Claude Skills by yanacuti1121

Detect and exploit race condition vulnerabilities in web applications

Identifying and exploiting SSRF vulnerabilities to access internal services,

'Identifies and exploits SMB protocol vulnerabilities using Metasploit

'Identifies and exploits SQL injection vulnerabilities in web applications

Detecting and exploiting SQL injection vulnerabilities using sqlmap to

Detecting and exploiting Server-Side Template Injection (SSTI) vulnerabilities

Exploit PHP type juggling vulnerabilities caused by loose comparison

The Metasploit Framework is the world's most widely used penetration

Testing WebSocket implementations for authentication bypass, cross-site

Exploit the Zerologon vulnerability (CVE-2020-1472) in the Netlogon Remote

Extism plugin system — multi-language WASM plugins (Rust/Go/JS/Python/C) with PDK, host functions, shared memory protocol. Build extensible agent tools where each plugin is an isolated WASM module. Sources: extism/extism (BSD-3-Clause).

Use when extracting, auditing, or standardizing error codes and messages across a codebase. Triggers on "error codes", "error messages", "unknown error", "extract errors", "error registry".

Extract and analyze browser history, cookies, cache, downloads, and bookmarks

Extract embedded configuration from Agent Tesla RAT samples including

Extract cached credentials, password hashes, Kerberos tickets, and authentication

'Extracts indicators of compromise (IOCs) from malware samples including

'Uses Rekall memory forensics framework to analyze memory dumps for process

Extract, parse, and analyze Windows Event Logs (EVTX) using Chainsaw,

Design and implement feature flags — flag types (release/experiment/ops/permission), lifecycle (create→target→rollout→cleanup), gradual rollout strategy, kill switch pattern, and flag hygiene. Use when asked to "add a feature flag", "gradual rollout", "kill switch", "LaunchDarkly", "Unleash", "GrowthBook", "dark launch", "flag cleanup", "percentage rollout", or "canary release via flags". Do NOT use for: deployment canaries managed at infra level (Kubernetes, load balancer weights). Do NOT us...

SSRF prevention via redirect chain control in HTTP fetch. Block automatic redirect following to internal IPs, validate post-redirect destination, manual redirect handling, and timeout enforcement. Sources: node-fetch/node-fetch, OWASP SSRF Cheat Sheet.

Chokidar-based file watcher that triggers `claude -p` on changes. Useful for automated AI reactions to file changes — design sync, code validation, config regeneration, etc.

Filesystem isolation via chroot and pivot_root. Building minimal rootfs, chroot jail setup, pivot_root for OCI containers, preventing chroot escapes, and read-only bind-mount overlays. Sources: zetamatta/go-chroot, opencontainers/runc.

Implement token cost estimation, sliding-window velocity caps, and hierarchical credit allocation for multi-agent LLM systems. Prevent runaway API spend with pre-request budget gates and dead-man switches.

Use when auditing a codebase for semantic code duplication — functions that serve the same purpose but were implemented independently. Triggers on: 'find duplicate functions', 'semantic duplicates', 'duplicate code audit', 'same intent different implementation', 'consolidate functions', 'codebase duplication', 'redundant functions', 'llm-generated duplicates', 'function deduplication', 'duplicate detection'.

Scrape and crawl websites for AI with Firecrawl — scrape single URLs to clean Markdown/HTML, crawl entire sites with depth/path filters, extract structured data with LLM schema, use map to discover all URLs, and batch scrape multiple pages in parallel.

Fix accessibility issues hands-on — focus management, keyboard traps, missing ARIA labels, skip links, color contrast failures, interactive element sizing, and screen reader announcements. Use when asked to "fix accessibility issues", "keyboard navigation broken", "focus trap", "ARIA label missing", "screen reader not announcing", "skip to content", "tab order wrong", "focus ring missing", "color contrast fails", or "make this accessible". Do NOT use for: full WCAG audit from scratch — see ac...

Fix animation jank and layout thrashing — compositor-only properties, will-change hints, avoiding layout-triggering CSS, GPU layer promotion, requestAnimationFrame usage, reduced-motion support, and auditing with DevTools Performance panel. Use when asked to "animation is janky", "fix animation performance", "layout thrashing", "GPU acceleration", "will-change", "compositor layer", "60fps animations", "CSS animation vs JS animation", "prefers-reduced-motion", "scroll performance", or "why is ...

FlashAttention IO-aware attention algorithm for memory-efficient transformer training and inference. Tiling, recomputation strategy, hardware memory hierarchy, FlashAttention-2/3 improvements, and integration with HuggingFace. Sources: Dao-AILab/flash-attention (BSD-3-Clause).

Visual flow connection patterns for generative UI agent workflows. jsPlumb anchor point architecture, connector routing, endpoint management, and dynamic flow diagram generation from agent pipeline state. Sources: jsplumb/jsplumb.

i18n cho React apps — react-intl, FormatJS. Dùng khi implement đa ngôn ngữ, format số/ngày/tiền tệ chuẩn theo locale.

Apple FoundationModels framework for on-device LLM — text generation, guided generation with @Generable, tool calling, and snapshot streaming in iOS 26+.

Multi-agent framework — assign roles (PM, architect, engineer) cho GPT team, build software từ 1 requirement. Dùng khi cần orchestrate multi-agent pipeline phức tạp.

Accessibility patterns for React/Next.js — semantic HTML, ARIA, form labeling, keyboard navigation, focus management, screen reader support. WCAG 2.2 AA compliance.

'Generates structured cyber threat intelligence reports at strategic,

Build streaming and generative UI with Vercel AI SDK — useChat, useCompletion, streamText, streamUI, tool calling in the UI layer, loading states for streaming, error boundaries, and AI-native component patterns. Use when asked about "Vercel AI SDK", "useChat", "AI SDK", "streaming chat UI", "streamText", "streamUI", "generative UI", "AI-generated components", "tool call UI", "LLM streaming response", "chat interface", "loading skeleton for AI", "partial response rendering", or "AI message st...

