Loading...
Loading...
Found 137 Skills
Prepares a reproducibility artifact (code/data) for submission and badging. Use when a researcher says "artifact evaluation", "artifact appendix", "reproducibility", "badge", "Artifacts Available/Evaluated/Functional/Reusable", "Results Reproduced/Replicated", "ACM badging", "USENIX/OSDI/SOSP AE", "SIGMOD ARI", "NeurIPS code/checklist", "ACL repro checklist", "Zenodo DOI", "Software Heritage", "anonymize my code/repo", or "package my code". Builds the artifact README + appendix, the dependency/run instructions, an anonymized repo for double-blind, and archival-DOI (Zenodo version vs concept) / Software Heritage SWHID guidance; resolves the ACM badge taxonomy and the Reproduced/Replicated era swap; and lints the artifact directory against the ML Code Completeness checklist with bundled stdlib-only scripts. Outputs an artifact-readiness checklist + packaging plan. Re-verifies the venue current artifact rules live. Advisory only; never submits.
Estate and gifting architecture for wealth management: the unified estate/gift/GST framework, lifetime exemption vs annual exclusion, basis step-up vs carryover, trust taxonomy, and beneficiary planning. Use when the user asks about the 'estate tax exemption', 'annual gift exclusion', 'step-up in basis', a 'revocable trust' or 'irrevocable trust', 'gifting to my kids', '529 superfunding', or the 'portability election'. Also trigger on questions about gift-splitting, Form 706 or Form 709, DSUE, ILITs, GRATs, SLATs, IDGTs, charitable remainder trusts, state estate or inheritance taxes, the SECURE Act 10-year rule for inherited IRAs, whether to gift appreciated stock now or leave it at death, or how to fund estate taxes for an illiquid estate. For income-tax angles of charitable giving (QCDs, donating appreciated securities, DAF bunching), see the tax-efficiency skill.
Turn complex explanations into a one-page visual HTML explainer: the model writes only an extended Markdown content draft, while the skill’s bundled CLI handles templates, components, automatic SVG layout, and STE controlled-writing checks to produce a single-file page in one call. Use this skill as well when the user says `/answer-me-with-html config` or wants to change settings (automatically opening the browser, always-on mode, default theme). Proactively use it, without waiting for the user to ask, whenever an answer involves any of the following: ≥3 interrelated concepts; a flow/protocol/architecture with branches or multiple participants; a comparison or trade-off across ≥3 dimensions; a hierarchy (table of contents, modules, taxonomy); an evolutionary history or stages; or the user says "explain the principles / I didn’t get it / draw a diagram / explain this codebase / explain it with HTML / explain visually." Do not use it for: short Q&A that can be answered in under 200 characters, commands that need to be copied and executed immediately, pure code modifications, or when the user explicitly requests plain text.
Create lean-spec style GitHub issues as specs for human-AI aligned implementation on the current repo. Use when asked to "create a spec", "write a spec issue", "spec this feature", "spec this", or when planning work that needs a specification before implementation. Follows the lean-spec SDD methodology — small focused specs (<2000 tokens), intent over implementation, context economy. Creates GitHub issues with Overview, Design, Plan, Test, Alignment, and Notes sections. Repo-specific area taxonomy, sister-skill names, custom body sections (e.g. Provider impact / Schema impact / Reach), and additional principles are overlaid by the consumer repo's CLAUDE.md and its `*-dev-process` / `*-pre-push` / `*-pr-lifecycle` sister skills — read those first when the repo isn't obvious.
Create product-led SEO strategies that turn product value, user intent, page architecture, taxonomy, and scalable user experiences into organic growth. Use when a user asks for SEO strategy, organic growth planning, content/product SEO, programmatic SEO direction, search moat creation, or wants to avoid keyword-list SEO.
Update initiative tasks in One Horizon, including status, ownership, parent linkage, and taxonomy labels. Use when asked to "update initiative status", "reassign initiative", or "move this under another initiative". Requires One Horizon MCP.
Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host-header injection redirects token, predictable/numeric token, Referer leak, no-expiry/reuse), (2) email change without re-auth, (3) OAuth account-link CSRF, (4) MFA bypass (per hunt-mfa-bypass), (5) session fixation, (6) JWT manipulation (forge token to another identity; crypto details → hunt-jwt-crypto), (7) password change without step-up (chain with login timing/length oracle), (8) social-recovery / security-question brute-force, (9) SSO subdomain takeover at OAuth redirect_uri. Chains: cookie theft + password oracle + no step-up = persistent ATO; lax redirect_uri = auth-code theft; dangling-CNAME takeover at redirect_uri = ATO. Validate: demonstrate real takeover of test account B from attacker A's session; OOB/Collaborator confirm blind token-leak steps. Use when hunting ATO chains, testing password reset / email change / MFA / OAuth / session / JWT, or chaining primitives toward Critical.
Review Rust changes for correctness, memory and thread safety, error semantics, unnecessary allocation or cloning, lock scope, API compatibility, test gaps, documentation, and dependency risk, applying the Rust API Guidelines checklist (C-PANIC, C-UNWRAP, C-TRANSMUTE, C-BOOL, C-NEWTYPE, C-COMMON-TRAITS, C-CONVERT, C-SEALED, C-NON-EXHAUSTIVE). Use when reviewing Rust diffs, pull requests, libraries, unsafe boundaries, or production incidents; report actionable findings by severity before summaries, route automated formatting or lint policy to rust-style-clippy, and route API shape decisions (trait sealing, error taxonomy, newtype design, builder patterns) to rust-api-design.
Enforces a typed-error spine — a hand-rolled sealed Result<T,F> plus one per-boundary sealed Failure carrying a stable code and typed params (never a localized string), returned instead of thrown; recoverable failures are values, only bugs throw. Convert-at-boundary catches narrowly with an on-clause and logs the original error+stack BEFORE returning a typed Failure; call sites switch exhaustively with no default:; the taxonomy of what the global error net (FlutterError.onError + PlatformDispatcher.onError, installed by app-startup-and-bootstrap) routes into, plus Isolate.run re-wrapping; mechanism selection (Error vs assert vs Exception vs sealed outcome) and @useResult; and a never-lose-data layer (one-transaction-per-mutation, debounced autosave drafts, optimistic soft-delete/Undo). Use when writing result.dart/failures.dart, a try/catch or sealed-switch default:, wiring bootstrap handlers, a repository/service/DAO boundary, or transactions, drafts, or soft-delete/Undo.
Use the EmDash CLI to inspect and manage an EmDash instance from the command line, including content, schema, media, taxonomies, menus, search, authentication, seeds, migrations, generated types, and whole-site export and import.
Selection and writing methods for short-form video hooks (openings), Chinese name: 「钩子」. Use when creating a hook, writing a hook, figuring out how to write a hook, running out of ideas for a hook, designing a hook for the first 5 seconds, or writing a video opening or spoken-script opening; also use when the user asks how to start a video, requests an opening template, asks about hook types, or asks for help creating a hook, including during ra-洗稿 script rewriting and topic ideation. Provides a scenario-based taxonomy of 7 hook types with a decision flow, prerequisites, sentence templates, and common mistakes. To diagnose and optimize an existing hook draft, use dbs-hook instead; this skill chooses the type, while dbs-hook refines the execution.
Hunting skill for auth bypass vulnerabilities. Built from 12 public bug bounty reports across SAML XSW / parser-differential (GitHub Enterprise CVE-2025-25291/25292), SAML signature stripping (Uber, Rocket.Chat, samlify CVE-2025-47949), SAML domain enforcement bypass via control characters (HackerOne 2024), partner-portal cross-IdP assertion reuse (Slack), WordPress XMLRPC bypassing SSO (Uber), JWT alg-confusion HS256/RS256 (Jitsi), JWT signature-validation skip (Linktree, Newspack), and token-audience confusion (Argo CD CVE-2023-22482). For standalone JWT signature/crypto forging (alg:none, key confusion, kid/jku) see hunt-jwt-crypto; this skill covers JWT only inside SSO/SAML/token-trust bypass chains. SAML assertion-layer attacks (XSW, comment injection, signature stripping, XXE-in-assertion) are owned by hunt-saml; this skill owns the broader cross-protocol auth-bypass taxonomy. Use when hunting auth bypass — see the Legacy-Protocol Matrix for branded-UI vs legacy-endpoint patterns.