Review the UI and style files changed in the working tree against this repo's own design system, before they are saved or committed. Runs the same deterministic check as the CLI's --check flag (no tokens, about a second): hardcoded colours where a token exists, near-identical colour twins, off-scale spacing, radii, font sizes and shadows, typefaces outside the system, arbitrary Tailwind values, static inline styles, !important, duplicate component definitions and imports of the copy to avoid, new tokens that copy an existing one, chart colours written by hand where the repo keeps a chart palette (and one calm warning asking for a palette where it keeps none), on a repo built on MUI, Mantine, Chakra or Ant Design, colours or pixel sizes written onto kit components where the theme has a value, and on a Tailwind theme or a shadcn repo, palette classes such as text-gray-500 where the theme names a colour of that kind. Findings name the file, the line and the fix. This is the small, fast check for what just changed; the roast skill is the full scan of the whole repo with a report.
日本語の概要は準備中です。原文の説明を表示しています。
gregkozakiewicz/roast-my-design-system☆ 272026年10月16日 更新
Run AI agent tasks on a Volcengine (火山引擎) cloud phone via the Mobile Use Agent OpenAPI. Use when the user asks to drive, automate, operate, or test an Android app on a cloud phone for enterprise use cases (e.g. reply to WeCom customer messages, add leads in a CRM, clock in on DingTalk, check invoicing stats, query inventory in a supply-chain app, ship e-commerce orders, approve OA requests) or personal ones (open 小红书 and search, place an order, check nearby places on a map), or to check status, fetch result, cancel, or list a Mobile Use run. Requires one-time setup to store Volcengine AK/SK locally; ProductId and PodId can be saved as a default device during setup, the user prompt is provided per run. Supports optional GPS injection (GpsInfo) with user consent (auto-asked only for location-related tasks).
日本語の概要は準備中です。原文の説明を表示しています。
volcengine/vePhone☆ 272026年10月12日 更新
Use when you need to know where a piece of reporting actually came from — the user gives an article URL and asks "where does this come from?", "who is the original source?", "is this just a rewrite?", or another skill needs the provenance chain before grading or citing a report. Follows an article's links and named attributions back to the originating vendor, government, victim or actor document and returns the chain, the primary's stated access and confidence language, publication dates, and every hop it could not resolve. Deterministic — a script or the Liberty91 platform resolves the chain; the model does not reconstruct it from memory. Invoked by /quality-of-information-check, /threat-actor-profiling, /campaign-tracking and /intelligence-writing. Works on any URL with no API key.
日本語の概要は準備中です。原文の説明を表示しています。
Liberty91LTD/cti-skills☆ 272026年9月30日 更新
Structured OSINT collection methodology. Planning, collection techniques, search operators, and documentation. Loaded by the osint-researcher agent.
日本語の概要は準備中です。原文の説明を表示しています。
Liberty91LTD/cti-skills☆ 272026年9月30日 更新
Structured threat assessment methodology. Intent + Capability + Opportunity = Threat Level. Use when formally evaluating a threat. Prefers graded evidence items from /quality-of-information-check and runs that skill first when handed raw URLs or text. Confidence is capped by the weakest load-bearing claim, and at Moderate when the evidence is ungraded.
日本語の概要は準備中です。原文の説明を表示しています。
Liberty91LTD/cti-skills☆ 272026年9月30日 更新
Use when the user asks to write a threat / risk / vulnerability assessment, or wants the appropriate template for each type. Distinct structures and section ordering per assessment kind. Prefers graded evidence items from /quality-of-information-check and runs that skill first when handed raw URLs or text. Confidence is capped by the weakest load-bearing claim, and at Moderate when the evidence is ungraded.
日本語の概要は準備中です。原文の説明を表示しています。
Liberty91LTD/cti-skills☆ 272026年9月30日 更新
Use when evidence needs grading before anyone reasons from it — the user asks "how reliable is this?", "grade this source", "check this report", "can I trust this article?", "is this corroborated?", or hands over a URL, a pasted report or a Liberty91 event ahead of an ACH or assessment. The Quality of Information Check from the CIA Tradecraft Primer, adapted for vendor and press CTI reporting. Resolves each document to its originating source, splits it into claims, and grades every claim on two written elements, access level (how the source knows) and claim support (what backs the statement), with a stated rationale, using a fixed rubric with hard caps. The grade is not an Admiralty rating. Five outlets citing one vendor report count as one source; anything that cannot be traced to a primary is capped, not guessed. Returns a graded claim table, gaps, a deception screen and JSON. /ach, /threat-assessment and /writing-assessments run it first by default.
