76 skills · sorted by relevance
Create text banners, character speech bubbles, and decorative frames, or convert images into ASCII art, pictures made from text characters. Choose local tools or free APIs for the task, and search collections of existing artwork.
Create concise commit messages from a code diff, a file list, or a description of changes. The skill selects one emoji that matches the change’s purpose, follows gitmoji conventions, and explains the choice without running Git commands.
Review punctuation in code, comments, and text files using a policy that favors the plain hyphen over em and en dashes, while accounting for exceptions involving existing data and explicitly requested literary or news text.
Examine writing for familiar AI patterns, statistical features, Pangram detection scores, and hidden character signatures. Compare drafts against known human writing to interpret the evidence, with explanations and limitations rather than a definitive authorship claim.
Assess web content for usefulness, readability, depth, and evidence of experience and expertise. Get quality scores and improvement suggestions, review how clearly content supports AI citations, and clean up formulaic phrasing and invisible characters in drafts.
Helps create, explain, debug, and optimize regular expressions for finding, extracting, or replacing text. Accounts for differences between programming languages and checks matching and nonmatching examples to identify overly broad patterns and potential performance problems.
Extract text, tables, and images from PDFs, or create and modify PDF documents. Covers merging, splitting, rotation, watermarks, password protection, page rendering, and OCR, which turns scanned page images into text.
Create a macOS-style notification banner from an announcement or message, complete with an app icon, title, and body text. The single-file HTML design supports frosted-glass styling, light or dark appearances, and placement over video.
Process Excel workbooks and generate PDF reports by running Python scripts directly. Covers multiple sheets, data transformations, formatting, and error handling, with scripts saved as files for complex tasks.
Create PDF checklists, reports, and scorecards with Python in a sandbox, an isolated code execution environment. The workflow covers choosing a library, arranging headings and tables, generating the document, and checking that the output file exists.
Generate Word, PDF, and HTML documents from one Markdown source. The workflow checks available tools, replaces problematic characters for PDF conversion, tries alternative conversion engines when needed, and checks that output files were created.
Create Word, PDF, and HTML documents from Markdown, choosing pandoc or ReportLab to suit formatting and layout needs. The workflow covers character handling, output checks, and an alternative generation method when PDF conversion fails.
Prepare large Excel datasets by combining sheets, using Parquet, a format for efficient table storage, and cleaning a selected text column to retain only Chinese characters. Export the cleaned data as an Excel file with a local download link.
Clean Excel columns by removing unwanted prefixes from numeric values and extracting Chinese characters from text. Add the cleaned results as new columns, then save an Excel file and provide a download link.
LLM application red-teaming — prompt injection (direct + indirect), jailbreak, system-prompt leak, data exfiltration, guardrail bypass, multi-turn crescendo, cross-lingual + cipher + invisible-unicode token smuggling, excessive agency / tool abuse, insecure output handling. Canonical OWASP LLM Top 10 + ASI01-ASI10 mapping. Use when a target exposes a chat/completions/assistant/copilot endpoint, an AI feature that consumes user text or documents, or any /v1/chat, /api/chat, /mcp surface.
The English summary is being prepared. Showing the original description.
Draft or reformat copy-paste-ready LinkedIn posts from user-provided ideas and source material. Use for professional posts, concise thought-leadership drafts, resource announcements, story-led posts, carousel text, or optional Unicode emphasis with an accessible plain-text alternative.
The English summary is being prepared. Showing the original description.
Hunt LLM/AI feature bugs — prompt injection, indirect injection, exfiltration via tool-use/markdown, ASCII smuggling, agentic AI security (OWASP Agentic Apps 2026, ASI01-ASI10). Patterns: direct injection ('ignore previous instructions'), indirect injection via documents/web pages/email the model reads, ASCII smuggling (Unicode Tags block U+E0000-U+E007F, invisible to humans, decoded by the model), tool-use exfiltration (model has fetch/browse tool, attacker injects OOB URL, model exfils chat history/secrets), markdown-image zero-click exfil, system-prompt extraction, IDOR-via-AI (cross-tenant data). Targets: chatbots, RAG, summarizers, agentic copilots, MCP tools. Detection: any LLM-backed endpoint, doc upload triggering AI processing, autonomous agent with tools. Validate: OOB/Collaborator callback for exfil, verbatim-reproducible system-prompt leak (run twice), verifiable cross-tenant leak or RCE. Confabulation is NOT a finding. Use when hunting AI features, chatbots, RAG, agentic systems, MCP.
