Claude Skills by aibot88

本文档是面向通用 Python Agent 系统的 `Agent Skill` 设计规范。 本文档关注 `Agent Skills` 本身，不依赖任何具体项目实现，也不绑定某个特定框架、目录结构或运行时。目标是为开发者提供一套可以直接落地的 `Skill` 设计、定义、治理与演进规则，使 `Skill` 成为 Agent 系统中的稳定能力抽象，而不是临时拼接的函数集合。 `Agent Skill` 的核心理念来自 Agent Skills 生态：将一项可复用能力封装为一个可被发现、理解、选择、加载、执行和治理的能力单元。它既可以承载 instruction，也可以承载结构化 schema 与 executable handler，还可以作为 workflow 组成部分被更高层 Agent 编排。 --- 在 Agent 系统中，`Skill` 的定义是： > 一个可复用、可组合、可路由、可执行、可治理的能力单元，用于让 Agent 以稳定方式完成某一类任务。 一个完整的 `Skill` 应当回答以下问题： - 这个能力做什么 - 在什么任务条件下应该被选中 - 接受什么输入 - ...

Maven build expertise for this multi-module Java project. Use when working with pom.xml files, managing dependencies, running builds or tests for specific modules, configuring or troubleshooting plugins (surefire, jacoco, shade, spotless, pitest, owasp), regenerating OpenAPI sources, building the JMH benchmark JAR, or releasing to Maven Central.

> Aktif permanen. Tanpa pengecualian. Untuk semua tugas. ---

Runs linter+typechecker with auto-detected toolchain (ruff/mypy, eslint/tsc, phpstan, golangci-lint, clippy). Triggers: lint, typecheck, static analysis.

Personal portfolio of Ayush Dutta - security researcher and developer. Contains projects related to cybersecurity, zero-knowledge proofs, malware analysis, and security education. Use when users need info about security research, bug bounty, penetration testing, or want to explore open source security projects.

根据任务信号注入条件性规则包（测试、迁移、安全、文档、性能）。

Create a distributable coding-agent skill (`saf-checker-dev`) that guides agents through creating SAF bug-finding checkers, taint rules, resource leak detectors, and typestate specifications. Spec-first workflow with three tiers: declarative (YAML + CheckerSpec), typestate (TypestateSpec), and custom patterns (new SitePattern variants).

Generate Sales Nav URLs from a niche, check counts via Vayne, scrape leads, and store results. Say "prospect [niche]" or "run the prospector" to start.

扮演資安分析師，提供威脅分析、漏洞評估、安全架構建議與資安事件應變指導。適用於滲透測試規劃、資安政策制定、事件調查、合規稽核。當用戶面臨資安威脅、需要安全評估或資安建議時啟動。

Dixin的私人投资分析师Skill。当Dixin（BlackRock软件工程师，31岁，San Francisco）询问任何投资相关问题时激活。 Trigger words: - "早间分析" / "盘前分析" / "Daily Brief" → daily-brief流程 - "组合体检" / "Portfolio Checkup" → portfolio-checkup流程 - "决策检查 [标的]" / "该买/卖XXX" → decision-checklist流程 - "财报预演 [标的]" / "财报怎么看" → earnings-response流程 - "市场暴跌怎么办" / "心慌" → event-response流程 - "月度复盘" → monthly-review流程 Auto-trigger guards (always active): - 危险词检测：清仓/All in/梭哈/杠杆/全卖 → 强制启动检查流程 - Tier 3来源警告：X推文/Reddit/CNBC/微信群 → 启动信号vs噪音筛选 - 情绪检测：心慌/焦虑/兴奋/恐惧/赌一...

Trigger this skill for any request involving: - Broken, erroring, or misbehaving code in any language - Stack traces, error messages, or unexpected output - "Why doesn't this work?" or "What's wrong with my code?" - Code review, quality audit, or refactor requests - Performance problems, memory leaks, or slow execution - Tests that fail unexpectedly - Security review or vulnerability assessment - "Make this code better / cleaner / more maintainable"

Comprehensive coding standards and best practices for maintainable, consistent software development across multiple languages and paradigms

General-purpose Static Application Security Testing (SAST) skill for code vulnerability analysis. Trigger when the user asks to: "analyze code for vulnerabilities", "review code security", "find security bugs", "do a SAST scan", "check for [vulnerability type] in code", "audit source code", or requests a security code review of any language or framework. Covers 34 vulnerability classes across web, API, auth, mobile, and logic layers.

**CyberSecurity Awareness Series — Part 1: Foundation** เขียนโดย Claude Opus 4.6 | บรรณาธิการ: Tanin T.  <!-- Canva Design: https://www.canva.com/d/EcBQGoI6-LkAv3n --> ---

Use this skill whenever writing, reviewing, or responding to an RFP that involves wealth management, asset management, private banking, financial advisory, portfolio management, robo-advisory, trading platforms, financial planning, investment management, or related domains. Triggers include any mention of wealth management, HNW/UHNW clients, portfolio rebalancing, financial planning, advisor workbench, client onboarding/KYC/AML, SEC/FINRA/MiFID compliance, trading systems, performance reporti...

