1.5K skills · sorted by relevance
Review authorized source code or pull request changes for security flaws. Combine automated static analysis, which checks code without running it, with manual validation to document affected locations, data flows, reproduction examples, and suggested fixes.
Generate a customizable AI prompt for finding representative examples in an existing codebase. Configure analysis depth, categories, and snippets so GitHub Copilot can produce exemplars.md with real file references and explanations of coding conventions.
Learn Claude Code workflows through a Chinese-language guide covering tool use, large-file analysis, task tracking, and troubleshooting. It also explains MCP, a protocol for connecting external systems, alongside development and review patterns.
Structure and revise investment research into readable Markdown reports for Codex. Explain business economics, competitive advantages, opposing arguments, and valuation, then connect the evidence to price bands and actions for prospective investors and existing holders.
Develop security design improvements from vulnerability reports, incident documents, source code, or scan results. Compare architectural options with before-and-after diagrams, engineering tradeoffs, and migration plans to support a concrete design decision.
Turn existing source code into reusable learning materials. This skill identifies architectural patterns and implementation techniques, then organizes them into a SKILL.md with structured metadata, explanatory code templates, practical examples, and validation steps.
Get a quick structural overview of a codebase with Trailmark. The skill identifies programming languages, counts entry points where execution begins, and returns dependency information to support orientation before deeper analysis.
Scan source code for security weaknesses with Semgrep after approving the target and rulesets. Choose full results or focus on important findings, then receive merged results and a record of failed or skipped scans.
Reviews code changes for security risks using Git history, caller counts, and test coverage. Produces a Markdown report with evidence, potential attack scenarios, affected code, and clear limits on what was reviewed.
Organize existing code components into business areas to prepare for service separation. Produce domain maps, component assignment tables, and refactoring plans that align namespaces, the naming structure used to organize code, with business responsibilities.
Analyze business concepts in a codebase to map business areas and suggest service boundaries. Use Domain-Driven Design, an approach organized around business meaning, to classify responsibilities, assess how closely they belong together, and recommend clearer integration points.
Explore code through structured summaries of functions, calls, branches, and variable usage. Use the tldr commands to locate relevant files, trace change impacts, find affected tests, and identify potentially unused code before inspecting the implementation.
Read-only R code review protocol for `.R` scripts. Checks code quality, reproducibility, domain correctness, tidyverse idioms, and professional standards; produces a report without editing. Use when user says "review this R script", "check the R code", "audit the analysis code", "code review on the R", or when an R file is touched as part of a paper submission. NOT for running the code — pair with `/audit-reproducibility` for numeric verification.
The English summary is being prepared. Showing the original description.
Use when the user asks to run Codex CLI (codex exec, codex resume) or references OpenAI Codex for code analysis, refactoring, or automated editing
The English summary is being prepared. Showing the original description.
Measures cyclomatic complexity, cognitive complexity, and function length across codebases to identify maintenance hotspots. Use when someone asks about code complexity, function length analysis, maintainability metrics, or needs to find the most complex parts of their codebase. Trigger words: complexity, cyclomatic, cognitive complexity, long functions, hotspots, maintainability index, code metrics.
The English summary is being prepared. Showing the original description.
Analyze indexed codebases via graph database (neug) and vector index (zvec). Covers call graphs, dependencies, dead code, hotspots, module coupling, architecture reports, semantic search, impact analysis, bug root cause from GitHub issues, class diagrams (UML), and PR review (risk scoring, conflict detection, auto-merge candidates, labeling). Also covers creating, inspecting, and repairing a CodeScope index. Use for: code structure, who calls what, why something changed, similar functions, module boundaries, bug tracing, class relationships, PR risk/conflicts, or any question benefiting from a code knowledge graph. Applies when a `.codegraph` index exists in the workspace, or when the user wants to create one.
The English summary is being prepared. Showing the original description.
Interactive codebase orientation for a HUMAN who wants to learn the code. Runs the same tree-sitting + featuring pipeline as exploring-codebases but synthesizes it into guided exercises and an HTML teaching artifact rather than an analysis document. Use for "orient me to this repo", "teach me this codebase", "walk me through this code", "learning orientation", or when someone wants genuine comprehension rather than a task completed. The audience is the test: if nobody is being taught and the goal is to get work done, use exploring-codebases instead.
The English summary is being prepared. Showing the original description.
Run CodeQL static analysis for security vulnerability detection, taint tracking, and data flow analysis. Use when asked to analyze code with CodeQL, create CodeQL databases, write custom QL queries, perform security audits, or set up CodeQL in CI/CD pipelines.
The English summary is being prepared. Showing the original description.
Emulates position-independent shellcode in a controlled CPU emulator (Unicorn) to trace executed instructions, memory writes, and decoded second stages without running it on a real host. Activates for requests to emulate shellcode, trace a decoder stub, or recover a stage unpacked at runtime by shellcode.
The English summary is being prepared. Showing the original description.
Review code for security flaws, bugs, performance problems, maintainability, and test quality. Produce structured feedback with issue locations, likely impact, suggested fixes, positive observations, and a recommendation on whether changes are ready to merge.
Schedule workers to run checks at fixed times while a Claude Code session stays open. Set up recurring security scans, test coverage analysis, or documentation tasks, and find or cancel scheduled jobs.
Review source code with Strix to trace data flow and authorization checks, then test suspected vulnerabilities in a running environment. Receive proven findings with exploit examples and code locations, while keeping unconfirmed observations clearly identified.
Review GitHub Actions workflows that run AI agents, tracing how external input reaches prompts and tools. Produce findings with evidence, severity, impact, and remediation guidance through static analysis, which examines configuration without running attacks.
Understand and extend GitNexus taint analysis, which tracks data from input sources to potentially dangerous operations. Use its implementation guidance to investigate missed or incorrect findings, add detection models, and validate analysis changes.