333 skills · sorted by relevance
Behavioral rules and lifecycle event handlers for the dev-tools package. Defines automated behaviors that trigger at specific points in the agent workflow. (converted from hooks)
The English summary is being prepared. Showing the original description.
Behavioral rules and lifecycle event handlers for the core-tools package. Includes auto-approval of file operations targeting deep-analysis session directories.
The English summary is being prepared. Showing the original description.
Behavioral rules and lifecycle event handlers for the core-tools package. Defines automated behaviors that trigger at specific points in the agent workflow. (converted from hooks)
The English summary is being prepared. Showing the original description.
GraphQL, WebSockets, and microservices patterns for NestJS. Apply only when the relevant package is in dependencies (`@nestjs/graphql`, `@nestjs/websockets`, `@nestjs/microservices`). Each section is orientation, not exhaustive — defer to NestJS docs for deep dives. Use this skill to: - Wire a GraphQL resolver (code-first) with class-validator inputs. - Build a WebSocket gateway with auth and room management. - Set up a microservice transport (TCP/RabbitMQ/NATS/Redis/Kafka) and message handlers. Do NOT use this skill for: - REST controllers (see nest-conventions + decorator-patterns). - ORM (see nest-data-layer). - Auth strategies (see security-analyst phase guidance).
The English summary is being prepared. Showing the original description.
Scaffold a new CLI command using Commander.js with options, action handler, three output modes (human-readable, quiet, JSON), and optional ceremony variant. Covers command naming, option design, shared context patterns, error handling, and integration testing. Use when adding a command to an existing Commander.js CLI, designing a new CLI tool from scratch, or standardizing command structure across a multi-command CLI.
The English summary is being prepared. Showing the original description.
Foundation obedience training for dogs — sit, stay, come, heel, and down using positive reinforcement and marker training. Covers timing, reward hierarchy, session structure, distraction proofing, and common handler errors. Use when a new puppy (8+ weeks) is ready for foundation training, an adult dog lacks reliable basic commands, a rescue dog needs to learn the household's command vocabulary, before advancing to complex behaviors or off-leash work, or when existing commands have degraded and need re-establishing.
The English summary is being prepared. Showing the original description.
Specifies standards for RestController classes, including API route mappings, HTTP method annotations, dependency injection, and error handling with ApiResponse and GlobalExceptionHandler.
The English summary is being prepared. Showing the original description.
Focuses on routing, CSRF protection, context handling, and template usage within the internal handlers directory.
The English summary is being prepared. Showing the original description.
This skill should be used when the user says "找 bug" / "看一下有没有 bug" / "smart-qa" / "/smart-qa" / "帮我测一下这个项目" / "智能 QA" / "推断业务流程测一下"，or asks for an autonomous bug-hunt where they DON'T already know what to test. Distinct from `qa` (blind exploration) and `devtest` (verifies a specific change). smart-qa READS the project source — prefers PRD/requirements docs, falls back to code (activities, routes, click handlers, API calls) — then proposes a focused test plan for confirmation before driving the app. v1 stops after the user confirms the plan and hands off to the existing `qa` skill for execution. v2 (planned) adds per-step assertions.
The English summary is being prepared. Showing the original description.
Use when writing no_std Cortex-M or RISC-V firmware in Rust with cortex-m-rt, probe-rs, defmt, RTIC, or a panic handler. Not for no_std library constraints: use rust-no-std.
The English summary is being prepared. Showing the original description.
Fix Elixir/Erlang AST processing bugs in Grafema beam-analyzer. Use when: (1) Elixir parser returns MODULE node but 0 functions/calls — body nesting issue, (2) Erlang parser crashes with "cannot convert list to string" on OTP 26+ — location format changed from integer to keyword list, (3) pipe operator |> creates spurious CALL nodes instead of desugared function calls — clause ordering bug, (4) multi-module .ex files return only the first module — missing __block__ handler, (5) installing Erlang/Elixir on macOS with outdated Xcode/Clang.
The English summary is being prepared. Showing the original description.
Next.js best practices - file conventions, RSC boundaries, data patterns, async APIs, metadata, error handling, route handlers, image/font optimization, bundling
The English summary is being prepared. Showing the original description.