CVE lookup via MITRE + NVD: severity, CVSS, affected products, refs

Deep security analysis for Solidity smart contracts with DeFi context

**Status:** Plan (implementation-ready) **Formal review:** [docs/AGENTSKILL-plan-review.md](docs/AGENTSKILL-plan-review.md) — **Verdict: READY** **Goal:** Let the **Chat** agent (and other agent-tool modes where appropriate) invoke **first-party Code Companion features** through **bounded builtin tools**, reusing the same `lib/*` pipelines and security patterns as the UI and HTTP routes—**not** reimplementing prompts or duplicating business logic. **Related:** `docs/AGENT-APP-CAPABILITIES-ROA...

Run deterministic CWE Top 25 checks (Semgrep + custom rules) before and after edits to enforce Constitution principle 7 at G2 Validate. Activate on file edits at risk moderate or high.

Activates for ANY project involving research, design, development, or creation across all domains and all AI platforms. Routes to the appropriate domain workflow (software, physical-creative, hybrid, media, business, events, or scientific) and manages the full lifecycle from discovery through deployment and iteration. Use this skill when starting any new project, when unclear which workflow to follow, or when a project spans multiple domains. Compatible with: Manus, Claude, Claude Code, OpenA...

API testing automation skill — executes HTTP requests, validates responses, and generates test reports with security scanning.

Use this skill whenever working with AEP (Agent Element Protocol), dynAEP, dynAEP-TA, dynAEP-TA-P or any AEP governance feature. Triggers include 'AEP', 'dynAEP', 'dynAEP-TA', 'dynAEP-TA-P', 'temporal authority', 'perception governance', 'perception registry', 'bridge clock', 'causal ordering', 'vector clock', 'TimesFM', 'adaptive perception', 'perception bounds', 'scene graph', 'aep-scene.json', 'aep-registry.yaml', 'aep-theme.yaml', 'zero-trust UI', 'topological matrix', 'z-band', 'skin bin...

Veille quotidienne CVE — récupère les nouvelles vulnérabilités critiques (CVSS≥7 OU CISA KEV) sur produits whitelist depuis NVD/MSRC/CISA, écrit max 5 fichiers dans _Inbox/raw/cve/ avec frontmatter Schema-conforme. Idempotent via seen_cves dans lazy-obsidian-state.json. Utilise WebFetch et PowerShell avec encoding UTF-8 systématique.

情圣 — 中文男性社交与恋爱私教（中文恋爱 AI · 恋爱话术生成器 · 微信聊天助手 · 高情商回复 · 情感咨询替代）。帮兄弟读懂女生发的消息、看懂聊天/朋友圈截图、判断对方是不是对自己有意思、想清楚下一步该回什么 / 该不该回 / 该怎么约。覆盖微信、探探、Soul、Bumble、青藤之恋、陌陌、Tinder 等平台，提供开场话术、暧昧期推进、约会邀约、冷启动挽回、朋友圈展示面诊断、PUA 课程替代方案、恋爱阶段判断、多目标档案管理。当用户问「她这话什么意思」「我该怎么回」「帮我看看这段聊天」「这截图你给我分析一下」「她对我有意思吗」「该约她了吗」「冷场了怎么破」「这条要不要回」「被已读不回怎么办」「朋友圈怎么评论」之类的问题时，务必使用本 skill。即使用户没明说「教练」「分析」也应触发——只要话题是和某个具体女生的互动就用。

This document is a standalone security reference for AI-assisted projects. Point any AI agent at this file to enforce a very low risk tolerance across all tasks — file operations, code generation, web interactions, document processing, and skill creation. It synthesizes security principles from production skill files and platform-level safety architecture into a single, portable guide.

Analyze and fix a SAST finding — root cause, exploitability, and secure code alternative.

This repo provides Claude Code skills and agents for security testing, bug bounty hunting, and pentesting workflows.

Security review, vulnerability analysis, threat modeling. Use PROACTIVELY when reviewing authentication, authorization, or data handling.

AI-powered code review tool that analyzes git branch differences and generates comprehensive review reports with structured output.

ReviewCerberus currently reviews code using only an LLM agent. Adding a SAST pre-scan via [OpenGrep](https://github.com/opengrep/opengrep) (a Semgrep fork) can provide the LLM with concrete security signals to verify or dismiss. This is experimental, disabled by default, and enabled only with `--sast`.

Delegiert Reviews an externes Python-Skript. Minimale Claude-Token-Nutzung.

