开发技能

设计请求和响应结构时使用。适用于字段定义、校验规则、响应格式。优先使用 JSON:API 风格 + 字段稳定性 + 完整校验规则。

中文简介正在准备中。当前显示原文说明。

设计列表接口的分页、筛选、排序、搜索时使用。适用于所有列表 API。优先使用 cursor 分页（大数据）或 offset 分页（小数据）+ 统一筛选/排序规范。

中文简介正在准备中。当前显示原文说明。

Lark/Feishu workspace operations through the `lark-cli` tool — calendar and meeting rooms, docs, sheets, Base (多维表格), wiki, drive, mail, IM messages, tasks, OKR, approvals, minutes, video conferences, whiteboards, slides, contacts, attendance, and real-time events. Use whenever the user mentions 飞书 / Lark / 我的日程 / 约会议 / 订会议室 / 飞书文档 / 多维表格 / 知识库 / 云空间 / 发消息 / 群聊 / 邮件 / 待办 / OKR / 审批 / 妙记 / 会议纪要 / 画板 / 幻灯片, or asks to look up a colleague, or hands you a `feishu.cn` / `larksuite.com` URL. Also covers `lark-cli` setup, auth login, and permission-denied errors.

中文简介正在准备中。当前显示原文说明。

Create robust Python automation with full logging and safety checks. Use when tasks need complex data processing, authenticated API work, conditional file operations, or error handling beyond simple shell commands.

中文简介正在准备中。当前显示原文说明。

Wire builders' isolated tdmcp tool files into the shared registries, CLI, and docs as a single writer, conflict-safe, and confirm a green typecheck + build. Use when integrating/wiring/registering new tdmcp tools, adding their CLI commands, resolving build breaks after parallel feature work, or merging several builders' files into the registry without conflicts.

中文简介正在准备中。当前显示原文说明。

How to migrate the tdmcp Claude Desktop bundle from legacy .dxt to .mcpb (MCP Bundle) and keep it building — covers the manifest schema (verify against the installed packer, never hardcode), the build-mcpb.mjs packer/zip-fallback flow, the npm scripts, and the full .dxt→.mcpb reference sweep across docs and scripts. Use when packaging or migrating the tdmcp desktop bundle.

中文简介正在准备中。当前显示原文说明。

Consolidate the td-trend-scout reports under `_workspace/hype-scout/` into one prioritized HYPE_TOOL_BACKLOG.md — dedupe trends across surfaces, vet each candidate against the real tdmcp codebase (layer fit, operator coverage, bridge work), rank by Hype × Build-Ease, and emit a 'Ready for tdmcp-pipeline' top-5. Use when a td-hype-synthesizer agent is consolidating scouts at the end of the tdmcp-hype-scout harness.

中文简介正在准备中。当前显示原文说明。

How to migrate the tdmcp Codex Desktop bundle from legacy .dxt to .mcpb (MCP Bundle) and keep it building — covers the manifest schema (verify against the installed packer, never hardcode), the build-mcpb.mjs packer/zip-fallback flow, the npm scripts, and the full .dxt→.mcpb reference sweep across docs and scripts. Use when packaging or migrating the tdmcp desktop bundle.

中文简介正在准备中。当前显示原文说明。

Implement production changes with or without new test coverage.

中文简介正在准备中。当前显示原文说明。

Hand off code review to OpenAI Codex CLI. Use when asked to "review code with codex", "codex review", "get a second opinion on code", "review my changes", "review this PR", or when you want AI-powered code review from a different model perspective.

中文简介正在准备中。当前显示原文说明。

CRISP session manager — detects project state and routes to the right entry point. Use /crisp to start or resume any CRISP engagement. Handles new projects (discovery), existing codebases (archaeology), active sprints (execute), and validation (prove). Reads docs/crisp-state.json to know where you are.

中文简介正在准备中。当前显示原文说明。

Generates AI-authored code reading guides from a project or module. Invoke when user asks to read code, summarize architecture, and write a guide document.

中文简介正在准备中。当前显示原文说明。

Use Arcade MCP to create custom MCP servers and tools with OAuth-aware authorization, evals, and deployment paths for agent tool-calling workflows.

中文简介正在准备中。当前显示原文说明。

Scaffold, build, and run MCP servers from a predictable Python project layout with tools, prompts, resources, auth, and OpenTelemetry hooks.

