Claude Skills by yanacuti1121

Persistent memory + RAG + User Profile cho AI agents. #1 LongMemEval benchmark. Thay thế L1/L2 memory thủ công bằng API cloud chuẩn.

Secure the software supply chain — SBOM generation, dependency provenance verification, package integrity (Sigstore/npm provenance), lockfile auditing, typosquatting detection, CI artifact signing, and dependency update policy. Use when asked about "SBOM", "software bill of materials", "supply chain attack", "dependency provenance", "Sigstore", "npm provenance", "package integrity", "typosquatting", "dependency confusion", "artifact signing", "SLSA", "slsa framework", "lockfile security", or ...

Recognize and extract text from images or PDFs using Surya OCR (datalab-to/surya). Use when a user uploads a document, screenshot, scan, or photo and wants the text extracted or analyzed. Surya supports 90+ languages and works on both images and PDFs without an internet connection.

When 2+ independent perspectives must agree before a risky Yana AI action — dispatching review subagents synchronously via the Task tool, resolving their findings by priority (Safety > Correctness > Performance > Style), and blocking on any Safety-severity finding. Replaces an earlier async message-bus/vote design that was never actually wired into the running system.

Deploy full honeynet infrastructure within a multi-agent swarm. Decoy agent prompts, honey-vault canary tokens, ghost file-system monitoring, runtime mutation of compromised agents, and immune system rule generation from blocked attacks.

SWC (Speedy Web Compiler) Rust-based JS/TS transforms. Programmatic transpilation, custom plugins via WASM, minification, module format conversion, and performance-sensitive parse pipelines. Sources: swc-project/swc (Apache-2.0).

Swift 6.2 Approachable Concurrency — single-threaded by default, @concurrent for explicit background offloading, isolated conformances for main actor types.

SwiftUI architecture patterns, state management with @Observable, view composition, navigation, performance optimization, and modern iOS/macOS UI best practices.

AES-256 symmetric encryption for agent memory cache protection. CryptoJS AES encrypt/decrypt, HMAC integrity, secure key derivation, and encrypting agent session state at rest. Sources: brix/crypto-js.

Linux seccomp BPF syscall filtering. Default-deny profiles, allow-listing safe syscalls, SCMP_ACT_ERRNO vs SCMP_ACT_KILL, Docker/OCI seccomp JSON format, blocking reboot/mount/ptrace for agent subprocesses. Sources: seccomp/libseccomp, opencontainers/runc.

Linux syslog integration for agent audit logging. Write structured events to /dev/log via UDP syslog, severity levels (EMERG→DEBUG), facility codes, RFC5424 format, and forwarding to centralized log aggregators. Sources: bnoordhuis/node-syslog.

Hardware and OS telemetry collection for agent resource monitoring. CPU temperature, memory usage, disk I/O, network interfaces, battery, and process-level resource extraction. Sources: sebhildebrandt/systeminformation.

Native database client cho developers — free, open source, fast. PostgreSQL, MySQL, SQLite, MongoDB. Swift/macOS. 4.3K stars.

Expert guidance for creating, writing, building, and refining Claude Code Skills. Use when working with SKILL.md files, authoring new skills, improving existing skills, or understanding skill structure and best practices.

Expert guidance for creating, configuring, and using Claude Code hooks. Use when working with hooks, setting up event listeners, validating commands, automating workflows, adding notifications, or understanding hook types (PreToolUse, PostToolUse, Stop, SessionStart, UserPromptSubmit, etc).

Create Model Context Protocol (MCP) servers that expose tools, resources, and prompts to Claude. Use when building custom integrations, APIs, data sources, or any server that Claude should interact with via the MCP protocol. Supports both TypeScript and Python implementations.

Create optimized prompts for Claude-to-Claude pipelines with research, planning, and execution stages. Use when building prompts that produce outputs for other prompts to consume, or when running multi-stage workflows (research -> plan -> implement).

Create hierarchical project plans optimized for solo agentic development. Use when planning projects, phases, or tasks that Claude will execute. Produces Claude-executable plans with verification criteria, not enterprise documentation. Handles briefs, roadmaps, phase plans, and context handoffs.

Expert guidance for creating Claude Code slash commands. Use when working with slash commands, creating custom commands, understanding command structure, or learning YAML configuration.

