← all publishers

xuanjgcarryyou

@xuanjgcarryyou source repo

Report this profile Claim this profile

• 16 skills
• 0 followers
• 10 hours ago last updated

1. ▌
   Writing Business Plan · xuanjgcarryyou

   Generates a structured Business Plan document from a product concept, startup idea, platform concept, or new venture proposal. TRIGGER when the user says "幫我寫創業計畫書", "幫我把這個想法寫成提案", "這個創業項目怎麼規劃", "幫我分析這個創業模式", "我想做 X，幫我想清楚創業邏輯", "幫我寫一份可以去募資的文件", "write a business plan", "help me plan this business", "analyze the business model", "turn this idea into a proposal", or "create a go-to-market strategy document". Do NOT trigger for: system requirement specs (→ writing-srs), financial model simulations, or users who only want to explore market trends without a deliverable.
   0 installs
2. ▌
   Implementation Planner · xuanjgcarryyou bundle

   Technical execution architect that turns architecture specs into executable implementation plans. Triggers when an architecture or system design is ready and needs to be broken into build tasks. TRIGGER on: "how do we build this", "let's plan the implementation", "break this into tasks", "how should we tackle each component", "split this for subagents", "what's the build plan", "give me a task breakdown", "research the best approach for each part", "plan how to implement this spec", "make this executable", or when an architecture spec was just produced and the user wants to move to implementation. This skill sits AFTER idea-refiner and BEFORE code generation.
   0 installs
3. ▌
   Orchestrating Hackathon · xuanjgcarryyou bundle

   Hackathon orchestrator for two-day team competitions. Coordinates problem framing, architecture design, and task generation for 3-person teams — from raw prompt to parallel execution packages. TRIGGER on: "黑客松開始", "hackathon start", "題目是…", "幫我破題", "我們要參加黑客松", "hackathon theme", "two-day hackathon", "幫我規劃黑客松", "我們怎麼好", "幫我們分工", or whenever the user pastes a hackathon problem statement and wants to plan, scope, or assign work. ALSO trigger when a team needs to go from competition prompt → architecture → parallel task packages. This skill runs four stages: Problem Framing → Architecture Design → Task Generation (fresh session) → Interrupt Handling (any time). Does NOT write feature code, business logic, UI, or migrations.
   0 installs
4. ▌
   Debugging Systematically · xuanjgcarryyou bundle

   Runs a structured root-cause analysis protocol when a bug resists quick fixes. Invoke this skill when the user says "still broken", "tried three times", "I don't know why", "same error", or "still failing". The skill resets all prior assumptions, classifies the error type, traces data flow, proposes five ranked hypotheses with the fastest verification method for each, and enforces a no-repeat-fix rule: Claude may not attempt a second fix for the same hypothesis without verification evidence. Prevents the infinite guess-and-retry loop that wastes sessions and erodes trust.
   0 installs
5. ▌
   Csrf Review · xuanjgcarryyou bundle

   Dedicated Cross-Site Request Forgery (CSRF) vulnerability scanner that audits state-mutating endpoints, session cookie configuration, middleware setup, and SPA token-handling patterns. Invoke this skill when code defines POST, PUT, PATCH, or DELETE endpoints; when configuring session cookies or CORS; when adding or modifying auth middleware; or when the user says "check for CSRF", "CSRF token", "SameSite", "state mutation", "form submission security", "cookie security", or "is my API CSRF-safe". CSRF lets an attacker forge authenticated requests from a victim's browser to your API — it is especially dangerous in applications that use cookie-based sessions, and is frequently missed in SPAs that assume JSON-only traffic is automatically protected.
   0 installs
6. ▌
   Ssrf Review · xuanjgcarryyou bundle

   Dedicated Server-Side Request Forgery (SSRF) vulnerability scanner that audits every HTTP client call in the reviewed code. Invoke this skill when code uses requests, httpx, aiohttp, fetch, axios, urllib, or any HTTP client with a URL that may come from user input, query parameters, form fields, JSON bodies, headers, or database values. Also trigger when the user says "check for SSRF", "is this URL safe", "user-supplied URL", "external HTTP call", "fetch this URL", or "webhook handler". SSRF lets an attacker redirect the server to call internal services, cloud metadata endpoints, or private IP ranges — treat it as CRITICAL in any service that makes outbound HTTP calls.
   0 installs
7. ▌
   Writing Srs · xuanjgcarryyou

   Generates a production-grade System Requirements Specification (SRS) from vague requirements, a product idea, or a partial feature description. TRIGGER when the user says "幫我寫 SRS", "幫我寫系統開發規格書", "幫我寫規格書", "幫我把需求寫成規格", "我要開始設計這個系統的架構和功能", "幫我定義這個項目的架構和功能", "write SRS", "create system specification", "document requirements", "help me write a spec", or "turn this into a spec document". Do NOT trigger for: users only exploring architecture without a deliverable doc, users requesting a business plan (→ writing-business-plan), or users requesting only API documentation when a spec already exists.
   0 installs
8. ▌
   Idea Refiner · xuanjgcarryyou bundle