中文简介正在准备中。当前显示原文说明。

Client-side initial access and social-engineering attack module. Use when the operator selects a human/client/browser/identity-delivery attack direction: ClickFix/FileFix, AiTM session phishing, OAuth device-code or consent abuse, Teams/helpdesk social engineering, HTML/file delivery, QR/mobile handoff, legacy HTA/OLE/Office paths. This is an Attack module: own the chain until host shell or remote interactive foothold. Credential/token/session are intermediate results, not the stop condition. If endpoint AV/EDR/AMSI/application-control blocks an otherwise-valid client execution path, the operator may temporarily select /edr-bypass and then resume this phishing chain until shell.

中文简介正在准备中。当前显示原文说明。

HTTP/HTTPS application-layer reconnaissance after a web service is identified: fingerprinting, content/API discovery, JS/source maps, proxy/cache topology, WAF, CMS, and known CVE/PoC candidates. Recon only — do not exploit, write files, or obtain a shell. Hand CVE candidates and attack surface to the operator, who may select /web-attack. Non-HTTP ports belong to /recon.

中文简介正在准备中。当前显示原文说明。

HTTP/Web exploitation until a server shell or equivalent OS execution. Use after /web-recon has mapped the application. Covers injection, upload, LFI, SSRF/XXE, SSTI, deserialization, JWT/SAML, API logic, desync/cache/parser, and Web-controlled backend abuse. WAF stays here. Endpoint blocks after OS execution hand off to /edr-bypass then return. Direct non-HTTP service ports belong to /recon or /service-attack.

中文简介正在准备中。当前显示原文说明。

Look at real hardware, screens, panels, and wiring on a desk or workbench through a camera, so Claude can SEE physical output that no unit test, log, or API can. Use whenever the user says "are you seeing this?", "olha isso", "look at this", "watch this", "can you see...", "check the camera", "look at the screen" / "look at the display", "is this wired right?", or "what's this part?"; asks to visually verify a rendered display, LCD, LED, or panel; wants a wiring, polarity, or voltage-rail check before power-on; or needs to confirm a font, layout, clipping, or on-screen value renders correctly instead of trusting green tests. Grabs the current camera frame(s) and reads them; supports a watch mode for an action in progress. Needs a snapshot-capable camera reachable over HTTP (Android IP Webcam app, Raspberry Pi camera-streamer, or any snapshot URL) set via CCE_CAM_URL.

中文简介正在准备中。当前显示原文说明。

Decide what to borrow, adapt, or write before building something. Use when the user describes an app, tool, CLI, or feature they want to build and needs to know which parts already exist as open-source GitHub repos (BORROW), which are worth reading and adapting (KITBASH), and which to just write (WRITE). Every repository named is checked against the live GitHub API, so invented ones never reach the user.

中文简介正在准备中。当前显示原文说明。

Check or apply rustfmt formatting across the workspace. Use this when asked to format code, check formatting, or fix rustfmt issues.

中文简介正在准备中。当前显示原文说明。

Fetch Cadmus application logs from Loki by run ID. Use when asked to look up logs for a specific run, debug a device session, or find log output for a given run ID.

中文简介正在准备中。当前显示原文说明。

Run clippy locally and report only issues in the current diff, matching the CI reviewdog flow. Use when asked how to lint changed code or get clippy feedback on a branch before pushing.

中文简介正在准备中。当前显示原文说明。

Multi-backend database security auditor. Audits Supabase, Firebase (Firestore/RTDB/Storage/Functions/Remote Config), MongoDB (self-hosted + Atlas), self-hosted PostgreSQL, and self-hosted MySQL for RLS/rules misconfigurations, exposed credentials, auth bypasses, MongoBleed (CVE-2025-14847), pgBouncer CVE-2025-12819, mysql_native_password drift, ghost auth, and storage exposures. Use this skill whenever the user mentions database security, RLS or rule audits, security review, penetration testing a vibe-coded app, checking if their DB is exposed, hardening a backend, fixing security rules, or auditing apps built with Lovable/Bolt/Replit/Cursor/Claude Code on any of these backends. Trigger on phrases like 'is my app secure', 'check my database', 'audit my Firebase', 'audit my MongoDB', 'audit my Postgres', 'audit my Supabase', 'is my DB exposed', or any cross-backend variant ('audit my full stack').

中文简介正在准备中。当前显示原文说明。

当用户明确要求发布项目到 GitHub、创建 GitHub Release 或生成 Release Notes 时使用。根据版本历史整理发布说明；仅要求预览时不执行发布。

中文简介正在准备中。当前显示原文说明。