Development skills

API authorization and BOLA testing playbook. Use when APIs expose object identifiers, nested resources, hidden writable fields, or weak function-level authorization.

The English summary is being prepared. Showing the original description.

Anti-debugging detection and bypass playbook. Use when reversing protected binaries that detect debuggers via ptrace, PEB flags, timing checks, or signal/exception handlers on Linux and Windows.

The English summary is being prepared. Showing the original description.

Decompile, analyze, and reverse engineer Android applications (APKs). Utilize tools like JADX, Apktool, and dex2jar to extract source code (Java/Kotlin), analyze manifest configurations (Intents, Activities), and identify hardcoded secrets or insecure API endpoints.

The English summary is being prepared. Showing the original description.

Identify and exploit flaws in API rate limiting enforcement. Use this skill when encountering HTTP 429 Too Many Requests errors during password brute-forcing, OTP validation, credential stuffing, or enumeration attacks. These bypasses leverage IP spoofing, parameter manipulation, and edge-case application logic.

The English summary is being prepared. Showing the original description.

Identify and exploit Mass Assignment vulnerabilities in APIs. Use this skill when testing REST APIs or application forms that directly map user-supplied JSON or POST input to internal database objects. An attacker can inject undocumented variables (e.g., `is_admin`, `verified`) to illegally modify restricted properties.

The English summary is being prepared. Showing the original description.

API reconnaissance and documentation review playbook. Use when discovering endpoints, schemas, versions, OpenAPI specs, hidden docs, and surface area for API testing.

The English summary is being prepared. Showing the original description.

API authentication and JWT abuse playbook. Use when testing bearer tokens, API keys, claim trust, header spoofing, rate limits, and API auth boundary weaknesses.

The English summary is being prepared. Showing the original description.

Systematically discover hidden Application Programming Interfaces (APIs), uncover undocumented endpoints (Shadow APIs), and fuzz parameters. Use this skill as the pivotal first step in API Bug Hunting, transforming a basic frontend application into a vast mapped attack surface.

The English summary is being prepared. Showing the original description.

Test APIs for authentication and authorization bypass vulnerabilities including JWT manipulation, OAuth2 flaws, API key leakage, broken authentication, and token forgery. Use this skill when assessing REST/GraphQL APIs for access control weaknesses, session management flaws, or credential handling issues. Covers JWT algorithm confusion, OAuth redirect manipulation, and rate limit bypass.

The English summary is being prepared. Showing the original description.

Arbitrary write to RCE playbook. Use when you have an arbitrary write primitive (from heap exploitation, format string, or OOB write) and need to convert it into code execution by targeting GOT, hooks, _IO_FILE vtable, exit_funcs, TLS_dtor_list, modprobe_path, .fini_array, or C++ vtables.

The English summary is being prepared. Showing the original description.

401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths. Covers path manipulation, HTTP method tampering, header injection, protocol downgrade, and automated bypass tools.

The English summary is being prepared. Showing the original description.

Entry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any deeper API topic skill.

The English summary is being prepared. Showing the original description.

Consult this skill BEFORE proposing a fix to any CLI gap or schema gap that touches evidence, trust magnitude, evidence types, evidence grades, the TM formula, or star-level promotion gates. Also read it whenever an issue mentions citations, stars, commits, contributors, views, reviewers, percentile, arxiv, github-stars-own, repo-own, social-signal, benchmark-result, peer-review, self-attestation, fusion-recipe, verifier-attestation, or proxy-containment — those are the 10 canonical evidence types and the raw inputs that feed their formulas. Also read it when asked whether a skill qualifies for a given star level (0★–6★): the Star Bar and promotion gates live in `META.md`, not in the TM methodology page. Reading both prevents proposing a calibration that satisfies the TM grade threshold but violates a Star Bar installability or link requirement.

The English summary is being prepared. Showing the original description.

Review the changes since a fixed point (commit, branch, tag, or merge-base) along two axes — Standards (does the code follow this repo's documented coding standards?) and Spec (does the code match what the originating issue/PRD asked for?). Runs both reviews in parallel sub-agents and reports them side by side. Use when the user wants to review a branch, a PR, work-in-progress changes, or asks to "review since X".

The English summary is being prepared. Showing the original description.

Use this skill when the user wants the full existing-registry Trust Magnitude inspector: understand why a named Gaia skill has a particular star rank, what its Trust Magnitude (TM) score is, which evidence rows are contributing (or dead), how far it is from the next grade, or what evidence to add to move the needle. Also use when asked for a full leaderboard of all named skills ranked by TM. Triggers: "why does X have 3 stars", "what's the TM for X", "inspect TM", "explain the score for X", "what evidence would rank up X", "show leaderboard", "rank all skills by TM", "what's dragging down X's score", "dead evidence rows", "how close is X to grade A/S".

