Claude Skills by aibot88

Use when designing, reviewing, or hardening Terraform remote state and secret handling after the repo/module scaffold exists and security and infrastructure-platform have decided the state-isolation and secret posture. Produces remote state backend selection (S3+DynamoDB / GCS / Azure Storage / Terraform Cloud), state encryption at rest, state locking, workspace-vs-directory state isolation strategy, sensitive-output discipline, secret references to a secret manager instead of plaintext, and ...

Analyzes Terraform state files and plan outputs to detect drift, orphaned resources, and dependency cycles. Uses the Terraform CLI state commands, tfsec for security scanning, and Infracost API for cost impact analysis.

Authoritative Tesseron documentation lookup via the `@tesseron/docs-mcp` MCP server. Calls `search_docs` to find relevant pages and `read_doc` to fetch the full markdown body when the user asks precision questions about Tesseron protocol or SDK behaviour. Triggers on requests that need an exact spec, not an overview — wire format (JSON-RPC envelopes, `tesseron/hello`, `tesseron/welcome`, `tesseron/resume`, `actions/progress`, `actions/cancel`), transport framing, handshake and claim-code flow...

[Tier 2 — Non-Functional: Usability · ISO 25010] Accessibility test workflow — WCAG 2.1 AA compliance via axe-core + Playwright. Creates tests if missing, augments if exists. Run after Tier 1 functional tests pass.

Test how tool-gates evaluates any tool invocation (Bash, Read, Write, Edit, Glob, MCP) and show the permission decision (allow / ask / deny / defer). Pipes a synthesized JSON payload to the tool-gates binary and formats the result. Useful for verifying a new gate, debugging why a command was blocked, or distinguishing 'tool-gates explicitly asks' from 'tool-gates lets CC handle it'. NOT for approving a pending permission (use tool-gates:review) or editing rules manually (use update-config).

Use when reviewing, designing, triaging, or rationalizing test suites — unit, integration, e2e/UI, exploratory, property-based, contract, snapshot, mutation, or performance tests. Trigger for flakiness triage, false-pass risk, brittleness on refactor, suite pruning, test-pyramid/trophy decisions, exploratory charters, and snapshot review. Routes by activity (triage / review / author / strategize / prune) and layer.

Generates test files, creates mocking strategies, analyzes code coverage, designs test architectures, and produces test plans and defect reports across functional, performance, and security testing disciplines. Use when writing unit tests, integration tests, or E2E tests; creating test strategies or automation frameworks; analyzing coverage gaps; performance testing with k6 or Artillery; security testing with OWASP methods; debugging flaky tests; or working on QA, regression, test automation,...

Evaluate test suites for coverage gaps and TDD/BDD compliance.

[Tier 2 — Non-Functional: Security · ISO 25010] Security test workflow — OWASP Top 10, dependency CVEs, secrets scanning, and auth testing. Run after Tier 1 functional tests pass.

Enforces dependency injection, pure functions, observable state, and seam-based design

TestCafe is a Node.js-based end-to-end browser testing framework by DevExpress that requires no WebDriver installation. It supports all major browsers, automatic waiting, live mode for rapid development, and both JavaScript and TypeScript test authoring.

Principes et outils de chaos engineering pour tester la résilience des systèmes distribués, incluant fault injection et game days. Se déclenche avec "chaos engineering", "Chaos Monkey", "fault injection", "résilience", "Litmus", "game day"

Compliance control testing and evidence collection.

Instrukce pro návrh pytest testů pro Python kód. MUSÍ být použity při analýze testovacího pokrytí — happy path, edge cases, error cases, security regrese, fixtures.

Summarise a chunk of text down to roughly `length` words using the agent's configured LLM provider. Input shape `{ text: string, length?: number }` on stdin, JSON; output shape `{ summary: string }` on stdout, JSON. Minimal: ~50 lines, no streaming, no retries — a deliberate baseline so the wiring is visible. For a production summariser, fork this and add retries, prompt-injection sanitisation, length validation, and per-model cost tracking.

Teya payment integration guide covering POSLink (cloud-based terminal integration), All-In-One (single-device Android), E-Commerce APIs (hosted checkout, payment links), and Payments Gateway. Includes decision trees, authentication patterns, test cards, and certification guidance.

TeyvatGuide 项目 SKILL。处理 Vue+Tauri+TypeScript 项目开发，包括组件开发、API 集成、SQLite 操作或代码规范。

triflux 전용 릴리즈 자동화. 기존 scripts/release/* 래퍼 + AskUserQuestion 기반 버전 선택 + CHANGELOG 편집 게이트 + Co-Authored-By/AI trailer 금지 강제. 'ship', '배포', '릴리즈', 'release', 'tfx-ship', 'publish' 같은 요청에 반드시 사용.