日本語の概要は準備中です。原文の説明を表示しています。
Liberty91LTD/cti-skills☆ 272026年9月30日 更新
Peer review checklist and quality standards for intelligence products, plus schema validation for graded evidence items and claim tables from /quality-of-information-check and /claim-extraction. Rejects outputs that break the evidence schema or the grading caps. Loaded by the quality-reviewer agent.
日本語の概要は準備中です。原文の説明を表示しています。
Liberty91LTD/cti-skills☆ 272026年9月30日 更新
Use when you need to classify an IP as internet scanner noise vs. targeted activity. Returns noise/riot flags, classification (benign/malicious/unknown), actor name if known. IP-only. Commonly invoked by /ip-investigation to filter out mass-scanning noise. Retrieval only.
日本語の概要は準備中です。原文の説明を表示しています。
Liberty91LTD/cti-skills☆ 272026年9月30日 更新
Use when you need to submit a URL for live scanning via URLScan.io and retrieve results, or search existing scans for a domain. Returns verdict, final URL after redirects, resolved IP, contacted domains/IPs, and screenshot URL. Commonly invoked by /url-investigation and /domain-investigation.
日本語の概要は準備中です。原文の説明を表示しています。
Liberty91LTD/cti-skills☆ 272026年9月30日 更新
Use when you need CrowdStrike Falcon Intelligence on an indicator (IOC reputation for an IP, domain, hash, or URL — malicious confidence, linked actors, malware families, reports) OR on an adversary (threat-actor profile, origin/target search, MITRE ATT&CK TTPs, finished intel reports). Answers questions like "look up 1.1.1.1", "what TTPs does Charming Kitten use?", "which threat actors operate from Russia?", and "latest report on Mustang Panda". Commonly invoked by the four /*-investigation skills, /ioc-enrichment-workflow, /threat-actor-profiling, and the regional espionage cells. Other agents/skills can chain this for vendor-authoritative actor and finished-intel context. Requires a Falcon Intelligence subscription.
日本語の概要は準備中です。原文の説明を表示しています。
Liberty91LTD/cti-skills☆ 272026年9月30日 更新
Use when you need host reconnaissance for an IP or domain — open ports, services, banners, OS detection, vulnerabilities. For domains, resolves DNS first then queries the IP. Commonly invoked by /ip-investigation and /domain-investigation. Retrieval only.
日本語の概要は準備中です。原文の説明を表示しています。
Liberty91LTD/cti-skills☆ 272026年9月30日 更新
Use when you need to hunt in the organisation's own Microsoft Sentinel workspace — sweep the logs for IOC hits (IP, domain, hash, URL, account), hunt behavioural TTPs from MITRE ATT&CK techniques, run KQL against live data, or check which tables the workspace actually ingests. Discovers available tables first and only generates KQL for tables that verifiably exist, so hunts adapt to each environment's connectors. Commonly chained by the /*-investigation skills to answer "were we exposed?". Reads $SENTINEL_TENANT_ID, $SENTINEL_CLIENT_ID, $SENTINEL_CLIENT_SECRET, $SENTINEL_WORKSPACE_ID. Read-only.
日本語の概要は準備中です。原文の説明を表示しています。
Liberty91LTD/cti-skills☆ 272026年9月30日 更新
Indicator pivoting methodology — how to use one known indicator to discover related infrastructure across the IOC graph. Decision tree by indicator type with concrete `/lookup-*` commands per pivot, a worked multi-hop example, pivot-quality scoring, and routing into the rigor pipeline. Use when the user asks "what else is connected to this IP / domain / hash / cert / actor?", needs to expand a single seed IOC into a campaign cluster, or wants the canonical reference for graph-walking IOCs.
日本語の概要は準備中です。原文の説明を表示しています。
Liberty91LTD/cti-skills☆ 272026年9月30日 更新
Use when a user asks to check, identify, or characterize a file hash (MD5, SHA-1, SHA-256). Chains VirusTotal and OTX, optionally triggers /malware-analysis for deeper behavioral review. Returns detection signals, malware family, behavioral tags, and pivot candidates (communicating IPs, dropped files). Invoked by /cti-orchestrator when the target is a hash.
日本語の概要は準備中です。原文の説明を表示しています。
Liberty91LTD/cti-skills☆ 272026年9月30日 更新
Use when you need to check an IP, domain, file hash, or URL against AlienVault OTX community pulses. Returns pulse count, key pulses, tags, related indicators, and passive DNS. Commonly invoked by investigation skills to pull community context. Retrieval only — does not interpret.
