cross-examine
通过连续提问深入审查计划或设计，直到达成共识。
▸ 推荐理由用于方案打磨与风险发现，能系统化暴露隐藏假设。
全部收录
相关性达标的全量 Skills（含未精选长尾）· 共 6584 个
vercel-composition-patterns
提供可扩展的 React 组件组合模式与实践指南。
▸ 推荐理由适合重构组件库、减少布尔 props 污染并提升可组合性。
code-vuln-audit
扫描代码中的依赖漏洞、秘密泄露与常见 OWASP 风险。
▸ 推荐理由覆盖依赖审计与秘钥检测，适合纳入 CI/开发流程防护。
▸ 风险提示会读取并分析代码与依赖清单，可能暴露密钥并触发外部请求。
code-to-diagram
解析代码依赖并自动生成架构、流程与层级图。
▸ 推荐理由快速将复杂代码库可视化，便于理解模块与调用关系。
▸ 风险提示需要访问代码库文件，可能暴露敏感信息。
code-documenter
为代码生成注释、API 文档与文档站点。
▸ 推荐理由面向开发者的系统化文档生成，支持多种文档格式与站点构建。
cloud-penetration-testing
对 Azure/AWS/GCP 等云平台进行资源发现、枚举与安全评估的方法集合。
▸ 推荐理由覆盖多云场景，适合云安全评估与合规检查
▸ 风险提示包含敏感攻击技术，仅用于授权安全测试。
chart-image
用 Vega-Lite 在无头 Node 环境生成高质量 PNG 图表，支持多种图表类型。
▸ 推荐理由无需浏览器或本地编译，适合服务器端图像生成
caching
介绍缓存策略、失效、缓存键设计与何时不该缓存的最佳实践和反模式。
▸ 推荐理由能显著降低延迟与成本，实用性强
burp-suite-testing
使用 Burp Suite 进行 HTTP 拦截、修改、重放及手动/自动漏洞测试的工作流。
▸ 推荐理由系统化介绍 Burp 工具链，适合渗测者上手
▸ 风险提示涉及流量拦截与篡改，可能侵犯隐私或被滥用。
broken-authentication
检测并利用网站的认证与会话管理缺陷以评估安全风险与修复建议。
▸ 推荐理由对修复常见认证缺陷和防护策略很有帮助
▸ 风险提示包含攻击性测试方法，应仅在合法授权下执行。
aws-penetration-testing
涵盖 AWS 上 IAM 枚举、权限提升、S3/Lambda 等渗透与利用技术。
▸ 推荐理由适合授权红队与安全评估者的操作指南
▸ 风险提示含具体渗透与利用步骤，易被滥用，限授权环境使用。
authentication-patterns
对比会话/JWT/OAuth 等认证模式并提供安全检查清单与常见误区。
▸ 推荐理由帮助团队选型与审查认证实现，实用且全面
audit-flow
跨 CODE/API/AUTH/DATA/NETWORK 多层追踪并将流程存入 SQLite，支持 Mermaid 导出。
▸ 推荐理由适合安全审计与事后分析，带持久化与可视化输出
api-shape-explorer
并行生成多种截然不同的 API 设计方案并进行比较与评估。
▸ 推荐理由基于“Design It Twice”原则快速产出多备选接口形态，利于架构抉择。
api-fuzzing-bug-bounty
提供针对 REST/GraphQL 等接口的模糊测试与漏洞发现方法。
▸ 推荐理由系统化覆盖 API 渗透与模糊测试流程，适合安全研究与bug bounty。
▸ 风险提示包含可被滥用的攻击方法，使用须在授权与合规范围内。
active-directory-attacks
提供针对 Active Directory 的渗透测试与攻击技术指南。
▸ 推荐理由覆盖多种 AD 攻击技术，仅适用于授权红队与安全评估场景。
▸ 风险提示高风险内容：涉及非法渗透与敏感操作，仅限授权测试与合规环境。
academic-paper-reviewer
模拟同行评审，从原创性、方法学、结果与写作四维度给出评审意见。
▸ 推荐理由结构化审稿流程与可行动反馈，适合学者与投稿前自检使用。
weekend-family-activities
Find weekend (or any-day) activities near the user that suit their family and kids. Use this skill whenever the user asks what to do this weekend, wants ideas for outings with their kids, asks for family-friendly events, things to do near a town/city, or anything like "help me plan something fun for the kids Saturday" — even if they don't say the word "activity." Searches local events from official and reputable sources within a chosen radius, filters by kids' ages and the family's interests, and returns a ranked shortlist with a source link for each so the user can verify details before going.
