ethical-hacking-methodology
提供完整的渗透测试方法学、技术与合规流程指南（用于授权测试）。
▸ 推荐理由覆盖渗透测试全流程，适合安全评估与合规团队参考。
▸ 风险提示包含攻击性技术，可能被滥用；仅限授权环境并遵守法律。
全部收录
相关性达标的全量 Skills（含未精选长尾）· 共 6259 个
dev-guide-generator
把技术主题转成完整的环境配置、操作步骤与排错教程与备忘单。
▸ 推荐理由按 SOP 产出从入门到排错的完整文档，节省撰写教学成本。
design-system-builder
从界面参考图提取设计系统并生成可实施的 UI 设计指引与提示。
▸ 推荐理由自动化抽取视觉模式与设计规范，利于快速对齐产品视觉语言。
deep-module-refactor
分析代码库，识别架构摩擦并建议深度模块化的重构方案。
▸ 推荐理由聚焦提升可测试性与模块深度，适合需重构大型代码库的团队。
dataset-quality-audit
对表格数据运行多维质量检测并给出评分与修复建议。
▸ 推荐理由产出逐项得分与可操作修复建议，适合数据清洗与合规检查。
database-scout
只读探索 SQLite/PostgreSQL，查看表结构、预览数据并生成 ER 图。
▸ 推荐理由安全只读访问并能自动生成可视化的表关系图，便于数据理解。
database-optimizer
分析慢查询与执行计划，提供索引、分区与配置优化建议。
▸ 推荐理由适合需提升数据库性能与扩展性的工程或运维团队。
▸ 风险提示通常需访问数据库或查询计划，可能涉及敏感数据或高权限操作。
data-viz-renderer
从 JSON 数据生成独立的 HTML/SVG 信息图与图表。
▸ 推荐理由能生成无外部依赖、可嵌入的仪表盘与数据卡片，便于分享与发布。
cv-tailor
基于职位描述优化简历，使用 STAR 法量化经历并做 ATS 检查。
▸ 推荐理由帮助求职者快速定制高通过率简历并提升面试机会。
cross-examine
通过连续提问深入审查计划或设计，直到达成共识。
▸ 推荐理由用于方案打磨与风险发现，能系统化暴露隐藏假设。
vercel-composition-patterns
提供可扩展的 React 组件组合模式与实践指南。
▸ 推荐理由适合重构组件库、减少布尔 props 污染并提升可组合性。
code-vuln-audit
扫描代码中的依赖漏洞、秘密泄露与常见 OWASP 风险。
▸ 推荐理由覆盖依赖审计与秘钥检测，适合纳入 CI/开发流程防护。
▸ 风险提示会读取并分析代码与依赖清单，可能暴露密钥并触发外部请求。
code-to-diagram
解析代码依赖并自动生成架构、流程与层级图。
▸ 推荐理由快速将复杂代码库可视化，便于理解模块与调用关系。
▸ 风险提示需要访问代码库文件，可能暴露敏感信息。
code-documenter
为代码生成注释、API 文档与文档站点。
▸ 推荐理由面向开发者的系统化文档生成，支持多种文档格式与站点构建。
cloud-penetration-testing
对 Azure/AWS/GCP 等云平台进行资源发现、枚举与安全评估的方法集合。
▸ 推荐理由覆盖多云场景，适合云安全评估与合规检查
▸ 风险提示包含敏感攻击技术，仅用于授权安全测试。
chart-image
用 Vega-Lite 在无头 Node 环境生成高质量 PNG 图表，支持多种图表类型。
▸ 推荐理由无需浏览器或本地编译，适合服务器端图像生成
caching
介绍缓存策略、失效、缓存键设计与何时不该缓存的最佳实践和反模式。
▸ 推荐理由能显著降低延迟与成本，实用性强
burp-suite-testing
使用 Burp Suite 进行 HTTP 拦截、修改、重放及手动/自动漏洞测试的工作流。
▸ 推荐理由系统化介绍 Burp 工具链，适合渗测者上手
▸ 风险提示涉及流量拦截与篡改，可能侵犯隐私或被滥用。
broken-authentication
检测并利用网站的认证与会话管理缺陷以评估安全风险与修复建议。
▸ 推荐理由对修复常见认证缺陷和防护策略很有帮助
▸ 风险提示包含攻击性测试方法，应仅在合法授权下执行。
aws-penetration-testing
涵盖 AWS 上 IAM 枚举、权限提升、S3/Lambda 等渗透与利用技术。
▸ 推荐理由适合授权红队与安全评估者的操作指南
▸ 风险提示含具体渗透与利用步骤，易被滥用，限授权环境使用。
authentication-patterns
对比会话/JWT/OAuth 等认证模式并提供安全检查清单与常见误区。
▸ 推荐理由帮助团队选型与审查认证实现，实用且全面
audit-flow
跨 CODE/API/AUTH/DATA/NETWORK 多层追踪并将流程存入 SQLite，支持 Mermaid 导出。
▸ 推荐理由适合安全审计与事后分析，带持久化与可视化输出
api-shape-explorer
并行生成多种截然不同的 API 设计方案并进行比较与评估。
▸ 推荐理由基于“Design It Twice”原则快速产出多备选接口形态，利于架构抉择。
api-fuzzing-bug-bounty
提供针对 REST/GraphQL 等接口的模糊测试与漏洞发现方法。
