Explore

ACL-family venue paper formatting (ACL, EMNLP, NAACL, EACL, AACL, COLING, ARR, Findings) — activate when the user wants any ACL-series template setup, migration, or format fixes.

AAAI paper formatting — activate when the user wants AAAI template setup, migration, or formatting/compilation fixes.

当用户要下载或管理微信公众号文章时使用本技能。支持订阅同步、微信收藏和链接导入；互动数据仅在用户微信短时会话有效时补充指标与精选评论。优先本地运行；不要扩展成内容改写、总结、SaaS 或云服务。

Install or upgrade Scope Recall when the user asks the agent to set it up, update it, or migrate old Scope Recall memories. Automatically distinguish first-time installation from legacy migration.

Use when the user asks what Scope Recall remembers about them, where a memory came from, whether it still holds, or wants one corrected, muted or deleted ("你记了我什么", "这条是我说的还是你总结的", "现在还有效吗", "改掉", "别再主动提", "删掉"). Says what a deletion takes with it before doing it.

Turn vulnerability notes, disclosure reports, PoCs, source code, or Codex Security findings into self-contained, sceptically validated, natural-sounding vulnerability reports. Use for one vulnerability or a disclosure campaign; a Codex Security scan is optional.

Use only when the user explicitly requests verification that a security fix remediates a reported vulnerability. Do not invoke automatically while implementing fixes, reviewing ordinary code changes, or running tests. Do not use for non-security fixes, candidate finding validation, or full repository scans.

Use when Codex is already in the validation phase of a security scan or the user explicitly asks to determine whether one or more candidate security findings are valid. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

Use when the user supplies or imports existing security findings, vulnerability reports, or security/vulnerability Jira/Linear tickets from scanners, advisories, GitHub, Atlassian Rovo, Linear, or similar backlog sources and wants static repo-impact triage. Do not use for discovery, duplicate-bug triage, validation, or fixes.

Track validated Codex Security findings in Linear, Jira, GitHub issues, or draft GitHub security advisories. Use it for one finding or an explicitly selected batch of up to 25 findings tracked as Linear, Jira, or GitHub issues. Includes duplicate checks, exact previews, approval-gated writes, and readback. Do not use it for scans or fixes.

Review a pull request, commit, branch diff, or working-tree patch for security vulnerabilities.

Develop evidence-backed structural and architectural security hardening proposals from vulnerability disclosures, supplied findings, incident or assessment documents, source code, or a completed Codex Security scan. Use when a user asks for systemic improvements, alternatives beyond per-finding patches, before-and-after security architecture views, engineering tradeoff analysis, or an implementation-ready plan for a selected hardening option. Also use automatically after a Codex Security scan with reportable findings when the top-level scan workflow requests final-report hardening guidance.

Use when the user explicitly asks to fix and verify a validated or plausible security finding. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

Use when Codex is already in the finding-discovery phase of a security scan or the user explicitly asks to discover candidate security findings in a repository or code change. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

Define, review, or update SECURITY.md guidance for a repository or component. Use when the user wants to clarify what Codex Security should review, what is out of scope, which security properties must hold, or whether existing guidance still matches the code.

Use when the user asks for a deep, exhaustive, multi-pass, or variance-reducing repository-wide or scoped-path Codex Security scan. Run repeated complete independent Standard scans with the Codex Security deep-scan tool, which aggregates their validated findings and prepares the canonical artifacts; then complete the same scan once. Do not use for PRs, commits, branch diffs, or working-tree diffs.

Use when Codex is already in the attack-path-analysis phase of a security scan or the user explicitly asks to trace a security finding from source to sink and calibrate severity. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

Send a message to another VelaTerm session when the user asks you to tell, notify, or send instructions to that session. Messages appear in the recipient's chat with the sender's agent icon and session name. Use --report when an assigned planning/execution workflow requires submitting an executor's result for review. Available only inside VelaTerm-hosted local sessions.