The English summary is being prepared. Showing the original description.

Dry-run Trust Magnitude for proposed named skills or suites before curation. Use when deciding whether a proposed suite deserves A/S treatment, when checking Fusion Score structural inputs, when comparing repo stars vs suite component counts, or when asked to appraise a candidate before adding it to the registry.

The English summary is being prepared. Showing the original description.

Explore a feature or CLI, reproduce defects and record bounded findings. Use for "explore X", "find issues with X", or the exploration stage of feature- pipeline; standalone runs return findings without automatically expanding scope.

The English summary is being prepared. Showing the original description.

Use this skill when the user wants to understand why a named Gaia skill has a particular star rank, what its Trust Magnitude (TM) score is, which evidence rows are contributing (or dead), how far it is from the next grade, or what evidence to add to move the needle. Also use when asked for a full leaderboard of all named skills ranked by TM. Triggers: "why does X have 3 stars", "what's the TM for X", "inspect TM", "explain the score for X", "what evidence would rank up X", "show leaderboard", "rank all skills by TM", "what's dragging down X's score", "dead evidence rows", "how close is X to grade A/S".

The English summary is being prepared. Showing the original description.

Close out a review/meta branch that lands an evidence-ingest / curation batch: create the named nodes, ingest verified evidence, appraise Trust Magnitude, calibrate stars, wire suites, correct upstream naming, stage ONLY the intended artifacts (dropping CRLF churn and blocking leaks), validate, and open the PR. Use when a curation/ingest batch is verified and ready to land, or when the user says "close the review/meta branch", "land the ingest batch", "wrap up the intake PR", "/gaia-review-meta-close". Wraps the deterministic hygiene in scripts/review_meta_close.py and gates the judgment calls (calibration, Origin, suite promotion, naming, merge) behind explicit human checkpoints.

The English summary is being prepared. Showing the original description.

Post-review intake closing skill. After an intake is resolved (whether accepted via review/meta PR merge or rejected/deferred at triage/evidence review), run this skill to post standardized, personalized closing comments on the PR (if any) and each intake issue. Comments include: evidence pipeline findings with /trust-appraise TM output, per-row artifact scores, decisions rationale, path-to-promotion/acceptance guidance, and a mandatory badge status note including the universal Powered by Gaia badge. Use after curation completes, before or immediately after merge for accepted intakes, or immediately upon rejection.

The English summary is being prepared. Showing the original description.

Close out a completed EPIC / sprint end-to-end: author a fact-verified meta-post announcing what shipped, archive the EPIC's handovers, snapshot orchestrator memory, gate the integration→main merge on CI-green + explicit human go, drive the version bump (merge-commit conventions that auto-sync classifies), and verify the release reached the registry/PyPI. Use when the user says "close out EPIC <n>", "wrap up the sprint", "ship the meta shift", "/epic-close", or asks to finalize an integration branch that is ready to merge to main. Generalizes the EPIC 1002 (Yggdrasil II) close-out. This skill orchestrates — it authors founder docs directly (superadmin) and delegates code/regen to workers; it NEVER merges to main without the human gate.

The English summary is being prepared. Showing the original description.

Discovery-only global trending extension for Gaia. Snapshots configured external skill sources, prioritizes five-candidate pages for L4 review, and stops before trust, evidence, intake, or registry mutation.

The English summary is being prepared. Showing the original description.

Batch wrapper for /gaia-ingest. Ingests a bounded set of already-verified evidence rows through CLI-only writes, uses --no-build on every row, appraises Trust Magnitude for every affected named skill, then runs exactly one build and validation pass. Use for an L4-approved intake after /ev-pipeline; benchmark-result rows also require a Phase 2B report and explicit human gate approval.

The English summary is being prepared. Showing the original description.

Playbook for correcting a named skill's star level to match its computed Trust Magnitude grade, with an independent post-calibration verification pass and a CLI-logged timeline event (never hand-written). Use when: recalibrating a skill's level, fixing a stale or drifted star rating, running a batch of `gaia dev calibrate` corrections, or confirming a past calibration actually landed. Triggers: "calibrate <skill>", "recalibrate the trust magnitude backlog", "promote/demote <skill> to N stars", "why is <skill> still N stars", "verify a calibration actually landed", "Hall of Heroes ranking is wrong".

The English summary is being prepared. Showing the original description.