Data & AI skills

Plan a feature before writing any code. Use this skill at the START of non-trivial feature work — when the user says they want to "add", "build", "implement", "create", "develop", or "ship" a feature, endpoint, component, page, service, or capability. Especially trigger when the user's prompt is short or under-specified ("add a dashboard", "build an auth flow", "let's do user activity reports") — those need planning, not direct execution. The skill walks through requirements clarification, codebase exploration, sketches a Mermaid architecture/flow diagram of the proposed design, and produces a plan.md document the user can hand off to a fresh AI session for execution. Skip only when the change is genuinely trivial (typo fixes, single-line tweaks, renames). When in doubt, plan.

The English summary is being prepared. Showing the original description.

Guidance for Tauri v2 NFC plugin with session handling and data validation.

The English summary is being prepared. Showing the original description.

Guidance for Tauri v2 SQL plugin setup, migrations, and safe query access.

The English summary is being prepared. Showing the original description.

Guidance for Tauri v2 stronghold plugin with encrypted storage and sensitive data handling.

The English summary is being prepared. Showing the original description.

Generate fantasy character names in zh-TW with original spelling and etymology, across human, elf, dwarf, orc/beastfolk, and halfling naming traditions. Use when the user needs a name for a character, NPC, party member, villain, shopkeeper, or monster, asks to think of, suggest, or rename such a character, names entities for a MUD/TRPG/game world or worldbuilding document, or writes lore, quests, presets, or seed data that require in-world personal names.

The English summary is being prepared. Showing the original description.

Tunes noisy detections by analyzing historical alert data to quantify false-positive sources, recommend allow-list filters and threshold adjustments, and measure precision impact. Activates for requests to tune a detection, reduce false positives, or analyze alert noise and recommend filters.

The English summary is being prepared. Showing the original description.

Pivots on indicators of compromise across multiple data sources by correlating a seed set of IOCs against logs to find co-occurring indicators, hosts, and timeframes that expand the investigation. Activates for requests to pivot on IOCs, correlate indicators across data sources, or expand an investigation from a seed indicator set.

The English summary is being prepared. Showing the original description.

Hunts for unusual outbound network connections by flagging direct-to-IP traffic, uncommon ports, rare destinations, high data-egress ratios, and connections from unexpected processes in network telemetry. Activates for requests to hunt unusual outbound traffic, detect suspicious egress, or find anomalous external connections.

The English summary is being prepared. Showing the original description.

Detects DNS-based tunneling and data exfiltration in DNS logs: scoring high query volume to single domains, long/high-entropy subdomains, unusual record types, and encoded payload labels. Activates for requests to hunt DNS tunneling, detect DNS exfiltration, or analyze suspicious DNS query patterns.

The English summary is being prepared. Showing the original description.

Hunts for pre-exfiltration data staging and archiving by detecting archive-tool execution (rar, 7z, zip, tar), large compressed files written to staging directories, and collection into a single location before transfer. Activates for requests to hunt data staging, detect pre-exfil archiving, or find collection and compression before exfiltration.

The English summary is being prepared. Showing the original description.

Builds Zeek-based network hunting analytics by writing scripts and analyzing Zeek logs (conn, dns, http, ssl, files) to surface long connections, rare JA3s, suspicious downloads, and beaconing. Activates for requests to build Zeek analytics, write a Zeek hunting script, or analyze Zeek logs for threats.

The English summary is being prepared. Showing the original description.

Analyzes suspected webshells (PHP, ASPX/ASP, JSP) by detecting dynamic-execution sinks, input-to-sink data flow, and common encoder/obfuscation chains, then decoding obvious layers to reveal the command interface. Activates for requests to analyze a webshell, identify a PHP/ASPX/JSP backdoor, or deobfuscate server-side malicious scripts.

The English summary is being prepared. Showing the original description.

Frames a structured, testable threat-hunting hypothesis: grounding it in adversary behavior and available telemetry, defining the data sources and detection logic, and setting success criteria and outcomes. Activates for requests to start a threat hunt, write a hunt hypothesis, or plan a hypothesis-driven hunt.

The English summary is being prepared. Showing the original description.

Analyzes banking trojan webinject configurations to extract targeted institutions, injected JavaScript/HTML, and data-theft hooks, mapping the fraud workflow. Activates for requests to analyze banking trojan webinjects, parse a webinject config, or map targeted banks and credential-theft injections.

The English summary is being prepared. Showing the original description.

Give your AI agents something more useful than a prompt. Velocity through clarity.

The English summary is being prepared. Showing the original description.

Set up GEPA prompt optimization for an ORC workflow

The English summary is being prepared. Showing the original description.

Set up LLM-as-judge evaluation for ORC workflows

The English summary is being prepared. Showing the original description.

SQL discipline for querying Pulp Perfetto traces (.pftrace) with trace_processor — idempotent CREATE OR REPLACE PERFETTO views, GLOB not LIKE, dur = -1 incomplete-slice handling, EXTRACT_ARG for span args, joining on stable utid/upid, SPAN_JOIN PARTITIONED, and the draft→validate→execute loop. Ships Pulp's CPU/UI trace stdlib plus closed GPU startup, health, and probe views. TRIGGER when writing or debugging SQL over a .pftrace, when `pulp trace query` returns wrong/empty rows, or when the trace-analysis skill needs a query primitive.

The English summary is being prepared. Showing the original description.

Prove a UI or generation feature actually works before asking a human to look at it. Covers A/B-ing an imported design against its source render, driving controls headlessly so a dead button cannot ship, proving the generator really spawns, and launching the real host (VCV Rack, a DAW). Use before any "take a look" on imported UI, plugin shells, or prompt-to-artifact pipelines.

The English summary is being prepared. Showing the original description.

Judge whether a change made things better with demonstrable proxy measures tied to the mechanism it targets, not wall-clock time. Load before choosing acceptance measures for any before/after or A/B claim — CI and fleet speed-ups, build speed, DSP/audio quality, render fidelity. Each proxy names its data source, detection floor and sample size, and every zero is paired with a control on the same instrument.

The English summary is being prepared. Showing the original description.

Coordinate a cross-session or cross-machine handoff — snapshot the open work, write a status doc to the pulp-planning repo on main, and emit a ready-to-paste goal prompt that links it, so a fresh session (often on another machine) can pick up and finish. Use when the user says "coordinate a handoff", "hand this off", "move this work to a new machine", "we're retiring this session", or asks for a status doc plus a goal for someone else to continue.

The English summary is being prepared. Showing the original description.

Research, author, validate, render, and archive data-only Pulp Sample Heritage profiles. Use when creating or revising a sampler character profile, importing or exporting Heritage JSON, proving profile behavior with analytic and listening fixtures, recording evidence and trademark-safe provenance, or preparing a caller-owned profile artifact bundle.

The English summary is being prepared. Showing the original description.

Validate, install, update, list, rescan, remove, and reveal data-only Pulp content packs for installed plugins. Use for presets, themes, samples, sample banks, wavetables, and other end-user data that must be reviewed before install or update.

The English summary is being prepared. Showing the original description.

Convert any pile of documents (PDF, Word, HTML pages, wiki exports, PowerPoint slides) into clean, LLM-ready markdown context: inventories the sources, picks the right extractor per file type (pdftotext or PyMuPDF for PDF, pandoc or mammoth for docx, readability extraction for HTML.

The English summary is being prepared. Showing the original description.