Browse skills

Local-tooling companion to the bug-bounty orchestrator — carries the SAME complete bug-bounty workflow, but reach for THIS variant when you also need to resolve where tools, wordlists, and clones are installed on the local machine (jhaddix, SecLists, trufflehog, ffuf, dalfox, ghauri); for pure orchestration/routing use the bug-bounty skill. Workflow it covers — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaining (IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth), bypass tables (SSRF IP bypass, open redirect bypass, file upload bypass), language-specific grep (JS prototype pollution, Python pickle, PHP type juggling, Go template.HTML, Ruby YAML.load, Rust unwrap), and reporting (7-Question Gate, 4 validation gates, human-tone writing, templates by vuln class, CVSS 3.1, PoC generation, always-rejected list, conditional chain table, submission checklist). Use when you need the local install path of a tool / wordlist / clone for a hunt, or as the full-workflow variant when operating from this local toolkit; for general routing use the bug-bounty skill. 中文触发词：漏洞赏金、安全测试、渗透测试、漏洞挖掘、信息收集、子域名枚举、XSS测试、SQL注入、SSRF、安全审计、漏洞报告

The English summary is being prepared. Showing the original description.

Hunting skill for idor vulnerabilities. Built from 26 public bug bounty reports. Use when hunting idor on any target.

The English summary is being prepared. Showing the original description.

Scrape and extract public data from 27+ social media platforms using the ScrapeCreators REST API. Covers TikTok, Instagram, YouTube, LinkedIn, Facebook, Twitter/X, Reddit, Threads, Bluesky, Pinterest, Snapchat, Twitch, Kick, Truth Social, TikTok Shop, Google, and link-in-bio services (Linktree, Komi, Pillar, Linkbio, Linkme, Amazon Shop). Use when the user asks to scrape, fetch, extract, search, or look up social media profiles, posts, videos, reels, comments, transcripts, followers, ads, hashtags, trending content, or engagement metrics from any social platform. Also use when user mentions ScrapeCreators, social media API, ad library, or creator data.

The English summary is being prepared. Showing the original description.

E-commerce SEO audit for online stores (WooCommerce, Shopify, Magento, custom). Covers category / product listing pages (PLP), product detail pages (PDP), faceted navigation and its crawl-budget and duplicate-content traps, pagination, canonicals for variants and filters, out-of-stock / discontinued products, internal linking and breadcrumbs, and Product / Offer / Review / AggregateRating / BreadcrumbList structured data. Use whenever the user runs an online store and asks about product or category page SEO, filter URLs being indexed, product rich results, or thin/duplicate product pages. Trigger on: "e-commerce SEO", "ecommerce SEO", "product page SEO", "category page SEO", "WooCommerce SEO", "Shopify SEO", "faceted navigation", "filter URLs in Google", "product schema", "rich snippets for products", "out of stock SEO", "duplicate product pages". For a single URL use /seo-page; for full-site use /seo-analysis.

The English summary is being prepared. Showing the original description.

Shopify store command center. Orders, inventory, fulfillment, analytics, and store health. Works with any Shopify store via Admin API.

The English summary is being prepared. Showing the original description.

Revenue and costs tracker. AWS spend via aws ce, credits tracker, project revenue stages. Shows burn rate, runway estimate, credits expiring.

The English summary is being prepared. Showing the original description.

Interactive setup wizard for the claude-ops plugin. Installs missing CLIs, configures env vars for each channel (Telegram, WhatsApp, Email, Slack, Notion, Linear, Sentry, Vercel), builds the project registry, and saves user preferences. Run once after installing the plugin or any time to reconfigure.

The English summary is being prepared. Showing the original description.

Lightweight green/red status panel for every configured integration. No gather, no actions.

The English summary is being prepared. Showing the original description.

Post-setup credential manager. Shows current integration status (configured/missing/expired) and lets you update individual credentials without re-running the full setup wizard. Runs a smoke test after each update.

The English summary is being prepared. Showing the original description.

Automate Shopify tasks via Rube MCP (Composio): products, orders, customers, inventory, collections. Always search tools first for current schemas.

The English summary is being prepared. Showing the original description.

Use when the user asks to "check technical SEO"; audits crawlability, indexing, Core Web Vitals, robots.txt, sitemaps, canonicals, redirects, and migrations. Not for on-page tags or content — use on-page-seo-checker. 技术SEO/网站速度

The English summary is being prepared. Showing the original description.

Build animations in React Native and Expo, making the decisions in the order that determines whether they feel right — should it animate, which thread it runs on, which properties, spring or timing, how the gesture hands off, how it degrades. Writes the implementation with Reanimated, Gesture Handler, Expo Router and expo-haptics. Use when animating anything in an Expo app, adding gestures, sheets, screen transitions, press feedback or haptics, or fixing motion that stutters on device. For web animation use `animate`.