The English summary is being prepared. Showing the original description.
编码解码与加解密工具 — base64/URL/Hex/HTML实体编码解码，MD5/SHA哈希，AES/DES/RSA加解密，JWT解析，Caesar/ROT13密码，栅栏/Vigenere密码，Unicode转义，Morse电码等
The English summary is being prepared. Showing the original description.
Provides miscellaneous CTF challenge techniques for problems that do not cleanly fit the main categories. Use for encoding puzzles, pyjails, bash jails, RF/SDR, DNS oddities, unicode tricks, esoteric languages, QR or audio puzzles, constraint solving, game theory, unusual sandbox escapes, and hybrid logic puzzles. Prefer a more specific skill first when the challenge is mainly web, pwn, reverse, forensics, malware, OSINT, or crypto. Treat this as the fallback skill for genuine cross-category or edge-case challenges, not the default starting point.
The English summary is being prepared. Showing the original description.
Terminal security analysis for shell environments. This skill should be used when checking commands for supply-chain attacks before execution, scanning repositories for hidden content or config poisoning, scoring URLs for homograph attacks, setting up AI tool protection, inspecting Python package artifacts, governing untrusted tasks or Web3 commands, auditing browser extensions, creating provenance receipts, downloading and executing scripts safely, investigating why tirith blocked a command, managing trusted patterns, running security audits, configuring MCP gateway proxies, or working with threat intelligence databases. Also use when the user mentions "tirith", "pipe-to-shell", "homograph", "ANSI injection", "zero-width", "punycode", "terminal security", "shell hook", "cloaking detection", "supply chain attack", "bidi override", "invisible unicode", or "config poisoning". Even if the user does not explicitly name tirith, use this skill when they ask about protecting shell environments, intercepting dangerous commands, or hardening AI agent tool execution.
The English summary is being prepared. Showing the original description.
Contain an encoded Unicode Tag Block marker used for hidden instructions
The English summary is being prepared. Showing the original description.
Generate and render Mermaid diagrams for architecture docs, READMEs, PRs, terminals, chats, and CI as themed SVG, PNG, or ASCII/Unicode art. Use this skill whenever the user provides Mermaid code or .mmd files; asks for a flowchart, sequence/state/class diagram, ERD, XY chart, or architecture/workflow/data-model visualization; or wants to beautify, theme, batch-convert, or make a diagram terminal-friendly. Runs locally without a browser or DOM, with 15 built-in themes and custom colors.
The English summary is being prepared. Showing the original description.
Detects prompt injection hidden in documents from the other side (pleadings, skeletons, bundles, served evidence, opponents' emails and attachments) before an AI reads them, so the model is not turned against your client. Checks word by word that the text an extractor hands the model was visibly drawn on the page: white, near-white, covered, clipped, off-page, tiny, transparent and invisible-mode text in PDF (ink test plus OCR); Word formatting resolved as Word does (styles, shading, theme colours, scaling, off-page frames, fallbacks, unused headers); HTML/CSS, RTF, email with attachments and zips, xlsx/pptx and legacy formats. Flags Unicode smuggling, text addressed to an AI and authorities found only in hidden text. Fails closed. Optional Read-tool hook. Use BEFORE any AI summary or analysis of an opposing or third-party document. Triggers: 'scan for injection', 'is this document safe', 'check the other side's skeleton', 'injection guard'.
The English summary is being prepared. Showing the original description.
用于编码题、pyjail、bash jail、RF/SDR、DNS 异常、Unicode、奇特语言、QR、音频、约束求解、博弈论与沙箱逃逸等跨类或边缘 CTF 题;触发名:ctf-misc
The English summary is being prepared. Showing the original description.