102 skills · sorted by relevance
Guide changes to the published @kortix/sdk package with rules for preserving public APIs, writing failing tests before behavior changes, keeping the core independent of frameworks, and checking package installation. It also covers exports, streaming transport, and release version handling.
Review an AI tool deployment with six checks covering prompt protection, dangerous commands, malicious inputs, sensitive data transfers, Chinese compliance requirements, and audit records. The result summarizes protection status, risks, and proposed hardening actions.
Apply Michael Feathers-inspired legacy-code rules when changing hard-to-test code safely with characterization tests, seams, sprout methods, or wrap methods.
The English summary is being prepared. Showing the original description.
Build and maintain a design system inside an Expo app - a reusable theme of design tokens (color, spacing, typography, radius, shadow, motion), reusable component structure with variant/size/state prop conventions, and rules for when to extract a repeated view into a shared component. Use when creating or organizing theme files and design tokens (theme.ts / theme/), extending an existing theme or styling library (NativeWind, Tamagui, Restyle, Unistyles) in its own idiom, standardizing styles so screens (including AI-generated ones) look consistent and polished, fixing an app that looks AI-generated or generic instead of native (the named native-slop tells), building an in-app component library, or auditing an app for design-system drift (hardcoded colors, spacing, fonts). For platform styling specifics (semantic colors, HIG rules, native controls) use expo-native-ui; for folder layout of a new app use expo-project-structure.
The English summary is being prepared. Showing the original description.
Genre anatomy from John Truby's The Anatomy of Genres (类型解剖 / 类型节拍 / 混合类型 / 超越类型) — genres as beat systems with a life philosophy underneath; three rules (hit every beat of your genre, mix three or four genres, transcend the primary genre), the ladder and families of twelve genres (Horror 恐怖, Action 动作, Myth 神话, Memoir and Coming-of-Age 回忆录与成长, Science Fiction 科幻, Crime 犯罪, Comedy 喜剧, Western 西部, Gangster 黑帮, Fantasy 奇幻, Detective and Thriller 侦探与惊悚, Love 爱情), each with its hero/opponent/world/plot-shape template, beat list, hard rules with failure conditions, subgenres and transcendent paths, plus a genre-mixing worksheet and a diagnostic. Kept beside sw-truby-anatomy and the Field/Snyder page maps. Use when choosing or confirming a script's genre, when a genre story feels generic or misses the beats its audience expects, when mixing genres, when a horror lacks pressure, an action lacks plot, a love story lacks opposition or a detective story lacks reveals.
The English summary is being prepared. Showing the original description.
Build an all-hands that lands with everyone from intern to VP — the mixed-altitude structure (the story for all, the numbers for some), the wins-with-names section done right, the hard-news slide handled straight, and the Q&A design that gets real questions. Use when asked build the all-hands deck, make the monthly town hall not boring, how do we share the numbers with everyone, or announce this change at all-hands. Produces the segment structure, the altitude-mixed content rules, the hard-news handling, and the Q&A mechanics.
The English summary is being prepared. Showing the original description.
Apply CIS benchmarks and secure Linux servers. Configure SSH, manage users, implement firewall rules, and enable security features. Use when hardening Linux systems for production or meeting security compliance requirements.
The English summary is being prepared. Showing the original description.
Use when syncing real-time data, structuring JSON trees, reading/writing, creating listeners, enabling offline persistence, managing presence, sharding, or writing security rules.
The English summary is being prepared. Showing the original description.
Use when you need to design, review, or improve security in Micronaut applications — including micronaut-security authentication, @Secured and intercept-url-map rules, JWT/session strategies, SecurityService checks, CORS, CSRF awareness for browser apps, rejection handlers, and sensitive-data-safe logging. This should trigger for requests such as Add Micronaut security support; Review Micronaut security configuration; Improve API authorization in Micronaut; Add JWT security in Micronaut; Harden Micronaut route authorization rules. Part of Plinth Toolkit
The English summary is being prepared. Showing the original description.
Applies the reasoning of Pieter Abbeel, robotics and reinforcement learning expert, UC Berkeley professor, and co-founder of Covariant. Use this skill whenever you are designing AI systems, tackling Sim2Real transfer, deploying machine learning in the physical world, or evaluating reinforcement learning architectures. Trigger this skill for questions about domain randomization, reward design, bootstrapping real-world AI, robotics hardware assumptions, or shifting from hard-coded rules to data-driven deep learning. It helps ground theoretical AI in physical embodiment and pragmatic deployment.
The English summary is being prepared. Showing the original description.
Applies the reasoning of Pieter Abbeel, robotics and reinforcement learning expert, UC Berkeley professor, and co-founder of Covariant. Use this skill whenever you are designing AI systems, tackling Sim2Real transfer, deploying machine learning in the physical world, or evaluating reinforcement learning architectures. Trigger this skill for questions about domain randomization, reward design, bootstrapping real-world AI, robotics hardware assumptions, or shifting from hard-coded rules to data-driven deep learning. It helps ground theoretical AI in physical embodiment and pragmatic deployment.
The English summary is being prepared. Showing the original description.
