Loading...
Loading...
Found 3,220 Skills
Source code security audit using backward taint analysis, slot type classification, render context verification, and 3-phase parallel review producing an exploitation queue.
Validates planning artifacts and reviews code for quality, consistency, and completeness. Use to lint planning documents (cross-references, dependencies, format) or to review changed code (security, coherence, scope, quality).
Guides VP-level cloud program leadership—multi-year cloud strategy and migration/modernization portfolio, landing zone and CCoE operating model at org scale, hyperscaler enterprise agreement and commit governance, hybrid/multi-cloud posture, cloud center of excellence and talent, and board/CFO/CTO cloud narratives. Use when setting cloud direction, prioritizing migration waves, governing EA/MACC and cloud spend envelope, designing federated cloud org model, steering CCoE and standards adoption, preparing executive or board cloud updates, or adjudicating product vs platform vs security cloud trade-offs—not for Terraform/K8s implementation (cloud-engineer, infrastructure-engineer), landing zone technical design (enterprise-cloud-architect, cloud-architect), monthly CUR FinOps (finops-analyst), TCO/NPV modeling (cloud-economist), full infra portfolio including DC capex (vp-of-infrastructure), or GL close (compute-accounting-manager).
Use when an RFP, RFI, RFQ, security questionnaire, vendor questionnaire, or proposal request arrives and the team needs a structured response — parsing multi-section buyer-dictated requirements (MANDATORY vs WEIGHTED vs NICE-TO-HAVE), building a Shipley-method proof-point matrix mapping each requirement to a verifiable proof point, articulating 3-5 win-themes that ladder up across requirements, and producing a Shipley-derived winrate estimate that informs a bid / no-bid / partner-bid recommendation. For Bid Managers, Proposal Leads, Directors of Sales, and Sales Engineers at the response-strategy moment. Surfaces GAP requirements explicitly — never invents claims. NOT free-form proposal narrative authoring, NOT contract redline, NOT marketing collateral.
Delegate menial, well-scoped coding tasks to a cheap Qwen-backed subagent via the `claude-9arm` command instead of burning Claude tokens/quota. Use when the work is mechanical and low-risk — bulk renames, formatting, boilerplate, find-replace, grep-style search & summarization, reading/condensing logs or files, test/docstring/comment scaffolding, or running builds/linters/tests and reporting pass-fail. Also use when the user says "use qwen", "delegate this", "send it to 9arm/qwen", or "do this cheaply". Do NOT use for architecture, design, debugging judgment, security-sensitive edits, or anything needing this conversation's context.
Audit a JavaScript/TypeScript repo's npm, yarn, or pnpm configuration for supply-chain hardening: tool version, lifecycle scripts, unsafe dependency protocols, and minimum release age ≥3 days. Use when the user invokes /check-npm or asks to audit package manager security, lifecycle scripts, git dependencies, ignore-scripts, min-release-age, allow-git, approvedGitRepositories, strictDepBuilds, or blockExoticSubdeps in a Grafana plugin or JS/TS project.
Configures GKE edge networking, traffic routing, load balancing, and private service endpoints. Use when configuring Gateway API manifests, standard Ingress, Cloud Armor WAF security policies, Container-Native Load Balancing (NEGs), Private Service Connect (PSC), or Google-managed SSL certificates on GKE. Don't use for core cluster IP planning, Dataplane V2 network policies, or node NAT egress (use gke-networking instead).
Multi-dimensional health assessment for .NET projects with letter grades (A-F) using Roslyn MCP tools. Evaluates 8 dimensions: build health, code quality, architecture, test coverage, dead code, API surface, security posture, and documentation. Produces a structured report card with actionable recommendations. Load this skill when: "health check", "how healthy is this", "project health", "code quality report", "grade this project", "assess codebase", "quality audit", "technical assessment", "codebase review", "report card".
Validate database integrity, test migrations forward and backward, verify schema constraints, manage seed data, detect migration drift, and identify query performance issues. Covers PostgreSQL, MySQL, MongoDB with Prisma, TypeORM, Drizzle, and SQLAlchemy, plus Testcontainers test databases. Use when: "database test," "migration test," "migration rollback," "rollback test," "data integrity," "SQL test," "schema validation," "seed data," "query performance," "Testcontainers." Not for: synthetic data generation/masking at scale — use test-data-management; Docker/IaC test-environment provisioning — use test-environments; SQL injection — use security-testing. Related: test-data-management, test-environments, security-testing, ci-cd-integration.
Use when reviewing or implementing Lightning Data Service best practices in an LWC (.js, .html, .js-meta.xml) — UIAPI vs Apex, refreshApex / notifyRecordUpdateAvailable, @salesforce/schema imports, LDS record-form data patterns. TRIGGER on "apply LDS best practices to this LWC", "review this LWC for LDS best-practice issues", "review this component for Lightning Data Service issues", "UIAPI or Apex for this data?", "fix stale data after record save", "sync LDS cache", "use @salesforce/schema for field names", "choose between getRecord and Apex". DO NOT TRIGGER when building a new LWC (use experience-lwc-generate), applying SLDS design tokens (use design-systems-slds-apply), picking or wiring a `lightning-*` base component's props/events/slots generically (use experience-lwc-base-components-integrate — this skill covers only the LDS data-layer rationale, even when the fix involves a base record form), or for security / RTL / accessibility reviews (separate passes).
Guide for creating, configuring, and refining AI Agents. Use this skill when users want to define a new agent persona, generate a system prompt, or assemble a specific set of skills/workflows for a specialized agent (e.g., "Create a QA Agent" or "Design a Security Auditor Agent").
Execute token swaps and manage on-chain transactions: list supported swap chains, browse available swap tokens, get swap quotes with price/slippage/route info, build signable swap transactions, estimate gas/transaction fees, and broadcast signed transactions to the blockchain. Trigger words: swap, trade, exchange, buy token, sell token, convert, swap tokens, trade tokens, exchange tokens, buy crypto, sell crypto, get a quote, swap quote, price quote, how much will I get, swap rate, exchange rate, slippage, swap route, best price, execute swap, confirm swap, make a trade, place a trade, transaction, send transaction, broadcast, submit transaction, tx, send tx, gas fee, transaction fee, fee estimate, gas estimate, how much gas, supported chains, swap chains, which chains, available tokens, swap tokens, chain list, token list, build transaction, sign transaction. Chinese: 兑换, 交易, 买入, 卖出, 换币, 代币兑换, 报价, 兑换报价, 价格, 能换多少, 滑点, 路由, 最优价格, 执行交易, 确认交易, 发送交易, 广播交易, 手续费, Gas费, 费用估算, 支持的链, 可用代币, 构建交易, 签名交易. CRITICAL: Always use `--json` flag for structured output. CRITICAL: Swap amounts are in **smallest unit** (e.g. lamports for SOL, wei for ETH). CRITICAL: ALWAYS run `lfi token security` on the target token BEFORE executing a swap. CRITICAL: NEVER execute swap or send transaction without explicit user confirmation. Do NOT use this skill for: - Token search, info, security audit, K-line → use liberfi-token - Trending tokens or new token rankings → use liberfi-market - Wallet holdings, activity, or PnL stats → use liberfi-portfolio - Token holder or trader analysis → use liberfi-token Do NOT activate on vague inputs like "trade" or "buy" without specifying tokens or amounts.