Cloud, CI/CD, monitoring, and deployment (7.3K skills)
Use when the user asks to build or update a threat-actor profile, "tell me about actor X" / "profile actor Y", or another skill needs the canonical profile template (attribution, TTPs, campaigns, infrastructure patterns, intelligence gaps).
The English summary is being prepared. Showing the original description.
Use when a user asks to scan, investigate, or characterize a URL. Submits to URLScan (unlisted by default), cross-references with VirusTotal and OTX, extracts the parent domain and resolved IP for follow-up investigation. Returns verdict, redirect chain, contacted infrastructure, and screenshot. Invoked by /cti-orchestrator when the target is a URL.
The English summary is being prepared. Showing the original description.
Use when you need to check whether an organisation/domain has been claimed by a ransomware group, profile a specific ransomware group (TTPs, leak-site infra, IOCs, YARA), or aggregate ransomware victim claims by country/sector/timeframe. Backed by ransomware.live's leak-site scrapes — 27k+ victims across 330+ groups. Commonly invoked by /domain-investigation, /ransomware-ecosystem, /threat-actor-profiling, and detection-engineering workflows. Reads $RANSOMWARE_LIVE.
The English summary is being prepared. Showing the original description.
Use when the user asks for a KQL query, a Microsoft Sentinel / Defender / Azure Log Analytics detection or hunt, or wants to translate a finding from `/hash-investigation` / `/malware-analysis` into KQL. Format spec + writing guide.
The English summary is being prepared. Showing the original description.
Indicator pivoting methodology — how to use one known indicator to discover related infrastructure across the IOC graph. Decision tree by indicator type with concrete `/lookup-*` commands per pivot, a worked multi-hop example, pivot-quality scoring, and routing into the rigor pipeline. Use when the user asks "what else is connected to this IP / domain / hash / cert / actor?", needs to expand a single seed IOC into a campaign cluster, or wants the canonical reference for graph-walking IOCs.
The English summary is being prepared. Showing the original description.
Use when you need to query an OpenCTI instance — is this IOC already known, what entities/reports/campaigns exist for an actor — or push new intel into it — creating indicators/observables, labelling, TLP markings, relationships, or importing a STIX 2.1 bundle. Two-way integration. Commonly invoked by /ip-investigation and friends to check whether an indicator is already in your knowledge base, and by analytical skills that want to publish their findings back to OpenCTI. Reads $OPENCTI_URL and $OPENCTI_TOKEN.
The English summary is being prepared. Showing the original description.
Dark web intelligence collection methodology — vendor-first access posture, sourced reference lists for 35+ underground forums and 30+ Telegram channels, OPSEC primer, passive-monitoring strategy, and bundled Python CLIs for onion-indexer search, Telegram channel monitoring, and local keyword matching. Use when the user wants to design or run dark-web collection, build a selector list, pick a vendor, or set up monitoring infrastructure.
The English summary is being prepared. Showing the original description.
Use when building functions that must survive process crashes, retry automatically on failure, run on a schedule, react to events, or maintain state across infrastructure failures — e.g., webhook handlers that drop events, flaky cron jobs, background jobs that fail mid-execution, or workflows that need to resume where they left off. Covers Inngest function configuration, triggers (events, cron, invoke), step execution and memoization, idempotency, cancellation, error handling, retries, logging, and observability.
The English summary is being prepared. Showing the original description.
Inspect and operate Inngest Cloud through its OAuth MCP connection. Use for deployed apps and functions, failed or slow runs, traces, events, environments, sessions, experiments, and Insights. Prefer this for Cloud operations when MCP tools are available; use CLI or REST skills for explicit terminal or HTTP tasks.
The English summary is being prepared. Showing the original description.
万能复刻 / universal website copy-remix workflow with evidence-based reference recon. Use when the user wants to copy, clone, recreate, remix, migrate, or rebuild any reference website's look, interaction feel, scroll rhythm, hero motion, layout structure, visual system, deployed static assets, or landing-page experience into a new website. Trigger for requests like 万能复刻, 万能网站复制, 复刻官网, 一比一复刻, 授权复制, 高仿但换产品, 参考某官网做自己的官网, RMUX 风格, Linear/Raycast/Apple/Vercel 风格迁移, hero 动效复刻, 滚动体验复刻, 官网换皮重构, 网站侦察, 复刻验收, WebGL/Canvas/Three.js 效果还原.
The English summary is being prepared. Showing the original description.
Alibaba Cloud SLS (Simple Log Service) provider for obz. Supports metrics (PromQL), logs (SLS Query), and traces across project/store pairs. Requires AccessKey auth and provider-specific flags like --project, --logstore, --metricstore, and --trace-logstore. This skill should be used when the user mentions "SLS", "Alibaba Cloud", "obz -p sls", or needs to configure SLS provider instances.
The English summary is being prepared. Showing the original description.
Multi-backend observability CLI for querying metrics, logs, and traces across 12 backends. This skill should be used when the user runs obz commands, constructs metric/log/trace queries, configures providers, parses obz JSON output, or troubleshoots obz errors. Covers all core commands (metric query/list/info/labels/label-values/series, log search, trace search/get), global flags, time formats, output modes, config files, and exit codes.
