436 skills · sorted by relevance
Use XcodeBuildMCP to build, run, launch, and debug the current iOS project on a booted simulator. Trigger when asked to run an iOS app, interact with the simulator UI, inspect on-screen state, capture logs/console output, or diagnose runtime behavior using XcodeBuildMCP tools.
The English summary is being prepared. Showing the original description.
Test and debug browser UIs using Chrome DevTools MCP — DOM inspection, console errors, network requests, performance traces, and visual verification. Load when building or debugging anything that renders in a browser, verifying a UI fix, profiling Core Web Vitals in a real page, or the user asks for browser testing with DevTools. Requires chrome-devtools MCP configured. Not for backend-only or CLI work. Pairs with frontend-design and performance-optimization.
The English summary is being prepared. Showing the original description.
Plan or audit the cross-layer Harbor cooperative editor: Loro replicas for humans and agents, governed edit claims, salvage authority, and transport across shared, LAN, and remote harbors. Use when a change spans editor collaboration, identity, recovery, or transport contracts. For a single GPUI pane use gpui-rust-console; for motion use rust-gpui-motion; for a shader use gpui-shaders. NOT for non-collaborative screens, web editors, or generic Rust development.
The English summary is being prepared. Showing the original description.
App Store and Google Play submission automator with Fastlane, screenshot automation, metadata management, and TestFlight/internal testing. Activate on: app store submission, Fastlane, TestFlight, Google Play Console, screenshot automation, metadata management, app review, code signing, provisioning profiles. NOT for: CI/CD pipeline setup (use github-actions-pipeline-builder), app architecture (use react-native-architect), analytics (use mobile-analytics-crash-reporting-expert).
The English summary is being prepared. Showing the original description.
Design low-friction UX, interaction patterns, and comeback loops for AI coding assistant apps, agent consoles, background coding agents, and Port Daddy swarm/operator surfaces. Use when creating flows like prompt-to-diff, context attach, plan/apply/review, checkpoint rollback, background-agent dashboards, visual proof, or multi-agent invocation. NOT for generic landing pages, static dashboards, or implementation-only changes without product flow.
The English summary is being prepared. Showing the original description.
Extend and modify the admin dashboard, developer portal, and operations console. Use when adding new admin tabs, metrics, monitoring features, or internal tools. Activates for dashboard development, analytics, user management, and internal tooling.
The English summary is being prepared. Showing the original description.
Research AI coding assistant products, audiences, user stories, social proof, hacks, and unmet needs for apps like Cursor, Claude Code, Codex, Warp Code, Devin, Windsurf, GitHub Copilot, Cline, Aider, and homegrown agent stacks. Use when designing or positioning agentic developer tools, Port Daddy Agent Harbor, swarm consoles, background coding agents, or competitive/product research for AI software engineering. NOT for implementing the coding agent runtime, generic market research, or UX mockups without developer workflow evidence.
The English summary is being prepared. Showing the original description.
The frontend Error Inspector capture system (captureError, lib/diagnostics/**). Use when wiring a new CapturedErrorSource or adapter, calling captureError from a new site, picking a red/orange/yellow tier or errorTierRules downgrade, or turning a console.error or swallowed catch into a captured error.
The English summary is being prepared. Showing the original description.
Admin debug system wiring for the floating AdminIndicator's live debug data and Copy Full Context. Use when adding debug visibility to a route or feature, wiring useDebugContext or the debug panel, capturing console errors, or enabling the copy-context workflow for a page.
The English summary is being prepared. Showing the original description.
Find and identify the CCSPlayerPawn_SnapViewAngles function in CS2 server binary using IDA Pro MCP. Use this skill when reverse engineering CS2 server.dll or libserver.so to locate the non-virtual SnapViewAngles method, anchored on the "setang" console-command usage string and its non-teleport call branch. Emits a unique IDA-style byte signature and a func YAML. Trigger: CCSPlayerPawn_SnapViewAngles, SnapViewAngles
The English summary is being prepared. Showing the original description.
Find and identify the CBasePlayerPawn::CommitSuicide virtual function's vtable slot in the CS2 server binary using IDA Pro MCP. Use this skill when reverse engineering server.dll or libserver.so to locate the self-inflicted-death handler (used by the "kill"/bot_kill console commands and related gameplay code) by RTTI-walking CBasePlayerPawn's primary vtable and reading its known slot index directly, then confirming the body matches CommitSuicide(bool bExplode, bool bForce) semantics. Trigger: CBasePlayerPawn_CommitSuicide
The English summary is being prepared. Showing the original description.
Use when a running Spark or DSH web service needs real-browser verification — page load, client-plugin boot errors, console errors, failed requests, or onboarding/dialog rendering — with the repository's own Playwright chromium.
The English summary is being prepared. Showing the original description.
Complete SEO + GEO (Generative Engine Optimization) system for SaaS companies wanting to rank on both Google and AI search engines (ChatGPT, Perplexity, Gemini, Claude). Use this skill whenever the user asks about SEO strategy, keyword research, content planning, writing SEO-optimized articles, auditing their search performance, creating a content calendar, analyzing competitors, or optimizing for AI search visibility. Trigger on: "seo", "keyword research", "content calendar", "rank on google", "search traffic", "write an article", "blog post", "serp", "backlinks", "competitor analysis", "content cluster", "seo audit", "geo optimization", "ai search", "search console", "organic traffic", "content strategy", "publish article", "seo setup", "ranking", "impressions", "ctr", "meta description", "schema markup", "faq schema". Also trigger when a user wants to set up their SaaS blog SEO from scratch, analyze their current rankings, or create a publishing workflow.
The English summary is being prepared. Showing the original description.