The English summary is being prepared. Showing the original description.

Extract, suggest, and sync tags and categories for blog posts across all major CMS platforms. Supports WordPress REST API, Shopify GraphQL, Ghost Content API, Strapi REST/GraphQL, and Sanity GROQ. Generates tag suggestions from content analysis (keyword frequency, heading extraction, semantic grouping), enforces minimum post-count thresholds to prevent thin tag archives, and syncs taxonomy via authenticated API calls. Use when user says "tags", "categories", "taxonomy", "tag suggestions", "sync tags", "WordPress tags", "Shopify tags".

The English summary is being prepared. Showing the original description.

Suggest tags and categories for a blog post from its content, audit a site's tag and category health, and, only after the user approves a shown plan, sync tags and categories to WordPress, Shopify, Ghost, Strapi, or Sanity. suggest and audit are read-only; sync is dry-run by default and never deletes, merges, or edits post content. Use when the user says "tag suggestions", "taxonomy audit", "sync tags", "WordPress tags", "Shopify tags". Not for keyword research (blog-brief) or schema markup (blog-schema).

The English summary is being prepared. Showing the original description.

Build Shopify applications, extensions, and themes using GraphQL/REST APIs, Shopify CLI, Polaris UI components, and Liquid templating. Capabilities include app development with OAuth authentication, checkout UI extensions for customizing checkout flow, admin UI extensions for dashboard integration, POS extensions for retail, theme development with Liquid, webhook management, billing API integration, product/order/customer management. Use when building Shopify apps, implementing checkout customizations, creating admin interfaces, developing themes, integrating payment processing, managing store data via APIs, or extending Shopify functionality.

The English summary is being prepared. Showing the original description.

1:1 rebuild of award-winning creative websites (WebGL / scroll-animation / portfolio sites). Evidence-driven pipeline - mirror-first forensics, line-number-traceable reverse engineering of minified bundles, verbatim porting, quantitative verification gates. Use when user asks to "复刻网站", "重建网站", "1:1 rebuild", "clone this site", or provides a URL of a creative/award site to reproduce.

The English summary is being prepared. Showing the original description.

Write a product listing for an overseas marketplace or store, localised for the buyer rather than translated from Chinese: title, bullet points, description, search terms and the compliance claims that must or must not appear. Use when asked 帮我写亚马逊 listing, 跨境电商标题, write a product listing for Amazon, TikTok Shop, Shopee, Lazada, Etsy or Shopify, or localise my listing for the US, UK, Germany or Japan. Produces the listing in the target language within the platform's field limits, a keyword map, a compliance check of every claim, and a list of images the listing needs.

The English summary is being prepared. Showing the original description.

Help users build a professional eye for quality, articulate the reasoning behind successful product paradigms, and develop the conviction to make high-stakes decisions before data is available.

The English summary is being prepared. Showing the original description.

Work with your Shopify store: view orders, products, customers; create products and discounts (with confirmation). No order or customer writes. Trigger phrases: shopify, shopify orders, shopify store, shopify discount.

The English summary is being prepared. Showing the original description.

This skill should be used when the user asks to "agentize a website", "transform a website", "create an agentfront", "build a WWA app", "make an agent-first website", "turn a website into an agent experience", "agentizer", "wwa transform", or mentions "agentfront" in context of building one from a URL.

The English summary is being prepared. Showing the original description.

Anti-slop frontend skill for landing pages, portfolios, and redesigns. The agent reads the brief, infers the right design direction, and ships interfaces that do not look templated. Real design systems when applicable, audit-first on redesigns, strict pre-flight check.

The English summary is being prepared. Showing the original description.

Generates Instagram-ready product reels from any e-commerce product page URL. Scrapes product images, classifies by type, generates AI-animated clips via Higgsfield API, creates text overlays with style presets, and composes a 15-20 second reel with music. Supports model-based and product-only reels.

The English summary is being prepared. Showing the original description.

Find Twitter/X influencers to promote a product or brand. Use when asked to find influencers, discover Twitter accounts for partnerships, identify creators in a niche, or build an influencer outreach list.

The English summary is being prepared. Showing the original description.

The intake stage of a Meta ad harness. Researches the brand first, states what it assumes, and asks only what it cannot infer and what would change money, claims or legal exposure if guessed wrong — at most four questions a turn, in plain business language. Writes the brand's stable facts (ads/brand.md), the campaign brief, and a log of what was asked vs assumed. Use it when someone wants to run Meta ads and the brand's ad facts are not yet recorded.

The English summary is being prepared. Showing the original description.