The English summary is being prepared. Showing the original description.
Partner, channel, and ecosystem marketing for B2B SaaS — and the design of the partner program itself. Use this skill for co-marketing with technology alliances and channel partners, integration launches, joint campaigns and content, partner tiering and enablement, cloud-marketplace go-to-market (AWS, Azure, GCP listings, private offers, committed-spend drawdown), and for channel program architecture: whether to launch a partner program at all, which motions to run (referral, technology, services/SI, reseller), partner unit economics, margin and SPIF design, partner recruitment and certification ramp, and the rules of engagement that settle a contested deal. Also triggers on: partner marketing, co-marketing, channel, reseller, VAR, MSP, distributor, OEM, alliance, ecosystem, integration launch, marketplace listing, AWS Marketplace, private offer, MDF, joint webinar, co-branded, channel conflict, rules of engagement, deal registration, partner program design, should we build a partner program, partner economics, partner P&L, partner CAC, margin stacking, SPIF, rebate, partner recruitment, partner onboarding, partner certification, partner tiers, our partners signed up and never sold anything.
The English summary is being prepared. Showing the original description.
Set up and run local LLMs with Harbor. Use when the user wants to run models locally, install Harbor, start Open WebUI, llama.cpp, Ollama, vLLM, Docker Model Runner, MLX, or oMLX, pull GGUF or HuggingFace models, add SearXNG web search, Speaches TTS/STT, or Open Terminal code execution, launch Codex/Claude/Grok/OpenCode against a Harbor backend, or troubleshoot GPU, VRAM, and service startup.
The English summary is being prepared. Showing the original description.
Orchestrate AI coding agents (Claude Code, Codex, OpenCode) in isolated sandboxes using the @ai-hero/sandcastle SDK. Use when the user needs to (1) run agents AFK in Docker/Podman containers, (2) build multi-agent pipelines with plan-execute-review patterns, (3) run parallel agents on separate worktrees, (4) create iterative agent loops with maxIterations, (5) extract structured output from agent runs, (6) set up sandcastle in a new or existing project, or (7) write prompt files with template args and shell expressions.
The English summary is being prepared. Showing the original description.
系统架构图绘制。当需要绘制任何系统架构图、云架构设计图、微服务架构图、Serverless架构图、混合云架构图时使用此技能，支持腾讯云及通用架构场景。基于 Draw.io XML 生成 .drawio 文件，支持二次可视化编辑。
The English summary is being prepared. Showing the original description.
Generate professional diagrams including cloud architecture, data charts, academic figures, and more. Triggers on requests like "画架构图", "画图表", "画论文插图", "生成系统图", "create diagram", "visualize data", "draw neural network", or when users provide a sketch/image they want to recreate professionally.
The English summary is being prepared. Showing the original description.
用户咨询腾讯云产品资源、AWS、阿里云等多云资源时，查看智能顾问架构图、架构目录、架构详情、架构评估结果、绘制架构图、开通智能顾问时、AI智能巡检、AI容量监测、AI混沌演练、AI云诊断、主动预警、架构健康度、云运维问答、云资源查询、云成本优化、安全合规、云资源盘点、闲置资源检查、云产品最佳实践等AIOps、ChatOps、CloudOps操作时使用。
The English summary is being prepared. Showing the original description.
MVP 开发专家团运维工程师（卜宕机）。负责自动化部署（CloudBase/Docker）、环境验证、健康检查、回滚策略、交付包组装。确保每次部署可验证、每次交付可追溯。 触发词：由 mvp-dev-team-lead 主理人调度执行 Phase 4 部署任务时激活。不直接面向用户。
The English summary is being prepared. Showing the original description.
Makers 开发专家团部署 Skill — 将前端/全栈项目部署到 EdgeOne Makers。 包含 CLI 安装、登录鉴权、一键部署、JSON 输出解析、URL 铁律。 触发词：部署、发布、上线、发版、deploy、publish、go live、 重新部署、deploy to EdgeOne。 当执行 edgeone makers deploy 命令时必须加载此 skill。
The English summary is being prepared. Showing the original description.
Infrastructure and CI/CD specialist. Automates deployments to Vercel, Docker, or AWS.
The English summary is being prepared. Showing the original description.
Executes structured recovery from a ransomware incident following NIST and CISA frameworks, including environment isolation, forensic evidence preservation, clean infrastructure rebuild, prioritized system restoration from verified backups, credential reset, and validation against re-infection. Covers Active Directory recovery, database restoration, and application stack rebuild in dependency order. Activates for requests involving ransomware recovery, post-encryption restoration, or disaster recovery from ransomware.
The English summary is being prepared. Showing the original description.
Use when creating new skills, editing existing skills, or verifying skills work before deployment
The English summary is being prepared. Showing the original description.
Threat actor infrastructure tracking involves monitoring and mapping adversary-controlled assets including command-and-control (C2) servers, phishing domains, exploit kit hosts, bulletproof hosting, a
The English summary is being prepared. Showing the original description.