发现 Skills

Configure AIDE (Advanced Intrusion Detection Environment) for file integrity monitoring, including baseline creation, periodic integrity checks, change detection, and alerting

Implement software supply chain integrity verification for container build processes using the in-toto framework, creating cryptographically signed attestations for each step in CI/CD pipelines.

In red team engagements, use WMI-based remote execution techniques (including Impacket's wmiexec.py, CrackMapExec, and native WMI commands) to perform lateral movement within Windows networks and carry out covert post-exploitation operations.

Enforces FastAPI best practices: async/sync correctness, domain-driven structure, Pydantic validation, dependency injection, production hardening, and structured logging. Trigger: When creating or modifying FastAPI endpoints, services, dependencies, routers, or any backend Python code that uses FastAPI.

Activates when reviewing code, checking for security issues, or validating best practices. Use this skill for: security audits, performance reviews, React 19 pattern validation, TypeScript strict mode compliance, and OWASP vulnerability checks. Keywords: review, security, performance, audit, OWASP, vulnerability, best practice, lint

React Native and Expo best practices for building performant mobile apps. Use when building React Native components, optimizing list performance, implementing animations, or working with native modules. Triggers on tasks involving React Native, Expo, mobile performance, or native platform APIs.

Generate comprehensive changelogs from Git history, commit messages, pull requests, and issue tracking for release documentation. Use when preparing releases, documenting changes, creating release notes, categorizing commits, generating version summaries, maintaining project history, or automating changelog updates.

Use when the user requests image generation, illustration, icon, logo, photo, visual content creation, or image editing - any task requiring AI-generated or AI-edited images

When the user wants to optimize logo placement, linking, or branding on a website. Also use when the user mentions "logo," "brand logo," "header logo," "logo placement," "AI logo design," "logo link," "logo alt text," "logo sizing," "favicon logo," or "logo usage." For full brand visuals, use brand-visual-generator.

When the user wants to add, optimize, or audit a top announcement bar or sticky banner. Also use when the user mentions "announcement bar," "top banner," "sticky bar," "promo banner," "discount banner," "student discount banner," "header banner," "announcement bar design," "sticky header," "promo bar," "urgency banner," or "lead capture bar." For promos, use discount-marketing-strategy.

Transforms scattered notes and ideas into polished technical blog posts with SEO optimization. Make sure to use this skill whenever the user wants to write a blog post, has rough notes to turn into an article, mentions blog writing, technical writing, or publishing content — even if they just say 'I have some thoughts I want to write up.'

Engages deep thinking mode - question assumptions, plan meticulously, craft elegant solutions, and iterate relentlessly toward excellence. Use when user says "/ultrathink", wants deep thinking, needs thorough analysis, or asks for a carefully crafted solution.

Electronics project architecture and constraint definition. Guides users through defining project requirements, power systems, interfaces, and physical constraints.

Git version control and GitHub CLI workflows for commits, branches, pull requests, and code reviews with professional commit message practices.

For discovering and understanding database structure, tables, columns, and relationships

Write scenario-based end-to-end Go testcases for the compiled `lark-cli` binary under `tests/cli_e2e`. Use when adding or updating a CLI testcase that should autonomously explore help and schema output, build a self-contained lifecycle with `clie2e.RunCmd`, organize steps with `t.Run`, clean up with `t.Cleanup`, and assert JSON output with `testify/assert` and `gjson`.

Feishu Miaoda application (lark-cli apps): deploy local HTML files or directories as a reachable, shareable Miaoda app (static website / web page), return an access URL; and provide management capabilities such as creating apps, updating, listing, and setting access scope (specific — visible to specified users / public — Internet public / tenant — visible to the entire enterprise). Use this when the user says things like 'use HTML / web to develop a PPT / slides / presentation / demo', 'deploy / publish HTML / static site / web page / dist directory', 'deploy the HTML files under /xxx with lark-cli / send to Miaoda', 'develop an xxx and deploy it as a shareable site / accessible link / shareable URL', 'generate a PPT / page / demo that I can send to others', or mentions keywords such as Miaoda / miaoda / apps / app_id / access scope / open-to-tenant / open-to-public. **Deployment policy: if the user explicitly says 'deploy / publish / share / accessible / shareable URL', automatically run `apps +html-publish` to deploy and return the URL; if the user expresses a vague intent like 'make a demo / write a PPT / do a demo', after generating the HTML ask 'Do you want to deploy to Miaoda so it can be shared?' before deciding.**

Performs a rigorous technical audit of the codebase — vulnerabilities, performance, bad practices. Read-only, no code written. Use when assessing code quality, preparing a release, or investigating technical debt.

Scenario-planning toolkit — 2x2 matrices, four-case canvas, Monte Carlo setup, sensitivity & tornado, decision-tree EV, war-game, reverse stress test, optionality scoring.

Interact with the user's Ledgi personal finance data. Use when the user asks about their accounts, balances, net worth, holdings, investments, ISA allowances, pensions, snapshots, or wants to add/update financial data.

Develops, optimizes, and validates Claude Code plugins, skills (SKILL.md), commands, agents, hooks (hooks.json), and scripts. Ensures consistency with official best practices. Activates when creating, editing, or reviewing files in the plugins/ directory, .claude-plugin/, plugin.json, permissions.json, or marketplace.json. Covers YAML frontmatter, element structure, cross-references, naming conventions, and plugin manifest validation. NOT for application development (use domain-specific skills).

Query the Wolfram Alpha LLM API for computational knowledge, mathematics, science, and factual data.

Create and manage pi-coding-agent skills. Use when creating new skills, understanding skill structure, writing SKILL.md files, or debugging skill loading. Covers skill format, frontmatter, directory structure, and best practices.

Upgrades Python pip/poetry/pipenv dependencies with breaking change handling