context-diet
Slim down CLAUDE.md, skills, and system prompts. Claude 5-class models have judgment that already covers most generic rules — old guardrails become noise, and worse, they conflict with each other. Use when creating or reviewing a CLAUDE.md or SKILL.md, when adding a rule to one, when context feels bloated, or when asking "where should this rule live?".
rails-8
Playbook for building full-stack Ruby on Rails 8.1 applications "the Rails way" — vanilla Rails, Hotwire (Turbo + Stimulus), the Solid stack, Propshaft + importmap, RSpec testing, ecosystem gems, OpenAPI docs, AI features, observability, and Kamal 2 deployment. Use this skill whenever the user is creating, extending, debugging, refactoring, testing, upgrading, documenting, or deploying a Rails app — or mentions Ruby on Rails, a Gemfile containing rails, ERB templates, Active Record, migrations, Hotwire, Turbo, Stimulus, Action Mailer, Active Storage, Action Text, Action Cable, Solid Queue, Solid Cache, Kamal, Thruster, RSpec, FactoryBot, simple_form, Tailwind, OpenAPI, Swagger, rswag, ruby_llm, or `bin/rails` commands. Trigger it for indirect phrasings like "my Ruby web app", "add a background job", "make this page update live", "add login to my app", "document my API", or "add AI to my app" when the project is Rails. Also for "how should I structure this in Rails?" questions.
hotwire
Deep reference for the Hotwire stack from the official handbooks — Turbo (Drive, Frames, Streams, morphing page refreshes), Stimulus (controllers, actions, targets, values, outlets), and Hotwire Native (wrap a web app into iOS and Android apps with bridge components and path configuration). Use this skill whenever the user works with Turbo or Stimulus in any backend (Rails, Laravel, Django, Phoenix, plain HTML), mentions turbo-rails, stimulus-rails, @hotwired packages, turbo_frame_tag, turbo_stream, broadcasts, data-controller/data-action/data-*-target attributes, morphing, "SPA-like without a SPA", partial page updates, live updates over WebSockets — or wants a mobile app from their web app: Hotwire Native, Turbo Native, Strada, bridge components, path configuration, WKWebView/ webview wrapper apps, or "turn my Rails app into an iOS/Android app". Pair with the rails-8 skill for Rails integration specifics.
fidara-design
The Fidara design system — how to build consistent, modern, responsive UI in Rails 8 + Hotwire + Tailwind CSS v4 (Fidara / fmworkflows brands). Load this WHENEVER building or reviewing UI: components (buttons, cards, forms, nav, modals, tables, badges, alerts), page layouts, tokens/theming, dark mode, responsiveness, or brand/logo usage. It defines the token architecture (brand primitives → semantic roles → fluid scale), the layout primitives you compose instead of ad-hoc flex/grid, the component catalog with variant/size/state, the Stimulus interaction patterns, and the responsive doctrine. Consistency is enforced here, not left to taste.
openspec-git-merge
MANDATORY skill that activates whenever the OpenSpec archive phase runs. Triggers: /opsx:archive or /opsx:bulk-archive runs, openspec-archive-change or openspec-bulk-archive-change is referenced or active, `openspec archive` is invoked, or the user asks to archive/finalize/complete an OpenSpec change. Runs AFTER the vanilla archive workflow completes: commits the archive move, merges the feature branch into the main branch with --no-ff, and deletes the feature branch.
openspec-git-commit
MANDATORY skill that activates whenever the OpenSpec apply phase begins. Triggers: /opsx:apply runs, openspec-apply-change is referenced or active, `openspec instructions apply` is invoked, or the user asks to implement/apply/execute/build out an OpenSpec change. Wraps the vanilla apply step 6 implementation loop: commits each completed task and verifies commits when all tasks are done.
