, RBAC/ABAC, and privilege escalation risks.
- ▌ Bc Security · majiayu000 bundleImplement BigCommerce security — OAuth token management, API authentication, webhook verification, CSP, input validation, PCI compliance, and app security best practices. Use when hardening integrations or reviewing security posture.
- ▌ Better Auth · majiayu000 bundleBetter Auth is comprehensive, framework-agnostic authentication/authorization framework for TypeScript with built-in email/password, social OAuth, and powerful plugin ecosystem for advanced features.
- ▌ Blackhat Go · majiayu000 bundleGo-based security techniques from "Black Hat Go" extended with macOS, Cloud, Mobile, IoT, Supply Chain, API, Web3, AI/ML, Red Team, ATT&CK, and LLM chapters. 186 techniques, 36 tools, 33 defenses across 37 chapters. Includes adversarial bisimulation games with Ungar (order-dependent) and join-semilattice structures. AAIF-compatible multiplayer agent games for human-agent security exercises.
- ▌ Btp Ba2 CLI · majiayu000 bundleInteract with the Binarly Transparency Platform (BTP) via CLI commands for uploading firmware, running scans, downloading BA2 archives, and pushing custom rules. Use when you need to interact with the Binarly Transparency Platform or working with BA2s.
- ▌ Cybersorted · majiayu000 bundleSecurity and enterprise architecture advisory skill. Use this skill when the user needs help with cybersecurity strategy, threat modeling, risk assessment, compliance, security architecture, enterprise architecture, or governance. Trigger when the user mentions: security posture, threat model, STRIDE, PASTA, risk assessment, risk register, compliance mapping, SOC2, ISO 27001, NIST 800-53, CIS benchmarks, MITRE ATT&CK, zero trust, incident response, IR plan, security policy, architecture decision record, ADR, vendor risk, third-party risk, board briefing, security maturity, maturity assessment, gap analysis, security review, code review for security, IaC review, Terraform security, Kubernetes security, CI/CD security, API security, cloud configuration review, tabletop exercise, red team, blue team, penetration test planning, security architecture, network segmentation, defense in depth, least privilege, data classification, encryption strategy, key management, identity and access management, IAM, SIEM, SOC, vu
- ▌ Phx Deps Update · majiayu000 bundleBump outdated Hex deps — inventory, snapshot changelogs, update, fix breaks, split reviewable PRs (patches bundled, majors solo). Use to upgrade/bump Elixir dependencies or when versions fall behind. NOT for deps.get failures (/phx:investigate).
- ▌ Edr Evasion · majiayu000 bundleEDR/AV bypass — hook unhooking, direct/indirect syscalls, PPID spoofing, process injection, AMSI bypass, ETW patching, memory encryption, behavioral evasion
- ▌ Fuzzing Operations Skill · majiayu000 bundleComprehensive fuzzing operations with AFL++, libFuzzer, and OSS-Fuzz integration
- ▌ Hunt Aspnet · majiayu000 bundleHunt ASP.NET-specific surface — ViewState deserialization (signed-only vs encrypted), machineKey recovery, dual-parser MAC-bypass anti-pattern, request-validator bypass, trace.axd/elmah.axd disclosure, load-balanced ViewState cross-node failures, SafeControl enumeration via reflection, customErrors mode=Off stack-trace leaks, classic Webforms .aspx/.asmx/.svc surface. Built for ASP.NET Webforms + WCF + SharePoint farms.
- ▌ Hunt LLM AI · majiayu000 bundleHunt LLM/AI feature bugs — prompt injection, indirect injection, exfiltration via tool-use, ASCII smuggling, agentic AI security framework (ASI01-ASI10). Patterns: direct prompt injection in user input (bypass system prompt with 'ignore previous instructions'), indirect injection via documents/web pages the model reads, ASCII smuggling (Unicode tag block U+E0000-U+E007F invisible to humans, visible to model), tool-use exfiltration (model has fetch_url tool, attacker injects URL, model exfils chat history), system prompt extraction (manipulate model to reveal hidden instructions), training data extraction, IDOR-via-AI (model reads other-user data via system prompt confusion). Tools: chatbots, RAG endpoints, summarization, agentic copilots. Detection: any LLM-backed endpoint, document upload that triggers AI processing, autonomous agent with tools. Validate: cross-user data leak, system prompt revealed, tool-use exfil demonstrated. Use when hunting AI features, chatbots, RAG, agentic systems.