You CAN see whether other vlx-term sessions are busy. This reports each session's current state — working, asking for permission, waiting for input — straight from the same status the sidebar shows. Use it when the user asks how a run or another session is doing ("is it done yet", "what are they up to", "how is the orchestration going") in any language, or when checking execution-session activity. Read-only and instant; nothing is sent to any session. Available only inside vlx-term-hosted sessions.

Same as /vspawn, but **opens a dedicated git worktree for the child session** (equivalent to vspawn --worktree). Only use when the user explicitly invokes /vspawn-tree or $vspawn-tree; never auto-trigger. This is a real session run by its own process in the vlx-term left-panel tree — not an in-process sub-agent, and not a background Task. Available only inside vlx-term-hosted sessions.

Explicitly spawn a standalone child session under the current vlx-term session, passing the task in as its first message (mirrors spawn_task). With --plan-execute, create a planner, persistent executors and an optional separate reviewer; --split-tasks enables user-confirmed task decomposition. **Runs in the current directory by default, without a git worktree** (use vspawn-tree for a worktree). Only use when the user explicitly invokes /vspawn or $vspawn; never auto-trigger. This is a real session run by its own process in the vlx-term left-panel tree — not an in-process sub-agent, and not a background Task. Available only inside vlx-term-hosted sessions.

Read a VelaTerm session's saved properties and parent-child relationships. Use for ordinary or agent sessions when the user asks who spawned a session, which child sessions it has, or what configuration is saved on it. Can inspect the current session or another session by ID or name. Read-only: does not open, launch, message or interrupt any session.

You CAN read other sessions' conversations. Sessions are not isolated from you here: this reads any other vlx-term session's transcript, whether or not it is running. Use it whenever the user points at another conversation — naming a session, or saying things like "that other session", "last time", "the other branch", "how did we solve this before", "what did it decide" — in any language. Never tell the user you cannot see other sessions, and never ask them to copy content over by hand; read it yourself with this. Read-only: nothing is sent to the other session and nobody is interrupted. Available only inside vlx-term-hosted local sessions.

Query the current project's CodeGraph and the VelaTerm knowledge base only when the user explicitly requests vkb, including /vkb or $vkb. Never auto-trigger for code analysis, dependency tracing, or design history. Available inside VelaTerm sessions.

Query VelaTerm plan-execute workflows by session: find planner, executor and optional reviewer IDs, tasks, states, rounds, delivery receipts and saved session properties. Use when a workflow ID is unknown or the user asks which execute sessions belong to a plan session. Lookup is read-only; it does not dispatch, message, stop or accept work.

Ask a focused question about another vlx-term session without importing its full conversation into the current context. This is the skill form of `vrefer SESSION --ask "QUESTION"`. Use it when the target session is known and the user needs a conclusion, decision, result, reason, or status from it. Read-only: nothing is sent to the target session and nobody is interrupted. Available only inside vlx-term-hosted local sessions.

当用户纠结要不要学某个东西、学到什么程度，或在做时间/精力/项目取舍时使用。用「简易策略」先逼问要解决的既定问题，检验现有知识能否搞定，评估知识贬值速度与 ROI，用「探索 vs 应用」判断该学新的还是用现有的，给出「学 / 不学 / 只学最小够用」的结论，避免囤积会贬值的知识。触发场景：要不要学 X、值不值得深入、学到什么程度够、时间不够该学啥、该深挖还是够用就行。

当用户要系统学一个新领域、不知道从哪入手、或担心「学得不够系统」时使用。用「知识图谱学习法」和用户一起构建该领域的概念/用途/父子节点图谱（自己建图的过程本身就是学习），标出复用价值最高的节点和「从常识就能入门的点」，给出有效学习路径并回答「学到哪算够」。触发场景：系统学 X 领域、从哪开始学、学得不系统、想要 X 的全貌、规划学习路径、这个领域有多大。

当用户学完一个东西想自查是否真懂、或觉得「好像懂了」但不确定时使用。用「费曼学习法」让他用自己的话把概念讲出来，你扮好奇学生专挑他含糊/跳过的地方追问，把「讲不顺的模糊处」揪出来作为没真懂的漏洞，定位是缺前置知识还是没想透，判断理解是否闭环。触发场景：我学完了考考我、自查一下、我好像懂了、我讲讲你看对不对、检验我的理解、这个我真懂了吗。

