发现 Skills

Claude Code CLI orchestrator: dispatch Anthropic's Claude Code from external AI assistants for code, review, deep reasoning.

GitHub Spec-Kit integration for constitution-based spec-driven development. 7-phase workflow (constitution, specify, clarify, plan, tasks, analyze, implement). Use when working with spec-kit CLI, .specify/ directories, or creating specifications with constitution-driven development. Triggered by "spec-kit", "speckit", "constitution", "specify", references to .specify/ directory, or spec-kit commands.

Azure Cosmos DB SDK for Python (NoSQL API). Use for document CRUD, queries, containers, and globally distributed data. Triggers: "cosmos db", "CosmosClient", "container", "document", "NoSQL", "partition key".

Azure Maps SDK for .NET. Location-based services including geocoding, routing, rendering, geolocation, and weather. Use for address search, directions, map tiles, IP geolocation, and weather data. Triggers: "Azure Maps", "MapsSearchClient", "MapsRoutingClient", "MapsRenderingClient", "geocoding .NET", "route directions", "map tiles", "geolocation".

Build messaging applications using Azure Service Bus SDK for JavaScript (@azure/service-bus). Use when implementing queues, topics/subscriptions, message sessions, dead-letter handling, or enterprise messaging patterns.

Transforms a rough idea into a detailed design document with implementation plan. Follows Prompt-Driven Development — iterative requirements clarification, research, design, and planning.

Create distinctive, production-grade frontend interfaces with high design quality. Use this skill when the user asks to build web components, pages, or applications. Generates creative, polished code that avoids generic AI aesthetics.

Python 3.13+ development specialist covering FastAPI, Django, async patterns, data science, testing with pytest, and modern Python features. Use when developing Python APIs, web applications, data pipelines, or writing tests.

Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.

Create plugin settings file with user preferences

Sync a Rust implementation with recent Python changes (excluding UI/login) by reviewing recent changes, mapping modules, porting logic, and updating tests.

Activate this skill when analyzing iOS app UI/UX, evaluating iOS design patterns, proposing iOS interface improvements, or creating iOS implementation specifications. Provides deep expertise in Apple Human Interface Guidelines, SwiftUI patterns, native iOS components, accessibility standards, and iOS-specific interaction paradigms.

This skill should be used when the user asks about "RSU taxes", "Amazon stock compensation", "cost basis for RSUs", "Form 8949 adjustment", "vesting income calculation", "1099-B cost basis is wrong", "RSU double taxation", or provides RSU vesting confirmations, 1099-B forms, or W-2s with stock compensation. Also triggered by mentions of fair market value at vesting, capital gains on RSU sales, or broker-reported basis errors.

Institutional governance framework for Codex bootstrap operations

Implements 10 of the NIST AI RMF 1.0 GOVERN function's ~25 documented subcategories. Use when an org wants to programmatically validate their NIST AI RMF posture against a manifest of policies, role assignments, training records, and inventory mechanisms. The skill verifies that the manifest exists, is current (within declared review cadence), declares evidence, and covers at least 50% of the population each subcategory applies to. Emits one OCSF Compliance Finding (class 2003) per subcategory with `compliance.requirement` set to the subcategory ID and `compliance.status` ∈ {pass, partial, fail, not_applicable}. Use when the user mentions NIST AI RMF GOVERN, AI governance posture, AI risk-management policy audit, AI roles + responsibilities review, or AI inventory completeness check. Do NOT use as a substitute for the qualitative org-level assessment NIST AI RMF requires; this is a manifest-completeness + freshness check, not the assessment itself. Do NOT use to grade the other three functions (MAP / MEASURE / MANAGE) — those ship as sibling skills.

Configure AIDE (Advanced Intrusion Detection Environment) for file integrity monitoring including baseline creation, scheduled integrity checks, change detection, and alerting

Detect lateral movement in network traffic using Zeek (formerly Bro) log analysis. Parses conn.log, smb_mapping.log, smb_files.log, dce_rpc.log, kerberos.log, and ntlm.log to identify SMB file transfers, NTLM account spray activity, remote service execution, and anomalous internal connections.

Write multi-event correlation rules that detect APT lateral movement by chaining Windows authentication events, process execution telemetry, and network connection logs across hosts. Uses Splunk SPL and Sigma rule format to correlate Event IDs 4624, 4648, 4688, and Sysmon Events 1/3 within sliding time windows to surface attack sequences invisible to single-event detections.

Assess Active Directory security posture using PingCastle, BloodHound, and Purple Knight to identify misconfigurations, privilege escalation paths, and attack vectors.

Execute a phased DMARC rollout from p=none monitoring through p=quarantine to p=reject enforcement, ensuring all legitimate email sources are authenticated before blocking unauthorized senders.

Perform security assessments of SCADA Human-Machine Interface (HMI) systems to identify vulnerabilities in web-based HMIs, thin-client configurations, authentication mechanisms, and communication channels between HMI and PLCs, aligned with IEC 62443 and NIST SP 800-82 guidelines.

Reverse engineers iOS applications using Frida dynamic instrumentation to understand internal logic, extract encryption keys, bypass security controls, and discover hidden functionality without source code access. Use when performing authorized iOS penetration testing, analyzing proprietary protocols, understanding obfuscated logic, or extracting runtime secrets from iOS binaries. Activates for requests involving iOS reverse engineering, Frida iOS hooking, Objective-C/Swift method tracing, or iOS binary analysis.

A complete toolkit for generating materials for Chinese software copyright applications. It supports automatic extraction of information from project code, documentation, and other sources, and can generate the software copyright registration application form, source code documentation (first and last 30 pages), a user manual, and a design specification, then automatically convert them to PDF. Applicable to WeChat Mini Programs, web applications, mobile apps, desktop applications, and other software projects. Use this skill when a user needs to apply for Chinese software copyright.

Find the best tools for any task - both agent skills and MCP servers. Use when a user says "I need to do X, what tools exist?", "What can help me with X?", or wants to discover both agent skills and MCP servers for a task.