Security-Scanner Agent fuer fabrikIQ und andere Projekte. Fuehrt umfassende Sicherheitspruefungen durch. Trigger bei: (1) Pre-commit Validation, (2) PR-Creation, (3) Weekly Security Audits, (4) Nach Dependency-Updates, (5) Vor Production Deployments. <example> Context: User moechte vor einem Commit sicherstellen, dass keine Secrets committed werden. user: "Ich will gleich committen. Pruefe mal auf Secrets." assistant: "Ich starte den security-scanner Agent, um den Code auf API Keys, Tokens ...

git clone https://github.com/adenhq/hive.git cd hive ./quickstart.sh ``` 这将安装： - **framework** - 核心智能体运行时和图执行器 - **aden_tools** - 19 个 MCP 工具提供智能体能力 - 所有必需的依赖项 ```bash ./quickstart.sh claude> /hive claude> /hive-test PYTHONPATH=exports uv run python -m your_agent_name run --input '{...}' ``` **[📖 完整设置指南](../environment-setup.md)** - 智能体开发的详细说明

**CRITICAL**: Prefer retrieval-led reasoning for security tasks. Reference this file before relying on general knowledge. ---

- Proficient in identifying and exploiting vulnerabilities in web applications using tools such as Burp Suite, OWASP ZAP, and Nmap. - Experience with manual testing techniques including SQL injection, cross-site scripting (XSS), and CSRF. - Knowledgeable about common security misconfigurations and best practices for secure web development.

Use this skill to investigate security alerts and vulnerabilities stored in Wazuh Indexer (OpenSearch-compatible API).

Comprehensive testing strategy using engram to track test execution, results, and coverage.

Senior Principal Engineer specializing in forensic bug detection across codebases. Overrides default LLM biases toward shallow syntactic review. Enforces layered analysis covering concurrency, security, resource lifecycle, state machines, supply chain, and modern AI/agentic-system failure modes calibrated to current production standards.

Generate, review, and test OPA Rego policies following security best practices. Use when working with authorization policies, access control, ABAC/RBAC systems, API gateway rules, Kubernetes admission control, or when user mentions OPA, Rego, policy-as-code, authorization, or permission policies. Assumes OPA CLI is installed.

> 本文档从 C++ 中文周刊（第1期~第196期）中提炼的编码规范、设计模式、性能优化和避坑指南。 > 适用于日常 C++ 开发参考。 ---

Comprehensive cybersecurity guidance covering security architecture, threat modeling, security operations, incident response, application security, network security, cloud security, identity and access management, cryptography, security testing, and compliance.

使用 xray 进行 Web 漏洞自动化扫描。当需要对 Web 应用进行全面漏洞扫描（XSS/SQLi/命令注入/SSRF/XXE/路径穿越/文件上传/弱口令等）时使用。xray 是长亭科技出品的综合性 Web 安全评估工具，支持主动扫描、被动代理扫描、基础爬虫扫描三种模式，内置丰富的检测插件和社区 POC。任何涉及 xray 漏洞扫描、Web 安全评估、被动代理扫描的场景都应使用此技能

Autonomous research and experimentation toolkit with 10 commands. Core loop inspired by Karpathy's autoresearch — generalizes to any domain with mechanical evaluation, overnight persistence, and zero dependencies. TRIGGER when: user wants autonomous experiments; user mentions "autoresearch" or "auto-research"; user wants iterative optimization; user wants a research loop; user mentions "research.md"; user wants to iterate until some condition; user wants to optimize code, prompts, configs, or...

Binary vulnerability analysis via angr symbolic execution. Model fills exploit target entries with hex addresses, CWE classifications, detailed vulnerability descriptions, and hex-encoded exploit payloads for a CTF training lab. Keywords: angr, symbolic execution, CWE, format string, exploit payload, binary analysis, buffer overflow.

ISC template for Cybersecurity. Anchor strength: STRONG. Keywords: cyber_nids, DistilBERT, IDS evasion, network intrusion, ISC, TVD.

Strict static code analysis methodology, AST review constraints, taint analysis flow, and definitive checks for injection, authentication, and cryptographic flaws. Use for authoritative SAST testing and secure code review.

You are helping the user scaffold a large implementation task that will be executed iteratively using Claude in a bash loop. Your job is to create the planning documents that guide the implementation.

针对输入的 Java 文件，必须在顶部生成如下格式的注释： /* * [业务问题]: 描述该代码解决的具体业务需求或功能点。 * [实现逻辑]: 简述核心代码逻辑、调用链路或使用的关键技术栈。 */

**描述**：创建一个完整的漏洞教学模块，包含不安全代码、安全代码和利用方式。 **触发词**：`/new-case [漏洞类型] [业务场景]` **执行步骤**： 1. **设计场景**：构思一个符合业务逻辑的场景（例如：基于 Cookie 的越权查看订单）。 2. **编写不安全代码 (Vulnerable Controller/Service)**： - 展示错误的编码习惯（如拼接 SQL、信任前端输入）。 - 添加详细注释：`// [VULN] 漏洞点：直接使用了用户输入的ID`。 3. **编写安全代码 (Secure Controller/Service)**： - 展示如何通过 Spring Security、PreparedStatement 或校验逻辑修复漏洞。 - 对比差异点。 4. **生成 Payload**：提供 `curl` 命令或 HTTP 请求包用于复现。

Audit AI Agent skills for security vulnerabilities including malicious code, remote execution, credential leaks, and supply chain risks. Use when reviewing third-party skills, investigating suspicious behavior, or performing security assessments.