用户学任何新概念/新技术/新理论的默认深度入口——一次性用五个视角把概念讲透并帮他选深入方向：crossover 用已会的撬动、occam 框定该学多深、graph 建知识地图、prototype 最小原型迭代、feynman 拷问检验。触发场景：我想学 X、理解 X、X 是什么、讲讲 X、搞懂 X、学一下 X、深入 X、给我讲讲 X。除非用户明确只要某一个视角（那时改用对应的单个 learn-* skill）。

当用户学习或接触一个新概念/新技术/新算法/新领域时使用（尤其感到陌生或有点难时）。用「跨界原则」拿用户已掌握的知识快速撬动新知识——指出他其实已经学过的同一个东西（换了名字）、结构同构的旧知识、能解释新知识的已有知识，并点出新概念体现的跨领域元知识模式。让「学新东西」变成「发现你已经会了一半」。触发场景：学 X、接触 X、这个好难、X 是什么、帮我理解 X。

Use when 用户想以一对一苏格拉底导师的方式系统学习一个课题——开一门新课、推进课题的下一篇、提交学习反馈或说「我读完了」、或整理/查看学习日志。基于 Bloom 2 Sigma 的交互式学习系统。触发词：开个文件夹学X、我想学X、帮我学X、继续、下一篇、我读完了、整理学习、查看学习日志、interactive Socratic tutoring、Bloom 2 sigma learning。

写 git 提交信息、整理提交历史时使用——Conventional Commits 的格式、类型选择和拆分原则。

Token analysis — mint/burn authority, permit, fee-on-transfer, rebasing, hooks, upgradeability. Load for any token, especially ones used as collateral, vault assets, or bridge assets.

Multi-agent Web3 research orchestration — specialist roles, coordinator merge rules, independent verification. Load when the swarm tool is available for a Web3 engagement.

Signature analysis — EIP-712 domain separation, nonces, replay, malleability, multisig quorum. Load for permit, meta-transactions, off-chain orders, or multisig-controlled assets.

Web3 protocol reconnaissance — contract maps, proxy/admin discovery, privilege inventories, asset-flow graphs, trust boundaries. Load at the start of any Web3 engagement.

Oracle analysis — staleness, TWAP windows, single-source spot prices, decimals, manipulation cost vs gain. Load for any price-dependent mint, borrow, liquidation, or settlement logic.

Lending-market and AMM/DEX analysis — collateral valuation, health factors, liquidation, reserve/invariant manipulation, LP accounting, callbacks and hooks. Load for lending, borrowing, liquidity pools, or concentrated liquidity.

Web3 incident knowledge base — root causes, violated invariants, attack sequences, detection strategies. Load for pattern analogies during hypothesis generation.

Governance and proxy/upgrade analysis — voting power, timelocks, upgrade authorization, storage layout, initialization. Load for DAOs, timelocked admin, or any upgradeable contract.

Web3 output templates — protocol model, attack path, finding, evidence, verification report. Load when writing up models or findings.

Multi-transaction exploit chains and cross-contract composition — call graphs, state tracking, primitive composition. Load when single-function analysis stalls or primitives need combining.

Economic modeling — flash-loan capital, profit equations, manipulation cost, liquidation games. Load before calling anything an exploit.

DeFi accounting analysis — ERC4626 share inflation, donation attacks, rounding, decimal mismatch, desync, phantom value, fee/reserve errors. Load when vaults, shares, or paired state variables exist.

Bytecode/unverified-contract analysis, invariant derivation, and the 12-gate verification protocol. Load when source is missing or before classifying any finding as confirmed.

Bridge and cross-chain analysis — message validation, replay, validator quorum, mint/burn authorization, locked-vs-minted accounting. Load for bridges, messaging layers, and cross-chain asset representations.

