Zhao

依赖安全审计时使用。覆盖 npm audit / Snyk / Trivy / 密钥扫描 / 容器扫描。

The English summary is being prepared. Showing the original description.

代码安全审查时使用。适用于 PR 审查 / SAST 扫描 / 手动代码审计。融合 OWASP Code Review Guide + Semgrep + SonarQube。

The English summary is being prepared. Showing the original description.

架构文档编写时使用。适用于系统设计 / 数据流 / 决策记录（ADR）。

The English summary is being prepared. Showing the original description.

供应链安全时使用。适用于依赖漏洞扫描 / 镜像安全 / CI 投毒防护 / SBOM。融合 SLSA + Sigstore + Snyk + Trivy。

The English summary is being prepared. Showing the original description.

Web 漏洞检测时使用。适用于 OWASP Top 10 检测 / XSS / SQLi / SSRF / CSRF。融合 OWASP Testing Guide + Burp Suite + ZAP。

The English summary is being prepared. Showing the original description.

日志分析和排障时使用。适用于生产问题定位、慢查询排查、错误追踪、日志搜索。融合 ELK / Loki + 结构化日志 + Trace ID 追踪。

The English summary is being prepared. Showing the original description.

On-call 轮值和 Runbook 维护时使用。适用于值班制度设计、操作手册编写、升级路径定义。融合 PagerDuty On-call + Atlassian Runbook。

The English summary is being prepared. Showing the original description.

可靠性工程时使用。适用于 SLO 定义 / 错误预算管理 / Chaos Engineering / 灾备演练。融合 Google SRE SLO + Netflix Chaos Monkey。

The English summary is being prepared. Showing the original description.

威胁建模时使用。适用于新功能 / 新系统的安全设计评审。融合 STRIDE + Attack Tree + Microsoft SDL。

The English summary is being prepared. Showing the original description.

容量规划时使用。适用于扩缩容决策、大促准备、成本优化、资源预测。融合 Google SRE Capacity Planning + 负载测试 + 成本模型。

The English summary is being prepared. Showing the original description.

把界面组件按层级组织时使用。适用于设计系统建立、组件库设计、可复用性提升。优先使用 Brad Frost 的 Atomic Design 五层模型（原子→分子→有机体→模板→页面）。

The English summary is being prepared. Showing the original description.

把设计交接给前端时使用。适用于设计完成后的交付、设计审查通过后的执行准备。优先使用 Figma DevMode 实践 + 交接清单 + 待确认问题。

The English summary is being prepared. Showing the original description.

设计移动 App 或多平台产品时使用。适用于 iOS/Android/桌面应用的平台原则适配。优先使用 Apple HIG 四原则 + Material Design 3 原则 + 平台规范。

The English summary is being prepared. Showing the original description.

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Android APK hooking, Frida tracing, request-signing recovery, SSL pinning bypass, JNI boundary inspection, and app trust-boundary analysis. Use when the user asks to hook an APK, inspect signer logic, trace Java or native boundaries, bypass pinning or root checks, inspect shared prefs or app databases, or replay accepted mobile requests. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

The English summary is being prepared. Showing the original description.

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for source maps, build manifests, chunk registries, emitted bundles, obfuscated loader flow, and frontend runtime recovery. Use when the user asks to reconstruct served JavaScript structure, inspect source maps or chunk maps, trace bundle loading, recover hidden routes or APIs from emitted assets, or explain runtime behavior from built frontend artifacts. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

The English summary is being prepared. Showing the original description.

安全报告输出时使用。适用于安全评审报告 / 漏洞汇总 / 风险等级 / 修复跟踪。融合 CVSS 评分 + 修复建议 + 验证确认。

The English summary is being prepared. Showing the original description.

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for file uploads, imports, previews, archive extraction, format conversion, parser invocation, and deserialization chains. Use when the user asks to inspect an upload or import path, trace archive extraction, preview or converter behavior, explain how a file reaches a parser or deserializer, or connect one uploaded artifact to the decisive backend effect. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

The English summary is being prepared. Showing the original description.

事故复盘时使用。适用于 P1/P2 事故后 24~72 小时内的 Blameless Postmortem。融合 Google SRE Postmortem + 5 Whys + 改进项跟踪。

The English summary is being prepared. Showing the original description.

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for cloud metadata services, instance identity, workload identity, link-local credential paths, role assumption, and metadata-to-privilege trust edges. Use when the user asks to inspect metadata-service access, instance credentials, pod or workload identity, link-local token paths, SSRF-to-metadata escalation, or explain how metadata-derived credentials turn into accepted cloud or control-plane privilege. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

The English summary is being prepared. Showing the original description.

线上事故响应时使用。适用于服务不可用、性能退化、数据异常等生产事故。融合 Google SRE Incident Management + PagerDuty Response Framework。

The English summary is being prepared. Showing the original description.

API 文档编写时使用。适用于 OpenAPI 说明 / 示例 / 错误码文档。

The English summary is being prepared. Showing the original description.

复盘文档编写时使用。适用于事故复盘 / 时间线 / 根因 / 改进项。

The English summary is being prepared. Showing the original description.

发布说明编写时使用。适用于 Changelog / 迁移指南 / 影响说明。

The English summary is being prepared. Showing the original description.

用户手册编写时使用。适用于操作指南 / 截图 / FAQ / 教程。

The English summary is being prepared. Showing the original description.