Claude Skills by aibot88

Browser automation security audit pack. Validates Playwright/Puppeteer headless configuration for dangerous arguments. 1 audit tool.

Ecosystem differentiation audit pack. MCP firewall, RAG pipeline, sandbox exec, context health, provenance tracking, cost analytics, and token budget optimization. 7 ecosystem tools.

Legal status analysis and corporate structuring pack. Legal form comparison, tax simulation, social protection analysis, governance structuring, and compliance checklist. 5 legal status tools.

Observability pipeline and CI audit pack. JSONL-to-SQLite trace ingestion and CI workflow validation. 2 observability tools.

Runtime environment and configuration audit pack. Validates Node.js version, secrets workflow, HTTP headers, allowed commands, trusted proxy, disk budget, and DM allowlist. 7 runtime security tools.

固件安全分析方法论。涵盖固件获取（从设备/下载/UART/JTAG）、固件解包与文件系统提取（binwalk/firmware-mod-kit）、静态分析（硬编码凭据/加密密钥/后门）、动态分析（QEMU 模拟）、漏洞挖掘、固件修改与重打包。当 Agent 需要分析嵌入式设备固件、提取固件中的敏感信息、或进行 IoT 设备安全评估时触发。

Fiscaliste IA pour la fiscalité personnelle des contribuables français. Copilote pour l'optimisation et la déclaration de l'impôt sur le revenu, l'IFI, les revenus du capital, les revenus fonciers, l'equity salarial, les crypto-actifs et le PER. Couvre le calcul de l'IR (barème progressif, quotient familial, décote, PAS, CEHR, revenus exceptionnels), la déclaration 2042 et ses annexes, les revenus du capital (PFU vs barème, PEA, assurance-vie rachats, dividendes, plus-values mobilières), les...

Systematically fixes all failing tests in a project by running test commands repeatedly until 100% pass with zero warnings. Use when tests are failing, validation is not passing, or when asked to fix test suites. Works with any testing framework (Jest, Pytest, Go test, etc.) and ensures complete test compliance without skipping or modifying tests.

Descompone un fix grande en porciones atomicas cuando el cambio es demasiado amplio para resolverse de una sola vez. Usa esta skill SIEMPRE que la skill fix-developer detecte que un fix supera los criterios de complejidad, o cuando el usuario mencione descomponer un fix, dividir un fix en partes, crear porciones de fix, o fix grande. La skill advierte al desarrollador, descompone el fix en porciones Front/Back, incluye una porcion de verificacion de regresion, y guarda todo en una carpeta de ...

Resuelve bugs, ajustes visuales, refactors y mejoras de comportamiento en el proyecto. Usa esta skill SIEMPRE que el usuario mencione fix, bug, error, no funciona, arreglar, corregir, ajustar, modificar comportamiento, o cuando describa algo que no está funcionando como se espera o quiere cambiar algo puntual del código existente. La skill entiende el problema, analiza el impacto, propone la solución mínima necesaria, espera confirmación y recién implementa.

Load a GitHub issue, create an isolated worktree, plan the implementation, and submit a PR. Use when asked to fix, implement, or work on a GitHub issue by number. Requires the gh CLI to be authenticated.

Fix all guardrail findings (make lint, make test, make sast) across repositories. Use when the user asks to fix linting errors, test failures, SAST findings, or run the full guardrail remediation workflow.

Verifies that git commits address security audit findings without introducing bugs. This skill should be used when the user asks to "verify these commits fix the audit findings", "check if TOB-XXX was addressed", "review the fix branch", "validate remediation commits", "did these changes address the security report", "post-audit remediation review", "compare fix commits to audit report", or when reviewing commits against security audit reports.

Attempt to fix a security issue tracked in <tracker> by implementing the change in a public <upstream> PR. Runs the sync-security-issue skill first to reconcile the issue's state, then analyses the discussion to decide whether the issue is easily fixable (clear consensus, small scope, known location). If it is, proposes an implementation plan, waits for explicit user confirmation, writes the change in the user's local <upstream> clone, runs the local checks and tests, opens a PR from the user...

Use this skill only when the user explicitly selects security finding IDs to fix. Do not use it to fix all findings or perform broad refactors.

Fix Dependabot security vulnerabilities in Java/Gradle projects using severity-based processing, dependency substitution strategies, and dependency graph verification. Use when Dependabot alerts need resolution with proper CI validation.

バグ修正→コンパイル確認→回帰テスト→失敗時 revert の安全修正パイプライン。修正が新たなバグを生まないことを機械的に保証する。USE WHEN 単発バグ修正、影響範囲が見えにくい変更、リファクタの安全確認。SKIP 大規模機能追加は impl-orchestrator、セキュリティ Finding 一括修正は robust-fix、仕様整合性回復は spec-fix を使うこと。

Use when CI is failing on a branch, PR, or specific Buildkite build and the user wants to iteratively fix it through verify-locally → push → check → iterate. Strong signals: "fix CI", "make CI green", "CI is failing", "tests are failing in Buildkite", "iterate on this build", a Buildkite build URL paired with intent to push fixes, a PR with a red check the user wants to make green, or repeat-push debugging. Covers verify-fix-locally workflows (rspec, jest, lint, type checking before pushing),...

