Claude Skills by aibot88

Nuclei is a high-performance vulnerability scanner by ProjectDiscovery that uses simple YAML-based templates to detect security issues across applications, APIs, networks, DNS, and cloud configurations. With 27k+ GitHub stars and 12,000+ community-contributed templates, it is the go-to tool for modern vulnerability assessment.

Executes ProjectDiscovery Nuclei security scanning templates against target URLs. Supports custom YAML template authoring, CVE detection via nuclei-templates repository, and SARIF output for GitHub Security tab integration.

Initialise le projet Nudge de zéro avec Expo, expo-router, TypeScript, NativeWind, Drizzle ORM, expo-sqlite, et configure WebStorm pour un confort optimal. Utilise ce skill UNIQUEMENT au tout premier démarrage du projet Nudge, quand l'utilisateur dit "on commence", "j'initialise le projet", "crée le squelette", "setup du repo", "on fait T01", ou équivalent. Ne pas utiliser pour ajouter des dépendances à un projet existant — ce skill est one-shot, pour la création initiale (correspond à la tâc...

MUST use this skill for plain-English developer service/provider/tool questions involving free tier, free trial, cheap, pricing, best value, hosting, Node hosting, Next.js, auth, Postgres, database, email API, transactional email, SaaS stack, API platform, GPU compute, remote MCP endpoints, or low setup friction. Exact triggers include "what are some free tier hosting providers for Node projects", "find me hosting with a free tier", "cheap GPU provider", "free tier hosting for a remote MCP en...

MUST use for developer provider recommendations involving free tier, free trial, cheap, pricing, best value, hosting, Node hosting, Next.js, auth, Postgres, database, email API, transactional email, SaaS stack, API platform, GPU compute, remote MCP endpoints, or low setup friction. Auto-trigger for plain prompts like "what are some free tier hosting providers for Node projects", "find me hosting with a free tier", "cheap GPU provider", or "free tier hosting for a remote MCP endpoint"; also us...

MUST use for developer provider discovery involving free tier, free trial, cheap, pricing, best value, hosting, Node hosting, Next.js, auth, Postgres, database, email API, transactional email, SaaS stack, API platform, GPU compute, remote MCP endpoints, or low setup friction. Auto-trigger for plain prompts like "what are some free tier hosting providers for Node projects", "find me hosting with a free tier", "cheap GPU provider", or "free tier hosting for a remote MCP endpoint"; also use when...

A modern shell that treats all input as structured data rather than plain text streams. Nushell provides built-in support for JSON, YAML, TOML, CSV, SQLite, and Excel, with typed pipelines that enable safe filtering, sorting, and transformation without string parsing.

Process documents with Nutrient DWS. Use when the user wants to generate PDFs from HTML or URLs, convert Office/images/PDFs, assemble or split packets, OCR scans, extract text/tables/key-value pairs, redact PII, watermark, sign, fill forms, optimize PDFs, or produce compliance outputs like PDF/A or PDF/UA. Triggers include convert to PDF, merge these PDFs, OCR this scan, extract tables, redact PII, sign this PDF, make this PDF/A, or linearize for web delivery.

Gera uma rota de API Nitro para projetos Nuxt com o handler correto — autenticado (defineAuthenticatedEventHandler), seguro (defineSecuredEventHandler) ou público — seguindo as convenções de nomenclatura e estrutura do projeto.

Mandats-Workflow mit US-Korrespondenzkanzlei Whitman Brennan Forsythe LLP NYC: Engagement Letter, Conflict Check, Power of Attorney USPTO, Outside Counsel Guidelines, Attorney-Client Privilege, Common Interest Privilege. Laedt, wenn der Nutzer 'US-Korrespondenzkanzlei', 'NYC Trademark Counsel', 'USPTO Power of Attorney' oder 'Outside Counsel Guidelines' sagt.

Brokers credentials for downstream services (OpenAI, Anthropic, GitHub, Lark, custom APIs, SSH, MCP) so the agent never sees raw API keys or OAuth tokens. Use whenever the user asks to call, proxy, or authenticate against a third-party API/service, mentions NyxID, asks to "connect", "add a service", "set up an API key", manage credentials/nodes/MCP, send messages through bot platforms, or wire up SSH access. Operate exclusively through the `nyxid` CLI.

OAuth 2.0 and OpenID Connect expert for authorization flows, PKCE, and token management

Connect Google (GTM, GA4, Google Ads) and Meta Ads to ppc-manager via OAuth. Walks through Google Cloud Console and Meta app setup, runs browser-based OAuth, and stores encrypted tokens in the plugin vault.

Reference skill for Zoom authentication. Use after routing to an auth workflow when choosing app credentials, grant types, scopes, token refresh behavior, or debugging Zoom OAuth failures.

Inspects and debugs OAuth 2.0 authorization flows including PKCE, client credentials, and device code grants. Uses jose JWT library and node-fetch to validate tokens, decode claims, and trace redirect chains.