openspec-git-branch
MANDATORY skill that activates whenever a new OpenSpec change is started. Triggers: /opsx:new, /opsx:propose, or /opsx:ff runs; openspec-new-change, openspec-propose, or openspec-ff-change is referenced or active; `openspec new change` is about to be invoked; or the user asks to start, create, scaffold, or propose a new OpenSpec change. Runs BEFORE any change files are created: verifies the repo is on the main branch and clean, then creates the feature branch <prefix>/<change-name>.
start
Kick off a new project by asking clarifying questions until there is enough clarity to write a PRD and a phased roadmap. Use this first, before architecture, design, or feature breakdown.
review
Review implemented code for a feature (or the current diff/branch) against the acceptance criteria, architecture, design, and coding standards docs, running available tests and verification. Use after implementing work defined by /features.
features
Break the roadmap into concrete user stories and features, one file per feature under docs/features/, and optionally create matching GitHub issues. Use after /start (and ideally /architect), before implementation begins.
design
Define the project's UI design system (principles, tokens, base components) and, per feature, the screens/flows for that feature specifically. Two modes — run without a feature named for the system, or naming a feature for its screens. Use after /start; the system pass works alongside /architect and /features, the per-feature pass happens as each feature is about to be built.
architect
Turn the PRD into a technical architecture and coding standards by asking technical questions, then write architecture.md and standards.md, and optionally scaffold the initial project structure. Use after /start, before or alongside /features and /design.
product-requirement-analysis
Use when converting structured requirement intake and product fact source context into a product requirement analysis for Web admin consoles or mobile apps. Produces analysis.md with problem definition, goals, scenarios, options, recommended solution, MVP/non-goals, risks, PRD writing instructions, and HTML prototype design instructions. Use after intake.md and product-fact-context.md exist; do not use for PRD writing, prototype design, version management, or product fact source maintenance.
html-prototype-builder
Use when generating, revising, debugging, validating, or freezing runnable HTML prototypes for Web admin consoles or mobile apps. Consumes analysis.md, PRD, product-fact-context.md, shared-context.md, and ui-system/ to produce versioned index.html, styles.css, app.js, data.js, and prototype-readme.md with stable IDs, interactions, mock data, states, role differences, and PRD-prototype consistency. Do not use for requirement analysis or UI system design.
dot
以代码生成像素风美术资源，支持 SVG/Canvas/Phaser 等导出
▸ 推荐理由适合游戏/复古界面快速生成可复用美术与 spritesheet
▸ 风险提示可能调用外部 Antigravity CLI 或下载第三方资源
ascent
提供职业变动、侧业与独立路径的自我定位、市场调研与面试薪酬策略
▸ 推荐理由适合求职或转型者做系统化职业规划与执行准备
agora
基于 Bloom 与反向设计法构建课程、学习目标与测评工具。
▸ 推荐理由可产出可衡量目标与评估量表，适合课程与培训设计者使用。
drawio-skill
生成 .drawio XML 并通过本地 draw.io CLI 导出 PNG/SVG/PDF 等格式。
▸ 推荐理由把文字描述直接转为可复用的 draw.io 文件，方便迭代与共享。
▸ 风险提示需本地安装并调用 draw.io 桌面应用的 CLI，依赖本地二进制。
gptpro-handoff
在编码代理与慢速前沿模型间执行研究/审计交接流程与提示模板。
▸ 推荐理由规范化把复杂代码库交给 ChatGPT/GPT Pro 等深度推理模型的流程。
▸ 风险提示依赖 Web UI 上传/预加载代码，存在敏感数据外泄风险。
fable-orchestration
为稀缺顶级模型＋廉价子代理栈定义路由与委派策略。
▸ 推荐理由适合有成本/配额约束的多模型编排场景参考与落地。
codex-fleet
Codex CLI 的独立运行器与并行任务（fleet）编排器，负责执行 codex exec 与图像任务。
▸ 推荐理由适合需要并行化 Codex 任务与图像流水线的自动化场景，能直接执行而非仅描述。
▸ 风险提示会执行外部命令与代码，运行前需审查权限与命令内容
chainscan
通过 Etherscan V2 统一 API（并以 Foundry cast 为后备）查询多链区块链数据。
▸ 推荐理由统一多链探索器访问并提供 ABI/交易/事件等关键链上数据，便于链上开发与审计。
▸ 风险提示需要 Etherscan API key 并进行外部网络请求