Hard-won, cross-project lessons from building, deploying, and operating Flare-family (Flare / Songbird / Coston2) dApps. Use this skill whenever the user is: deploying or interacting with a Flare/Songbird/Coston2 contract, building a frontend with RainbowKit + Wagmi for Flare chains, writing Foundry fork tests against Flare-family state, claiming or rotating FTSO reward redistributors, debugging a stuck or silently-failing transaction, choosing RPC endpoints for browser vs server use, or trou...

Security-first checklist for Flare-family contract design, deployment, and audit. Covers both (1) GENERIC EVM security patterns the user must apply by default — Ownable2Step over Ownable, ReentrancyGuardTransient, SafeERC20, CEI, custom errors, no tx.origin, bounded loops, pull-over-push, immutable for constructor values — and (2) FLARE-SPECIFIC overlays that the generic audit skills don't catch: Permit2 chain availability, fee-on-transfer detection, blacklistable stablecoin surface, FTSO red...

Procesa las herramientas e instrucciones de flasheo de un repositorio de fabricante y crea guías interactivas paso a paso para flashear firmware en microcontroladores ESP32 sin errores. Activa cuando el usuario menciona: flashing, grabación, firmware upload, bootloader, esptool, flash download tool, COM port, serial port, firmware update, burn firmware, grabar firmware, ESP32 flash, boot mode, download mode, UART download, grabar dispositivo, flashear, o cuando un estudiante necesita instrucc...

Build Python web apps with Flask using application factory pattern, Blueprints, and Flask-SQLAlchemy. Prevents 9 documented errors including stream_with_context teardown issues, async/gevent conflicts, and CSRF cache problems. Use when: creating Flask projects, organizing blueprints, or troubleshooting circular imports, context errors, registration, streaming, or authentication.

Analyze fleet maintenance programs for preventive maintenance scheduling effectiveness, parts inventory forecasting, vehicle downtime minimization, total cost of ownership modeling, and telematics integration. Covers DOT annual inspections, FMCSA DVIR requirements, ELD mandate compliance, condition-based maintenance from fault codes, PM compliance rates, and TCO replacement analysis.

Deploy payloads and shell commands fleet-wide using reliable tasking. Execute scripts, collect data, or run commands across all endpoints with automatic handling of offline sensors. Use for vulnerability scanning, data collection, software inventory, compliance checks, or any fleet-wide operation.

Analyze fleet safety programs including driver behavior scoring, accident trend analysis, CSA BASIC score monitoring, DOT audit readiness, Hours of Service compliance, and drug and alcohol testing programs. Covers telematics event review, dashcam AI classification, preventability determinations, roadside inspection management, and risk mitigation ROI per FMCSA regulations and CSA methodology.

Deploy a Flet web app to Azure Container Apps — covers all pitfalls: container startup, WebSocket transport, GHCR auth, ACA provisioning, revision forcing, and health diagnosis

Implement data handling for Flexport supply chain data including PII redaction, shipment data retention, GDPR compliance, and secure document management. Trigger: "flexport data handling", "flexport PII", "flexport GDPR", "flexport data retention".

Install and configure Flexport API authentication with API keys or OAuth credentials. Use when setting up a new Flexport logistics integration, configuring bearer tokens, or initializing the Flexport REST API client for shipment and supply chain operations. Trigger: "install flexport", "setup flexport", "flexport auth", "flexport API key".

Apply Flexport API security best practices including webhook signature verification, API key rotation, and least-privilege access patterns. Trigger: "flexport security", "flexport webhook signature", "secure flexport API key".

Orchestrate compliance validation workflow with requirements mapping, audit evidence collection, gap analysis, remediation tracking, and attestation

Use when deploying Flow metadata across environments and worrying about activation order: which flow version becomes active, how paused interviews survive deploys, and how to avoid the 'two active versions for a moment' race. Covers SFDX / Metadata API deploy flags, 'Deploy as Active', rollback, and paused-interview safety. Does NOT cover Flow authoring best practices (see flow-bulkification) or general release management.

Fix ESLint issues in migrated Output SDK code. Use when seeing lint errors after migration, or when writing new Output SDK code that needs to follow project conventions.

Author NULL-safe, type-correct, performance-aware Formula resources and condition expressions in Flow: lazy re-evaluation, BLANKVALUE/ISBLANK guards, ISPICKVAL vs =, VALUE/TEXT/DATETIMEVALUE coercion, time-zone differences between TODAY/NOW, and the 5,000-character formula limit. NOT for record-level formula fields on objects — see admin/formula-fields. NOT for Validation Rule formulas (different runtime context) — see admin/validation-rules.

Use when reviewing or authoring Flow logic that contains a Loop element — covers DML-in-loop / SOQL-in-loop refactors, the collect-then-DML idiom, nested loops, and loop-free alternatives (Collection Filter, Transform, Get-with-criteria). Triggers: 'DML inside flow loop', 'Get Records inside loop element', 'Update Records in loop blowing governor limits', 'nested loop in flow', 'Subflow in loop'. NOT for general collection processing semantics (see flow-collection-processing) and NOT for end-...