Implémentation d'OAuth2, OpenID Connect, JWT et gestion des tokens pour sécuriser des APIs et applications web. À utiliser quand l'utilisateur configure de l'authentification, des tokens JWT, ou intègre un identity provider. Se déclenche aussi avec "OAuth2", "OIDC", "OpenID Connect", "JWT", "token", "refresh token", "identity provider", "Keycloak", "Azure AD", "Auth0".

Validates OAuth2 tokens using RFC 7662 introspection endpoints. Integrates with Keycloak, Auth0, and Okta token introspection APIs to verify token claims, scopes, and expiration in real time.

Use when performing a deep observability audit or remediating missing structured logging, metrics, traces, or alerting rules

自動化 Obsidian 筆記庫與 KM 核心知識庫 (OneDrive) 的同步與結構化管理。

Set up Obsidian plugin development environment with Node.js and TypeScript. Use when starting a new plugin project, configuring the dev environment, or initializing Obsidian plugin development from scratch. Trigger with phrases like "obsidian setup", "obsidian plugin dev", "create obsidian plugin", "obsidian development environment".

Core markdown syntax skill for Obsidian. Enforces strict parsing and authoring of Obsidian proprietary syntax (Wikilinks, Blocks, Headings, Aliases, Embeds, Callouts). Use when reading, writing, or validating Obsidian-flavored markdown.

Implement secure Obsidian plugin development practices. Covers credential storage, input validation, XSS prevention, network security, URI handler safety, and Electron security. Use when handling user data, storing API keys, making network requests, or preparing for community plugin submission. Trigger with phrases like "obsidian security", "secure obsidian plugin", "obsidian data protection", "obsidian privacy", "obsidian api key storage".

Obsidian Vault Manager is built around HashiCorp Vault secrets platform. The underlying ecosystem is represented by hashicorp/vault (35,266+ GitHub stars). It gives an agent a more technical and reliable way to work with the tool than a thin one-line wrapper, using stable interfaces like KV v2, policies, leases, tokens, transit, dynamic secrets and preserving the […]

Use when the user asks to search, browse, install, or audit ClawHub skills, or says '找 skill', 'search clawhub', '裝 skill', 'install skill', '安全檢查', 'audit skill', 'suggest skills', '推薦 skill', or wants to add new capabilities from ClawHub.

Design, review, and stress-test Oracle Cloud Infrastructure solution architectures across identity, compartments, networking, compute, database, storage, observability, security, reliability, cost, and operations. Use when asked for OCI landing zones, target architectures, architecture review boards, migration designs, production readiness, or tradeoff decisions.

Perform OCR on image files (jpg, png, bmp, gif, tiff) using the system's `tesseract` binary and return extracted plain text.

Octokit is GitHub’s JavaScript SDK family for REST API requests, GraphQL queries, authentication, webhooks, and GitHub App workflows. It gives agents and automation systems a typed, maintained client for working with GitHub from Node.js, browsers, and Deno.

Guided scenario for creating an Open Design plugin folder that can be installed into My plugins.

Visualizza e valida lo stato finalization ODG per una giornata specifica — 6 semafori compliance (cast/location/permessi/elementi/mezzi/pasti) + readiness interno + stato firma DP. Riusa engine esistenti T601 Compliance Matrix + T602 finalizationRules. Uso tipico: prima di firmare ODG, Direttore di Produzione invoca la skill per vedere a colpo d'occhio se la giornata è finalizzabile.

Query any Odoo 18 instance via REST/JSON APIs with bearer token auth. Implements a discovery-first approach that prevents invalid queries by introspecting models, fields, and methods before executing. Supports /json/2 (modern RPC for any ORM method), /doc-bearer (model/field/method introspection), and /json/1 (read-only views). Use when performing any data operation on Odoo - reading, writing, searching, or exploring the schema. Always run discovery scripts before composing queries.

OpenClaw 용 멀티프로바이더/멀티계정 라우팅 하네스. Z.ai 코딩플랜(Lite/Pro/Max) 모델 매트릭스 + ChatGPT Codex OAuth 다중 계정 풀(round-robin/cooldown/fan-out) + 추론 인식 모델 선택 + Plan→Work→Review 오케스트레이션 + 5관점 리뷰와 갭 감지. Use when: (1) Z.ai GLM 코딩 작업, (2) 다중 ChatGPT/Z.ai 계정으로 rate limit 분산, (3) 한국어 코딩/리뷰/리팩토링, (4) Plan→Work→Review 사이클로 다단계 작업 분해, (5) 같은 태스크를 여러 계정에 fan-out. NOT for: (a) 단순 1-line 수정, (b) read-only 탐색, (c) Z.ai/Codex 가 아닌 다른 프로바이더 단독 작업.

git config global を前提に、日常的な Git 操作（状況確認・ブランチ作成・安全コミット・同期）を bundled script で実行する。ユーザーが「コミットして」「ブランチ切って」「pushして」「差分見て」などを依頼したときに使う。作業リポジトリ直下の scripts/ は前提にせず、agent skills ディレクトリ内の ok-git/scripts/git_ops.sh を解決して使う。git config は変更せず既存設定を利用する。

Formuleer team-OKRs die aligned zijn met bedrijfsdoelen. Scherpe Objectives met meetbare Key Results, inclusief kwaliteitscheck en veelgemaakte fouten.