- ▌ Hunt Nosqli · majiayu000 bundleHunt NoSQL Injection — MongoDB operator injection ($where, $regex, $gt, $ne), CouchDB, Redis command injection, auth bypass via NoSQLi, data dump. Use when target uses MongoDB/Mongoose, CouchDB, Redis, or shows NoSQL error messages.
- ▌ Hunt Threat · majiayu000 bundleConduct proactive, hypothesis-driven threat hunting. Use when performing advanced hunting based on threat intelligence, TTPs, or anomalies. For Tier 3 analysts or dedicated threat hunters. Supports iterative search, pivoting, and comprehensive documentation.
- ▌ Jekyll Hyde · majiayu000 bundle· Review product, engineering, design, and business decisions with Jekyll/Hyde lenses. Triggers: 'jekyll', 'hyde', 'decision review', 'strategy review', 'red-team', 'dark pattern'.
- ▌ Nauth Guide · majiayu000 bundleGuides how to integrate the NAuth package for user authentication in a .NET 8 project. Use when the user wants to add authentication, configure NAuth, use IUserClient, or understand the NAuth authentication flow.
- ▌ Nist 800 53 · majiayu000 bundleNIST SP 800-53 Rev 5 compliance advisor — all 20 control families (AC, AT, AU, CA, CM, CP, IA, IR, MA, MP, PE, PL, PM, PS, PT, RA, SA, SC, SI, SR), Low/Moderate/High baseline selection, FIPS 199/200 system categorization, control tailoring and overlays, privacy controls (PT family), supply chain risk management (SR family), assessment procedures (SP 800-53A), OSCAL, RMF integration (SP 800-37), and mapping to FedRAMP, FISMA, CMMC 2.0, and ISO 27001. Use for any federal system security controls, FISMA compliance, RMF step guidance, control narrative writing, or baseline tailoring question.
- ▌ Nist AI Rmf · majiayu000 bundleExpert NIST AI Risk Management Framework (AI RMF 1.0) advisor covering all four functions: GOVERN, MAP, MEASURE, MANAGE. Use this skill whenever a user asks about NIST AI RMF, AI risk management, AI trustworthiness, GOVERN function, MAP function, MEASURE function, MANAGE function, AI RMF Playbook, AI risk profiles, responsible AI, AI bias management, AI transparency, AI explainability, AI reliability, AI safety, NIST AI 100-1, AI risk assessment, AI incident response, or alignment to EU AI Act, ISO 42001, or NIST CSF via AI RMF. Trigger even if the user doesn't say "skill" — any NIST AI RMF or AI governance risk question should use this skill.
- ▌ OAUTH Login · majiayu000 bundleComplete OAuth login flow and store tokens for verification. Use when browser verification requires authenticated sessions.
- ▌ Bknd Assign Permissions · majiayu000 bundleUse when assigning permissions to roles in Bknd. Covers permission syntax (simple strings, extended format), permission effects (allow/deny), policies with conditions, entity-specific permissions, and fine-grained access control patterns.
- ▌ Recon Osint · majiayu000 bundleComprehensive reconnaissance and OSINT — subdomain enumeration, CVE lookup, breach intelligence, DNS history, social profiling, attack surface mapping
- ▌ Rug Checker · majiayu000 bundleSolana token rug-pull risk analysis. 10-point on-chain check with visual report. Zero API keys. Read-only. Not financial advice.
- ▌ Sf Security · majiayu000 bundleAudit Apex code for CRUD/FLS violations, sharing rule compliance, SOQL injection risks, and PII exposure. Scans entire codebases for security issues that cause AppExchange review failures. Use when asked about security review, AppExchange review readiness, CRUD/FLS audit, vulnerability scanning, or code security. Activate on mentions of "security audit", "AppExchange", "CRUD/FLS", "stripInaccessible", "with sharing", or "security review".
- ▌ Vaultkeeper · majiayu000 bundleCredential rotation reminders and API key hygiene monitoring. Tracks when credentials were last rotated, reminds you to update them, and scans for leaked keys. Use when: managing API keys, maintaining security hygiene, or rotating credentials regularly. NOT for: password management (use 1Password, Bitwarden), secrets management at scale (use Vault, AWS Secrets Manager), or compliance auditing.
