개발 스킬

API authentication and JWT abuse playbook. Use when testing bearer tokens, API keys, claim trust, header spoofing, rate limits, and API auth boundary weaknesses.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Anti-debugging detection and bypass playbook. Use when reversing protected binaries that detect debuggers via ptrace, PEB flags, timing checks, or signal/exception handlers on Linux and Windows.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Identify and exploit Mass Assignment vulnerabilities in APIs. Use this skill when testing REST APIs or application forms that directly map user-supplied JSON or POST input to internal database objects. An attacker can inject undocumented variables (e.g., `is_admin`, `verified`) to illegally modify restricted properties.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Arbitrary write to RCE playbook. Use when you have an arbitrary write primitive (from heap exploitation, format string, or OOB write) and need to convert it into code execution by targeting GOT, hooks, _IO_FILE vtable, exit_funcs, TLS_dtor_list, modprobe_path, .fini_array, or C++ vtables.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Entry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any deeper API topic skill.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Test APIs for authentication and authorization bypass vulnerabilities including JWT manipulation, OAuth2 flaws, API key leakage, broken authentication, and token forgery. Use this skill when assessing REST/GraphQL APIs for access control weaknesses, session management flaws, or credential handling issues. Covers JWT algorithm confusion, OAuth redirect manipulation, and rate limit bypass.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

401/403 bypass playbook. Use when encountering access-denied responses on admin panels, API endpoints, or restricted paths. Covers path manipulation, HTTP method tampering, header injection, protocol downgrade, and automated bypass tools.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Consult this skill BEFORE proposing a fix to any CLI gap or schema gap that touches evidence, trust magnitude, evidence types, evidence grades, the TM formula, or star-level promotion gates. Also read it whenever an issue mentions citations, stars, commits, contributors, views, reviewers, percentile, arxiv, github-stars-own, repo-own, social-signal, benchmark-result, peer-review, self-attestation, fusion-recipe, verifier-attestation, or proxy-containment — those are the 10 canonical evidence types and the raw inputs that feed their formulas. Also read it when asked whether a skill qualifies for a given star level (0★–6★): the Star Bar and promotion gates live in `META.md`, not in the TM methodology page. Reading both prevents proposing a calibration that satisfies the TM grade threshold but violates a Star Bar installability or link requirement.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use this skill when the user wants the full existing-registry Trust Magnitude inspector: understand why a named Gaia skill has a particular star rank, what its Trust Magnitude (TM) score is, which evidence rows are contributing (or dead), how far it is from the next grade, or what evidence to add to move the needle. Also use when asked for a full leaderboard of all named skills ranked by TM. Triggers: "why does X have 3 stars", "what's the TM for X", "inspect TM", "explain the score for X", "what evidence would rank up X", "show leaderboard", "rank all skills by TM", "what's dragging down X's score", "dead evidence rows", "how close is X to grade A/S".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Review the changes since a fixed point (commit, branch, tag, or merge-base) along two axes — Standards (does the code follow this repo's documented coding standards?) and Spec (does the code match what the originating issue/PRD asked for?). Runs both reviews in parallel sub-agents and reports them side by side. Use when the user wants to review a branch, a PR, work-in-progress changes, or asks to "review since X".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Dry-run Trust Magnitude for proposed named skills or suites before curation. Use when deciding whether a proposed suite deserves A/S treatment, when checking Fusion Score structural inputs, when comparing repo stars vs suite component counts, or when asked to appraise a candidate before adding it to the registry.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Explore a feature or CLI, reproduce defects and record bounded findings. Use for "explore X", "find issues with X", or the exploration stage of feature- pipeline; standalone runs return findings without automatically expanding scope.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use this skill when the user wants to understand why a named Gaia skill has a particular star rank, what its Trust Magnitude (TM) score is, which evidence rows are contributing (or dead), how far it is from the next grade, or what evidence to add to move the needle. Also use when asked for a full leaderboard of all named skills ranked by TM. Triggers: "why does X have 3 stars", "what's the TM for X", "inspect TM", "explain the score for X", "what evidence would rank up X", "show leaderboard", "rank all skills by TM", "what's dragging down X's score", "dead evidence rows", "how close is X to grade A/S".