Multi-backend database security auditor. Audits Supabase, Firebase (Firestore/RTDB/Storage/Functions/Remote Config), MongoDB (self-hosted + Atlas), self-hosted PostgreSQL, and self-hosted MySQL for RLS/rules misconfigurations, exposed credentials, auth bypasses, MongoBleed (CVE-2025-14847), pgBouncer CVE-2025-12819, mysql_native_password drift, ghost auth, and storage exposures. Use this skill whenever the user mentions database security, RLS or rule audits, security review, penetration testing a vibe-coded app, checking if their DB is exposed, hardening a backend, fixing security rules, or auditing apps built with Lovable/Bolt/Replit/Cursor/Claude Code on any of these backends. Trigger on phrases like 'is my app secure', 'check my database', 'audit my Firebase', 'audit my MongoDB', 'audit my Postgres', 'audit my Supabase', 'is my DB exposed', or any cross-backend variant ('audit my full stack').
The English summary is being prepared. Showing the original description.
Read-only audit of a GitHub repository's security posture. Gathers ref protection (rulesets AND classic branch protection), Actions token permissions, code and supply-chain features (Dependabot, secret scanning, push protection, CodeQL), and repo hygiene toggles via `gh api`, then classifies findings against essential / recommended / advanced tiers into a PASS/GAP report. Makes NO changes. Use when reviewing a repo before open-sourcing or a release, auditing a public user-owned repo whose CI auto-commits to the default branch, verifying a hardening change actually took effect, or producing a baseline security posture report for a repository.
The English summary is being prepared. Showing the original description.
Use when designing or configuring public pages on an Experience Cloud site — guest user profile setup, page-level access settings in Experience Builder, object/field visibility for unauthenticated visitors, and explicit sharing rules that expose data on public pages. Triggers: 'configure public pages Experience Cloud', 'guest user profile setup', 'unauthenticated site access', 'public community page visibility', 'make page visible without login'. NOT for authenticated user features (use admin/experience-cloud-member-management). NOT for security hardening or remediation of guest user exposure (use security/guest-user-security). Also covers the deployable shape: pageAccess on the route file, the guest Profile's objectPermissions and fieldPermissions, sharingGuestRules, siteGuestRecordDefaultOwner on CustomSite, and the Network guest flags.
The English summary is being prepared. Showing the original description.
Router for the 49 SfSkills `security` skill packages. Platform security and compliance: org hardening, encryption, session policy, MFA, monitoring, incident response, and TROUBLESHOOTING a specific record-access denial. Designing the sharing model itself (OWD, role hierarchy, sharing rules) is salesforce-admin. Use when the request mentions security, org hardening, Shield, platform encryption, field audit trail, MFA, SSO, SAML, session policy, guest user, event monitoring, GDPR, XSS, injection, why can this one user see this record, Apex managed sharing, sharing recalculation. Finds and opens the exact skill package to read; it does not contain the guidance itself.
The English summary is being prepared. Showing the original description.
Configures Microsoft Defender for Endpoint (MDE) advanced protection settings including attack surface reduction rules, controlled folder access, network protection, and exploit protection. Use when hardening Windows endpoints beyond default Defender settings, deploying enterprise-grade endpoint protection, or meeting compliance requirements for advanced malware defense. Activates for requests involving Windows Defender configuration, ASR rules, MDE tuning, or Microsoft endpoint security.
The English summary is being prepared. Showing the original description.
Use when you need to design, review, or improve security in Quarkus applications — including Quarkus Security with JWT/OIDC, basic auth, @RolesAllowed / @Authenticated / @PermitAll, SecurityIdentity, permission checks, path-based authorization in configuration, exception mapping for auth failures, and sensitive-data-safe logging. This should trigger for requests such as Add Quarkus security support; Review Quarkus security configuration; Improve API authorization in Quarkus; Add JWT/OIDC security in Quarkus; Harden Quarkus authorization rules. Part of cursor-rules-java project
The English summary is being prepared. Showing the original description.
Configures Microsoft Defender for Endpoint (MDE) advanced protection settings including attack surface reduction rules, controlled folder access, network protection, and exploit protection. Use when hardening Windows endpoints beyond default Defender settings, deploying enterprise-grade endpoint protection, or meeting compliance requirements for advanced malware defense. Activates for requests involving Windows Defender configuration, ASR rules, MDE tuning, or Microsoft endpoint security.
The English summary is being prepared. Showing the original description.
Configures Microsoft Defender for Endpoint (MDE) advanced protection settings including attack surface reduction rules, controlled folder access, network protection, and exploit protection. Use when hardening Windows endpoints beyond default Defender settings, deploying enterprise-grade endpoint protection, or meeting compliance requirements for advanced malware defense. Activates for requests involving Windows Defender configuration, ASR rules, MDE tuning, or Microsoft endpoint security.
The English summary is being prepared. Showing the original description.
Generate 4–30 second videos with synchronized audio using ByteDance Seedance 2.5. Organize image, video, and audio references, write shot-by-shot prompts, and define continuity rules to keep characters and locations consistent across cuts.
Guide Git operations with explicit authorization for history changes and destructive actions. It defines recovery snapshots before discarding work, careful handling of locks and index corruption, and checks that keep unexplained changes out of commits.
Turn a successful workflow from the current session into a reusable OMC skill draft. Capture inputs, ordered steps, decision rules, pitfalls, and verification evidence, then choose an appropriate storage location.
Set up Cisco Duo multi-factor authentication for VPN, RDP, SSH, and web applications. Configure access rules based on users and device health, introduce security keys, and establish authentication monitoring and emergency access procedures.
Recommend where new gbrain pages belong using the active schema pack, a configuration defining page types and storage paths. It also checks existing pages for missing or undeclared types and highlights cases requiring a classification decision.