- ▌ Vcp Context · majiayu000 bundleInject VCP security and architecture standards into context. Run this at session start or after context compaction so the AI internalizes rules while writing code.
- ▌ Vuln Triage · majiayu000 bundleTriage a vulnerability or scanner finding — assess real severity, exploitability, and how urgently to fix. Use when asked to triage a CVE, prioritize scanner/pentest findings, assess a vuln's risk, or decide what to patch first. Produces a triage verdict: CVSS-informed severity adjusted for your context, exploitability, real risk, a fix/mitigation, and an SLA — so you fix what matters, not just what's red.
- ▌ Web Pentest · majiayu000 bundleUse when pentesting a web application or API — injection, XSS/CSP, SSRF/cloud-metadata, HTTP desync & cache poisoning, SSTI/prototype-pollution/deserialization, JWT/OAuth/GraphQL/IDOR, business logic & single-packet race
- ▌ X9 Parse Qr · majiayu000 bundleYou parse EMVCo QR content strings into their TLV structure, validate the CRC-16 checksum, and extract the X9.150 payment URL.
- ▌ X9 Template · majiayu000 bundleYou generate payment request template JSON files for testing the X9.150 specification. Templates are partial PaymentRequest payloads — qrgenerator.py adds runtime fields (id, revision, createdAt, timestamps, status, qrCodeContent, paymentNotification).
- ▌ X9 Validate · majiayu000 bundleYou validate JSON payloads against the X9.150 OpenAPI schema (spec/openapi.yaml). You auto-detect the schema type and report constraint violations with explanations.
- ▌ Agentic Share · majiayu000 bundleShared core logic for importing/exporting reusable assets into the v0.2 plugin architecture. Internal helper for agentic-import and agentic-export.
- ▌ Evolving Loop · majiayu000 bundleSelf-Evolving Development Loop - Dynamic skill generation with learning and evolution
- ▌ Janitor Audit · majiayu000 bundleShow all your installed skills. Deprecated alias — use /janitor-report --brief.
- ▌
- ▌ Janitor Usage · majiayu000 bundleShow which skills you use. Deprecated alias — use /janitor-value (which now combines usage + token cost).
- ▌ Janitor Value · majiayu000 bundleShow whether each skill is earning its context-window cost — combined tokens-used view sorted by waste. Use when the user asks 'are my skills worth it', 'what's my context budget', 'which skills are dead weight', or anything about skill value, token cost, or usage.
- ▌ Meta Optimize · majiayu000 bundleAnalyze ARIS usage logs and propose optimizations to SKILL.md files, reviewer prompts, and workflow defaults. Outer-loop harness optimization inspired by Meta-Harness (Lee et al., 2026). Use when user says "优化技能", "meta optimize", "improve skills", "分析使用记录", or wants to optimize ARIS's own harness components based on accumulated experience.
- ▌ My Skill Name · majiayu000 bundleClear description of what this skill does and when Claude should use it. Include trigger keywords users might mention.
- ▌ Optimus Prime · majiayu000 bundleGenerates a Claude Code configuration tailored to a specific project. Use whenever the user wants to prime a project, set up claude for a repo, bootstrap claude config, or re-prime/refresh an already-primed project (for example after `/prime-sync` pulled new starter content). Triggers on 'prime', 'prime this project', 'optimus-prime', 're-prime', 'refresh claude config', 'regenerate CLAUDE.md', 'set up claude for this repo'. Deeply analyzes the real codebase and builds project-specific skills, rules, and CLAUDE.md — not generic boilerplate. For ongoing config health checks and proposal review, use `self-evolve` instead.
- ▌ Skill Adapter · majiayu000 bundleExecute analyzes existing plugins to extract their capabilities, then adapts and applies those skills to the current task. Acts as a universal skill chameleon that learns from other plugins. Activates when you request "skill adapter" functionality. Use when appropriate context detected. Trigger with relevant phrases based on skill purpose.
- ▌ Prima Materia · majiayu000 bundleThe irreducible essence of 105 skills boiled to one seed. Load this, get everything. The philosopher's stone — not the recipe for making it.