▸ 推荐理由系统化覆盖 API 渗透与模糊测试流程，适合安全研究与bug bounty。
▸ 风险提示包含可被滥用的攻击方法，使用须在授权与合规范围内。
active-directory-attacks
提供针对 Active Directory 的渗透测试与攻击技术指南。
▸ 推荐理由覆盖多种 AD 攻击技术，仅适用于授权红队与安全评估场景。
▸ 风险提示高风险内容：涉及非法渗透与敏感操作，仅限授权测试与合规环境。
academic-paper-reviewer
模拟同行评审，从原创性、方法学、结果与写作四维度给出评审意见。
▸ 推荐理由结构化审稿流程与可行动反馈，适合学者与投稿前自检使用。
weekend-family-activities
Find weekend (or any-day) activities near the user that suit their family and kids. Use this skill whenever the user asks what to do this weekend, wants ideas for outings with their kids, asks for family-friendly events, things to do near a town/city, or anything like "help me plan something fun for the kids Saturday" — even if they don't say the word "activity." Searches local events from official and reputable sources within a chosen radius, filters by kids' ages and the family's interests, and returns a ranked shortlist with a source link for each so the user can verify details before going.
context-diet
Slim down CLAUDE.md, skills, and system prompts. Claude 5-class models have judgment that already covers most generic rules — old guardrails become noise, and worse, they conflict with each other. Use when creating or reviewing a CLAUDE.md or SKILL.md, when adding a rule to one, when context feels bloated, or when asking "where should this rule live?".
rails-8
Playbook for building full-stack Ruby on Rails 8.1 applications "the Rails way" — vanilla Rails, Hotwire (Turbo + Stimulus), the Solid stack, Propshaft + importmap, RSpec testing, ecosystem gems, OpenAPI docs, AI features, observability, and Kamal 2 deployment. Use this skill whenever the user is creating, extending, debugging, refactoring, testing, upgrading, documenting, or deploying a Rails app — or mentions Ruby on Rails, a Gemfile containing rails, ERB templates, Active Record, migrations, Hotwire, Turbo, Stimulus, Action Mailer, Active Storage, Action Text, Action Cable, Solid Queue, Solid Cache, Kamal, Thruster, RSpec, FactoryBot, simple_form, Tailwind, OpenAPI, Swagger, rswag, ruby_llm, or `bin/rails` commands. Trigger it for indirect phrasings like "my Ruby web app", "add a background job", "make this page update live", "add login to my app", "document my API", or "add AI to my app" when the project is Rails. Also for "how should I structure this in Rails?" questions.
