发现 Skills

Use when you need to apply Java secure coding best practices — including validating untrusted inputs, defending against injection attacks with parameterized queries, minimizing attack surface via least privilege, applying strong cryptographic algorithms, handling exceptions securely without exposing sensitive data, managing secrets at runtime, avoiding unsafe deserialization, and encoding output to prevent XSS. This should trigger for requests such as Review Java code for secure coding. Part of cursor-rules-java project

Use when reasoning about systems that pass untrusted content to a language model: the data-vs-instruction collapse that makes this attack class a structural property of LLMs rather than a fixable bug, the direct/indirect/exfiltration/action-trigger taxonomy, the role of every untrusted surface (RAG retrievals, tool results, attachments, web content, document parsing, user-provided text), why content filters and improved system prompts do not solve it, and the defense-in-depth measures that do (capability constraint, content origin tracking, separate planning and execution stages, human-in-the-loop gates, principle-of-least-authority for tools). Do NOT use for jailbreaking and policy circumvention (use model-safety), for general API security (use api-security), for runtime input validation patterns (use type-safety + api-design), or for the protocol cycle of tool calls (use tool-call-flow).

Design engineering principles for making interfaces feel polished. Use when building UI components, reviewing frontend code, implementing animations, hover states, shadows, borders, typography, micro-interactions, enter/exit animations, or any visual detail work. Triggers on UI polish, design details, "make it feel better", "feels off", stagger animations, border radius, optical alignment, font smoothing, tabular numbers, image outlines, box shadows.

Fixture skill missing the implementation checklist

Determine the best Anthropic architecture for your project by analyzing requirements and recommending the optimal combination of Skills, Agents, Prompts, and SDK primitives.

Baseline cross-project coding conventions for naming, readability, immutability, and code-quality review. Use detailed frontend or backend skills for framework-specific patterns.

Enter explore mode - a thinking partner for exploring ideas, investigating problems, and clarifying requirements. Use when the user wants to think through something before or during a change.

Manage Google Tag Manager containers, tags, triggers, and variables. Use when working with GTM configuration, analytics tracking, conversion tracking, or event management. Triggers on "GTM", "Google Tag Manager", "tags", "triggers", "analytics".

Use when the user asks to "create a WBS", "decompose scope", "define work breakdown structure", "document scope statement", "set project boundaries", "identify deliverables", or mentions scope definition, deliverable decomposition, work packages, scope baseline, exclusions, 100% rule.

Software and technology viability validation — deep forensic analysis of maintainability, scalability, and security posture. Use when the user asks to "validate software viability".

AI-powered career path analysis with 8-agent pipeline. Use when user says "analyze my career", "career path recommendation", "career compass", "transition to [role]", "career guidance", or wants personalized career roadmap.

Adversarially test a thesis or take for differentiation, robustness, and blind spots. Prevents publishing consensus as contrarian and surfaces what would change your mind.

Take data, observations, or notes and surface non-obvious insights that click into place — connections, dynamics, and structural truths that were hiding in the data all along.

Create Apache Airflow DAGs for construction data pipelines. Orchestrate ETL, validation, and reporting workflows.

Convert CAD/BIM files to structured data. Extract element data from Revit, IFC, DWG, DGN files.

Automatically extract patterns, best practices, and reusable knowledge from construction automation sessions to improve future performance.

AI-powered contractor matching and selection for construction projects. Analyze contractor capabilities, past performance, certifications, and project requirements to recommend optimal matches.

Build cost assemblies from CWICR work items. Combine multiple items into reusable templates for common construction elements.

Load and parse DDC CWICR construction cost database from multiple formats: Parquet, Excel, CSV, Qdrant snapshots. Foundation for all CWICR operations.

Match BIM quantities to CWICR work items. Map element categories to cost codes, validate quantities, and generate cost-linked QTOs.

Generate professional cost estimation reports from CWICR calculations. HTML, PDF, Excel outputs with charts and breakdowns.

Assist with quantity takeoff using CWICR data. Calculate quantities from dimensions, apply waste factors, and suggest related work items.

Detect anomalies and outliers in construction data: unusual costs, schedule variances, productivity spikes. Statistical and ML-based detection methods.

Design data models for construction projects. Create entity-relationship diagrams, define schemas, and generate database structures.