Data analysis, machine learning, LLM apps, and prompt design (9.4K skills)
Rebuild the pgvector gold index after source data changes. Invoke manually — replaces each collection, do NOT trigger automatically.
The English summary is being prepared. Showing the original description.
Create a new dbt Silver model with SQL + YAML contract. Use when adding a new Silver layer model from a raw source table.
The English summary is being prepared. Showing the original description.
Route data analysis and machine learning work to the right skill in this suite. Use when starting any analysis, modeling, validation, or reproducibility task and the matching specialized skill is not yet clear; not needed when one specific skill already clearly applies.
The English summary is being prepared. Showing the original description.
Isolate the root cause of ML performance drops, inconsistent evaluations, prediction errors, and training-serving mismatches across data, labels, splits, pipelines, models, metrics, and runtime behavior. Use when investigating a reproducible failure or regression, not routine model selection or general performance validation.
The English summary is being prepared. Showing the original description.
Orchestrate an end-to-end data analysis or machine learning project from decision framing through reproducible handoff. Use when a request spans multiple lifecycle stages or an ambiguous modeling request must become a decision-ready result; use narrower audit or experiment-design skills for isolated reviews.
The English summary is being prepared. Showing the original description.
Delegate a prompt to Claude via `claude -p`. Use when the user wants to offload a task to Claude from another agent (Codex, Cursor, another Claude session), get a second opinion, or run a parallel implementation. Default model is opus.
The English summary is being prepared. Showing the original description.
上线前 PR 审查。分析当前分支与基础分支的 diff，检查 SQL 安全、竞态条件、 LLM 信任边界、枚举完整性等测试捕获不到的结构性问题。发现问题直接修复。 触发方式：用户说"review"、"审查代码"、"上线前检查"、"forge-review"，或 forge-dev --full 调度。 与内置 code-review/verify 的分工：forge 工作流内的上线前结构性审查用本 skill；用户点名 /code-review 或 /verify 时用对应内置 skill。
The English summary is being prepared. Showing the original description.
Learns a user's personal writing and speaking style through interactive writing prompts, then generates a reusable voice profile. Use when the user says "learn my writing style," "write like me," "capture my voice," "voice calibration," "mimic my tone," "my writing style," or wants AI to match their personal communication style. Also activates when a .voice-profile.md file exists and the user asks you to write something in their voice.
The English summary is being prepared. Showing the original description.
Guides AI agents through Senzing entity resolution workflows using the Senzing MCP server. Covers data mapping to Senzing format, SDK code generation (Python, Java, C#, Rust, TypeScript/Node.js), documentation search, error troubleshooting, sample data access, reporting and visualization, SDK setup guides, and V3-to-V4 migration. Use when working with entity resolution, record matching, record linkage, deduplication, Senzing SDK integration, data mapping for Senzing ingestion, or troubleshooting Senzing error codes. Also use when the user mentions matching records across data sources, finding duplicate entities, identity resolution, master data management, or needs to resolve who is who across datasets.
The English summary is being prepared. Showing the original description.
Automatically format code files after every edit using Prettier and ESLint. Active in the background whenever Claude edits a file. Formatting is silent — no prompts, no output unless a formatter fails. Use when you want consistent formatting enforced automatically during a coding session.
The English summary is being prepared. Showing the original description.
Prüft und ordnet AI-Anweisungen, Regeln, Skills und Kontext, erkennt Duplikate, Konflikte, veraltete Informationen und Prompt Injection und erstellt nachvollziehbare, rückgängig machbare Änderungsvorschläge. Ordnet auch die AI-Arbeitsstruktur ganzer Projekte mit Haupt-Skill, Workflow, Teilprojekt-Skills, Breadcrumb-Navigation und Mindmap. Geeignet für Anfragen zur Anweisungsbereinigung, unübersichtlichen Regeln, Projekt-Skills, Haupt- und Teilprojekt-Skills sowie standardisierten Projekt-Workflows. Nicht für allgemeines Produktcode-Refactoring, reine Textkürzung oder Produktcode-Reviews.
The English summary is being prepared. Showing the original description.