Interview user in-depth about an epic, task, or spec file to extract complete implementation details. Use when user wants to flesh out a spec, refine requirements, or clarify a feature before building. Triggers on /flow-next:interview with Flow IDs (fn-1-add-oauth, fn-1-add-oauth.2, or legacy fn-1, fn-1.2, fn-1-xxx, fn-1-xxx.2) or file paths.

Create structured build plans from feature requests or Flow IDs. Use when planning features or designing implementation. Triggers on /flow-next:plan with text descriptions or Flow IDs (fn-1-add-oauth, fn-1-add-oauth.2, or legacy fn-1, fn-1.2, fn-1-xxx, fn-1-xxx.2).

Execute a Flow epic or task systematically with git setup, task tracking, quality checks, and commit workflow. Use when implementing a plan or working through a spec. Triggers on /flow-next:work with Flow IDs (fn-1-add-oauth, fn-1-add-oauth.2, or legacy fn-1, fn-1.2, fn-1-xxx, fn-1-xxx.2).

Manage .flow/ tasks and epics. Triggers: 'show me my tasks', 'list epics', 'what tasks are there', 'add a task', 'create task', 'what's ready', 'task status', 'show fn-1-add-oauth'. NOT for /flow-next:plan or /flow-next:work.

Decide and audit the security boundary a Flow runs at — System Context With Sharing, System Context Without Sharing, or User Context — plus the per-element runInMode override and the implications for sharing rules, FLS, CRUD, and $User/$Profile/$Permission merge fields. NOT for Apex sharing keywords (see apex/with-without-sharing-and-context). NOT for record-access troubleshooting at the user level (see security/record-access-troubleshooting).

Orchestrate continuous security validation, threat modeling, vulnerability management, and security gate enforcement across SDLC phases

Trace data flow across files from source to sink. Use for cross-file taint analysis, understanding how user input reaches dangerous sinks, and documenting vulnerability paths.

FlowMVI usage guidance. Use when working with FlowMVI stores/containers, plugin pipelines, composing stores, decorators, or authoring plugins.

Debug failing Power Automate cloud flows using the FlowStudio MCP server. The Graph API only shows top-level status codes. This skill gives your agent action-level inputs and outputs to find the actual root cause. Load this skill when asked to: debug a flow, investigate a failed run, why is this flow failing, inspect action outputs, find the root cause of a flow error, fix a broken Power Automate flow, diagnose a timeout, trace a DynamicOperationRequestFailure, check connector auth errors, re...

Govern Power Automate flows and Power Apps at scale using the FlowStudio MCP cached store. Classify flows by business impact, detect orphaned resources, audit connector usage, enforce compliance standards, manage notification rules, and compute governance scores — all without Dataverse or the CoE Starter Kit. Load this skill when asked to: tag or classify flows, set business impact, assign ownership, detect orphans, audit connectors, check compliance, compute archive scores, manage notificati...

**Pro+ subscription required.** Tenant-wide Power Automate flow health monitoring, failure rate analytics, and asset inventory using the FlowStudio MCP cached store. Load this skill ONLY for tenant-wide aggregated views — not for listing flows in a single environment or debugging a specific run (use power-automate-mcp or power-automate-debug for those). Not the same as the server's `monitor-flow` tool bundle (`tool_search query: "skill:monitor-flow"`) — that bundle is for runtime control of a...

中文优先：用于FlutterDart代码审查相关任务，帮助识别、设计、实现或验证对应工作流。English keywords: Library-agnostic Flutter/Dart code review checklist covering widget best practices, state management patterns (BLoC, Riverpod, Provider, GetX, MobX, Signals), Dart idioms, performance, accessibility, security, and clean architecture.

Local database and persistence selection for Flutter including SharedPreferences, SecureStorage, Hive, and Drift. Use when implementing offline storage, encrypted data persistence, or choosing between key-value and relational local databases.

Use when integrating a design system, theming, the component library, accessibility posture, the internationalization seam, or permission-request UX into a Flutter application after the app scaffold exists and mobile architecture is approved or intentionally deferred. Produces the token and theming layer extending the scaffold's ThemeData placeholder, a composed component library, the accessibility posture from mobile-architecture.md (screen reader, dynamic text, reduced motion, contrast, tou...

Complete guide for using drift database library in Flutter applications. Use when building Flutter apps that need local SQLite database storage with type-safe queries, reactive streams, migrations, and efficient CRUD operations. Includes setup with drift_flutter package, StreamBuilder integration, Provider/Riverpod patterns, and Flutter-specific database management for mobile, web, and desktop platforms.

Implements declarative Flutter routing using GoRouter v17 with URL-based navigation, deep linking, and authentication guards. Activates when configuring GoRoute path patterns, setting up StatefulShellRoute for persistent bottom navigation state, implementing ShellRoute for shared nested layouts, adding redirect guards with loop prevention (idempotent redirects), configuring deep links for iOS (FlutterDeepLinkingEnabled) or Android (intent-filters), debugging redirect loops or navigation stack...