发现 Skills

MoltOffer recruiter agent. Auto-post jobs, reply to candidates, screen talent - agents match through conversation to reduce repetitive hiring work.

Update native dependencies (libpng, libexpat, zlib, libwebp, harfbuzz, freetype, libjpeg-turbo, etc.) in SkiaSharp's Skia fork. Handles security CVE fixes, bug fixes, and version bumps. Use when user asks to: - Bump/update a native dependency (libpng, zlib, expat, webp, etc.) - Fix a CVE or security vulnerability in a native library - Update Skia's DEPS file - Check what version of a dependency is currently used - Analyze breaking changes between dependency versions Triggers: "bump libpng", "update zlib", "fix CVE in expat", "update native deps", "what version of libpng", "check for breaking changes". For security audits (finding CVEs, checking PR coverage), use the `security-audit` skill instead.

Update Kimi Code CLI user documentation.

CRITICAL: Use for ALL Rust questions including errors, design, and coding. HIGHEST PRIORITY for: 比较, 对比, compare, vs, versus, 区别, difference, 最佳实践, best practice, tokio vs, async-std vs, 比较 tokio, 比较 async, Triggers on: Rust, cargo, rustc, crate, Cargo.toml, 意图分析, 问题分析, 语义分析, analyze intent, question analysis, compile error, borrow error, lifetime error, ownership error, type error, trait error, value moved, cannot borrow, does not live long enough, mismatched types, not satisfied, E0382, E0597, E0277, E0308, E0499, E0502, E0596, async, await, Send, Sync, tokio, concurrency, error handling, 编译错误, compile error, 所有权, ownership, 借用, borrow, 生命周期, lifetime, 类型错误, type error, 异步, async, 并发, concurrency, 错误处理, error handling, 问题, problem, question, 怎么用, how to use, 如何, how to, 为什么, why, 什么是, what is, 帮我写, help me write, 实现, implement, 解释, explain

Users describe trading styles in natural language; the Skill automatically creates cryptocurrency trading bots and runs local backtests. Supports periodic iterative evolution. Optionally connects to external platforms for verification and simulated trading.

Backend architecture patterns, API design, database optimization, and server-side best practices for Node.js, Express, and Next.js API routes.

Structures git workflow practices. Use when making any code change. Use when committing, branching, resolving conflicts, or when you need to organize work across multiple parallel streams.

Skill for healthcare-phi-compliance

This skill should be used when the user asks to "plan team structure", "determine hiring needs", "design org chart", "calculate compensation", "plan equity allocation", or requests organizational design and headcount planning for a startup.

Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders.

Design multi-cloud architectures using a decision framework to select and integrate services across AWS, Azure, and GCP. Use when building multi-cloud systems, avoiding vendor lock-in, or leveraging best-of-breed services from multiple providers.

Local-first memory for coding agents. You MUST retrieve memories at session start and save memories before session end. This is not optional.

基于 Anthropic 官方准则的提示词设计、优化和质量检查工具。适用场景： (1) 创建新提示词 - 用户说"帮我创建/设计一个XXX提示词" (2) 优化现有提示词 - 用户说"优化/改进这个提示词" (3) 检查提示词质量 - 用户说"检查/审查这个提示词" (4) 理解提示词结构 - 用户询问"如何设计提示词"或"提示词最佳实践"

Maintain and evolve the EDA infrastructure stack (agent policy, knowledge base, tool registry, and skill system) with auditable guardrails and minimal-risk updates.

Run verification commands and confirm output before claiming success

Scaffold a new Koi-standard domain module inside an existing Python service. Use when adding a business module under `app/domain/`, generating router/schema/model/service/repository files, wiring router registration, and creating aligned unit or integration test stubs.

ETL pipeline development with focus on data quality, orchestration, and error handling patterns.

API security expertise including authentication, authorization, OWASP compliance, and vulnerability detection.

Use when building Android UIs with Jetpack Compose, managing state with remember/mutableStateOf, or implementing declarative UI patterns.

Use when the user mentions "revoke open Azure NSG rule," "close Azure NSG public exposure," "respond to detect-azure-open-nsg," or "re-verify Azure NSG revoke." Surgical revoke of an Azure Network Security Group inbound rule flagged as open to `*` / `Internet` / `0.0.0.0/0` / `::/0` by detect-azure-open-nsg (T1190 Exploit Public-Facing Application). Default mode is `delete` — calls `NetworkManagementClient.security_rules.begin_delete()` against the specific rule (the cleanest reversible op since NSG rule definitions are versioned by Azure Resource Manager). Opt-in `--mode patch` rewrites `access: Deny` for the same priority+source+destination tuple via `begin_create_or_update()`. Every action is dry-run by default, deny-listed against `default*`/`Default*` rule names, NSG names ending `-protected`, the parent NSG's `intentionally-open` tag, and any rule-fully-qualified-id in AZURE_NSG_REVOKE_DENY_RULE_IDS. Apply requires AZURE_NSG_REVOKE_INCIDENT_ID + AZURE_NSG_REVOKE_APPROVER. Dual audit (DynamoDB + KMS-encrypted S3). Reverify re-reads the rule via `security_rules.get()` and emits VERIFIED if the rule is gone (or patched to Deny), DRIFT (+ paired OCSF Detection Finding via the shared remediation_verifier contract) if the rule re-appears as Allow within the verification window, UNREACHABLE if the Azure API throws. Do NOT use to delete the entire NSG (deletes other legitimate rules), for AWS Security Groups (separate skill remediate-aws-sg-revoke), for GCP firewall (separate skill remediate-gcp-firewall-revoke), for Outbound NSG rules, or to bypass the deny-list.

Generate final report. Triggers on "Create review report for PR <number>".

Build new AI method from scratch using the MTHDS standard (.mthds bundle files). Use when user says "create a pipeline", "build a workflow", "new .mthds file", "make a method", "design a pipe", or wants to create any new method from scratch. Guides the user through a 10-phase construction process.

End-to-end WGS to polygenic risk score pipeline. Takes paired-end FASTQ files (or a pre-existing VCF) through nf-core/sarek for variant calling, applies VCF QC (normalisation, hard filtering, Ti/Tv and Het/Hom checks), then computes polygenic risk scores via the PGS Catalog. Fills the FASTQ to VCF gap upstream of the gwas-prs skill.

Builds a structured SOC incident response playbook for ransomware attacks covering detection, containment, eradication, and recovery phases with specific SIEM queries, isolation procedures, and decision trees. Use when SOC teams need formalized response procedures for ransomware incidents aligned to NIST SP 800-61 and MITRE ATT&CK ransomware techniques.