Claude Skills by aibot88

Assess legacy workloads before modernization — application dependency graph, database schema, traffic patterns, RTO/RPO, compliance constraints (ISMS-P/PCI-DSS), technical debt scoring, and Five Lenses readiness. Use when starting brownfield migration to AWS and need a data-driven baseline before selecting a 6R pattern.

WorkOS AuthKit is a real authentication toolkit for Next.js applications. It gives agents a concrete integration target for login, sessions, RBAC, SSO, MFA, and user management backed by WorkOS docs and package releases.

Audit workplace risk scoring systems and occupational safety programs -- evaluate job hazard analysis (JHA/JSA) methodology and task-level hazard identification, risk matrix calibration for likelihood and consequence scales, exposure assessment accuracy for chemical, noise, vibration, and heat stress monitoring, PPE adequacy under 29 CFR 1910.132(d) and respirator fit testing per 29 CFR 1910.134, and ergonomic risk factors using REBA, RULA, NIOSH Lifting Equation, and Strain Index. Covers NIO...

Audit all git repos under ~/dev for dirty state, unpushed commits, exposed .env files, and tracked context files (CLAUDE.md, AGENTS.md, GEMINI.md). Use when the user wants to know if their workspace is clean, before a deploy, or when something feels off. Triggers on "audit workspace", "check repos", "anything unpushed", "is my workspace clean", "check for dirty repos", "any exposed secrets".

World Chain MiniApp Kit / MiniKit SDKを使ったブロックチェーンアプリケーション開発を包括的に支援するスキル。 World App内で動作するMiniApp（ミニアプリ）の設計・実装・デプロイまでをカバー。 World ID（Proof of Personhood）によるユーザー認証、ウォレット認証（SIWE）、 WLD/USDCトークン決済、スマートコントラクト連携（sendTransaction）、 Permit2トークン転送、通知、連絡先共有、ハプティクスフィードバックなど、 MiniKit SDKの全コマンドに対応。Next.jsベースのフルスタック開発をサポート。 使用場面：(1) MiniAppの新規作成・セットアップ、(2) World ID検証の実装、 (3) WLD/USDC決済機能の組み込み、(4) スマートコントラクトとの連携、 (5) ウォレット認証（Wallet Auth / SIWE）実装、(6) World Chainハッカソン参加、 (7) MiniAppのテスト・デプロイ。World App、World Chai...

Skill chuyên dụng để tạo trang web khóa học WordPress hoàn chỉnh với custom theme: Google Auth, hệ thống bài học + video Drive bảo mật, VIP membership, khóa/mở bài, khuyến mãi, admin chuyên nghiệp. Đã thực chiến với dự án Goveoai Edu.

WordPress theme and plugin review skill. Detects whether a target path is a theme or plugin, runs security and standards checks, scores the findings, and writes a markdown report. Use when the user wants to review a WordPress theme or plugin directory, generate a code review report, inspect WordPress security posture, or compare review strictness with selectable security levels.

WPScan is an open-source WordPress security scanner that detects vulnerabilities in plugins, themes, and core installations. It checks for known CVEs, weak passwords, exposed config files, and security misconfigurations using the WPScan Vulnerability Database API.

Author, audit, or polish a project README — clarity, structure (Pattern A grouped collapse / Pattern B per-entry collapse), wording concision, anchor integrity. Reads the repo first, proposes diffs, applies on approval.

Collaborative document authoring workflow for proposals, technical specs, decision docs, README sections, ADRs, and long-form prose that must work for fresh readers. Use when asked to "write the docs", "draft a proposal", "write a spec", "write an RFC", "write the README", or when a document needs to be understandable by someone without this session's context. Three stages: gather context, iterate on structure, reader-test for a stranger.

Create and validate a Myco-managed SKILL.md file using vault_write_skill. Use when authoring a new skill from scratch, updating an existing skill, or fixing a skill that failed the quality gate. Applies whenever you need to produce a valid .agents/skills/<name>/SKILL.md file that passes structural validation. Also load when vault_write_skill returns a rejection error — the error message identifies the failing constraint, but this skill explains the full field contract and the known contaminat...

Map the write path of a project across multiple frameworks — entry points, validation, auth, persistence, side-effects. Outputs report, Mermaid diagrams, JSON sidecar. Flags unauth writes, missing RLS, cache gaps. Use for write path, mutation audit, RLS audit.

WriteFreely is a clean, minimalist self-hosted publishing platform built in Go for writers. It features a distraction-free Markdown editor, ActivityPub federation for cross-platform community building, multi-blog support from a single account, and OAuth 2.0 integration for onboarding users from existing platforms.

Author a new Agent Skill for a Hive agent that conforms to the Agent Skills specification (SKILL.md with YAML frontmatter, optional scripts/references/assets directories). Use when the user asks to create, scaffold, add, or package a new skill for a Hive agent.

