Claude Skills by aibot88

Check AEM Edge Delivery Services page content against a brand style guide. Validates term usage, tone, capitalization, formatting rules, and terminology conventions. Supports style guides stored as EDS spreadsheets (spreadsheet-as-API pattern), documents, or inline rules. Use when enforcing brand consistency, onboarding new authors, or auditing content before publication.

Install @reopt-ai/brandapp-sdk in a consumer project. Sets up auth, OAuth client, EAV, API routes, and env config. Triggers on "brandapp-sdk install", "brandapp-sdk init", "brandapp sdk setup", "brandapp sdk bootstrap", "apply SDK", "brandapp integration".

Assess breach notification compliance — requirements by jurisdiction, SLA obligations

Red team engineering agent. Designs attack scenarios, builds threat models, applies MITRE ATT&CK/OWASP frameworks, runs Purple Team exercises, and performs AI/LLM red teaming. Use when adversarial security validation is needed.

Brev instance operating guidance for NeMo-RL agents working in /home/ubuntu/RL with limited workspace disk, a larger /ephemeral volume, and optional /home/ubuntu/RL/.env secrets. Use when running auto-research campaigns, experiments, training jobs, model or dataset downloads, shared cache-heavy commands, log-producing runs, checkpoint generation, W&B or Hugging Face authenticated workflows, or any workflow that may create large files on Brev.

PFLICHT vor jeder externen Aktion. Wird automatisch geladen wenn ein Agent mit externen Services interagiert, Browser-Aktionen durchfuehrt, Accounts verwaltet, APIs aufruft, Dateien auf fremden Systemen aendert, oder Credentials benoetigt. Erzwingt systematische Analyse VOR dem Handeln. IMMER laden wenn: Login, Signup, API-Call, Browser-Aktion, Deployment, Account-Management, DNS-Aenderung, Domain-Verwaltung, Payment, oder jede andere Interaktion mit der Aussenwelt.

Generate contextual briefings for legal work — daily summary, topic research, or incident response. Use when starting your day and need a scan of legal-relevant items across email, calendar, and contracts, when researching a specific legal question across internal sources, or when a developing situation (data breach, litigation threat, regulatory inquiry) needs rapid context.

Deploy Bright Data integrations to Vercel, Fly.io, and Cloud Run platforms. Use when deploying Bright Data-powered applications to production, configuring platform-specific secrets, or setting up deployment pipelines. Trigger with phrases like "deploy brightdata", "brightdata Vercel", "brightdata production deploy", "brightdata Cloud Run", "brightdata Fly.io".

Install and configure Bright Data SDK/CLI authentication. Use when setting up a new Bright Data integration, configuring API keys, or initializing Bright Data in your project. Trigger with phrases like "install brightdata", "setup brightdata", "brightdata auth", "configure brightdata API key".

Apply Bright Data security best practices for secrets and access control. Use when securing API keys, implementing least privilege access, or auditing Bright Data security configuration. Trigger with phrases like "brightdata security", "brightdata secrets", "secure brightdata", "brightdata API key security".

Store credentials once, then inject them into outbound agent requests at runtime so agents can call services without receiving raw secrets.

Improves graph coverage for a specific file with dynamic/unannotated patterns (event emitters, dynamic require, global injection). Use when dep-graph shows gaps on a file or when chat/query returns "not mapped". Not for querying — only for improving coverage.

Index local coding-agent sessions into a searchable SQLite-backed view so you can inspect usage, compare failures, and recover prior context quickly.

Probe a site's authentication flow for redirect leaks, missing CSRF, weak session cookies, and OAuth misconfiguration; produces an auth findings.md

Use when validating rendered web pages, local dev servers, browser automation, screenshots, forms, auth sessions, or UI evidence with strict browser safety boundaries.

Use this skill when you need to control a Chrome browser via CDP (Chrome DevTools Protocol) to reuse existing login sessions. Covers: launching Chrome in debug mode, opening URLs, waiting for page load, evaluating JavaScript, taking snapshots, and extracting auth tokens. Trigger phrases: browser automation, CDP, agent-browser, 浏览器操作, 操作浏览器, Chrome CDP, 复用登录态, extract token from browser.

Extract structured data via stored browser-templates or one-shot DOM queries, with mandatory AIDefence PII + prompt-injection gates before content reaches the model

Browse and visually inspect webpages using headless Chromium via Puppeteer MCP. Use when you need to see a page, interact with a web UI, extract information that WebFetch can't get (JS-rendered content, SPAs, authenticated pages), or when the user wants to show you something in a browser.

Drive an authentication flow once, sanitize cookies through AIDefence, and vault a reusable cookie handle in browser-cookies for future sessions

Collaborative headed browser session for UI work. Launch Playwright Chromium visible to the user, handle auth, then interactively drive the browser while the user watches and gives real-time visual feedback. Edit code and refresh to verify fixes live. Use when the user says 'browser pair', 'paired browser', 'let's look at this together', 'open chromium', or wants to iterate on UI with live visual feedback.