Deep Web3/DeFi security research — protocol modeling, asset-flow graphs, invariant reasoning, accounting/oracle/bridge/governance analysis, multi-transaction exploit chains, economic viability checks, and 12-gate verification. Use for any Solidity/EVM audit, DeFi review, bridge/cross-chain assessment, or when hunting fund-loss, insolvency, or privilege-escalation bugs.

OCR image files using the Qwen VL model via the bundled scripts/ocr.py (lives in this skill's directory, NOT your cwd). Use when the user asks to extract text from an image, perform OCR on a photo or screenshot, or recognize characters in an image file (.jpg, .jpeg, .png, .gif, .webp). Requires QWEN_API_KEY and QWEN_BASE_URL (env vars, or a .env in the skill directory).

使用 agentao-kanban 看板进行任务管理（拆任务 / 状态流转 / 后台服务 / 看产物）。 本技能负责：① 初始化 .kanban/ 项目 ② 把需求拆成原子卡片入板 ③ 推动状态流转 INBOX → READY → DOING → REVIEW → DONE ④ 启停 daemon 与 Web UI ⑤ 察看卡片状态与产物。 触发关键词（中/英）：看板 / kanban / 任务管理 / task board / 拆任务 / 任务卡 / 排期 / WIP / dispatcher / orchestrator。 复合触发短语（一键启停）： • "启动 kanban" → daemon（mock 执行器，后台）+ Web UI（自动开浏览器） • "启动 kanban 真跑" → daemon（--executor agentao，真调 sub-agent）+ Web UI • "停止 kanban" → 先停 Web UI，再停 daemon

Use for deterministic molecule understanding, graph-level editing, generation, and validation with MoleCode — an explicit Mermaid graph in which every atom and bond is a typed, named node/edge. Converting SMILES to MoleCode exposes the molecule as explicit atoms, hydrogen counts, bonds, bond orders, stereochemistry (R/S, E/Z), aromatic/ring systems, functional groups, and linkers, so an agent can locate substructures and plan edits far more reliably than from linear SMILES. Trigger when the task is to understand or edit a molecular structure, replace a functional group, add/delete/substitute atoms, close or fuse rings, change a linker or scaffold, count atoms/elements, check formula/connectivity/ valence, design a molecule under constraints, or convert between SMILES and MoleCode. Also covers polymers (PSMILES repeat units) and Markush structures (variable R-groups). Prefer MoleCode graph inspection and editing before hand-writing SMILES; the bundled script provides the conversion and validation API.

Performs comprehensive SEO audits on websites covering technical SEO, on-page optimization, off-page signals, and performance metrics. Generates actionable reports with prioritized recommendations.

Generates qualified B2B leads through systematic research, data collection, and scoring. Delivers structured lead lists with contact information and qualification scores.

Handles invoice creation, payment link generation, payment status tracking, and automated reminders via Stripe API. Supports multi-currency billing and recurring payments.

Runtime protection layer for AI agents. Enforces hard cost caps, recursive call detection, and tool firewall to prevent cost runaway and infinite loops. Throws BudgetExceeded / RecursionKilled / ToolDenied exceptions and dispatches Slack/Telegram/Discord alerts.

Assess an immutable patch artifact's program impact, regression risk, and auto-merge eligibility. Use for generated patch files, provider pull-request diffs, or commit ranges when reviewers need evidence about affected runtime paths, contracts, tests, and recoverability. This skill is read-only and does not generate, edit, apply, push, or merge the patch.

Trigger Pattern PDA flag detected (seeds/bump/find_program_address usage) - Inject Into Breadth agents, depth agents

Trigger Pattern CPI flag detected (invoke/invoke_signed/CpiContext usage) - Inject Into Breadth agents, depth agents

Trigger EXTERNAL_LIB flag detected (protocol uses third-party Move dependencies) - Used by Breadth agents, depth-external

X/Twitter public sentiment research. Searches X for real-time perspectives, market sentiment, expert opinions, breaking news, and community discourse. Use when: user asks "what are people saying about", "X/Twitter sentiment", "check X for", "search twitter for", "what's CT saying about", or wants public opinion on a stock, sector, company, or market event.