   Idea-to-plan converter and technical thinking partner for early-stage ideas. Use this skill whenever the user describes a raw idea, wants to think through architecture, needs help scoping a feature, or wants to plan before coding. TRIGGER on: "I have an idea", "I want to build something", "help me think through this", "how should I approach this", "I want to design a system for...", "let's plan this out", "what's the best way to architect...", "I want to create a service that...", "brainstorm with me", "help me scope this", "I'm thinking about building...", "let's think before we code", or whenever the user describes a feature or system without yet asking for code to be written.
   0 installs
9. ▌
   Contracting API · xuanjgcarryyou bundle

   Locks API interface contracts before parallel development begins, serving as the formal bridge between frontend and backend teams. Invoke this skill when a user says "define API", "lock the interface", "API contract", "frontend-backend boundary", "what does the endpoint look like", or "agree on the shape". It outputs an OpenAPI-compatible YAML contract marked LOCKED with a semantic version, without implementing any endpoints. Any contract modification requires a version bump and explicit notification to all dependent parties.
   0 installs
10. ▌
    Auto Code Review · xuanjgcarryyou bundle

    Post-generation self-review gate. AUTOMATICALLY appends a structured self-review report after every meaningful code generation or modification — new functions, services, modules, API endpoints, classes, config files, refactors, dependency additions. This is NOT a manually triggered review; it runs as the final mandatory step of every code generation response, like a PR review bot that comments on every commit. MUST trigger whenever Claude writes or modifies code of any substance. Do NOT trigger for one-liner fixes, typo corrections, documentation-only changes, or responses with no code.
    0 installs
11. ▌
    Migrating Schema · xuanjgcarryyou bundle

    Acts as the mandatory safety gate for all database schema changes, requiring explicit approval before any migration file is generated. Invoke this skill when a user says "migration", "alter table", "schema change", "add column", "drop column", or mentions "schema.prisma". It produces an impact analysis with risk level, forward SQL (up migration), rollback SQL (down migration), and production recovery steps. HIGH RISK operations — including DROP COLUMN, DROP TABLE, and adding NOT NULL constraints — are blocked until a data migration strategy is confirmed and the user explicitly approves.
    0 installs
12. ▌
    Refactoring Safely · xuanjgcarryyou bundle

    Captures a binding pre-refactor contract before any code is restructured. Use this skill whenever the user says "refactor", "clean up", "restructure", "reorganize", or "simplify the code". The skill snapshots every public function signature, exported type, and module consumer so that post-refactor behaviour can be verified against an immutable baseline. It then pauses and waits for explicit approval before any code is touched, preventing silent API breakage in downstream callers.
    0 installs
13. ▌
    Reviewing Security · xuanjgcarryyou bundle

    Deep nine-axis pre-release security audit for high-risk features. Invoke this skill when the user says "security review", "security audit", "review for security", "is this secure", or "before we ship" — especially when code touches authentication, authorization, PII handling, payment flows, or file uploads. SCOPE: Injection, Authentication, Authorization, Sensitive Data Exposure, Misconfiguration, Secrets Leakage, Input Validation, and Dependency CVEs. NOTE: SSRF findings — delegate to ssrf-review skill for deeper analysis. NOTE: CSRF findings — delegate to csrf-review skill for deeper analysis. Do NOT use this skill for routine post-generation review — that is auto-code-review's job. Use this skill only for explicit pre-release audits of security-critical features.
    0 installs
14. ▌
    Secure Vibe Coding · xuanjgcarryyou bundle

    Security co-pilot for AI-assisted rapid development (vibe coding) sessions. Activates a set of non-negotiable security guardrails that run alongside every code generation, preventing the classic vibe-coding failure modes: hardcoded secrets, disabled auth guards, raw SQL from user input, unvalidated outbound URLs, and stack-trace leakage in API responses. Invoke this skill at the START of any vibe coding session, or when the user says "let's go fast", "just ship it", "vibe coding mode", "speed run this", "skip the boilerplate", "secure vibe coding", "vibe with guardrails", or "keep me secure while we build fast". ALSO trigger whenever Claude is about to generate code that touches auth, database queries, HTTP clients, file uploads, or API responses — these are the five zones where speed kills security. The goal is not to slow down: it is to eliminate the security rework that happens after shipping insecure code fast. When this skill is active, do NOT produce a separate security report after code generation — th
    0 installs
15. ▌
    Auditing Dependencies · xuanjgcarryyou bundle

    Performs a seven-point health audit on any external package before it enters the codebase, preventing hallucinated packages and dependency bloat. Invoke this skill when a user says "install", "npm install", "add dependency", "import", "new package", or "pip install". It checks existence, redundancy against current dependencies, maintenance activity, popularity, license compatibility, bundle size, and known CVEs, then delivers a PASS, WARN, or BLOCK verdict with a replacement recommendation when blocked.
    0 installs
16. ▌
    Running Retrospective · xuanjgcarryyou bundle

    Conducts a structured post-feature retrospective that transforms this session's AI errors and effective patterns into permanent CLAUDE.md rules. Invoke this skill when the user says "retro", "retrospective", "let's do a retro", "what did we learn", or "update CLAUDE.md". The skill extracts effective prompt patterns worth keeping, identifies AI misjudgement patterns that should become explicit prohibitions, produces a ready-to-apply CLAUDE.md diff, and recommends off-limits zone updates. Makes each CLAUDE.md incrementally more accurate with each completed feature.
    0 installs