Development

Perform static analysis on Android APK, iOS IPA, or bundled web apps to extract endpoints, secrets, permissions, code flow, and other security-relevant data

Hunt mobile vulnerability classes in decompiled Android (jadx/apktool) and iOS (class-dump/otool/nm) trees — ripgrep signature scan first (zero deps), optional semgrep taint analysis for dataflow classes, then triage (exported check, attacker-APK discipline) and pick the matching dynamic PoC (adb/drozer/Frida) per class from the bundled reference docs.

Greybox fuzz Android native libraries (.so) on-device with AFL++ — cross-compile the fuzzer for Android arm64, harness a JNI parser with a stub JNIEnv, detect memory bugs with ASan/libdislocator, and validate the harness actually reaches the target.

Perform static analysis on Android APK, iOS IPA, or bundled web apps to extract endpoints, secrets, permissions, code flow, and other security-relevant data

Hunt mobile vulnerability classes in decompiled Android (jadx/apktool) and iOS (class-dump/otool/nm) trees — ripgrep signature scan first (zero deps), optional semgrep taint analysis for dataflow classes, then triage (exported check, attacker-APK discipline) and pick the matching dynamic PoC (adb/drozer/Frida) per class from the bundled reference docs.

Greybox fuzz Android native libraries (.so) on-device with AFL++ — cross-compile the fuzzer for Android arm64, harness a JNI parser with a stub JNIEnv, detect memory bugs with ASan/libdislocator, and validate the harness actually reaches the target.

Review coding-agent execution reports and SpecStory history to find workflow bottlenecks, repeated work, and verification gaps; propose or implement evidence-based workflow improvements. Use for workflow audits and improving orchestration, not for implementing product features.

Take a feature, fix, or PR from request to checked, independently reviewed code. Claude acts as chief of staff, delegating scoped work to subagents. Use for /implement and implementation requests.

The design doctrine for the mobile app: typography roles, spacing rhythm, motion tokens, state choreography, and per-surface "default beautiful" checklists. Use when building or restyling any screen, component, list, form, modal, or interaction — BEFORE composing the JSX.

The migration -> RLS -> ./client read -> tRPC procedure -> web screen -> mobile screen -> test recipe for shipping one whole feature slice through the Next 16 web + Expo 57 mobile + Supabase monorepo in a single turn. Use when asked to add a feature, procedure, or screen end-to-end.

The decide-the-columns -> schema -> ciphertext DAL -> seal/open at the screen -> store-policy -> DSR record -> reviewers recipe for encrypting one feature end-to-end with the opt-in e2ee module, so the server never holds plaintext or a key that decrypts it. Use when asked to encrypt a feature, add client-side encryption, or make a column unreadable to the server.

Generates a project-specific /find-bugs skill with stack-specific security and correctness checklists. Run once per project. Usage: /generate-find-bugs

前端 UI 交互与动效选型知识库。当用户要为页面、组件或图表选择、描述、实现交互效果时使用。覆盖 8 种质感动效（磁吸、液态形变、3D 视差、中心聚焦、液态 Tab、图片展开、手势转场、碰撞回弹）、7 种图表交互（框选、十字线、数据点高亮、数据提示框、图例筛选、缩放、下钻）、10 种 App 高级交互模式（圆形主题切换、拖拽排序、批量勾选、滑杆惯性吸附、文本展开、步骤条回弹、开关联动涟漪、曲线删除、卡片堆叠滚动、标签挤开）、7 种展开动画、8 种折叠组件、7 种导航组件、7 种弹窗组件、7 种加载动效、3 种滚动驱动官网模式（滚动驱动开场、横向滚动区段、可反向的爆炸视图），6 种质感组件交互（重叠排列、进度底色、横向手风琴、组件托盘、跟手放大图标、下拉摘要），8 种手势与反馈（捏合改变内容密度、滚动驱动进度动画、快速滚动拖影、下拉拉伸顶部图片、拖拽元素自动吸附、网格重排走弧线、悬浮元素自动反色、选中项突出显示），8 种图标交互动效（描边绘制、双态形变、播放暂停切换、点赞回弹、铃铛摇铃、旋转加载、填充推进、图标跟随指针），以及 6 种即时反馈组件（多选筛选标签、可删除标签、输入联想...

Set up or repair a comment-checker PostToolUse hook. Use when comment-checker does not resolve or 'comment-checker did not run' appears on edits, or a flake/direnv/npm install path must be verified. Triggers on: 'comment-checker setup', 'hook not running', 'doctor the comment checker'. Do not use for comment-writing advice or unrelated hook debugging.

This skill encodes Emil Kowalski's philosophy on UI polish, component design, animation decisions, and the invisible details that make software feel great.

Teach the user a new skill or concept, within this workspace.

React and Next.js performance optimization guidelines from Vercel Engineering. This skill should be used when writing, reviewing, or refactoring React/Next.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements.

Use when upgrading dependencies, frameworks, runtimes, or native platforms and compatibility or rollback risk matters.

Use when mapping an unfamiliar repository, architecture, dependencies, or impact before deciding what to change.

Use when checking whether a change, artifact, or release is ready for handoff or external release.

Use when assessing threat models, attack surfaces, trust boundaries, auth/authz, secrets, exposure, or exploitability.

Use when product or business input needs explicit behavior, rules, acceptance criteria, assumptions, or open decisions.

Use when planning QA/QC scenarios, risk coverage, regression scope, compatibility checks, or bug-report evidence.

Use when product UI needs design direction, UX decisions, responsive layout, accessibility, or visual polish.