Expert guidance for creating, building, and using Claude Code subagents and the Task tool. Use when working with subagents, setting up agent configurations, understanding how agents work, or using the Task tool to launch specialized agents.

Deep analysis debugging mode for complex issues. Activates methodical investigation protocol with evidence gathering, hypothesis testing, and rigorous verification. Use when standard troubleshooting fails or when issues require systematic root cause analysis.

Set up and configure Geoffrey Huntley's original Ralph Wiggum autonomous coding loop in any directory with proper structure, prompts, and backpressure.

Search The Pirate Bay for torrents and extract magnet links via the apibay.org JSON API. Use when asked to "find a torrent", "search pirate bay", "get a magnet link", "download torrent", "find seeders", "top torrents", or any torrent search task. Can operate via CLI tool or direct API calls.

Use when you need to prove test results with a signed receipt from yana-rt evidence run — not just text. Required for all Rust guard/evidence modules in Yana AI, and any claim "tests passed" that must be verifiable. Triggers on: yana-rt evidence run, signed receipt, viết test trước, evidence run, proof of test.

Use when implementing features or fixing bugs with test-driven development. Enforces RED→GREEN→REFACTOR cycle with vertical slicing and multi-agent context isolation. Triggers on: 'implement with TDD', 'write tests first', 'red green refactor', 'test-driven', '/tdd <feature>'. Supports Jest, Vitest, pytest, Go test, cargo test, RSpec, PHPUnit.

Agent Teams 오케스트레이션 엔진 - 팀 구성, 작업 분배, 의존성 관리, 결과 집계

Use when asked to analyze hook activity, token usage, audit logs, or agent behavior patterns. Triggers on: 'xem log', 'hook nào fire nhiều', 'token usage', 'audit trail', 'what hooks fired', 'session summary', 'telemetry report', 'hook health', 'agent activity'.

Use when implementing a text/HTML template engine (lexer, parser, renderer) from first principles — not when just using Handlebars/Jinja/EJS in an app. Triggers on: 'write a template engine', 'build a templating language', 'implement mustache-style templates', 'template lexer and parser', 'safe string interpolation without eval'. Covers tokenizing, AST design, and safe (non-eval) rendering.

4-tier hierarchical agent memory — compress tool logs into Mermaid diagrams, organise conversations into personas/scenes, 61% token reduction. Triggers on: 'agent memory hierarchy', 'long-term agent memory', 'compress tool logs', 'agent persona memory', 'L0 L1 L2 L3 memory', 'symbolic short-term memory', 'tencent agent memory', 'memory without API', 'local agent memory', 'mermaid tool log', 'agent memory tiers', 'session memory compression'.

Evidence-first repo execution workflow for ECC. Use when the user wants a command run, a repo checked, a CI failure debugged, or a narrow fix pushed with exact proof of what was executed and verified.

Write production-grade Terraform — module structure, remote state, workspace strategy, variable validation, lifecycle rules, data sources, provider version pinning, and safe plan/apply workflow. Use when asked about "Terraform", "IaC", "infrastructure as code", "Terraform module", "remote state", "terraform plan", "terraform apply", "state locking", "Terraform workspace", "provider version", "terraform import", "destroy protection", "variable validation", or "Terraform best practices". Do NOT...

'Tests Android inter-process communication (IPC) through intents for

'Tests API authentication mechanisms for weaknesses including broken

'Tests REST and GraphQL APIs for Broken Object Level Authorization (BOLA/IDOR)

'Tests APIs for mass assignment (auto-binding) vulnerabilities where

Systematically assessing REST and GraphQL API endpoints against the OWASP

Identifying and exploiting Cross-Origin Resource Sharing misconfigurations

Systematically testing web applications for broken access control vulnerabilities

Identifying flaws in application business logic that allow price manipulation,

Test web application email functionality for SMTP header injection vulnerabilities

Test web applications for HTTP Host header injection vulnerabilities

Test JWT implementations for critical vulnerabilities including algorithm

Identify and test open redirect vulnerabilities in web applications by

Identifying sensitive data exposure vulnerabilities including API key

Test web applications for XML injection vulnerabilities including XXE,

Identifying and validating cross-site scripting vulnerabilities using

'Tests web applications for Cross-Site Scripting (XSS) vulnerabilities

Discovering and exploiting XML External Entity injection vulnerabilities

Assessing JSON Web Token implementations for cryptographic weaknesses,

'Tests authentication and authorization mechanisms in mobile application