Use when the user asks about past bugs, recurring mistakes, what went wrong before, or wants to avoid repeating errors. Extracts lessons from git history without needing L3 memory. Examples: 'What bugs have we fixed before?', 'Have we hit this error before?', 'What patterns keep breaking?'

Coordinate multiple AI agents using Git as the shared protocol — issues as task queues, branches as agent workspaces, PRs as deliverables, and commit messages as structured agent signals. Use when asked about "GNAP", "git native agent", "agents coordinating through git", "issue-driven agent", "PR as agent output", "multi-agent git workflow", "agent task board", "agents sharing work via repo", "agent kanban in git", or "how do agents hand off work without a message bus". Do NOT use for: real-t...

GitHub Copilot SDK — embed Copilot agent runtime vào app: Node/Python/Go/.NET/Java/Rust. JSON-RPC tới Copilot CLI. Custom agents + tools + model selection. MIT.

Spec-Driven Development toolkit của GitHub — specs executable, không phải tài liệu. 5 core commands: constitution→specify→plan→tasks→implement. 30+ agent integrations.

.gitignore-compatible pattern matching for agent file access control. Ignore rule parsing, negative patterns, per-directory scope, and building file access gates from gitignore-style rules. Sources: kaelzhang/node-ignore.

Use when the user needs to run GitNexus CLI commands like analyze/index a repo, check status, clean the index, generate a wiki, or list indexed repos. Examples: \"Index this repo\", \"Reanalyze the codebase\", \"Generate a wiki\"

Glob pattern matching and file filtering using minimatch. Convert glob patterns to optimized regex, batch file filtering, negation patterns, brace expansion, and ReDoS-safe usage. Sources: isaacs/minimatch.

中国法律全领域系统性检索专家。 ## 核心特色 - 支持用户身份识别（普通人/法学生/律师/法官检察官） - 根据不同身份提供差异化服务 - 完整法源检索（法律/行政法规/司法解释/指导性案例/典型案例） - 法条原文引用与条文互引梳理 ## 核心触发条件（满足任一即触发） **高优先级（必须触发）**： - 明确要求查找法条/法规/司法解释/规范性文件 - 要求判断合法性/违法性（"违法吗""合法吗""有没有责任"） - 要求查找赔偿标准/补偿金额/责任认定/程序要求 - 询问"根据什么法律""法律怎么规定""法律依据是什么" **中优先级（结合上下文触发）**： - "怎么办""怎么维权""能不能告" - "需要什么手续""要具备什么条件" - "还能主张什么""可以去哪里投诉" ## 适用场景 - 劳动争议：违法解除、经济补偿、工伤、社保、调岗等 - 合同纠纷：定金、违约金、违约责任、买卖合同等 - 侵权责任：交通事故、人身损害、医疗事故、环境污染等 - 婚姻家庭：离婚财产、子女抚养、房产继承等 - 行政/刑事/公司金融等 ## 不触发情况 - 仅询问法律概念/...

Grammar definition, lexing, and DSL compilation patterns for AI agent config parsing. Chevrotain high-performance LL(k) parser for custom rule DSLs, Handlebars safe template compilation without eval, marked Markdown-to-HTML with custom renderer, Prism tokenization for syntax highlighting, PEG.js parser generator from grammar expressions. Sources: chevrotain/chevrotain, handlebars-lang/handlebars.js, markedjs/marked, prismjs/prism, pegjs/pegjs.

Pure graph data structure operations: adjacency list, BFS/DFS traversal, cycle detection, topological sort, and shortest path. For dependency resolution in skill/rule graphs without external DB. Sources: bpesquet/graph-data-structure.

Graph algorithms and dependency resolution for AI agent systems. DAG construction for action gate ordering, cycle detection in skill/rule graphs, BFS/DFS traversal, semver range resolution for version conflicts, topological sort for execution ordering, and PageRank-based rule importance scoring. Sources: dagrejs/graphlib, trekhleb/javascript-algorithms, npm/node-semver, sindresorhus/toposort, asv/pagerank.

Đọc files trong project, xây knowledge graph, tìm kết nối ẩn giữa concepts. Multimodal — xử lý code, PDF, markdown, screenshot, diagram. 71.5x ít token hơn khi query so với đọc file thẳng. Triggers: "graphify", "knowledge graph", "knowledge graph từ code", "build graph", "tìm kết nối", "map codebase", "visualize dependencies", "graph codebase", "graph từ files", "safishamsi graphify", "/graphify"

Design and optimize GraphQL APIs — schema design, N+1 elimination with DataLoader, pagination (cursor/connection spec), authorization in resolvers, subscriptions, and error handling. Use when asked about "GraphQL schema", "resolver N+1", "DataLoader", "GraphQL pagination", "GraphQL subscriptions", "GraphQL authorization", or "how to structure a GraphQL API". Do NOT use for: REST API design — use `api-design`. General query optimization on the database layer — use `database-patterns`.

gRPC bidirectional streaming RPC over HTTP/2 for real-time agent clusters. Service definition, unary/server-stream/bidi-stream patterns, deadline propagation, and TLS mutual auth. Sources: grpc/grpc-node (Apache-2.0).

Harden native agents running on machines you do not fully control. Covers installer integrity and code signing per platform, OTA update channels with rollback and kill-switch, mTLS with per-agent identity and rotation, local secret storage (Keychain, DPAPI, libsecret), anti-tampering signals, and telemetry hygiene. Invoke when shipping a monitoring agent, RMM tool, CI runner, or IoT controller.