- ▌ Related Skill · majiayu000 bundleDiscover and install related skills from inference.sh skill registry. Helps find complementary skills for your AI workflow. Use for: skill discovery, workflow expansion, capability exploration. Triggers: related skills, find skills, skill discovery, complementary skills, expand workflow, more capabilities, similar skills, skill suggestions
- ▌ Skill Enhance · majiayu000 bundleGuide for enhancing and improving existing skills based on conversation analysis and usage feedback. This skill should be used when the Skill Sub-Agent needs to update or strengthen an existing skill by adding new patterns, fixing issues, or improving content quality based on observed usage.
- ▌ Skill Install · majiayu000 bundleInstall Claude skills from .skill files. Use when installing a new skill provided by the user as a .skill file (which is a zip archive containing the skill directory structure).
- ▌ Skill Monitor · majiayu000 bundleAnalyze skill effectiveness across sessions. Computes per-skill metrics (action rate, friction, outcomes), identifies degrading skills, and generates improvement recommendations. Requires session-scan data in metrics.jsonl.
- ▌ Skill Sharing · majiayu000 bundleSkillshare CLI reference and sharing workflows. Use when: (1) user says "share", "push", "sync skills", "skillshare", (2) managing extras (rules, commands, agents), (3) cross-machine sync, (4) team/org sharing setup, (5) hub or audit operations, (6) .skillignore configuration, (7) new team member onboarding with skills.
- ▌ Skills Create · majiayu000 bundleExpert guidance for creating, writing, and refining Agent Skills. Use when working with SKILL.md files, authoring new skills, improving existing skills, or understanding skill structure and best practices.
- ▌ Update Skills · majiayu000 bundleCheck for and apply updates to installed skill branches from upstream.
- ▌ Calendar Core · majiayu000 bundleBackground technical reference for Apple Calendar data on macOS. Auto-loaded when any calendar-* skill executes. Contains DB path, CoreData epoch conversion, schema, canonical query, and filtering rules.
- ▌ Droid Bin Mod · majiayu000 bundle修改 droid 二进制以禁用截断。当用户提到:修改/恢复/测试 droid、press Ctrl+O、output truncated、显示完整命令或输出时触发。
- ▌ Linux Cgroups · majiayu000 bundlecgroups v2: memory limits per OpenClaw instance, CPU quotas, OOM protection, systemd slices
- ▌ Skill Refresh · majiayu000 bundleManage Claude Code resources - terminate orphaned processes and clean up ~/.claude/ directory
- ▌
- ▌ System Health · majiayu000 bundleQuery system health metrics including CPU, memory, disk usage, and running processes. Use this when the user asks about system status, performance monitoring, or resource utilization.
- ▌ Top Processes · majiayu000 bundleGet the top memory or CPU consuming processes on the system. Use this when asked about which processes are using the most resources, memory leaks, or process monitoring.
- ▌ A11Y Testing · majiayu000 bundleAutomated accessibility testing with axe-core, Playwright, and jest-axe for WCAG compliance. Use when adding or validating a11y tests, running WCAG checks, or auditing UI accessibility.
- ▌ Add Provider · majiayu000 bundleGuide for adding new AI providers to ClaudeBar using TDD patterns. Use this skill when: (1) Adding a new AI assistant provider (like Antigravity, Cursor, etc.) (2) Creating a usage probe for a CLI tool or local API (3) Following TDD to implement provider integration (4) User asks "how do I add a new provider" or "create a provider for X"
- ▌ Add UI Tests · majiayu000 bundleAdd Selenium-based UI tests for NovaTune player and admin Vue SPAs against Aspire backend
- ▌ Agentv Bench · majiayu000 bundleOptimize agents through evaluation-driven iteration. Use when asked to evaluate an agent, optimize prompts against evals, run EVAL.yaml or evals.json evaluations, benchmark agent performance, compare agent outputs across providers, analyze eval results, or improve agent performance. Supports workspace evaluation with real repos, multi-provider targets, multi-turn conversations, code judges, tool trajectory scoring, and workspace file change tracking. Use this skill whenever the user mentions evaluating, benchmarking, testing, or optimizing any agent, prompt, or skill — even if they don't explicitly say "agentv".
