Loading...
Loading...
Found 2,521 Skills
You MUST use this when code-review findings, PR comments, CI review output, or reviewer suggestions need technical validation before any fix or disposition, including feedback from human reviewers, subagents, GitHub, static-analysis tools, or external review systems.
Используй, чтобы впустить ВНЕШНЕЕ СЛОВО в граф Искрона — шабда-интейк; чужой текст перед передачей в дело сверяется с графом и делами. Триггеры: «впусти внешнее слово», «засей граф из issue/доков», «внеси issue», «запиши пост», «внеси новость», «разнеси чужой разбор по делам», intake, ingest issues, shabda intake. Источник входит адаптером, дисциплина одна. Distinct from writing (готовое различение), assistant (слово человека дословно), feedback (опыт о методе), iskronify (derived-конфиг), product-roadmap (GitHub-адаптер). Нужны тулы iskron_*.
Initialize or repair SigNoz MCP server configuration for Agent Plugins v1, Claude Code, Codex, Cursor, VS Code/GitHub Copilot, Claude Desktop, Gemini CLI, Devin CLI, Grok Build, Windsurf, Zed, Antigravity CLI, OpenCode, or another MCP client. Use this skill before any SigNoz docs, query, dashboard, alert, or view workflow when `signoz_*` tools are unavailable, or when the user says "setup SigNoz MCP", "configure SigNoz plugin", "wrong region", "change SigNoz region", "MCP auth failed", or asks to connect SigNoz Cloud or a self-hosted MCP endpoint, even if they do not mention the plugin.
Optimize Django and pytest-django test execution in CI with cache configuration, slow-test splitting, database reuse strategy, parallel workers, pytest-xdist, CircleCI/GitHub Actions/Jenkins/Travis patterns, and full-coverage safeguards. Use when CI test jobs are slow, flaky under parallelism, missing slow-test coverage, or need a local-vs-CI test command design.
Use when a coding agent works in a repository where Jujutsu (jj) is available (a `.jj/` directory) — running jj commands, making speculative edits, splitting changes, recovering with the operation log (jj undo / jj op restore), handing off a PR to Git/GitHub/GitLab, updating a PR after review, or coordinating parallel agents. Uses jj as the local change-management layer while keeping Git as the canonical remote, PR, CI, and audit interface. Also use to avoid jj's agent footguns (pager/editor hangs, commit absorption, colocated git/jj desync) or to replace fragile git reset/checkout/stash/rebase recovery with reversible jj operations.
Use when automating a Unity 6.3 content pipeline or build: importing an art drop (FBX, PNG) with AssetPostprocessor rules and naming conventions, generating prefabs or editing scenes from script with correct Undo and SetDirty, Addressables groups, labels and content builds, content-validation tests, batch-mode, command-line or CI builds (Build Profiles, GameCI, GitHub Actions, Accelerator), editor tools; or when textures import wrong or reimport every run, a scripted edit vanishes, bundles duplicate assets, a batch build ignores its defines, or CI cannot activate Unity.
Operational arsenal for authorized external red-team and bug-bounty recon. Concrete probes, wordlists, regexes, dorks, curl one-liners for: subdomain enum, GraphQL/Swagger/REST discovery, identity fabric (Entra/Okta/ADFS/Google/SAML/M365 deep — Teams/SharePoint/OneDrive), cloud bucket enum (S3/GCS/Azure), CDN/WAF bypass, origin discovery, vendor fingerprinting (Citrix/F5/Pulse/Fortinet/PaloAlto/Cisco/VMware), CI/CD exposure, 48-pattern secret-scan catalog (AWS/GCP/GitHub/Stripe/Slack/Anthropic/OpenAI/Atlassian/DataDog/npm/PyPI), Postman workspaces, breach correlation (HudsonRock/HIBP/DeHashed/IntelX), TLS/JA3 audit, certificate transparency, JS endpoint extraction, package registry leaks, mobile/APK recon, sat imagery, sector-specific recon (healthcare DICOM, finance SWIFT, ICS/SCADA Modbus/BACnet). Detail content in 15 modular reference files, loaded on demand. Use for any authorized recon: scoping, asset discovery, attack-path mapping, secret triage, severity scoring.