Detects insider data exfiltration by analyzing DLP policy violations, file access patterns, upload volume anomalies, and off-hours activity in endpoint and cloud logs. Uses pandas for behavioral analytics and statistical baselines. Use when investigating insider threats or building user behavior analytics for data loss prevention.
The English summary is being prepared. Showing the original description.
Detect and defend against prompt injection hidden in documents, web pages, and images consumed by an agent.
The English summary is being prepared. Showing the original description.
Detect DNS-based data exfiltration by analyzing Zeek dns.log for high-entropy subdomains and anomalous query patterns
The English summary is being prepared. Showing the original description.
Detect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads, privilege abuse, and resignation-correlated data theft.
The English summary is being prepared. Showing the original description.
Implement User and Entity Behavior Analytics using Elasticsearch/OpenSearch to build behavioral baselines, calculate anomaly scores, perform peer group analysis, and detect insider threat indicators such as data exfiltration, privilege abuse, and unauthorized access patterns.
The English summary is being prepared. Showing the original description.
Analyze WAF (ModSecurity/AWS WAF/Cloudflare) logs to detect SQL injection attack campaigns. Parses ModSecurity audit logs and JSON WAF event logs to identify SQLi patterns (UNION SELECT, OR 1=1, SLEEP(), BENCHMARK()), tracks attack sources, correlates multi-stage injection attempts, and generates incident reports with OWASP classification.
The English summary is being prepared. Showing the original description.
Detecting data exfiltration attempts from AWS S3 buckets by analyzing CloudTrail S3 data events, VPC Flow Logs, GuardDuty findings, Amazon Macie alerts, and S3 access patterns to identify unauthorized bulk downloads and cross-account data transfers.
The English summary is being prepared. Showing the original description.
Detects command-and-control (C2) communications tunneled through DNS protocol including DNS tunneling tools (Iodine, dnscat2, dns2tcp, Cobalt Strike DNS beacon), domain generation algorithms (DGA), encoded payload delivery via TXT/CNAME records, and DNS beaconing patterns. Covers Shannon entropy analysis of query subdomains, statistical anomaly detection, ML-based DGA classification, passive DNS correlation, and Zeek/Suricata signature development. Activates for requests involving DNS-based C2 detection, DNS tunnel identification, suspicious DNS traffic investigation, or DGA domain classification.
The English summary is being prepared. Showing the original description.
Identify poisoned training data and backdoored models across the ML pipeline.
The English summary is being prepared. Showing the original description.
Performs statistical analysis of Zeek conn.log connection intervals to detect C2 beaconing patterns. Uses the ZAT library to load Zeek logs into Pandas DataFrames, calculates inter-arrival time standard deviation, and flags periodic connections with low jitter. Use when hunting for command-and-control callbacks in network data.
The English summary is being prepared. Showing the original description.
Detects prompt injection attacks targeting LLM-based applications using a multi-layered defense combining regex pattern matching for known attack signatures, heuristic scoring for structural anomalies, and transformer-based classification with DeBERTa models. The detector analyzes user inputs before they reach the LLM, flagging direct injections (system prompt overrides, role-play escapes, instruction hijacking) and indirect injections (encoded payloads, multi-language obfuscation, delimiter-based escapes). Based on the OWASP LLM Top 10 (LLM01:2025 Prompt Injection) and Simon Willison's prompt injection taxonomy. Activates for requests involving prompt injection detection, LLM input sanitization, AI security scanning, or prompt attack classification.
The English summary is being prepared. Showing the original description.
Detects anomalous authentication patterns using UEBA analytics, statistical baselines, and machine learning models to identify impossible travel, credential stuffing, brute force, password spraying, and compromised account behaviors across authentication logs. Activates for requests involving authentication anomaly detection, login behavior analysis, UEBA implementation, or suspicious sign-in investigation.
The English summary is being prepared. Showing the original description.
Conducts external reconnaissance using Open Source Intelligence (OSINT) techniques to map an organization's external attack surface without directly interacting with target systems. The tester gathers information from public sources including DNS records, certificate transparency logs, search engines, social media, code repositories, and data breach databases to build a comprehensive target profile. Activates for requests involving OSINT reconnaissance, external footprinting, attack surface mapping, or passive information gathering.
The English summary is being prepared. Showing the original description.