Claude Skills by yanacuti1121

Single-integration-point memory orchestrator — delegates to multiple providers, one external allowed, background async sync so slow providers never block a turn. Lifecycle hooks for compression/session-switch. Source: NousResearch/hermes-agent (MIT).

Scrub <memory-context> tags from LLM streaming output before displaying to UI — prevents internal memory blocks leaking into user-visible text. Stateful across chunk boundaries. Source: NousResearch/hermes-agent (MIT).

Build system prompts in three tiers — stable (identity+tools, prefix-cache-friendly), context (session CWD files), volatile (memory+date-only) — to maximize upstream prompt cache reuse across turns. Source: NousResearch/hermes-agent (MIT).

Yana AI-native (not hermes-agent-derived — see Provenance correction below) command allowlist + approval-gate pattern for safe tool execution. Block dangerous commands by default, prompt for approval on risky ones, auto-deny in non-interactive subagents. Complements YAMTAM's safe-run.sh at the agent decision level. Distinct from [[hermes-tool-loop-guard]], which detects within-turn tool-call failure loops.

Detect and stop within-turn tool-call failure loops and no-progress idempotent loops. Three detectors — exact failure (same tool+args), same-tool failure, no-progress (idempotent returns same result N times). Warn-first, hard-stop opt-in. Source: NousResearch/hermes-agent (MIT).

Web UI 3-panel cho AI agent — sessions, chat, file browser. Python + vanilla JS, không framework. Reference architecture cho YAMTAM IO web mode.

Teaches the AI to design like a high-end agency. Defines the exact fonts, spacing, shadows, card structures, and animations that make a website feel expensive. Blocks all the common defaults that make AI designs look cheap or generic.

High-performance data processing patterns from 5 repos. O(n log n) array algorithms, lazy evaluation chains, statistical computation on raw data, streaming JSON parsing for large files, and concurrent async queue management. Sources: d3/d3-array, lodash/lodash, simple-statistics/simple-statistics, vitorperes/json-stream, sindresorhus/p-queue.

Build active deception infrastructure for agent swarms. Honey-vault canary tokens, ghost file-system with inotify monitoring, decoy agent prompts on the Swarm Bus, and dynamic quarantine on trip detection.

Pattern guide for writing PreToolUse hooks that block dangerous shell commands. Use when: building or auditing a guard-destructive hook, adding new blocked patterns, reviewing what the current hook covers. Covers 3 safety levels (critical/high/strict) and 58+ regex patterns. Inspired by: karanb192/claude-code-hooks block-dangerous-commands pattern (MIT).

Pattern guide for writing PreToolUse hooks that block secret file access, credential exfiltration, and environment variable dumps. Use when: auditing token-scope-guard.sh, adding new sensitive file patterns, reviewing what secret paths are protected. Covers 33 file patterns + 24 bash patterns + 15 exfiltration patterns. Inspired by: karanb192/claude-code-hooks protect-secrets pattern (MIT).

This skill should be used when the user asks to create a hookify rule, write a hook rule, configure hookify, add a hookify rule, or needs guidance on hookify rule syntax and patterns.

Custom-allowlist XSS filtering with fine-grained tag and attribute control. leizongmin/js-xss whitelist configuration, attribute value sanitization, CSS sanitization, and protocol filtering. Sources: leizongmin/js-xss.

Hierarchical Task Network planning (provably correct plans via symbolic decomposition + LLM fallback) and AlphaEvolve evolutionary code search (fitness-gated genetic algorithm). ChatHTN 2025 hybrid, AlphaEvolve DeepMind 2025. Sources: rohitg00/ai-engineering-from-scratch (Apache-2.0).

HTTP client with authentication, retry, progress, and request pipeline patterns. superagent bearer token injection, multipart uploads, response validation, and timeout enforcement for agent API calls. Sources: ladjs/superagent.

HTTP/HTTPS proxy interception for agent network traffic. Trap outbound requests, inspect headers/bodies, enforce domain allowlists, inject auth tokens, and block SSRF targets. Sources: http-party/node-http-proxy.

HTTP/HTTPS tunneling and SOCKS5 proxy for agent network routing. CONNECT tunnel setup, TLS over HTTP proxy, agent-specific proxy routing, and secure tunnel authentication. Sources: request/request (tunneling patterns), node-tunnel.

AI-generated sites dưới dạng Markdown — describe site, AI builds it, anh own Markdown files. Landing pages, blogs, portfolios, docs với Tailwind blocks.

'Proactively hunts for Advanced Persistent Threat (APT) activity within

'Detects credential stuffing attacks by analyzing authentication logs

'Hunt for malicious PowerShell activity by analyzing Script Block Logging

Identify command-and-control beaconing patterns in network traffic by

Detect Cobalt Strike beacon network activity using default TLS certificate

Detect C2 beaconing patterns in network traffic using frequency analysis,

Hunt for data exfiltration through network traffic analysis, detecting

Detect data staging activity before exfiltration by monitoring for archive

'Hunt for DCOM-based lateral movement by detecting abuse of MMC20.Application,

Detect DCSync attacks by analyzing Windows Event ID 4662 for unauthorized

'Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION

Hunt for DNS-based persistence mechanisms including DNS hijacking, dangling

Detect DNS tunneling and data exfiltration by analyzing Zeek dns.log

Detect domain fronting C2 traffic by analyzing SNI vs HTTP Host header

Detect WMI-based lateral movement by analyzing Windows Event ID 4688

Hunt for adversary abuse of legitimate cloud services for C2, data staging,

Proactively hunt for adversary abuse of legitimate system binaries (LOLBins)

Hunt for adversary abuse of Living Off the Land Binaries (LOLBins) by

Detect NTLM relay attacks by analyzing Windows Event 4624 logon type

Systematically hunt for adversary persistence mechanisms across Windows

Hunt for adversary persistence through Windows Management Instrumentation

Detect process injection techniques (T1055) including CreateRemoteThread,

Hunt for registry-based persistence mechanisms including Run keys, Winlogon

Detect MITRE ATT&CK T1547.001 registry Run key persistence by analyzing

Hunt for adversary persistence via Windows Scheduled Tasks by analyzing

Hunt for Volume Shadow Copy deletion activity that indicates ransomware

Hunt for spearphishing campaign indicators across email logs, endpoint

Detect T1547.001 startup folder persistence by monitoring Windows startup

Hunt for supply chain compromise indicators including trojanized software

Hunt for adversary persistence and execution via Windows scheduled tasks

Hunt for MITRE ATT&CK T1098 account manipulation including shadow admin

Hunt for unusual network connections by analyzing outbound traffic patterns,