发现 Skills

Understand and customize the local Trellis architecture inside a user project. Use when modifying .trellis plus platform hooks, settings, agents, skills, commands, prompts, workflows, the channel runtime (trellis channel), bundled runtime agents under .trellis/agents/, selectable workflow templates, registry-backed spec refresh, cross-session memory (trellis mem) generated by trellis init, or AI-facing bundled skills (trellis-channel, trellis-session-insight, trellis-spec-bootstrap) and bundled-skill auto-dispatch flow.

A built-in skill for tracking personal income, expenses, categories, and budgeting within a local SQLite database. Uses a single TypeScript CLI tool for all operations.

Filling in a comparative, state-by-state policy tracker using authoritative sources and policy-interpretation rubrics to analyze policy across states regardless of policy area. Use this when a user uploads a policy tracker template and asks the AI assistant to populate it across U.S. states (or any defined set of jurisdictions).

Use when regenerating README.md and WORK_AREAS.md in a managed library workspace. Always dry-run first to preview changes.

Converted from the Claude plugin command "ralph-loop". Use when the user wants to run this slash-command workflow. Start Ralph Loop in the current session.

Create plugin settings file with user preferences

Audit SkiaSharp's native dependencies for security vulnerabilities and CVEs. Read-only investigation that produces a status report with recommendations. Use when user asks to: - Audit security issues or CVEs - Check CVE status across dependencies - Find security-related issues and their PR coverage - Get an overview of open vulnerabilities - See what security work is pending Triggers: "security audit", "audit CVEs", "CVE status", "what security issues are open", "check vulnerability status", "security overview", "what CVEs need fixing". This skill is READ-ONLY. To actually fix issues, use the `native-dependency-update` skill.

Run the Deep Research Protocol for multi-source, verified research with a final narrative report. Use when the user asks for 'research X', 'deep dive on Y', or needs exhaustive investigation with themes, verification, and implications.

Create a complete brand visual identity system from a project description. Use this skill when a user asks to create a brand kit, logo system, business card design, social media cover, color palette, typography specification, brand guidelines document, or any combination of brand identity deliverables. Covers the full spectrum of brand collateral: primary/wordmark/icon logos with monochrome and reversed variants, color systems with primary/secondary/neutral palettes, typographic hierarchies with heading/body/accent scales, business card layouts, social media assets, and compiled brand specification documents.

Generate and edit images using Google Gemini's native image generation models (Nano Banana / Nano Banana Pro). Supports text-to-image, image editing with reference images, multi-image composition, and character consistency. Use when the user asks to generate images via Gemini, create AI illustrations, edit photos with Gemini, or needs high-quality image generation with the Google API. Requires GEMINI_API_KEY. Triggers: "generate image with gemini", "nano banana", "gemini image", "create illustration", "AI generate picture", "text to image".

Cheminformatics toolkit for fine-grained molecular control. SMILES/SDF parsing, descriptors (MW, LogP, TPSA), fingerprints, substructure search, 2D/3D generation, similarity, reactions. For standard workflows with simpler interface, use datamol (wrapper around RDKit). Use rdkit for advanced control, custom sanitization, specialized algorithms.

Assess GCP projects against a curated subset of CIS GCP Foundations Benchmark v3.0 controls. Automates 7 high-impact read-only checks across IAM, Cloud Storage, and VPC networking. Use when the user mentions GCP CIS benchmark, GCP security posture, service account key audit, or public bucket detection. Do NOT use for AWS or Azure; do NOT use to remediate findings (assessment-only, zero write permissions); do NOT claim full CIS GCP coverage — only 7 controls are implemented, see the Roadmap section in this file for the gap.

Archive a completed change in the experimental workflow. Use when the user wants to finalize and archive a change after implementation is complete.

Start a new OpenSpec change using the experimental artifact workflow. Use when the user wants to create a new feature, fix, or modification with a structured step-by-step approach.

NGS read QC, alignment, and BAM processing pipeline. Wraps FastQC, BWA/Bowtie2/Minimap2, SAMtools, and MultiQC for automated read-to-BAM workflows.

Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.

Enumerates DNS records, attempts zone transfers, brute-forces subdomains, and maps DNS infrastructure during authorized reconnaissance to identify attack surface, misconfigurations, and information disclosure in target domains.

This skill covers conducting comprehensive security assessments of Operational Technology (OT) networks including SCADA systems, DCS architectures, and industrial control system communication paths. It addresses the Purdue Reference Model layers, identifies IT/OT convergence risks, evaluates firewall rules between zones, and maps industrial protocol traffic (Modbus, DNP3, OPC UA, EtherNet/IP) to detect misconfigurations, unauthorized connections, and attack surfaces in critical infrastructure.

Tenable Nessus is the industry-leading vulnerability scanner used to identify security weaknesses across network infrastructure including servers, workstations, network devices, and operating systems.

Conducts external reconnaissance using Open Source Intelligence (OSINT) techniques to map an organization's external attack surface without directly interacting with target systems. The tester gathers information from public sources including DNS records, certificate transparency logs, search engines, social media, code repositories, and data breach databases to build a comprehensive target profile. Activates for requests involving OSINT reconnaissance, external footprinting, attack surface mapping, or passive information gathering.

Configure and execute access recertification campaigns in Saviynt Enterprise Identity Cloud to validate user entitlements, revoke excessive access, and maintain compliance with SOX, SOC2, and HIPAA.

Performs comprehensive iOS application security assessments using Frida for dynamic instrumentation, Objection for runtime exploration, SSL pinning bypass for traffic interception, keychain extraction for credential analysis, and IPA static analysis for binary-level review. Use when conducting authorized iOS penetration tests, evaluating mobile app security posture against OWASP MASTG, or assessing iOS app data protection and transport security controls. Activates for requests involving iOS app pentesting, Frida-based iOS instrumentation, mobile app SSL pinning bypass, or IPA reverse engineering.

Bypasses SSL/TLS certificate pinning implementations in Android and iOS applications to enable traffic interception during authorized security assessments. Covers OkHttp, TrustManager, NSURLSession, and third-party pinning library bypass techniques using Frida, Objection, and custom scripts. Activates for requests involving certificate pinning bypass, SSL pinning defeat, mobile TLS interception, or proxy-resistant app testing.

Assess code maturity based on MultiversX standards (documentation presence and testing culture).