Explore

Add interface languages to a Doca editor subpackage (rich text, spreadsheet, Markdown, canvas, slides, and future formats) or the Doca host. Use when adding Chinese/English UI copy, a locale prop, message catalogs, or another language. Dictionary keys are stable English identifiers, not Chinese or full-sentence English.

Integrate or standardize any document-type editor subpackage (rich text, spreadsheet, Markdown, canvas, slides, and future formats) in Doca and online-office modules, including resource callbacks, readonly behavior, custom inline elements, toolbar commands, find/replace and host-owned permissions. Use when developing a subpackage, adapting editor packages, or defining their host API, not for unrelated application UI.

Implement, review, or upgrade realtime collaboration between Doca and any document-type editor subpackage (rich text, spreadsheet, Markdown, canvas, slides, and future formats) using the shared Yjs lifecycle, version, acknowledgement, presence, and comment-anchor contract. Use for collaboration SDK changes, subpackage development, and host package integration, not unrelated UI work.

You MUST use this before high-stakes architectural decisions, irreversible changes, or when requirements are ambiguous. Runs a decision handshake with the ask_user tool: summarize context, present structured options, collect explicit user choice, then proceed.

Detect and exploit SQL injection vulnerabilities in web applications. Load when user-controlled input is incorporated into database queries, or when authentication bypass, data extraction, or error-based information disclosure is the objective.

Perform initial HTTP/HTTPS reconnaissance on a target to identify the web stack, exposed endpoints, security headers, and surface-level misconfigurations. Load at the start of any web-facing task before running exploitation tools.

Discover and exploit directory traversal and local file inclusion vulnerabilities. Load when the target exposes file-serving, download, preview, or template endpoints, or when a parameter appears to reference a filename or path.

Bypass file upload validation to upload and execute malicious payloads. Load when the target exposes a file upload endpoint and the objective requires code execution or file write on the server.

Use this skill when the task requires reading, searching, or understanding source code in a repository. Covers finding files, searching for patterns, reading specific lines, tracing function references, and running AST-aware analysis. This skill teaches tool discipline — what command to run, in what order, and how to control output volume. It does not prescribe a fixed investigation process; follow the evidence.

Capture and analyze network traffic to extract credentials, session tokens, flags, or other sensitive data in transit. Load when the objective involves intercepting traffic between hosts or observing network communications.

Use this skill when a task requires identifying hosts, open ports, or running services on a target network.

any task where you have a shell on a Linux target and need to escalate privileges.

Use this when you need to perform bruteforce attacks. Note that bruteforce attacks are most common in CTF environment, avoid bruteforce attacks during real assessments.

Produce a voice contract from operator-curated exemplars (Phase 10). Triggered by exemplar paths, voice intent, or draft lint failure.

Per-company trust state procedure (learning / trial / operating). When a live outreach tool refuses, names the canonical draft replacement.

Postgres performance optimization and best practices from Supabase. Use this skill when writing, reviewing, or optimizing Postgres queries, schema designs, or database configurations.

Phase 11 procedure — capabilities → set_strategy_inputs → plan → apply → approve, plus 3-path blocker resolution (ask / build / defer). Covers WHOLE business surface via injected OPERATIONAL CONTEXT, not just what_we_sell.

Marketing-strategy foundations distilled from the Phase 11 strategy generator. Use BEFORE drafting a strategy or proposing tactics so output reflects the PESO / RACE / STDC / JTBD frameworks and avoids generic agency clichés. Pairs with the `company_plan` tool — this skill is the meta-grounding; the tool runs the full LLM strategy generation.

Use when user asks to "build a Solana dapp", "write an Anchor program", "create a token", "debug Solana errors", "set up wallet connection", "test my Solana program", or "deploy to devnet". End-to-end Solana development playbook covering wallet connection, Anchor/Pinocchio programs, Codama client generation, LiteSVM/Mollusk/Surfpool testing, and security checklists. Prefers framework-kit (@solana/client + @solana/react-hooks) for UI, wallet-standard-first connection (incl. ConnectorKit), @solana/kit for client/RPC code, and @solana/web3-compat for legacy boundaries.

React and Next.js performance optimization guidelines from Vercel Engineering. This skill should be used when writing, reviewing, or refactoring React/Next.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements.

Canonical workflow for "drive my business" / "operate this company". Single entry point — branches internally to onboard (new), Phase 11 plan (existing without strategy), or execute (existing with strategy).

React composition patterns that scale. Use when refactoring components with boolean prop proliferation, building flexible component libraries, or designing reusable APIs. Triggers on tasks involving compound components, render props, context providers, or component architecture. Includes React 19 API changes.

Audit animation code against Disney's 12 principles adapted for web. Use when reviewing motion, implementing animations, or checking animation quality. Outputs file:line findings.

指导如何可靠使用 subagents、多个 Agents、并行 Agent 审查、集群搜索和项目分片处理。当用户要求使用 Agents/SubAgents、并行 Agent、对抗审查、多角色审查、集群搜索、项目分片处理，或明确说出“进入agents approve迭代模式”时使用。

通过官方 getnote CLI 连接得到大脑，完成浏览器授权、连接诊断、CLI 升级，以及保存、查询、搜索和管理真实笔记。用户要保存链接/图片、上传文件到知识库、查询文件限制、读取标记/发芽报告/时间线、整理知识库/文件夹、订阅博主、管理标签，或明确要求登录、诊断或升级时使用；不会自行安装或更新 Skill。

React and Next.js performance optimization guidelines from Vercel Engineering. This skill should be used when writing, reviewing, or refactoring React/Next.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements.