Produces prose that reads as authentically human by avoiding statistical patterns common to LLM output. Use when writing or editing prose, documentation, READMEs, PR descriptions, or any text where the output must not read like AI-generated content.

CLI para organizar PDFs y libros con metadata generada por IA, búsqueda full-text (SQLite FTS5) y backups a iCloud o S3. Úsala cuando el usuario pida buscar, mostrar, ingestar o respaldar libros/PDFs en su biblioteca wst — por ejemplo "pasame tal libro a mi iPad", "ingestá esta carpeta a mi biblioteca", "mostrame qué libros tengo de Sagan", "hacé backup a iCloud del libro 12".

X/Twitter API integration for posting tweets, threads, reading timelines, search, and analytics. Covers OAuth auth patterns, rate limits, and platform-native content posting. Use when the user wants to interact with X programmatically.

Use when the user wants to read X Articles (long-form posts on X/Twitter). Fetches article content, author, published date, and metadata. Handles both individual article lookups and bulk extraction across an author or query.

Draft, validate, split into threads, open X/Twitter composer links, and use the dry-run-first MCP workflow for live X posting when local credentials are explicitly configured. Use when Codex needs to prepare social launch copy, repo/project announcements, X posts, tweet threads, or shareable publishing drafts where the user should manually review before posting.

Generates an x-ray.md pre-audit report covering overview, enhanced threat model (protocol-type profiling, git-weighted attack surfaces, temporal risk analysis, composability dependency mapping), invariants, integrations, docs quality, test analysis, and developer/git history. Triggers on 'x-ray', 'audit readiness', 'readiness report', 'pre-audit report', 'prep this protocol', 'protocol prep', 'summarize this protocol'.

Use whenever the user wants to add payments to an API, monetize endpoints, implement x402, handle HTTP 402 responses, create paid APIs, set up crypto paywalls, accept USDC, or build agent payments. Trigger on: x402, 402 Payment Required, paid API, paywall, micropayments, USDC payments, agent payments, monetize API, payment middleware, x402-next, x402-express, x402-fetch, Sentinel, payment router, audit trail, budget caps, payment receipts, facilitator. Also trigger when turning a free API int...

Applies chained XSLT transformations to XML documents using lxml and Saxon-JS. Supports XSLT 3.0 streaming, XPath parameter injection, and multi-stage transform pipelines with intermediate validation.

Automates XMS customer service system SSO login via browser automation. Handles navigation to the XMS portal, SSO redirection detection, DOM-based credential injection with event triggering, and login confirmation. Use when the user needs to log into XMS, authenticate with cs-packet.i4px.com, or perform any XMS workflow requiring a valid session.

Xray Cloud test management via `bun xray` CLI: create/list tests, manage test executions and plans, import JUnit/Cucumber/Xray JSON results, update run statuses, back up and restore projects, link defects. Triggers on: create a test in Xray, import test results to Xray, list Xray executions, update run status, backup Xray project, restore Xray tests, link defect to run, sync tests, Xray auth login. Do NOT use for: writing automated tests (test-automation); documenting test cases or ROI analys...

使用 xray 进行 Web 漏洞自动化扫描。当需要对 Web 应用进行全面漏洞扫描（XSS/SQLi/命令注入/SSRF/XXE/路径穿越/文件上传/弱口令等）时使用。xray 是长亭科技出品的综合性 Web 安全评估工具，支持主动扫描、被动代理扫描、基础爬虫扫描三种模式，内置丰富的检测插件和社区 POC。任何涉及 xray 漏洞扫描、Web 安全评估、被动代理扫描的场景都应使用此技能

Prévenir les attaques XSS. Utiliser quand on affiche du contenu dynamique ou sanitize des entrées utilisateur.

Identifying and validating cross-site scripting vulnerabilities using Burp Suite's scanner, intruder, and repeater tools during authorized security assessments.

Generates xUnit.net tests in C#. Covers Fact/Theory, constructor injection, IClassFixture, and FluentAssertions. Use when user mentions "xUnit", "[Fact]", "[Theory]", "Assert.Equal", "C# xUnit". Triggers on: "xUnit", "[Fact]", "[Theory]", "Assert.Equal C#", "xUnit.net".

Write and test YARA rules for malware detection and threat hunting. Use when creating YARA signatures, detecting malware families, scanning files or memory for indicators of compromise, or building detection rules for threat intelligence.

Conception d'API Gateway avec YARP (Yet Another Reverse Proxy) en .NET — routing, load balancing, rate limiting, transformations et authentification. À utiliser quand l'utilisateur implémente un reverse proxy ou une gateway API avec YARP en .NET. Se déclenche aussi avec "YARP", "reverse proxy .NET", "API gateway .NET", "YARP routing", "proxy .NET", "load balancer .NET".

Scrape daily job listings from YCombinator's Workatastartup platform without duplicates. Use this skill when asked to scrape YC jobs, update the YC companies list, or retrieve the latest startup jobs. It handles authentication, extracts company slugs via Inertia.js JSON payloads, falls back to public YC job pages when necessary, and maintains a local SQLite database to track historical jobs and prevent duplicates.