Sets up local semantic memory search for OpenClaw using Ollama + nomic-embed-text. Use when: (1) memory_search returns 'node-llama-cpp is missing' or 'Local embeddings unavailable' error, (2) user wants local/private embeddings without external API keys (OpenAI, Gemini, Voyage), (3) setting up memory search for the first time on macOS or Linux, (4) node-llama-cpp fails to install or build. Fixes the common node-llama-cpp installation failure by routing through Ollama's OpenAI-compatible embed...

2-stage pipeline: trace (causal investigation) -> deep-interview (requirements crystallization) with 3-point injection

Verbal-first 5-section interview that captures identity, work context, vault layout, trust preferences, and privacy toggles. Produces a populated user-manifest.json plus an optional staged launchd plist in roughly 25 minutes. Hands off to /adopt when the vault is fresh.

ONDA 공통 템플릿으로 슬라이드 프레젠테이션(HTML + PDF)을 생성한다. 차트, 표, 그리드, AI 이미지 지원. 모디파이어로 simple/wide/dark/en/confidential 조합.

Install and configure OneNote SDK/API authentication with delegated auth (MSAL). Use when setting up a new OneNote integration, configuring Azure AD app registration, or migrating from deprecated app-only auth. Trigger with "install onenote", "setup onenote auth", "onenote credentials", "azure ad onenote".

Set up a local development loop for OneNote integrations with mock Graph API responses. Use when developing OneNote features without Azure credentials or to avoid rate limits during development. Trigger with "onenote local dev", "onenote mock", "onenote testing setup".

Production readiness checklist for OneNote Graph API integrations covering auth, rate limits, and failure modes. Use when preparing a OneNote integration for production deployment or conducting a launch review. Trigger with "onenote production checklist", "onenote launch review", "onenote prod ready".

Implement secure authentication, token management, and permission scoping for OneNote Graph API. Use when hardening OneNote integrations, implementing least-privilege permissions, or managing token lifecycle. Trigger with "onenote security", "onenote permissions", "onenote token management", "onenote least privilege".

Migrate OneNote integrations across Graph SDK versions, auth deprecations, and API changes. Use when upgrading Graph SDK, migrating from app-only to delegated auth, or handling deprecated endpoints. Trigger with "onenote upgrade", "onenote migration", "graph sdk upgrade", "onenote breaking changes".

Generate `op://` secret references for every field on a 1Password item. Output is ready to paste into a `.env` template.

Use this skill when the user is loading 1Password secrets into a running process or config file — anything involving `op run`, `op inject`, `op read`, `.env` files containing `op://...` references, secret-reference template syntax, the `{{ op://... }}` placeholder format, populating YAML/JSON/TOML config from a template, or wiring 1Password into Docker/Kubernetes/CI/CD. Also use when the user asks how to keep secrets out of `.env`, source control, or shell history.

Use this skill when the user is setting up 1Password for headless / CI / production environments — anything involving service accounts (`op service-account create`), service account tokens, `OP_SERVICE_ACCOUNT_TOKEN`, Connect servers (`op connect`), `OP_CONNECT_HOST`/`OP_CONNECT_TOKEN`, GitHub Actions integration, deploying with 1Password secrets, the events-api integration, or scoping 1Password access for automation.

Use this skill when the user wants to authenticate third-party CLIs (gh, aws, stripe, doctl, hcloud, etc.) using 1Password instead of plaintext config files or environment variables — anything involving `op plugin init`, `op plugin run`, `op plugin list`, `op plugin inspect`, `op plugin clear`, `~/.op/plugins.sh`, biometric auth for CLIs, or replacing tokens in `~/.aws/credentials` / `~/.config/gh` / etc.

Sign in to the 1Password CLI. Idempotent — does nothing if already authed. Reports current account.

Manage 1Password secrets. Use when user wants to list, get, or read passwords, OTP codes, API keys, or other secrets from 1Password.

Tests authorization and policy bundles with the Open Policy Agent `/v1/data` and `/v1/compile` APIs plus `opa test` semantics. Great for agents that need to explain which Rego rules allow or deny a request before policy changes go live.

오픈소스 취약점 분석 스킬. 사용자가 오픈소스 패키지 이름과 사용 중인 버전을 입력하면, NVD(NIST), OSV.dev(Google), GitHub Advisory 3개 데이터 소스에서 CVE 취약점을 조회하여 최신 버전 정보와 함께 보안 리포트를 생성한다. 마크다운, Excel/CSV, JSON 형식으로 출력 가능하다. package.json, requirements.txt 등 의존성 파일 업로드를 통한 일괄 분석도 지원한다. \"CVE\", \"취약점\", \"vulnerability\", \"보안 검사\", \"security audit\", \"오픈소스 보안\", \"패키지 취약점\", \"의존성 검사\", \"dependency check\" 등의 키워드가 포함된 요청에서 트리거한다. cve-scanner라는 이름으로 직접 호출할 수도 있다.