Development skills

VirusTotal API v3 reference. File, IP, domain, and URL analysis endpoints.

The English summary is being prepared. Showing the original description.

ReversingLabs Spectra Analyze (A1000) API reference. File hash classification, detailed reports, dynamic analysis, network indicator reputation, advanced search, YARA, container relationships.

The English summary is being prepared. Showing the original description.

Use when evidence needs grading before anyone reasons from it — the user asks "how reliable is this?", "grade this source", "check this report", "can I trust this article?", "is this corroborated?", or hands over a URL, a pasted report or a Liberty91 event ahead of an ACH or assessment. The Quality of Information Check from the CIA Tradecraft Primer, adapted for vendor and press CTI reporting. Resolves each document to its originating source, splits it into claims, and grades every claim on two written elements, access level (how the source knows) and claim support (what backs the statement), with a stated rationale, using a fixed rubric with hard caps. The grade is not an Admiralty rating. Five outlets citing one vendor report count as one source; anything that cannot be traced to a primary is capped, not guessed. Returns a graded claim table, gaps, a deception screen and JSON. /ach, /threat-assessment and /writing-assessments run it first by default.

The English summary is being prepared. Showing the original description.

Use when you need to know where a piece of reporting actually came from — the user gives an article URL and asks "where does this come from?", "who is the original source?", "is this just a rewrite?", or another skill needs the provenance chain before grading or citing a report. Follows an article's links and named attributions back to the originating vendor, government, victim or actor document and returns the chain, the primary's stated access and confidence language, publication dates, and every hop it could not resolve. Deterministic — a script or the Liberty91 platform resolves the chain; the model does not reconstruct it from memory. Invoked by /quality-of-information-check, /threat-actor-profiling, /campaign-tracking and /intelligence-writing. Works on any URL with no API key.

The English summary is being prepared. Showing the original description.

Use when a user asks to investigate, check, enrich, or characterize an IP address (IPv4 or IPv6). Chains VirusTotal, Shodan, AbuseIPDB, GreyNoise, OTX, and optionally Censys in parallel, then consolidates findings and prioritizes follow-up IOCs. Invoked by /cti-orchestrator when the target is an IP.

The English summary is being prepared. Showing the original description.

AbuseIPDB API reference. IP reputation and abuse report lookups.

The English summary is being prepared. Showing the original description.

Censys API v2 reference. Host reconnaissance and certificate data.

The English summary is being prepared. Showing the original description.

Use when the user wants to configure API keys for the CTI skills pack, asks "how do I set up keys", "configure VirusTotal", "add my Shodan key", or runs /cti-setup. Walks through API key configuration inside Claude Code without needing to run a shell script. Also handles re-running setup, adding individual keys, and verifying that configured keys work.

The English summary is being prepared. Showing the original description.

CrowdStrike Falcon Intelligence (Intel API) reference. OAuth2 auth, Falcon Query Language, indicator (IOC) lookups, threat-actor entities, intel reports, MITRE ATT&CK mappings, malware families, vulnerabilities, rule sets.

The English summary is being prepared. Showing the original description.

Use when a user asks to investigate, check, or characterize a domain or hostname. Chains VirusTotal, URLScan (search existing scans), Shodan (DNS resolve + host), OTX, ransomware.live (victim-status sweep), and optionally Censys. Returns reputation, resolution, hosting fingerprint, ransomware-claim status, and pivot candidates. Invoked by /cti-orchestrator when the target is a domain.

The English summary is being prepared. Showing the original description.

GreyNoise API reference. Internet scanner/noise classification for IPs.

The English summary is being prepared. Showing the original description.

Use when assessing the maturity of a CTI programme, the user asks "how mature is our CTI?" / "what should we improve next?", or wants a benchmark against the five-level model across six dimensions.

The English summary is being prepared. Showing the original description.

Use when you need to check an IP, domain, file hash, or URL against VirusTotal's reputation database. Returns detection ratio, verdict, community score, and key findings. Commonly invoked by investigation skills (/ip-investigation, /domain-investigation, /hash-investigation, /url-investigation) and by analysts enriching IOCs. Other agents/skills can chain this for VirusTotal enrichment.

The English summary is being prepared. Showing the original description.