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Close out a review/meta branch that lands an evidence-ingest / curation batch: create the named nodes, ingest verified evidence, appraise Trust Magnitude, calibrate stars, wire suites, correct upstream naming, stage ONLY the intended artifacts (dropping CRLF churn and blocking leaks), validate, and open the PR. Use when a curation/ingest batch is verified and ready to land, or when the user says "close the review/meta branch", "land the ingest batch", "wrap up the intake PR", "/gaia-review-meta-close". Wraps the deterministic hygiene in scripts/review_meta_close.py and gates the judgment calls (calibration, Origin, suite promotion, naming, merge) behind explicit human checkpoints.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Post-review intake closing skill. After an intake is resolved (whether accepted via review/meta PR merge or rejected/deferred at triage/evidence review), run this skill to post standardized, personalized closing comments on the PR (if any) and each intake issue. Comments include: evidence pipeline findings with /trust-appraise TM output, per-row artifact scores, decisions rationale, path-to-promotion/acceptance guidance, and a mandatory badge status note including the universal Powered by Gaia badge. Use after curation completes, before or immediately after merge for accepted intakes, or immediately upon rejection.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Close out a completed EPIC / sprint end-to-end: author a fact-verified meta-post announcing what shipped, archive the EPIC's handovers, snapshot orchestrator memory, gate the integration→main merge on CI-green + explicit human go, drive the version bump (merge-commit conventions that auto-sync classifies), and verify the release reached the registry/PyPI. Use when the user says "close out EPIC <n>", "wrap up the sprint", "ship the meta shift", "/epic-close", or asks to finalize an integration branch that is ready to merge to main. Generalizes the EPIC 1002 (Yggdrasil II) close-out. This skill orchestrates — it authors founder docs directly (superadmin) and delegates code/regen to workers; it NEVER merges to main without the human gate.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Helper for release operations, compilation of changelogs between tags, version lockstep syncing, and promotion of GitHub releases from canary/pre-release to latest/production. Use when the user asks to "compile the changelog", "promote release to latest", "tag a release", or do version release operations.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Playbook for correcting a named skill's star level to match its computed Trust Magnitude grade, with an independent post-calibration verification pass and a CLI-logged timeline event (never hand-written). Use when: recalibrating a skill's level, fixing a stale or drifted star rating, running a batch of `gaia dev calibrate` corrections, or confirming a past calibration actually landed. Triggers: "calibrate <skill>", "recalibrate the trust magnitude backlog", "promote/demote <skill> to N stars", "why is <skill> still N stars", "verify a calibration actually landed", "Hall of Heroes ranking is wrong".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Atomically ingest one already-verified evidence row into one named Gaia skill using the CLI, then appraise Trust Magnitude and propose—never silently apply—a calibration. Use after /ev-pipeline has verified an approved intake source, or whenever a curator says "ingest evidence", "add verified evidence", "gaia-ingest", or "turn this source into registry evidence".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Batch wrapper for /gaia-ingest. Ingests a bounded set of already-verified evidence rows through CLI-only writes, uses --no-build on every row, appraises Trust Magnitude for every affected named skill, then runs exactly one build and validation pass. Use for an L4-approved intake after /ev-pipeline; benchmark-result rows also require a Phase 2B report and explicit human gate approval.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Discovery-only global trending extension for Gaia. Snapshots configured external skill sources, prioritizes five-candidate pages for L4 review, and stops before trust, evidence, intake, or registry mutation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Run any installed skill on several models at once — you, OpenAI Codex, OpenCode and whoever else the profile names — and show what each one made of it side by side. Every model gets the same prepared copy of the skill and works read-only. Use for "/multi:skill <name>", "run this skill on every model", "run <skill> through multi", or any skill whose answer you want from more than one model.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Put one question to several models at once — you, OpenAI Codex, and a cheap third via OpenCode — and show all the answers side by side. No judging, no consensus: three opinions, the user picks. Use for "ask everyone", "what do the other models think", "second opinion", "multi ask", or any open question where one model's answer is not enough.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Code review by several models at once — Claude sub-agents, OpenAI Codex, and a cheap third reviewer via OpenCode — reconciled into one report. Reviews whatever is named: a diff, a branch, specific files, one function, a legacy module, a whole repo. Use for any review request, a second or third opinion, a cross-check before a PR, or "code-review", "multi", "consensus review".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.