Claude Skills by yanacuti1121

High-performance data processing patterns from 5 repos. O(n log n) array algorithms, lazy evaluation chains, statistical computation on raw data, streaming JSON parsing for large files, and concurrent async queue management. Sources: d3/d3-array, lodash/lodash, simple-statistics/simple-statistics, vitorperes/json-stream, sindresorhus/p-queue.

Build active deception infrastructure for agent swarms. Honey-vault canary tokens, ghost file-system with inotify monitoring, decoy agent prompts on the Swarm Bus, and dynamic quarantine on trip detection.

Pattern guide for writing PreToolUse hooks that block dangerous shell commands. Use when: building or auditing a guard-destructive hook, adding new blocked patterns, reviewing what the current hook covers. Covers 3 safety levels (critical/high/strict) and 58+ regex patterns. Inspired by: karanb192/claude-code-hooks block-dangerous-commands pattern (MIT).

Pattern guide for writing PreToolUse hooks that block secret file access, credential exfiltration, and environment variable dumps. Use when: auditing token-scope-guard.sh, adding new sensitive file patterns, reviewing what secret paths are protected. Covers 33 file patterns + 24 bash patterns + 15 exfiltration patterns. Inspired by: karanb192/claude-code-hooks protect-secrets pattern (MIT).

This skill should be used when the user asks to create a hookify rule, write a hook rule, configure hookify, add a hookify rule, or needs guidance on hookify rule syntax and patterns.

Custom-allowlist XSS filtering with fine-grained tag and attribute control. leizongmin/js-xss whitelist configuration, attribute value sanitization, CSS sanitization, and protocol filtering. Sources: leizongmin/js-xss.

Hierarchical Task Network planning (provably correct plans via symbolic decomposition + LLM fallback) and AlphaEvolve evolutionary code search (fitness-gated genetic algorithm). ChatHTN 2025 hybrid, AlphaEvolve DeepMind 2025. Sources: rohitg00/ai-engineering-from-scratch (Apache-2.0).

HTTP client with authentication, retry, progress, and request pipeline patterns. superagent bearer token injection, multipart uploads, response validation, and timeout enforcement for agent API calls. Sources: ladjs/superagent.

HTTP/HTTPS proxy interception for agent network traffic. Trap outbound requests, inspect headers/bodies, enforce domain allowlists, inject auth tokens, and block SSRF targets. Sources: http-party/node-http-proxy.

HTTP/HTTPS tunneling and SOCKS5 proxy for agent network routing. CONNECT tunnel setup, TLS over HTTP proxy, agent-specific proxy routing, and secure tunnel authentication. Sources: request/request (tunneling patterns), node-tunnel.

AI-generated sites dưới dạng Markdown — describe site, AI builds it, anh own Markdown files. Landing pages, blogs, portfolios, docs với Tailwind blocks.

'Proactively hunts for Advanced Persistent Threat (APT) activity within

'Detects credential stuffing attacks by analyzing authentication logs

'Hunt for malicious PowerShell activity by analyzing Script Block Logging

Identify command-and-control beaconing patterns in network traffic by

Detect Cobalt Strike beacon network activity using default TLS certificate

Detect C2 beaconing patterns in network traffic using frequency analysis,

Hunt for data exfiltration through network traffic analysis, detecting

Detect data staging activity before exfiltration by monitoring for archive

'Hunt for DCOM-based lateral movement by detecting abuse of MMC20.Application,

Detect DCSync attacks by analyzing Windows Event ID 4662 for unauthorized

'Detect NTFS timestamp manipulation (MITRE T1070.006) by comparing $STANDARD_INFORMATION

Hunt for DNS-based persistence mechanisms including DNS hijacking, dangling

Detect DNS tunneling and data exfiltration by analyzing Zeek dns.log

Detect domain fronting C2 traffic by analyzing SNI vs HTTP Host header

Detect WMI-based lateral movement by analyzing Windows Event ID 4688

Hunt for adversary abuse of legitimate cloud services for C2, data staging,

Proactively hunt for adversary abuse of legitimate system binaries (LOLBins)

Hunt for adversary abuse of Living Off the Land Binaries (LOLBins) by

Detect NTLM relay attacks by analyzing Windows Event 4624 logon type

Systematically hunt for adversary persistence mechanisms across Windows

Hunt for adversary persistence through Windows Management Instrumentation

Detect process injection techniques (T1055) including CreateRemoteThread,

Hunt for registry-based persistence mechanisms including Run keys, Winlogon

Detect MITRE ATT&CK T1547.001 registry Run key persistence by analyzing

Hunt for adversary persistence via Windows Scheduled Tasks by analyzing

Hunt for Volume Shadow Copy deletion activity that indicates ransomware

Hunt for spearphishing campaign indicators across email logs, endpoint

Detect T1547.001 startup folder persistence by monitoring Windows startup

Hunt for supply chain compromise indicators including trojanized software

Hunt for adversary persistence and execution via Windows scheduled tasks

Hunt for MITRE ATT&CK T1098 account manipulation including shadow admin

Hunt for unusual network connections by analyzing outbound traffic patterns,

Detect suspicious Windows service installations (MITRE ATT&CK T1543.003)

Hunt for web shell deployments on internet-facing servers by analyzing

Hyperdrive P2P distributed filesystem for sharing agent sandboxes and source code. Content-addressed files, sparse sync, versioned snapshots, and P2P replication via Hyperswarm. Sources: holepunchto/hyperdrive (MIT).

Design and implement internationalization (i18n) — RTL layout, text expansion budgeting, locale-aware APIs, cultural color semantics, pseudo-localization testing, and Vietnamese-specific considerations. Use when asked about "RTL", "right-to-left", "internationalization", "localization", "i18n", "l10n", "translate the app", "text expansion", "Arabic/Hebrew layout", or "support multiple languages". Do NOT use for: translation content itself — that is a human/MT workflow. Do NOT use for: font lo...

IBM ContextForge — MCP Gateway + registry: federate MCP servers + A2A + REST/gRPC qua 1 endpoint. OTel tracing, JWT auth, RBAC, 7000+ tests. Production-ready.

Convert a UI screenshot, mockup, or design image into production-quality frontend code. Analyzes layout, spacing, component hierarchy, and visual states from the image, then outputs clean, semantic code. Use when the user provides an image/screenshot and asks to "code this", "build this UI", "implement this design", or "turn this into a component". Do NOT use for generating new designs — only for converting existing visuals to code.

Immutable agent identity using content-addressed identifiers. ethr-did patterns, deterministic ID generation from public key hash, identity anchoring, and verifiable credential issuance. Sources: uport-project/ethr-did.