Explore

当用户要求打开、启动或查看擎天大盘、当前项目的 AI 开发体系大盘或跨项目产物大盘时使用；仅讨论大盘设计、修改业务页面或询问体系接入不触发启动。

当用户要让 X/Twitter 账号获得更多相关读者和关注者，要求规划、执行或复盘账号增长时使用；单篇内容写作与平台操作由各自 Skill 负责。

当创始人明确只有一次 all in 商业机会、给出最低成功率，并已有经过高召回搜索和批量筛选的决赛候选时使用；候选不限于软件产品，普通头脑风暴、宽搜、功能优先级或投资人点评不使用。

维护项目知识与事实；在沉淀、整理、归档、事实更新或资料冲突时，区分现状、决策、历史和假设，保存长期关注与周期事项，选择唯一落点；不把知识文档当执行授权。

当共享 development-* 阶段触达 NextClaw 产品、仓库命令、运行实例或发布合同时使用；只补项目专项方法，不复制通用阶段状态。

用户要求持续自评、打磨到满意，或连续纠偏暴露同类质量差距时使用；整体诊断真实产物，按根因成批修复质量差距并复核，不替代验证、Review 或交付合同。

Use when a complex task will span turns or sessions and needs structured working notes to survive context compression or handoff; short single-turn work does not trigger it.

当确定要修改 AGENTS.md、commands、项目 AI 规则、skill/references、治理脚本，或明确优化 AI 驱动开发体系时使用；普通规则讨论和一次性纠偏不提前触发。

当风险为 L3-L4，或用户明确要求大型、多阶段、低监督完整交付或验收标准时使用；形成并维护 active acceptance contract 与阶段门，不替代任务理解、设计、验证、Review 或交付。

当用户已授权访问私有 VPS 或远程 Linux 主机，但 SSH 入口未知、TCP 22 在认证前失败，或需要建立安全可复用的备用 SSH 传输时使用；不处理 NextClaw 产品自身的 remote access。

当用户要求提交、收尾、changelog、release notes、版本更新笔记或发布变更汇总时使用；先选择提交范围判断、版本笔记、配图/社交一个阶段并读取对应 reference。

NextClaw NPM package 与 runtime channel 发布的专项流程 owner；用于发布 NPM、NPM 测试版、NextClaw 常规正式版及其恢复，覆盖 beta/stable、真实安装和分支回流，并按当前阶段读取一个 reference。

NextClaw Desktop 构建、发布、恢复与运行冒烟流程 owner。

当用户要求扫描、识别、清理、常态化治理 NextClaw 仓库里的死代码、无用代码、unused files、unused exports、unused dependencies，尤其是核心包越来越臃肿、想删旧实现或做定期减债时使用。

Use when a commit/release, cross-module delivery, important root-cause fix, red-zone change, large governance rewrite, NPM release, work note, or goal anchor may require docs/logs; ordinary small edits do not trigger it.

当用户要求对已有界面挑刺、删减低效区域、对标成熟产品，或反复指出页面布局、留白和信息层级不合理时使用；不替代控件交互质量验收或参考皮肤复刻。

当复刻外部主题、皮肤或参考图，要求整套产品和交互状态采用统一设计语言，或当前效果只有换背景/空状态成立而真实数据页失真时使用。

当任务触达动态 React 组件类型、列表 key、streaming UI，或 iframe/editor/media 等需要保持实例状态的界面时使用；也用于排查重渲染导致的焦点、选区、输入法或内嵌状态丢失。普通 React 修改不自动触发。

当设计或重构前端 presenter/manager/store、Zustand 持久化、状态归属、view logic、业务组件内聚、prop drilling、复杂 hook/state-flow 或 RxJS 边界时使用。

当修改前端样式、shared UI、设置界面、响应式/紧凑布局、输入焦点、配色、Tailwind/CSS/container query，或裁决 reusable component 的样式 owner 时使用。

当设计、修改或评估前端界面与交互、链接/按钮语义、控件状态、tooltip/popover/menu、键盘可达性、紧凑模式，或要求对齐 Windows/macOS/成熟产品体验时使用。

仅当用户明确要求前端可维护性治理、组件/逻辑系统性拆分、MVP 解耦、prop drilling 改造或前端重构优先级审计时使用；普通前端功能、样式和局部 bugfix 不触发。

当写、重写或重新设计任何用户可见内容时使用，包括官网、首页、UI 文案、更新提示、release notes、changelog、README 对外说明、用户文档、产品介绍、营销内容、截图说明和社交分享元信息；尤其适用于隔离内部讨论与最终呈现、判断旧内容能否继续作为结构基线、区分能力说明与真实用例场景、校验截图数据源，以及检查中文文案是否自然。

仅当任务实际新增或改变 fallback、兼容、降级、救援路径、重试、默认值或 legacy 保留时使用；普通实现没有这些分支时不触发。

当把 Codex、Claude Code、Hermes 或其他外部 agent runtime 通过 NARP stdio 接入 NextClaw，或触达 narp-stdio entry、launcher、agent-side wrapper 和旧 runtime 插件迁移时使用。

Use when integrating or debugging a Hermes-style external HTTP agent runtime in NextClaw, including runtime config, session selection, readiness, streaming, and adapter behavior.