hotwire
Deep reference for the Hotwire stack from the official handbooks — Turbo (Drive, Frames, Streams, morphing page refreshes), Stimulus (controllers, actions, targets, values, outlets), and Hotwire Native (wrap a web app into iOS and Android apps with bridge components and path configuration). Use this skill whenever the user works with Turbo or Stimulus in any backend (Rails, Laravel, Django, Phoenix, plain HTML), mentions turbo-rails, stimulus-rails, @hotwired packages, turbo_frame_tag, turbo_stream, broadcasts, data-controller/data-action/data-*-target attributes, morphing, "SPA-like without a SPA", partial page updates, live updates over WebSockets — or wants a mobile app from their web app: Hotwire Native, Turbo Native, Strada, bridge components, path configuration, WKWebView/ webview wrapper apps, or "turn my Rails app into an iOS/Android app". Pair with the rails-8 skill for Rails integration specifics.
fidara-design
The Fidara design system — how to build consistent, modern, responsive UI in Rails 8 + Hotwire + Tailwind CSS v4 (Fidara / fmworkflows brands). Load this WHENEVER building or reviewing UI: components (buttons, cards, forms, nav, modals, tables, badges, alerts), page layouts, tokens/theming, dark mode, responsiveness, or brand/logo usage. It defines the token architecture (brand primitives → semantic roles → fluid scale), the layout primitives you compose instead of ad-hoc flex/grid, the component catalog with variant/size/state, the Stimulus interaction patterns, and the responsive doctrine. Consistency is enforced here, not left to taste.
openspec-git-merge
MANDATORY skill that activates whenever the OpenSpec archive phase runs. Triggers: /opsx:archive or /opsx:bulk-archive runs, openspec-archive-change or openspec-bulk-archive-change is referenced or active, `openspec archive` is invoked, or the user asks to archive/finalize/complete an OpenSpec change. Runs AFTER the vanilla archive workflow completes: commits the archive move, merges the feature branch into the main branch with --no-ff, and deletes the feature branch.
openspec-git-commit
MANDATORY skill that activates whenever the OpenSpec apply phase begins. Triggers: /opsx:apply runs, openspec-apply-change is referenced or active, `openspec instructions apply` is invoked, or the user asks to implement/apply/execute/build out an OpenSpec change. Wraps the vanilla apply step 6 implementation loop: commits each completed task and verifies commits when all tasks are done.
openspec-git-branch
MANDATORY skill that activates whenever a new OpenSpec change is started. Triggers: /opsx:new, /opsx:propose, or /opsx:ff runs; openspec-new-change, openspec-propose, or openspec-ff-change is referenced or active; `openspec new change` is about to be invoked; or the user asks to start, create, scaffold, or propose a new OpenSpec change. Runs BEFORE any change files are created: verifies the repo is on the main branch and clean, then creates the feature branch <prefix>/<change-name>.
start
Kick off a new project by asking clarifying questions until there is enough clarity to write a PRD and a phased roadmap. Use this first, before architecture, design, or feature breakdown.
review
Review implemented code for a feature (or the current diff/branch) against the acceptance criteria, architecture, design, and coding standards docs, running available tests and verification. Use after implementing work defined by /features.
features
Break the roadmap into concrete user stories and features, one file per feature under docs/features/, and optionally create matching GitHub issues. Use after /start (and ideally /architect), before implementation begins.
design
Define the project's UI design system (principles, tokens, base components) and, per feature, the screens/flows for that feature specifically. Two modes — run without a feature named for the system, or naming a feature for its screens. Use after /start; the system pass works alongside /architect and /features, the per-feature pass happens as each feature is about to be built.
architect
Turn the PRD into a technical architecture and coding standards by asking technical questions, then write architecture.md and standards.md, and optionally scaffold the initial project structure. Use after /start, before or alongside /features and /design.
product-requirement-analysis
Use when converting structured requirement intake and product fact source context into a product requirement analysis for Web admin consoles or mobile apps. Produces analysis.md with problem definition, goals, scenarios, options, recommended solution, MVP/non-goals, risks, PRD writing instructions, and HTML prototype design instructions. Use after intake.md and product-fact-context.md exist; do not use for PRD writing, prototype design, version management, or product fact source maintenance.