Use when a user asks to check, identify, or characterize a file hash (MD5, SHA-1, SHA-256). Chains VirusTotal and OTX, optionally triggers /malware-analysis for deeper behavioral review. Returns detection signals, malware family, behavioral tags, and pivot candidates (communicating IPs, dropped files). Invoked by /cti-orchestrator when the target is a hash.

The English summary is being prepared. Showing the original description.

Use when you need authoritative classification, threat-name, MITRE ATT&CK mapping, dynamic-analysis or sandbox results on a file hash, or when you need network threat intelligence for a URL/domain/IP from ReversingLabs Spectra Analyze (A1000). Returns verdict, risk score, AV detection ratio, threat name, behavioural tags, and pivot candidates (parent containers, extracted files, related samples by family). Commonly invoked by /hash-investigation and /malware-analysis. Other agents/skills can chain this for deeper malware enrichment beyond VirusTotal.

The English summary is being prepared. Showing the original description.

Use when the user explicitly asks for the Inngest REST API v2, raw HTTP, OpenAPI, API docs, API authentication, or an endpoint that the Inngest CLI does not expose. Covers api-docs.inngest.com, llms.txt, the OpenAPI v2 spec, Bearer authentication with API keys or signing keys, production and local base URLs, raw curl/fetch requests, request-shape discovery, pagination, secret redaction, and when to prefer the `inngest-api-cli` skill instead.

The English summary is being prepared. Showing the original description.

Use when installing or running the Inngest CLI and Dev Server for local development, local testing, serve endpoint debugging, Docker or Docker Compose setup, MCP configuration, self-hosted `inngest start`, or deployment workflow checks. Covers `inngest dev`, `inngest start`, auto-discovery, config files, environment variables, `@inngest/test`, local event sending, platform gotchas, and production/self-hosted server flags.

The English summary is being prepared. Showing the original description.

Use when handling external API rate limits (e.g., OpenAI 429s, HubSpot or Stripe rate limits), preventing duplicate work from rapid event bursts (debouncing user actions), spreading load over time, ensuring per-tenant fairness, processing events in batches, limiting concurrent runs of the same operation, or assigning priority to important runs. Covers Inngest flow control: concurrency limits with keys, throttling, rate limiting, debounce, priority, singleton, and event batching.

The English summary is being prepared. Showing the original description.

Use when operating Inngest API resources from the terminal with `npx inngest-cli@latest api`: Cloud/local run debugging, event-run lookup, function traces, function invocation, app syncs, webhooks, environments, keys, account checks, and Insights queries. Provides prescriptive command routing for agents: which CLI command to run for a run ID, event ID, app ID, function ID, Cloud environment, API key, missing ID, or potentially mutating operation. Use `inngest-cli` for dev server setup/general CLI workflows and `inngest-api` only when raw REST API v2 docs or OpenAPI fallback are needed.

The English summary is being prepared. Showing the original description.

Use when upgrading an existing TypeScript codebase from Inngest SDK v3 to v4, or when fixing mixed v3/v4 API usage. Covers detecting current SDK usage, moving triggers into createFunction options, replacing EventSchemas with eventType/staticSchema, moving serve options to the client, updating realtime imports, rewriting step.invoke string IDs, checkpointing/serverless runtime settings, Connect option changes, and verification.

The English summary is being prepared. Showing the original description.

Use when the user wants to build a CLI tool to automate browser interactions on a specific website using kimi-webbridge. Invoke when user says "create a CLI for X site", "build a tool to automate X", or wants to control a website programmatically via an AI agent.

The English summary is being prepared. Showing the original description.

Appwrite .NET SDK skill. Use when building server-side C# or .NET applications with Appwrite, including ASP.NET and Blazor integrations. Covers user management, database/table CRUD, file storage, and functions via API keys.

The English summary is being prepared. Showing the original description.

Appwrite Go SDK skill. Use when building server-side Go applications with Appwrite. Covers user management, database/table CRUD, file storage, and functions via API keys. Uses per-service packages and functional options pattern.

The English summary is being prepared. Showing the original description.

Appwrite Ruby SDK skill. Use when building server-side Ruby applications with Appwrite, including Rails and Sinatra integrations. Covers user management, database/table CRUD, file storage, and functions via API keys.

The English summary is being prepared. Showing the original description.