Query Google Search Console for SEO data - search queries, top pages, CTR opportunities, URL inspection, and sitemaps. Use when analyzing search performance, finding optimization opportunities, or checking indexing status.
The English summary is being prepared. Showing the original description.
Use when auditing or improving example.com's SEO/indexing — Google Search Console issues (404s, sitemap, "discovered not indexed"), on-page checks (title/meta/canonical/OG/H1/internal links), or wiring search-engine notification (IndexNow/GSC/Bing/Yandex). Also use when the operator pastes GSC findings and asks to fix + validate.
The English summary is being prepared. Showing the original description.
Debug AEM Workflow issues on AEM as a Cloud Service — stuck workflows, failed steps, missing Inbox tasks, launcher failures, stale instances, thread pool exhaustion, queue backlogs, purge failures, and permissions errors. Use when the user reports workflow problems on Cloud Service, asks why a workflow is stuck or failed, needs step-by-step troubleshooting, or provides thread dumps, configuration status output, or Sling Job console output for analysis.
The English summary is being prepared. Showing the original description.
Route an explicitly requested independent/delegated browser QA assignment or durable E2E evidence need; do not trigger for direct Playwright/DOM/console/network inspection, ordinary UI implementation, backend-only work, or production-mutating flows.
The English summary is being prepared. Showing the original description.
Perform direct, bounded browser inspection through the `browser.qa` capability when the user requests runtime UI evidence or one browser-specific claim needs DOM/accessibility/console/network/visual verification; do not trigger for every UI change, backend work, delegated QA, or durable E2E artifact routing.
The English summary is being prepared. Showing the original description.
Use when a running Spark or DSH web service needs real-browser verification — page load, client-plugin boot errors, console errors, failed requests, or onboarding/dialog rendering — with the repository's own Playwright chromium.
The English summary is being prepared. Showing the original description.
IoT and embedded device security testing methodology. Covers hardware reconnaissance (UART, JTAG, SWD, SPI flash, I2C EEPROM, eMMC chip-off), firmware acquisition (vendor portals, OTA capture, flash dump, binwalk extraction), firmware analysis (filesystem mounting, binary triage, hardcoded secrets, default credential discovery), bootloader attacks (U-Boot console, secure-boot bypass, fault injection), runtime attacks on embedded Linux/RTOS (busybox CVEs, MTD writes, /dev/mem), wireless protocol attacks (Zigbee, BLE, Z-Wave, LoRaWAN, Thread/Matter, sub-GHz), MQTT/CoAP/Modbus/BACnet/OPC-UA exploitation, mobile companion app analysis, cloud-IoT API abuse, and side-channel/glitching basics. Use for IoT pentest, smart-home assessment, ICS/OT testing, or embedded vulnerability research.
The English summary is being prepared. Showing the original description.
Discover a single-page-app's hidden backend API from its public JS bundle, then test that API for broken access control / missing authentication. One of the highest-yield web plays in modern recon — SPAs ship their entire backend route map to the browser, and the API behind them is frequently missing the auth middleware the login page implies. Built from an authorized engagement where this play found an unauthenticated financial API that an ASM scan reporting hundreds of 'Criticals' completely missed. Use whenever a target serves a JS-heavy SPA (React/Vue/Angular/Next), an 'app'/'console'/'dashboard'/'portal' subdomain, or any `*api*` host shows up in recon. Leaked build artifacts (source maps / .env / .git / asset-manifest) are owned by hunt-source-leak; API version-inventory and behavioral diffing by hunt-shadow-api; this skill owns mapping a live SPA's backend routes from its JS bundle and testing them for broken access control / missing auth.
The English summary is being prepared. Showing the original description.
Hunt Spring Boot specific vulnerabilities — Actuator endpoints (heapdump, env, loggers, mappings, shutdown), Spring Expression Language (SpEL) injection → RCE, H2 console RCE, Jolokia JMX exposure, Spring4Shell (CVE-2022-22965), Spring Cloud Function SPEL (CVE-2022-22963), heap dump credential extraction. Use when target runs Spring Boot — detected via X-Application-Context header, /actuator, Whitelabel Error Page, or Java stack traces.
The English summary is being prepared. Showing the original description.
Hunt CI/CD pipeline vulnerabilities — GitHub Actions workflow injection (pull_request_target Pwnrequest + ${{ }}-into-shell), self-hosted runner poisoning, OIDC trust-policy abuse, Jenkins script-console RCE and CVE-2024-23897 file read, GitLab CI runner-token registration, Terraform state file leakage, artifact/log secret leakage, pipeline env-var disclosure. Use when target has a public GitHub/GitLab org, exposed CI dashboards (Jenkins/TeamCity/Drone/Argo), or build artifacts/images are reachable.
The English summary is being prepared. Showing the original description.
Comprehensive CI/CD pipeline exploitation methodology covering GitHub Actions injection vectors (expression injection via PR titles and issue bodies, workflow_run event abuse, GITHUB_TOKEN over-scoping, composite action supply chain compromise), Jenkins attack paths (Groovy sandbox escapes, script console remote code execution, Java remoting deserialization, credential store dumping, shared library injection), GitLab CI exploitation (YAML anchor injection, runner registration token abuse, CI variable extraction, protected branch bypass via merge request pipelines), and Azure DevOps pipeline agent compromise with service connection theft. Includes artifact poisoning techniques across all platforms, tooling guidance for gato and jenkins-attack-framework, and maps to MITRE ATT&CK T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain). Covers enumeration of pipeline configurations, privilege escalation from contributor to code execution, lateral movement through pipeline trust boundaries, and p...
The English summary is being prepared. Showing the original description.