Fetch Yahoo Finance market data via the yfinance library. Use for stock, ETF, mutual fund, index, crypto, futures, or FX questions — current quotes, historical OHLCV (daily / intraday), and company / fund fundamentals (P/E, dividend yield, sector, analyst targets, AUM, etc.). Triggers include "current price", "YTD performance", "N-year chart", "P/E ratio", "compare/rank tickers", "what does X do", and non-US tickers like 0700.HK or BMW.DE.

Yida (宜搭) server-side OpenAPI via DingTalk Open Platform. Use when calling Yida APIs from external systems — form CRUD, batch operations, process/workflow management, task approval, attachments. Authentication via DingTalk OAuth2 access_token. Trigger keywords: 宜搭, yida, API, 表單, form, 流程, process, 審批, approval, 服務端, server.

Extracts YouTube video transcripts via the youtube-transcript-api Python library and generates semantic chapter markers. Uses sentence-transformers for topic segmentation and formats chapter timestamps for YouTube description metadata compliance.

Access YouTube video data — transcripts, metadata, channel info, search, and playlists. A lightweight alternative to Google's YouTube Data API with no quota limits. Use when the user needs structured data from YouTube videos, channels, or playlists without dealing with Google API setup, OAuth, or daily quotas.

Download YouTube videos and HLS streams (m3u8) from platforms like Mux, Vimeo, etc. using yt-dlp and ffmpeg. Use this skill when users request downloading videos, extracting audio, handling protected streams with authentication headers, or troubleshooting download issues like nsig extraction failures, 403 errors, or cookie extraction problems.

Asistente especializado en normativa japonesa de vacaciones pagadas (有給休暇) y cumplimiento laboral

Asistente especializado en normativa japonesa de vacaciones pagadas (有給休暇) y cumplimiento laboral

Zammad helpdesk için CLI wrapper skill. Kullanıcı "ticket ara", "ticket aç", "ticket kapat", "müşteri tickets", "destek talepleri", "support ticket oluştur", "zammad'da güncelle", "/zammad-cli" dediğinde tetiklenir. zammad-cli Rust binary'sini doğru komutlarla çağırır - ticket search/list/get/create/update/articles/article add/overview, org list/search, user search, system groups/states/priorities. Her zaman --json kullanıp parse eder.

Orchestrates OWASP ZAP security scans via the ZAP API with automated spider, active scanner, and authentication sequence configuration. Generates compliance reports mapped to OWASP Top 10 and exports findings in SARIF and JUnit XML formats.

Web application security scanner with proxy and active/passive scanning

Builds a Zapier automation using the Zapier NLA API to trigger on new HubSpot form submissions and enrich contact records via the Clearbit Enrichment API. Enriched data is written back to HubSpot and simultaneously posted to Slack via the Web API chat.postMessage endpoint.

Creates and manages Zapier integrations using the Zapier Platform CLI and REST Hooks API. Builds custom triggers, actions, and searches with OAuth2 authentication flows.

Routes and validates inbound automation traffic built around Webhooks by Zapier endpoints such as `hooks.zapier.com/hooks/catch/...`. Useful for standardizing payload shapes, inspecting trigger contracts, and debugging chained zaps across third-party SaaS systems.

Automatisation avec Zapier — Zaps multi-étapes, filtres, paths, webhooks et intégration entre applications. Se déclenche avec "Zapier", "Zap", "automatiser sans code", "connecter des apps", "webhook Zapier".

Public guide: Generate short domain names, check availability, purchase on Dynadot, switch nameservers, set up on Zapmail, create inboxes, and export to your email sending platform. Requires your own Dynadot and Zapmail API keys. Use when someone wants to set up cold email domains end-to-end.

Manage Zendesk support tickets via the `zd` CLI. Use when the user asks about Zendesk tickets, support tickets, customer issues, helpdesk operations, or ticket triage. Covers listing, searching, creating, updating, and deleting tickets, plus authentication setup and Zendesk search queries. Triggers on tasks involving "zendesk", "zd", "support ticket", "ticket queue", "helpdesk", or "customer support".

Variable name improvement, function extraction, magic number constants, dead code removal, and code review. For refactoring and PR review — does not change behavior. Don't use for bug/security (Judge), new tests (Radar), architecture (Atlas), or feature implementation (Builder).

· Hunt novel vulnerabilities: reversing, patch diffing, fuzzing, attack surface, PoCs. Triggers: 'zero-day', '0-day', 'vulnerability research', 'variant analysis', 'fuzz', 'exploit dev', 'CVE'. Not for SAST (use security-audit).

Zero-Trust security patterns — mTLS between microservices (Istio/SPIFFE), SPIRE workload identity, OPA/Envoy authorization, NetworkPolicy default-deny-all, short-lived credentials, service mesh security, and Kubernetes RBAC hardening.