OrchestKit security wrapper for browser automation. Adds URL blocklisting, rate limiting, robots.txt enforcement, and ethical scraping guardrails on top of the upstream agent-browser skill. Use when automating browser workflows that need safety guardrails.

Set up browser automation and UI QA for a new repository using playwright-interactive as the primary interactive tool and agent-browser as the secondary CLI smoke-check tool. Use when a user wants to bootstrap browser testing, screenshots, auth-state reuse, or local UI debugging conventions in a fresh repo.

Bruno is an open-source, offline-first API client that stores collections as plain-text .bru files on your filesystem. It serves as a privacy-focused, git-friendly alternative to Postman and Insomnia with no cloud sync and no account required.

Activates for any bug bounty, penetration testing, or vulnerability research request. Triggers on: "start recon on [target]", "check for IDOR/SSRF/XSS on [endpoint]", "map attack surface for [domain]", "write a HackerOne/Bugcrowd report", "help me find vulns in this API", "create a PoC for this vulnerability", "enumerate subdomains", "scan for open ports", "chain these vulnerabilities", or any request involving ethical hacking, web/API security testing, red-teaming, or responsible disclosure....

When the user wants to find bugs, test edge cases, stress-test code, or perform adversarial analysis of their codebase. Use when the user says "find bugs," "break this," "what could go wrong," "red team," "hunt bugs," "adversarial test," "edge cases," "stress test," "what did I miss," "pen test this logic," or before any major release. Operates with red team psychology — assumes everything is broken until proven otherwise.

Author, scaffold, or review a Lollms Personality Structure (LPS) — the standard package format for lollms AI personas. Use this skill whenever the user wants to create a new lollms personality, write a SOUL.md, add tools or memory seeds to a personality, package a persona as a .lps archive, or understand how the LPS format works. Also trigger when the user asks about personality fields, SOUL.md sections, tool bindings, feature flags, or the lollms personality folder structure.

Uses the WordPress wp-rest-api skill to help an agent design, register, validate, and troubleshoot custom REST routes without skipping schema, auth, or permission_callback details. This is for agent-led endpoint work in plugins, themes, or core-adjacent codebases, not for browsing the WordPress REST API as a product catalog.

Author, validate, test, and troubleshoot Copilot Studio agents through YAML-driven commands instead of clicking through the product UI.

Mehrstufige CI/CD-Pipelines mit GitHub Actions entwerfen und implementieren — mit Matrix-Builds, Dependency-Caching, Artefaktverwaltung und Secret-Behandlung. Workflows erstellen, die Linting, Tests, Build und Deployment mit Parallelausfuehrung und bedingter Logik abdecken. Einsatz beim Einrichten automatisierter Tests und Deployments fuer neue Projekte, bei der Migration von Jenkins oder CircleCI zu GitHub Actions, beim Implementieren von Matrix-Builds ueber Plattformen hinweg, beim Hinzufue...

Produktionsreife Grafana-Dashboards mit wiederverwendbaren Panels, Template-Variablen, Annotationen und Provisioning fuer versionskontrolliertes Dashboard-Deployment erstellen. Verwenden, wenn visuelle Darstellungen von Prometheus-, Loki- oder anderen Datenquellen- Metriken benoetigt werden, operative Dashboards fuer SRE-Teams aufgebaut werden, von manueller Dashboard-Erstellung zu versionskontrolliertem Provisioning migriert wird oder Executive-Level-SLO-Compliance-Berichte eingerichtet werd...

Diagnose MSBuild build performance bottlenecks using binary log analysis. Only activate in MSBuild/.NET build context. USE FOR: identifying why builds are slow by analyzing binlog performance summaries, detecting ResolveAssemblyReference (RAR) taking >5s, Roslyn analyzers consuming >30% of Csc time, single targets dominating >50% of build time, node utilization below 80%, excessive Copy tasks, NuGet restore running every build. Covers timeline analysis, Target/Task Performance Summary interpr...

Build a SaaS web application using the Fireact framework (Firebase + React + TypeScript + Stripe). Triggers on "build a web app", "create a SaaS app", "scaffold SaaS application", "fireact app", "SaaS with auth and billing".

Author Sui Move modules and packages with a senior Move dev as your pair. Use when the user wants to write, build, author, add, or scaffold Move code, smart contracts, or Sui programs at the module or function level, in any phrasing.

Build secure API authentication systems with OAuth2, JWT, API keys, and session management. Use when implementing secure authentication flows. Trigger with phrases like "build authentication", "add API auth", or "secure the API".

Create API gateways with routing, load balancing, rate limiting, and authentication. Use when routing and managing multiple API services. Trigger with phrases like "build API gateway", "create API router", or "setup API gateway".

Build and modify EdgeSpark apps. Use when a project has edgespark.toml, the user mentions EdgeSpark, or work involves the edgespark CLI, server SDK types, storage/auth/database workflows, deployment, or @edgespark/web.