Use when designing event-driven workflows, decoupling services, implementing fan-out patterns (one trigger, many downstream handlers), implementing idempotent event handling with IDs (24-hour dedupe window), or handling at-least-once delivery from external sources like Stripe webhooks. Covers Inngest event schema, payload format, naming conventions, IDs for idempotency, the ts param, fan-out patterns, and system events like inngest/function.failed.
The English summary is being prepared. Showing the original description.
Use when adding durable execution to a TypeScript project — building retry-safe webhook handlers, background jobs that survive crashes, scheduled tasks, or long-running workflows that outlive a single request. Covers Inngest SDK installation, client config, environment variables, serve endpoints (Next.js, Express, Hono, Fastify), connect-as-worker mode, and the local dev server.
The English summary is being prepared. Showing the original description.
Use when building functions that must survive process crashes, retry automatically on failure, run on a schedule, react to events, or maintain state across infrastructure failures — e.g., webhook handlers that drop events, flaky cron jobs, background jobs that fail mid-execution, or workflows that need to resume where they left off. Covers Inngest function configuration, triggers (events, cron, invoke), step execution and memoization, idempotency, cancellation, error handling, retries, logging, and observability.
The English summary is being prepared. Showing the original description.
Use when analyzing an existing TypeScript or JavaScript codebase to decide where and how to introduce Inngest. Covers repository discovery, framework and package detection, finding durability gaps in HTTP handlers, webhooks, cron jobs, queues, long-running jobs, AI agents, Agent Evals, polling loops, eval loops, and side-effect-heavy code, then producing and implementing an incremental integration plan.
The English summary is being prepared. Showing the original description.
Use when adding cross-cutting concerns to durable functions — structured logging or tracing across all functions, error tracking with Sentry, payload encryption for sensitive data, dependency injection of clients (DB, Stripe, etc.) into function handlers, custom telemetry, or behavior that should apply uniformly across many functions. Covers Inngest middleware lifecycle, creating custom middleware, dependencyInjectionMiddleware, @inngest/middleware-encryption, @inngest/middleware-sentry, and custom middleware patterns.
The English summary is being prepared. Showing the original description.
Design consistent error handling across web, mobile, and React Native—central handlers, user-facing copy, retry, and logging.
The English summary is being prepared. Showing the original description.
Backend code review — injection and SSRF, boundary validation, object-level authorization, mass assignment and data exposure, error leakage, N+1 and unbounded queries. Use when a diff touches API routes or handlers, database access, auth middleware, or server code that reads files, starts processes or fetches URLs.
The English summary is being prepared. Showing the original description.
Use when writing or reviewing request handlers, RPCs, or background jobs for production; adding tracing, metrics, or structured-log calls; or making diagnosability decisions
The English summary is being prepared. Showing the original description.
Detects insecure platform interaction in mobile apps (Android/iOS). Trigger on: exported Activity, exported Service, exported BroadcastReceiver, Content Provider, Intent injection, deep link hijacking, WebView JavaScript enabled, JavascriptInterface, addJavascriptInterface, setJavaScriptEnabled, intent:// scheme, file:// scheme, WKWebView, WKScriptMessageHandler, UIPasteboard, URL scheme hijacking, Universal Links, PendingIntent, FLAG_IMMUTABLE, overlay attack, tapjacking, screenshot prevention, FLAG_SECURE, Broadcast sniffing, IPC data exposure. Covers MASVS-PLATFORM-1/2/3.
The English summary is being prepared. Showing the original description.
Dangling markup injection playbook. Use when HTML injection is possible but JavaScript execution is blocked (CSP, sanitizer strips event handlers, WAF blocks script tags) — exfiltrate CSRF tokens, session data, and page content by injecting unclosed HTML tags that capture subsequent page content.
The English summary is being prepared. Showing the original description.
Anti-debugging detection and bypass playbook. Use when reversing protected binaries that detect debuggers via ptrace, PEB flags, timing checks, or signal/exception handlers on Linux and Windows.
The English summary is being prepared. Showing the original description.
Analyzes malicious and vulnerable Windows kernel drivers (.sys) by parsing the PE for the native subsystem, identifying DriverEntry/IRP dispatch and IOCTL handlers, and flagging BYOVD and kernel-callback abuse. Activates for requests to analyze a Windows driver, examine a .sys sample, or assess a BYOVD/kernel driver threat.
The English summary is being prepared. Showing the original description.