Use this skill for any task involving Thai government letters, official correspondence, formal petitions, authorization letters, leave requests, or ราชการ forms. Trigger whenever the user asks to: write หนังสือราชการ, draft a คำร้อง, write an authorization (หนังสือมอบอำนาจ), submit a leave form (ใบลา), petition a government agency, or write a formal letter to a Thai official. Also trigger for requests like "เขียนหนังสือราชการ", "ยื่นเรื่อง", "คำร้อง", "หนังสือถึงราชการ", "ทำหนังสือถึง", "ใบลา...

Use this skill for tasks involving Thailand's PDPA (พ.ร.บ. คุ้มครองข้อมูลส่วนบุคคล พ.ศ. 2562). Trigger whenever the user asks to: draft a Thai privacy notice, write a PDPA consent banner, prepare a data subject rights notice, draft a 72-hour breach notification to the PDPC, decide if a DPO is required, list lawful bases, handle cross-border transfers, or audit a notice against PDPA. Also trigger for "เขียน privacy policy", "PDPA", "ขอความยินยอม", "นโยบายความเป็นส่วนตัว", "consent banner ไทย",...

Guía de desarrollo para el proyecto The Center (e-commerce Flask + React). Usar al implementar features, auth, API, estilos o cuando se pregunte por convenciones del proyecto.

Knowledge router AND interactive teacher across every book-derived skill in this project. Two modes — (1) **ask**: auto-discovers all domain skills (finance, vuln hunting, AI security, red-teaming, personal growth, ...), picks the relevant ones, invokes them in parallel as focused subagents, and synthesises one comprehensive cross-domain answer; (2) **walk**: proposes a curriculum and walks the user through it interactively — one concept at a time, taught from the source chapters, then quizze...

theHarvester is an open-source OSINT tool for gathering emails, subdomains, hosts, employee names, open ports, and banners from public sources. Used during reconnaissance in penetration testing and red team assessments, it queries search engines, PGP key servers, the Shodan API, and other data sources to map an organization's external threat surface.

Constrói teoria da mudança (insumos → atividades → resultados → impactos) e deriva indicadores de monitoramento com desagregações por grupo vulnerabilizado. Para planejamento de políticas, programas e projetos de impacto social.

Evaluate therapy outcome measurement systems for rehabilitation and physical therapy. Analyzes functional improvement scoring (MCID, MDC, risk-adjusted residuals), treatment effectiveness comparison by therapist, diagnosis, and facility with case-mix adjustment, discharge readiness prediction (plateau detection, visit utilization trending), patient satisfaction correlation with clinical outcomes, and quality reporting compliance (CMS MIPS, CARF accreditation) using FOTO, AM-PAC, OPTIMAL, DASH...

Evaluate physical therapy personalization and adaptive treatment systems. Analyzes exercise recommendation algorithms (rules-based, collaborative filtering, protocol-driven), contraindication enforcement and safety checks, difficulty progression logic (multi-parameter advancement with regression pathways), patient compliance prediction models, home exercise program (HEP) generation and delivery workflows, video/image exercise library quality and accessibility, and outcome-driven treatment pla...

Deliberately attack your own plans, systems, and assumptions to find weaknesses before adversaries or reality does. Use for security review, architecture validation, plan stress-testing, and pre-launch preparation.

Scans and analyses third-party dependencies and IaC configurations for security vulnerabilities. - User asks to scan dependencies, libraries, or third-party components - User mentions "thirdit", "SCA", "dependencies", "vulnerable libraries", "CVE" - User wants to check IaC files (Dockerfiles, Kubernetes manifests, cloud configs) - User asks "what third-party vulnerabilities do I have?"

Generate a personalized threat advisory based on your tech stack — what CVEs, breaches, and supply chain attacks matter to YOU.

Daily threat-intel digest — AI-discovered vulnerabilities, AI-in-the-wild exploitation observations, AI-authored malware families, exploit-trends rollup, vendor-trends month-over-month deltas. Use when producing a weekly security newsletter, scanning for novel threats, monitoring vendors with rising CVE counts, or tracking AI-discovered vulns from the researcher leaderboard.

Generate a threat model from spec.md using STRIDE methodology. Use when you need to identify security threats, attack surfaces, and mitigations for a feature before implementation. Triggers on "threat model", "security analysis", "attack surface", "STRIDE analysis".

