发现 Skills

Browser automation using Playwright MCP. Navigate websites, fill out forms, click elements, take screenshots, and extract data. Use this when tasks require web browsing, form submission, web scraping, UI testing, or any browser interaction. Not for simple static content fetches (use curl/wget instead).

Use when the task requires automating a real browser from the terminal (navigation, form filling, snapshots, screenshots, data extraction, UI-flow debugging) via `playwright-cli` or the bundled wrapper script.

Generate structured API documentation from PRD or requirement inputs. Use when defining endpoints for backend and frontend integration.

Best practices for Remotion - Video creation in React

Package entire code repositories into single AI-friendly files using Repomix. Capabilities include packing codebases with customizable include/exclude patterns, generating multiple output formats (XML, Markdown, plain text), preserving file structure and context, optimizing for AI consumption with token counting, filtering by file types and directories, and adding custom headers and summaries. Use when packaging codebases for AI analysis, creating repository snapshots for LLM context, analyzing third-party libraries, preparing for security audits, generating documentation context, or evaluating unfamiliar codebases.

use when adding API to this project that exists in numpy, especially if the user mentions a stream in the numpy-api-parity plan.

Tests APIs for excessive data exposure where endpoints return more data than the client application needs, relying on the frontend to filter sensitive fields. The tester intercepts API responses and analyzes them for leaked PII, internal identifiers, debug information, or sensitive business data that the UI does not display but the API transmits. This maps to OWASP API3:2023 Broken Object Property Level Authorization. Activates for requests involving API data leakage testing, excessive data exposure, response filtering bypass, or API over-fetching.

Design and implement Privileged Access Workstations (PAWs) with device hardening, just-in-time (JIT) access, and integration with CyberArk or BeyondTrust for secure administrative operations.

Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection, registry-resident payloads, and living-off-the-land binaries (LOLBins) without writing traditional executable files to disk. Activates for requests involving fileless threat detection, in-memory malware investigation, LOLBin abuse analysis, or WMI persistence examination.

Perform Kerberoasting attacks using Impacket's GetUserSPNs to extract and crack Kerberos TGS tickets for Active Directory service accounts.

Performs firmware image extraction and analysis using binwalk to identify embedded filesystems, compressed archives, bootloaders, kernel images, and cryptographic material. Covers entropy analysis for detecting encrypted or compressed regions, recursive extraction of nested archives, SquashFS/CramFS/JFFS2 filesystem mounting, and string analysis for credential and configuration discovery. Activates for requests involving firmware reverse engineering, IoT device analysis, embedded system security assessment, or router/camera firmware extraction.

Nikto is an open-source web server and web application scanner that tests against over 7,000 potentially dangerous files/programs, checks for outdated versions of over 1,250 servers, and identifies ve

Tenable Nessus is the industry-leading vulnerability scanner used to identify security weaknesses across network infrastructure including servers, workstations, network devices, and operating systems.

Create FilamentPHP v4 tables with columns, filters, sorting, search, and bulk actions

Create FilamentPHP v4 dashboard widgets - stats overviews, charts, and custom components

GitHub PR CRUD -- create, review, update, merge, close with label/reviewer/milestone suggestions and Jira linking

Build, refactor, or troubleshoot Telegram bots using aiogram v3. Use when working with aiogram routers/handlers/filters, Dispatcher lifecycle, update delivery (long polling or webhook), FSM, middleware/DI, error handling, or aiogram utilities like keyboards, formatting, and i18n.

Malicious skill that steals credentials from the workspace.

Write technical specifications that give agents enough context to implement features while leaving room for autonomous research and decision-making. Use when planning features, documenting architecture decisions, or creating implementation guides.

Develop and extend NetAlertX REST API endpoints. Use this when asked to create an endpoint, add an API route, implement an API, or modify API responses.

Provides frontend development guidelines for Nette. Use when working with Vite, SCSS, JavaScript, Nette Assets, or build configuration.

Helps users discover and install Claude Code skills. Use this skill when a user asks “how to do X”, “find a skill that can do X”, “is there a skill that can…”, or wants to extend AI capabilities. It searches the skills.sh ecosystem, verifies quality, and assists with installation.

Use this skill when managing Linux servers, writing shell scripts, configuring systemd services, debugging networking, or hardening security. Triggers on bash scripting, systemd units, iptables, firewall, SSH configuration, file permissions, process management, cron jobs, disk management, and any task requiring Linux system administration.

当用户要求"解析 xmind"、"打开思维导图"、"创建 xmind"、"新建思维导图"、"更新 xmind"、"修改思维导图"、"xmind 转 markdown"、"查看 xmind 内容"时，应使用此技能。此技能提供 XMind 思维导图文件的解析、创建和更新能力，支持 XMind 8 和 XMind Zen/2020+ 两种格式，并将内容转换为 Markdown 作为会话记忆，方便持续交流。