Execute use when constructing GitOps workflows using ArgoCD or Flux. Trigger with phrases like "create GitOps workflow", "setup ArgoCD", "configure Flux", or "automate Kubernetes deployments". Generates production-ready configurations, implements best practices, and ensures security-first approach for continuous deployment.

Builds bidirectional Streamlit Custom Components v2 (CCv2) using `st.components.v2.component`. Use when authoring inline HTML/CSS/JS components or packaged components (manifest `asset_dir`, js/css globs), wiring state/trigger callbacks, theming via `--st-*` CSS variables, or bundling with Vite / `component-template` v2.

Patrones de colas de tareas asíncronas con Bull/BullMQ en NestJS para producción. Usar PROACTIVAMENTE cuando se trabaje con jobs programados, recordatorios, notificaciones asíncronas, procesamiento en background, o cualquier tarea que no deba ejecutarse de forma síncrona en el ciclo de request/response. Activar siempre que aparezcan las palabras clave: Bull, BullMQ, @BullModule, @Processor, @Process, @OnQueueFailed, addJob, Queue, Worker, jobs, colas, tareas programadas, delayed jobs, recorda...

Procedures for Bun binary compilation, asset bundling strategies, virtual filesystem handling, build artifact packaging, multi-target compilation patterns, and binary entry point dispatch in Myco's build system. Use when compiling static binaries with Bun, managing package assets vs user files, resolving virtual filesystem paths, handling cross-platform builds, or debugging binary packaging issues, even if the user doesn't explicitly ask for Bun compilation help.

Integrate Bunny.net services (CDN, Storage, Stream, DNS, Edge Scripting, Shield, Magic Containers, Optimizer, Database). Use when building with Bunny.net APIs, deploying to Bunny CDN, uploading files to Edge Storage, managing video streaming, configuring DNS zones, writing edge scripts, setting up WAF/DDoS protection, deploying containers, or optimizing images. Triggers on "bunny", "bunnycdn", "b-cdn", "pull zone", "edge storage", "bunny stream".

Fact-check scientifique BYAN (Demonstrable, Quantifiable, Reproductible). Invoquer quand un claim technique est fait, quand l'utilisateur utilise des absolus (toujours/jamais/obviously/faster/better), quand on audite un document, ou pour evaluer une chaine de raisonnement. Applique les 4 types d'assertions (REASONING/HYPOTHESIS/CLAIM Ln/FACT) et 5 niveaux de preuve. Domaines stricts (security/performance/compliance) = LEVEL-2 minimum.

Create and maintain onboarding artifacts including file-level onboarding MDs and repo-level entity catalogs. Covers template, folder organization, section conventions, and metadata. Enforces strict 1-to-1 mapping for source files and one entity catalog per repo. Use this whenever creating new onboarding files, repo entity catalogs, or auditing existing onboarding artifacts for format compliance.

Performs comprehensive C/C++ security review for memory corruption, integer overflows, race conditions, and platform-specific vulnerabilities. Use when auditing native C/C++ applications, reviewing daemons or services for memory safety, or hunting integer overflow / use-after-free / race conditions in userspace code.

C2框架免杀方法论：分析 C2 源码、搜索检测规则(YARA/Sigma/Snort)、逐规则分析、修改源码绕过检测。当遇到 YARA/Sigma/Snort 规则触发告警、beacon/implant 被杀软检测到时使用。第一步：确认 implant/beacon 语言和架构；第二步：搜索对应检测规则并逐规则分析修改

Embed C2PA (Content Authenticity Initiative) provenance manifests in AI-generated marketing assets (image/video/audio/PDF). Use when: preparing AI-generated ad creative, social images, or video for EU markets to comply with EU AI Act Article 50 (applicable 2 Aug 2026); embedding visible AI-generation disclosure in assets; meeting brand-trust transparency requirements.

Expert guidance for Next.js Cache Components and Partial Prerendering (PPR). Use when implementing 'use cache' directive, configuring cache lifetimes with cacheLife(), tagging cached data with cacheTag(), invalidating caches with updateTag()/revalidateTag(), optimizing static vs dynamic content boundaries, managing 'use cache: private' for compliance scenarios, pass-through/interleaving patterns, GET Route Handler caching, debugging cache issues, and reviewing Cache Component implementations.

Warm the authoritative cache path first, then fan out cache-only readers in parallel so derived loaders never race stale state.

Bridge CAD, Mesh, and 3D Gaussian Splatting representations. Covers mesh↔3DGS conversion, surface extraction from Gaussians, CAD reverse engineering with 3DGS, B-rep/parametric reconstruction, and geometry processing pipelines. Analyzes 40+ methods at the intersection of structured geometry and neural rendering.

Caddy is a fast, extensible web server written in Go that provides automatic HTTPS via Let's Encrypt and ZeroSSL. It supports HTTP/1.1, HTTP/2, and HTTP/3, features a simple Caddyfile configuration format, a powerful JSON API for dynamic config, and serves as a production-grade reverse proxy with zero external dependencies.