Produces structured threat models for software systems using STRIDE on data flow diagrams. Generates DFDs with trust boundaries, identifies threats per element, scores risks, and defines concrete mitigations. Outputs a complete threat model Markdown document through phased, interactive delivery. Use when threat modeling a system, analyzing security threats, identifying attack surfaces, performing STRIDE analysis, assessing security risks in architecture, creating a threat model document, or w...

Discover a codebase's threat surface through systematic investigation — map ecosystem groups, dependency graphs, service connections, authentication mechanisms, and trust boundaries. Use when performing threat modeling, security review, or architectural analysis of any multi-ecosystem repository.

Analyze cybersecurity threat intelligence, triage security alerts, classify IOCs, map attacks to MITRE ATT&CK kill chain, reduce false positives, and attribute threat actors. Covers SIEM tuning, threat feed quality, detection coverage gaps, Diamond Model analysis, and strategic threat assessments for SOC and incident response teams.

Routed by tia-openness-roadmap. C# Openness implementation of PLC software engineering: program blocks, system blocks, PLC tags and tag tables, user data types, external sources, watch and force tables, technology objects, software units, know-how protection, SafetyAdministration, PLC online/offline control, download, upload, compare-to-online, PLC compile, PLC import/export, master secret, and certificate/security services.

Routed by tia-openness-roadmap. C# Openness implementation of project and portal lifecycle: opening, attaching, creating, archiving, retrieving, saving, copying, closing, deleting projects, project server sessions, transactions, exclusive access, UMAC/UMC, project library entry points, project-level CAx exchange, authentication events, project history, language settings, diagnostics, and advanced multiuser/VCI workflows.

Mechanical documentation hygiene. Spawns a doc-maintainer agent to audit all project documentation and fix correctness, completeness, freshness, and consistency issues autonomously within its authority. Surfaces anything requiring user judgment for approval.

Security auditing and hardening for OpenClaw and system infrastructure.

Use when the user works with the `tissue` CLI (shikorism.net / Tissue). Triggers on requests to check in, list/search checkins, manage collections or collection items, view tag stats, fetch user info, or configure authentication (`tissue configure`, `tissue checkin`, `tissue collection`, `tissue me`, `tissue search`, `tissue tags`). Also applies when discussing the `cmd/tissue` reference CLI in this repository or debugging its behavior.

Replay Titan bridge or console events into inspectable state without granting runtime authority to the replay result. Use when a Titan service-cohort route needs this explicit bounded step. Do not use for hidden background agents, silent mutation, unreviewed proof sovereignty, or memory canonization without owner confirmation.

Initialize or update Titan Memory Loom records as candidate memory with source refs, confidence, and authority warnings. Use when a Titan service-cohort route needs this explicit bounded step. Do not use for hidden background agents, silent mutation, unreviewed proof sovereignty, or memory canonization without owner confirmation.

Retrieve Titan candidate memory records with source, record id, authority note, confidence, and verification path. Use when a Titan service-cohort route needs this explicit bounded step. Do not use for hidden background agents, silent mutation, unreviewed proof sovereignty, or memory canonization without owner confirmation.

Analyzes TLS certificate chains using OpenSSL s_client and the crt.sh Certificate Transparency API. Detects weak algorithms, expiring intermediates, and CT log compliance issues.

Validates TLS/SSL certificate chains using OpenSSL x509 verification and checks OCSP stapling status. Integrates with Let's Encrypt ACME protocol for automated certificate renewal alerts and CT log monitoring via crt.sh API.

Design the target AWS architecture — ECS Fargate / EKS / Serverless choice, VPC topology with public-private-isolated subnets, managed database selection (RDS/Aurora/DynamoDB), IAM boundaries, and observability baseline (CloudWatch, X-Ray, Langfuse). Produces to-be-architecture.md with Mermaid diagram and compliance matrix. Use after modernization-strategy is approved.

Install Together AI SDK and configure API key for inference and fine-tuning. Use when setting up Together AI, configuring the OpenAI-compatible API, or initializing the together Python package. Trigger: "install together, setup together ai, together API key".

Together AI security basics for inference, fine-tuning, and model deployment. Use when working with Together AI's OpenAI-compatible API. Trigger: "together security basics".

Analyze current Claude Code session token usage via Splunk. Shows per-model, per-tool, and subagent token breakdown with cache efficiency metrics.

Keep compaction budgets under control by compacting incrementally and reinjecting truncated attachments only when the reasoning surface remains stable.

Use this skill when the user wants to launch a fungible token on Solana (SPL or Token-2022), set metadata, mint supply, revoke authorities, and optionally add liquidity on Raydium/Meteora/Orca.