UAT THẬT cho một bản framework sắp phát hành - dựng một dự án TRỐNG hoàn toàn mới, cài overstack đúng đường NGƯỜI MỚI (curl bootstrap từ GitHub raw, không phải file:// working-tree), rồi kiểm chứng năng lực MỚI của chính bản đó có tới tay người dùng không (skill reachable, rule CẮN thật, docs khớp). HAI PHA - (1) nhánh CANARY trước merge: đẩy lên nhánh tạm uat/<ts>, curl từ raw của chính nhánh đó (kèm HARNESS_BASE + REPO_RAW + SKILLS_REF trỏ canary), UAT đầy đủ; FAIL thì xoá canary và nhánh chính chưa hề bị bẩn. (2) main-URL smoke NGAY SAU merge: chạy đúng lệnh người mới gõ, KHÔNG override biến nào - chỉ pha này kiểm được các giá trị MẶC ĐỊNH (chỗ hardcode tên nhánh); FAIL thì gỡ commit khỏi remote (revert hoặc reset --force-with-lease). Gọi khi user nói "uat", "test thật", "test downstream", "kiểm tra người mới cài có chạy không", "acceptance", "/fdk-uat", hoặc trước khi công bố một bản có năng lực mới. KHÁC medic --ci và fresh-install-smoke (cả hai cài từ working-tree qua file:// nên KHÔNG chứng minh được đường remote).
A Git workflow assistant toolkit. Use this skill when the user asks to generate a commit message, commit or push code changes, create or switch branches based on a Chinese description, create or update a PR/MR for a target repository, merge a PR/MR by number and update the main branch, tag a branch with a version and push it, tag an already merged stable branch and create a GitHub/GitLab Release by default (the release phase after pr-merge), slim down the current Git repository into a shallow clone, or pull and categorize GitHub starred repositories. It also handles vague requests such as "write a commit message," "commit this," "create a branch for XX," "open a PR," "merge the PR," "create a tag," "publish a release," "publish a version," "slim down the repository," and "categorize my starred repositories."
Comprehensive OSINT methodology skill for offensive security, red team intelligence gathering, and bug bounty reconnaissance. Covers domain recon, email harvesting, social media profiling, GitHub/code leaks, Shodan/Censys enumeration, breach data lookup, employee profiling, infrastructure mapping, cryptocurrency tracing, geospatial intelligence, and AI-assisted analysis workflows. Use when performing reconnaissance against a target domain or organization, investigating a person or entity, tracing cryptocurrency flows, geolocating images or events, or building an attack-surface map.
ONLY for Pi Agents — all other agents have their own web tools. How Pi accesses the web via the pi-web-access package — search, fetch URLs/PDFs/YouTube/GitHub. Use whenever a Pi task needs current info, docs, news, prices, or content from a specific URL.
Hunting skill for auth bypass vulnerabilities. Built from 12 public bug bounty reports across SAML XSW / parser-differential (GitHub Enterprise CVE-2025-25291/25292), SAML signature stripping (Uber, Rocket.Chat, samlify CVE-2025-47949), SAML domain enforcement bypass via control characters (HackerOne 2024), partner-portal cross-IdP assertion reuse (Slack), WordPress XMLRPC bypassing SSO (Uber), JWT alg-confusion HS256/RS256 (Jitsi), JWT signature-validation skip (Linktree, Newspack), and token-audience confusion (Argo CD CVE-2023-22482). For standalone JWT signature/crypto forging (alg:none, key confusion, kid/jku) see hunt-jwt-crypto; this skill covers JWT only inside SSO/SAML/token-trust bypass chains. SAML assertion-layer attacks (XSW, comment injection, signature stripping, XXE-in-assertion) are owned by hunt-saml; this skill owns the broader cross-protocol auth-bypass taxonomy. Use when hunting auth bypass — see the Legacy-Protocol Matrix for branded-UI vs legacy-endpoint patterns.