当为 NextClaw 及关联产品写博客、官网短文、发布叙事、功能优势、社区稿或配图 brief，并需要把用户兴趣、愿景与证据收敛成可信公开内容时使用。

当确定要修改 AGENTS.md、commands、项目 AI 规则、skill/references、治理脚本，或明确优化 AI 驱动开发体系时使用；普通规则讨论和一次性纠偏不提前触发。

当用户需要在庞大且高不确定性的产品、创业或战略 idea 空间中先高召回发散、再用批量证据逐层收敛，并明确反对想到一个就立即验证时使用；已有少数候选的选型、普通功能脑暴或已经进入真实实验后不使用。

Binary security analysis for CTF challenges — authorized educational environment covering memory safety analysis, return-oriented programming, and vulnerability verification patterns.

Use when the user wants to discover, install, or use Tencent Skillhub from NextClaw, especially for CLI-only install, readiness checks, and safe skill installation guidance.

当用户希望把本机 Codex、ChatGPT Codex 或 Claude Code 订阅通过 localhost 暴露为 OpenAI 兼容端点，或希望在代理验证成功后把它添加成 NextClaw 自定义 provider 时使用。负责 CLIProxyAPI 安装检查、安全配置、OAuth 登录、Homebrew/systemd 持久托管、重启存活验收、NextClaw provider 事务式写入与 NCP 真实对话验收；不用于公网共享、转售、绕过配额或多用户账号池。

Use when a user wants to browse, apply, inspect, create, refine, switch, or remove a NextClaw skin; wants a personal skin with arbitrary CSS, JavaScript, images, SVG, DOM changes, motion, or component-level effects; asks for 易烊千玺/Jackson Yee, 桥本有菜, 迪丽热巴, 初音未来, KUN, Jinx, ENFP, or Gothic Void Crusade; or says a skin looks wrong or incomplete anywhere in the product.

Use when a development task needs visible phase tracing, task-level or phase-level Token measurement, model/effort comparison, or a deterministic usage report or local dashboard from Codex rollout logs.

当评估、适配、创建或发布 NextClaw 用户可用的 marketplace skill 时使用；统一处理产品集成与远端发布，但先选择一个阶段并只读取对应 reference。

当新增、重命名、移动文件，改变文件角色/feature root/目录边界，或用户明确要求命名、文件组织和目录概况治理时使用；统一路由命名、角色、feature-root 和概况扫描，局部修改现有文件不触发。

当用户需要搜索或读取 X/Twitter、操作 X 账号，或希望扩大 X 账号的相关关注者时使用；账号增长下转专门 Skill，单篇内容写作另有 owner。

Expert software testing — unit tests, integration tests, end-to-end tests, mocking, test design patterns, coverage strategy, and test architecture that catches real bugs without slowing development.

Systematic code refactoring: detect code smells, extract functions, simplify conditionals, remove duplication, and improve readability while preserving behavior.

Identify performance bottlenecks: CPU profiling, memory analysis, I/O optimization, and benchmarking strategies.

Implement observability: structured logging, distributed tracing, metrics collection, and alerting strategies.

Structured incident response: root cause analysis, rollback strategies, post-mortem templates, and prevention patterns.

Expert-level frontend design and engineering skill. Produces distinctive, production-grade UI with world-class animations, responsive layouts, accessibility, and UX polish. Outperforms generic AI-generated UI by 100x through systematic design thinking, motion design, and pixel-perfect execution.

Expert technical documentation — README files, API documentation, inline comments, changelogs, architecture decision records, and writing that developers actually want to read.

Expert Docker and container engineering — Dockerfiles, multi-stage builds, Docker Compose, optimization, security hardening, networking, volumes, and production-ready container configurations.

Audit project dependencies for known vulnerabilities, outdated packages, license compliance, and supply chain risks.

Expert debugging methodology — systematic error diagnosis, root cause analysis, logging strategies, debugging tools, and problem-solving techniques that find bugs fast instead of guessing.

Design and optimize data pipelines: ETL patterns, stream processing, batch jobs, and data validation.

Expert code review — systematic PR review methodology that catches bugs, security issues, performance problems, and design flaws. Provides actionable, specific feedback that improves code quality without being pedantic.

Deep code audit for vulnerabilities: taint analysis, data flow tracing, unsafe patterns, race conditions, and memory safety issues.

Cloud security assessment: IAM misconfigurations, S3 bucket exposure, SSRF via cloud metadata, container escape, and Kubernetes RBAC bypass.

Bug bounty report writing with mandatory 7-gate validation. Professional report templates, severity mapping, VRT alignment. Every report must reference which gates the finding passed. Use when writing reports or preparing submissions.

Client-side code analysis — download JS bundles and extract the API endpoints, GraphQL operations, and secrets that network scanning cannot see. Use on any SPA (Next.js, Nuxt, React, Angular, Vue) BEFORE generic endpoint wordlists.

Attack surface discovery — fingerprint first, then subdomains, DNS, tech detection, directory fuzzing, JS analysis, inventory building. Native tools first, websearch never for enumeration.

Automated bug bounty orchestration — runs the complete workflow from reconnaissance to reporting. Use when the user wants a fully automated bug bounty assessment.

Comprehensive code security audit: OWASP Top 10, CWE mapping, SAST/DAST methodology, and structured findings with CVSS scoring.

API security testing: authentication bypass, authorization flaws, rate limiting, input validation, GraphQL introspection, and REST endpoint enumeration.

RESTful and GraphQL API design: OpenAPI specs, pagination, rate limiting, error schemas, versioning, and backwards compatibility.

Expert REST API design and implementation — endpoint design, authentication, error handling, rate limiting, versioning, pagination, and production-ready API patterns that developers love to use.

Postgres performance optimization and best practices from Supabase. Use this skill when writing, reviewing, or optimizing Postgres queries, schema designs, or database configurations.