- ▌ API Test Gen · majiayu000 bundleSkill de generation automatique de tests API. Scanne les endpoints d'un projet (API Platform, Express, etc.) et genere des tests couvrant les cas nominaux, les erreurs, les autorisations et les cas limites. Supporte PHPUnit ApiTestCase (Symfony) et peut s'adapter a d'autres frameworks. Ce skill devrait etre utilise quand l'utilisateur veut ajouter des tests a des endpoints existants ou generer une couverture de test pour un domaine.
- ▌ Aps Doc Core · majiayu000 bundleCore documentation generation patterns and framework for Treasure Data pipeline layers. Provides shared templates, quality validation, testing framework, and Confluence integration used by all layer-specific documentation skills.
- ▌ Auto Testing · majiayu000 bundleAutomatically generate and run tests after each code change. Use when: any code is generated or modified in the pipeline. Triggers: internal use only.
- ▌ Browser Auth · majiayu000 bundleBrowser testing with agent-browser CLI and auth token injection. Loaded via test skill.
- ▌
- ▌
- ▌ Cucumber Bdd · majiayu000 bundle[Extends e2e-tester] BDD/Cucumber specialist. Use for Gherkin feature files, step definitions, Cucumber-JVM/JS, Spring/Playwright integration. Invoke alongside e2e-tester for BDD testing approach.
- ▌ Curate Tests · majiayu000 bundlePhase 2: Generate and discover tests, validate against real library. Only invoke when explicitly requested by the user or by the yoink orchestrator.
- ▌
- ▌ E2e Refactor · majiayu000 bundleRefactor existing E2E tests to use Page Object Model pattern and semantic locators. Triggers: 「テストをリファクタリング」「ロケータを改善」「Page Objectに変換」「refactor test」 Use when: Tests don't use semantic locators, Page Object pattern not applied, tests use deprecated patterns. Outputs: Updated/new Page Objects and refactored spec files.
- ▌ E2e Template · majiayu000 bundleTemplate generator for E2E test definitions. Creates structured test files for use with test-e2e skill. Triggers on keywords: e2e template, test template, create test definition
- ▌ E2e Test App · majiayu000 bundleEnd-to-end test the mobile app using Maestro - includes smoke testing, full test suites, or targeted feature testing. Use when the user wants to smoke test, E2E test, run Maestro tests, test the app, verify critical paths, or check if the app works.
- ▌ Fuzzer Skill · majiayu000 bundleUse this template for language-specific fuzzers (libFuzzer, AFL++, cargo-fuzz, etc.).
- ▌ Idor Vulnerability Testing · majiayu000 bundleThis skill should be used when the user asks to "test for insecure direct object references," "find IDOR vulnerabilities," "exploit broken access control," "enumerate user IDs or object references," or "bypass authorization to access other users' data." It provides comprehensive guidance for detecting, exploiting, and remediating IDOR vulnerabilities in web applications.
- ▌ New E2e Test · majiayu000 bundleCreate a Playwright E2E test with auth fixture, cleanup, accessibility checks, and error monitoring
- ▌ Nuxt Modules · majiayu000 bundleUse when creating Nuxt modules: (1) Published npm modules (@nuxtjs/, nuxt-), (2) Local project modules (modules/ directory), (3) Runtime extensions (components, composables, plugins), (4) Server extensions (API routes, middleware), (5) Releasing/publishing modules to npm, (6) Setting up CI/CD workflows for modules. Provides defineNuxtModule patterns, Kit utilities, hooks, E2E testing, and release automation.
- ▌ Pom Patterns · majiayu000 bundlePage Object Model patterns for Cypress tests with hierarchical structure. Covers BasePOM, DashboardEntityPOM, entity POMs, and selector integration. Use this skill when creating new POMs or extending existing ones.
- ▌ Proof Driven · majiayu000 bundleProof-driven development. Use when implementing with formal verification using property-based testing, theorem proving, or proof tactics; zero unproven property policy enforced.
- ▌ Replay Debug · majiayu000 bundleThis skill should be used when the user asks to "debug", "create test script", "analyze replay report", "why isn't my game", "test if", "verify that", "check if", "reproduce bug", "frame-by-frame", or mentions "ncrs", "replay test", "replay debugging", "snap", "assertion", or debugging game behavior via replay scripts.