Tauri v2+ cross-platform app development with Rust backend. Use when configuring tauri.conf.json, implementing Rust commands (#[tauri::command]), setting up IPC patterns (invoke, emit, channels), configuring permissions/capabilities, troubleshooting build issues, or deploying desktop/mobile apps. Triggers on Tauri, src-tauri, invoke, emit, capabilities.json.

Tauri development guidelines for building cross-platform desktop applications with TypeScript, Rust, and modern web technologies

TanStack Query (React Query) best practices for data fetching, caching, mutations, and server state management. Activate when building data-driven React applications with server state.

Powerful asynchronous state management, server-state utilities, and data fetching for TS/JS, React, Vue, Solid, Svelte & Angular.

Use when finishing a feature, fixing a bug, before committing React code, or when the user types `/doctor`, asks to scan, triage, or clean up React diagnostics. Covers lint, accessibility, bundle size, architecture. Includes a regression check and a full local-triage workflow that fetches the canonical playbook.

Reach for the react-call library (createCallable) when building UI that resolves a value back to its caller — confirmations, dialogs, form modals, toasts, notifications, context menus, pickers. Use when a React task involves any such "await the UI" interaction, when code imports createCallable, useMutationFlow, react-call/host, or react-call/vite, or when the user mentions react-call or Callables. If react-call isn't a dependency yet but the problem fits, propose adding it. Covers Declare→Root→Call, call vs upsert, mutation flow, multi-preview Hosts, SSR, and the single-Root rule.

Verify Next.js runtime behavior after editing app code. Use this skill to confirm a change actually works in a running app — not just that it compiles or type-checks. Combines /_next/mcp (Next.js's view) with agent-browser (the browser's view). Requires a running `next dev`.

Search LinkedIn, Hacker News, and Twitter/X for jobs with connections, hiring manager insights, and preference-based scoring. Use when the user wants to find jobs, search for positions, or explore job opportunities.

Set or update job-search preferences such as titles, salary, remote work, and filters for the other Job Apply skills.

Fill out job applications automatically using your resume. Use when the user wants to apply for jobs on LinkedIn Easy Apply, Greenhouse, Ashby, Lever, Rippling, or Workday.

Manage Job Apply's local profile, reusable answers, application history, and resumable sessions. Use whenever a Job Apply workflow needs to initialize, migrate, read, or update persistent applicant data.

Writing documents for agents. Use when creating or editing skills, or modifying AGENTS.md or CLAUDE.md.

Generate an interactive bash wizard that walks a human through steps only they can perform. Use when provisioning infrastructure, setting up credentials or CI secrets, walking an unfamiliar third-party dashboard, or running a one-off migration or cutover. Don't invoke this for steps the agent can perform itself.

Plan a huge chunk of work (more than one agent session can hold) as a shared map of decision tickets on your issue tracker, and resolve them one at a time until the way to the destination is clear.

Stop. That last message did not land: re-pitch it.

Which Platypus frontend component a UI state uses, and how it reads — empty states (EmptyCard vs ListState), their icon, title, description and buttons. Use when adding or changing a screen, list or section in apps/frontend that can be empty or fail to load.

Move issues and external PRs through a state machine of triage roles, categorise, verify, grill if needed, and write agent-ready briefs.

Break a plan, spec, or the current conversation into a set of tracer-bullet tickets, each declaring its blocking edges, published to the configured tracker (edges as text in one file per ticket locally, or native blocking links on a real tracker).

Turn the current conversation into a spec and publish it to the project issue tracker: no interview, just synthesis of what you've already discussed.

Turn a decision you can't fully answer into a questionnaire for someone else to fill in.

Teach the user a new skill or concept, within this workspace.

Test-driven development. Use when the user wants to build features or fix bugs test-first, mentions "red-green-refactor", or wants integration tests.

Manages shadcn components and projects — adding, searching, fixing, debugging, styling, and composing UI. Provides project context, component docs, and usage examples. Applies when working with shadcn/ui, component registries, presets, --preset codes, or any project with a components.json file. Also triggers for "shadcn init", "create an app with --preset", or "switch to --preset".

Configure this repo for the engineering skills: set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.

Build a throwaway prototype to answer a design question. Use when the user wants to sanity-check whether a state model or logic feels right, or explore what a UI should look like.

The final gate before a release is cut — go green, reconcile the release PR against what actually landed, sweep what CI can't see, check the roadmap and ADR statuses, optionally deep-review, then return a ship-or-hold verdict.

Platypus tools and tool sets — writing a tool, contributing a tool set from a plugin, scoping tools to a workspace, sharing a tool across sets, chat icons, and custom tool UI. Always load this skill when the user mentions tools or tool sets.

Scan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.

Implement the result of /to-spec and /to-tickets in code.

Implement a piece of work based on a spec or set of tickets.

Remove signs of AI-generated writing from text. Use when editing or reviewing text to make it sound more natural and human-written. Based on Wikipedia's comprehensive "Signs of AI writing" guide. Detects and fixes patterns including: inflated symbolism, promotional language, superficial -ing analyses, vague attributions, em dash overuse, rule of three, AI vocabulary words, passive voice, negative parallelisms, and filler phrases.

Grill the user relentlessly about a plan, decision, or idea. Use when the user wants to stress-test their thinking, or uses any 'grill' trigger phrases.

Post-save conventions for Platypus frontend forms — where a save lands the user, and what the submit button is called. Use when adding or changing a form in apps/frontend, its submit button, or what happens after it saves.

Build and sharpen a project's domain model. Use when discussing codebase terminology, writing or editing a GLOSSARY.md, or recording or editing an ADR.