日本語の概要は準備中です。原文の説明を表示しています。
Liberty91LTD/cti-skills☆ 272026年9月30日 更新
Use when you need Liberty91 platform intelligence — what actually happened (deduplicated Threat Events with every source, Admiralty reliability/credibility and verification stage), whether an IOC is already known to your account, the canonical threat library (actors, malware, vulnerabilities, clusters, ATT&CK TTPs), alert matches, or which of your customer organizations an occurrence affects — or when you need to push intelligence back: ingesting your own report, generating an intelligence package, or uploading an organization document. Also supplies event provenance fields, when the platform returns them, and Threat Library alias resolution to /source-provenance and /quality-of-information-check. Two-way, first-party integration. Commonly invoked by /ip-investigation and friends, /ioc-enrichment-workflow, /threat-actor-profiling, /campaign-tracking and /vulnerability-intelligence. Reads $LIBERTY91_API_KEY.
日本語の概要は準備中です。原文の説明を表示しています。
Liberty91LTD/cti-skills☆ 272026年9月30日 更新
Use when you need abuse-report history for an IPv4/IPv6 address — confidence score, total reports, distinct reporters, usage type. IP-only. Commonly invoked by /ip-investigation. Retrieval only.
日本語の概要は準備中です。原文の説明を表示しています。
Liberty91LTD/cti-skills☆ 272026年9月30日 更新
Use when a user asks to investigate, check, enrich, or characterize an IP address (IPv4 or IPv6). Chains VirusTotal, Shodan, AbuseIPDB, GreyNoise, OTX, and optionally Censys in parallel, then consolidates findings and prioritizes follow-up IOCs. Invoked by /cti-orchestrator when the target is an IP.
日本語の概要は準備中です。原文の説明を表示しています。
Liberty91LTD/cti-skills☆ 272026年9月30日 更新
Use when a user asks to investigate, check, or characterize a domain or hostname. Chains VirusTotal, URLScan (search existing scans), Shodan (DNS resolve + host), OTX, ransomware.live (victim-status sweep), and optionally Censys. Returns reputation, resolution, hosting fingerprint, ransomware-claim status, and pivot candidates. Invoked by /cti-orchestrator when the target is a domain.
日本語の概要は準備中です。原文の説明を表示しています。
Liberty91LTD/cti-skills☆ 272026年9月30日 更新
Use when a report or article needs to be split into individual claims before it is graded, cited or used as evidence — the user asks "what does this report actually claim?", "split this into claims", "separate the facts from the judgements", or another skill needs a claim list. Turns one document into five to twelve atomic claims, each typed (observation, attribution, assessment, actor claim, victim disclosure) and anchored to the verbatim sentence it rests on, so every extraction can be checked against the source. Preserves the source's own hedging. Does not grade. Invoked by /quality-of-information-check; its output feeds /ach, /key-assumptions-check, /intelligence-writing, /writing-assessments and /threat-actor-profiling.
日本語の概要は準備中です。原文の説明を表示しています。
Liberty91LTD/cti-skills☆ 272026年9月30日 更新
Detect and remove the tells of AI-generated writing in BOTH English and Spanish, and read back the evidence honestly. Use when the user asks to "de-AI" / "humanize" / "un-slop" a draft, to examine whether text carries the tells (delve, tapestry, "it's not just X, it's Y", "here's the thing", em-dash overuse, an assistant's own closing line left in the document), to compare documents for overlap, or mentions signs-of-ai / SignsOfAI. Backed by the SignsOfAI engine — for a measured 0–100 score, sentence-rhythm burstiness, originality, citations, a writer baseline or perplexity, hand off to that engine (web app, CLI or MCP server) as described below. It cannot determine who wrote a text and must never imply that it can.
日本語の概要は準備中です。原文の説明を表示しています。
peopleworks/SignsofAI☆ 272026年9月17日 更新
Build applications where agents are first-class citizens. Use this skill when designing autonomous agents, creating MCP tools, implementing self-modifying systems, or building apps where features are outcomes achieved by agents operating in a loop.
日本語の概要は準備中です。原文の説明を表示しています。
majiayu000/claude-skill-registry-data☆ 262026年10月17日 更新
Generate AGENT.md files with proper YAML frontmatter, role definitions, expertise areas, and prompt templates following Babysitter SDK conventions.
日本語の概要は準備中です。原文の説明を表示しています。
majiayu000/claude-skill-registry-data☆ 262026年10月17日 更新