- ▌ Risk Manager · majiayu000 bundleExpert risk manager specializing in comprehensive risk assessment, mitigation strategies, and compliance frameworks. Masters risk modeling, stress testing, and regulatory compliance with focus on protecting organizations from financial, operational, and strategic risks.
- ▌ Ros2 Testing · majiayu000 bundleTesting: launch_testing, gtest/pytest, rosbag2 C++/Python APIs, ros2trace profiling.
- ▌ Rust Mocking · majiayu000 bundleCreate mocks using mockall and trait-based abstractions. Use when unit testing code with external dependencies.
- ▌ Selection Q A · majiayu000 bundleAdd selection-based Q&A functionality to ChatKit UI allowing users to ask about highlighted text with proper integration.
- ▌ Vault Section · majiayu000 bundleGet the content under a specific heading in a note without reading the entire file. Triggers on "extract section", "get section", "content under heading", "section content".
- ▌ Sim Scaffold · majiayu000 bundleScaffold simulation-testable modules with sans-IO pattern, proptest state machine tests, and fault injection points — prevents retrofitting costs by making code DST-ready from the start
- ▌
- ▌ Cobuilder Tdd Pipeline · majiayu000 bundleThis skill should be used when System 3 or Guardian needs to "generate a TDD pipeline", "create a worker pipeline", "instantiate the tdd-validated template", "set up TDD execution pipeline", or when creating DOT pipeline files for test-driven worker execution. Documents the tdd-validated template and worker powers configuration.
- ▌ Team Testing · majiayu000 bundleUnified team skill for testing team. Progressive test coverage through Generator-Critic loops, shared memory, and dynamic layer selection. Triggers on "team testing".
- ▌
- ▌
- ▌ Test Doubles · majiayu000 bundleテストダブルの選択・設計・検証を一貫して整理するスキル。 依存関係の分離と検証戦略を統一し、テストの意図と可読性を高める。 Anchors: • Test-Driven Development: By Example / 適用: テストダブル選択 / 目的: テスト意図の明確化 • xUnit Test Patterns / 適用: テストパターン / 目的: ダブル設計の一貫性 Trigger: Use when choosing, designing, or validating test doubles such as mocks, stubs, fakes, or spies. test doubles, mock, stub, fake, spy
- ▌
- ▌ Test Package · majiayu000 bundleRun grok test for one or more Datagrok packages against a server host and report results
- ▌ Test Process · majiayu000 bundleGenerate `@CamundaSpringProcessTest` integration tests for a Zeebe BPMN process, with one `@Test` method per selected process path. Use when the user asks to "write process tests", "generate integration tests for a process", or "test the newsletter process". Analyzes all testable paths (happy path, gateway branches, timer expiry, message events, boundary events), lets the user select which to generate, and supports update mode to append tests to an existing class.
- ▌ Testing Data · majiayu000 bundleBuild integration tests for data access in the widget host app. Use when setting up test databases, running EF Core migrations for tests, or validating repository behavior end-to-end.
- ▌ Testing Gate · majiayu000 bundleGate 6 - Verify tests exist and cover critical paths. Issues result in WARNINGS (encourages tests, doesn't block).
- ▌ Testing Unit · majiayu000 bundleUnit: Jest/Vitest, pytest, Go test/testify, RSpec, XCTest, JUnit5. Mocking, stubs, isolation
- ▌
- ▌ Unit Testing · majiayu000 bundleUse when working with unit tests in any capacity - reading, writing, updating, planning, evaluating, or reviewing tests - applies TDD principles with focused test coverage, filtering out redundant tests while ensuring critical paths, edge cases, and state changes are verified
- ▌ Unityaiforge · majiayu000 bundleAI-powered Unity development toolkit with Model Context Protocol integration
- ▌ Verify Tests · majiayu000 bundleVerify tests by following recorded trajectories in tests-in-verification.json. Use this skill during the verify stage to independently confirm test results by re-executing recorded steps.
- ▌ Workflow Tdd · majiayu000 bundleUnified TDD workflow skill combining 6-phase TDD planning with Red-Green-Refactor task chain generation, and 4-phase TDD verification with compliance reporting. Triggers on "workflow:tdd-plan", "workflow:tdd-verify".