Loading...
Loading...
Found 640 Skills
Build, inspect, or revise cmux custom sidebar views using the runtime SwiftUI-style interpreter. Use for sidebar vibe coding, custom sidebars in Bonsplit panes, left sidebar picker previews, interpreted Swift sidebars, ~/.config/cmux/sidebars/*.swift, cmux docs sidebars, or Aziz's Swift interpreter work.
VeloDB/Apache Doris table design and cluster sizing best practices. MUST USE when writing, reviewing, or optimizing Doris CREATE TABLE statements, partition/bucket strategies, data models, or cluster configurations. ALSO MUST USE whenever the velodb-architecture-advisor skill produces DDL — apply the Pre-Flight Checklist to every CREATE TABLE before output. Also triggers on any workload design involving: IoT, analytics, dashboard, CDC, time-series, log analysis, real-time warehouse, point query, data platform, or any scenario where table design decisions are being made. Also triggers on replacing or migrating from legacy analytics/search/serving stacks such as Impala, Kudu, Elasticsearch/ES, Greenplum, Presto, HBase, Hive, Hadoop, Redis, or Lambda-style multi-engine data platforms, even when VeloDB/Doris is not named explicitly. Also use when user provides a VeloDB connection string or asks to get started. Also triggers on slow query investigation, query profiling, runtime performance diagnosis, tablet skew analysis, and table health checks — any scenario where runtime evidence (profile output, tablet distribution) informs optimization. For Cloud operations (auth, cluster lifecycle, billing, networking), defer to the velocli-cloud skill.
Detonate malware samples in Cuckoo Sandbox to observe runtime behavior — process creation, file system and registry changes, network communications, and API calls — and generate behavioral reports for classification and IOC extraction. Use when a sample has passed static triage and needs dynamic/behavioral analysis, when mapping a full infection chain, or when building YARA/behavioral signatures from observed sandbox activity.
Generate CSPRNG bytes from the Web Crypto API, returned as hex, base64 or a UUID. Never Math.random. Called as GET /v1/crypto/random-bytes, it takes bytes, encoding and returns value, encoding. Observed on-chain demand: agents need unguessable nonces, tokens and idempotency keys, and a language runtime without a CSPRNG or a model asked to "pick a random number" both produce predictable output. Reading this schema and dry-running the call are free and need no wallet; a real call costs $0.003, paid in USDC on Base over x402.
Insert, delete, replace, extract, locate or measure at exact character offsets, counting by grapheme, code point or UTF-16 unit, with the affected range reported in both the chosen unit and UTF-16. Called as POST /v1/text/char-edit, it takes text, op, unit, index and returns op, unit, text, inputLength. Character-indexed string edits are a measured failure mode for language models (arXiv:2409.15452), and the index a model reasons about is rarely the index a runtime uses: a skin-toned emoji is one grapheme, two code points and four UTF-16 units, so an offset is wrong until the unit is named. Reading this schema and dry-running the call are free and need no wallet; a real call costs $0.003, paid in USDC on Base over x402.
Guidance for threat modelling using STRIDE and the Microsoft Security Development Lifecycle (SDL). Covers data-flow diagrams, trust boundaries, the STRIDE categories, mitigation mapping, and tooling (Microsoft Threat Modeling Tool). WHEN: threat modeling, STRIDE, data flow diagram, trust boundary, identify threats, SDL threat modeling, security design review, threat model a system, mitigation mapping, Microsoft Threat Modeling Tool, secure design review, design-time security. DO NOT USE for org-wide security architecture (use security-architecture) or for runtime detection (use sentinel / defender-xdr).
This skill should be used when the user reports a Phaser 4 bug, black screen, missing sprite, failed collision, broken physics, animation issue, crash, console error, performance problem, slow game, save/load issue, mobile runtime issue, or unexpected gameplay behavior.
Fetch a public URL and return its title, description, preview image, site name and canonical URL from its meta tags. Called as GET /v1/doc/url-metadata, it takes url and returns bytes, found, title, description. A publishing, chat or bookmarking agent asked to render a link preview needs the card fields without shipping an HTML parser or a headless browser into its runtime. Reading this schema and dry-running the call are free and need no wallet; a real call costs $0.003, paid in USDC on Base over x402.
This skill provides comprehensive guidance for SAP Cloud Logging service on SAP BTP. Use when setting up Cloud Logging instances, configuring log ingestion from Cloud Foundry or Kyma runtimes, implementing OpenTelemetry observability, analyzing logs/metrics/traces in OpenSearch Dashboards, configuring SAML authentication, managing certificates, or troubleshooting ingestion issues. Covers service plans (dev/standard/large), all 4 instance creation methods (BTP Cockpit, CF CLI, BTP CLI, Service Operator), all 4 ingestion methods (Cloud Foundry, Kyma, OpenTelemetry, JSON API), and security best practices.
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for CTF web, API, SSR, frontend, queue-backed app, and routing challenges. Use when the user asks to inspect a site or API, follow real browser requests, debug auth or session flow, trace uploads or workers, find hidden routes, or explain why frontend and backend behavior diverge under sandbox-internal routing. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
Analyzes and enforces security protocols on the skill ecosystem. Operates via Audit, Guard, and Trust modes to prevent malicious commands, PII leakage, and excessive permissions.
A Web/JS reverse engineering case knowledge base extracted from 42 articles across the entire 1997.pro site. It applies to case clues such as Akamai/Kasada/PX/reese84/TongDun/a_bogus/Tencent slider/Alibaba slider/JSVMP/227/226/wasm/protobuf/rid/fuid/fs/bx-pp/run_js/storage.estimate/animationend, as well as scenario judgment, method routing and case comparison for risk control fingerprints, environment patching, JSVMP/flat flow/WASM, captchas, and protocol parameter chains; it is used in collaboration with web-js-reverse-master-flow and three MCPs: jshook + js-reverse + chrome-devtools-mcp by default.