Create or edit code that is compliant with Hugging Face diffusers conventions, including models, pipelines, schedulers, tests, docs, and PR preparation targeting diffusers.

Guide and automate the Cog release process

Web app discovery — directory/file fuzzing, vhost discovery, JavaScript endpoint extraction.

Use when improving performance, latency, throughput, memory usage, or general efficiency. Start by defining target metrics, measuring comprehensively, attributing bottlenecks, validating with static analysis, and prioritizing macro-optimizations before micro-optimizations.

Translate constraint problems into SMT-LIB2 or Z3 Python API code. Handles common problem classes including scheduling, graph coloring, arithmetic puzzles, and verification conditions.

Create and structure a new autonomous project — "/new-project <what project does>"

One-time setup for the commitments tracking system. Creates the workspace structure and schema docs, installs triage and digest missions, then excludes itself once `projects/commitments/README.md` exists.

One-time onboarding for the executive/manager commitment workflow — delegation, meeting prep, decision capture, daily digests. Creates a `commitments` project and two dashboard widgets, then excludes itself until its marker file is deleted.

Passive intelligence gathering without touching the target — DNS, WHOIS, subdomain enumeration, Certificate Transparency, technology fingerprinting, ASN mapping.

MUST use when writing Ansible playbooks.

End-of-session reflection. Reviews friction encountered during the session and proposes updates to docs/ to capture lessons learned.

Used to analyze Apache ShardingSphere community issues. Emphasizes root-cause-first and evidence-first classification before conclusions, and produces copy-ready GitHub issue replies in the voice of an Apache ShardingSphere community maintainer.

Finds open PRs in the dotnet/maui and dotnet/docs-maui repositories that are good candidates for review, prioritizing by milestone, priority labels, partner/community status.

QR-code phishing (Quishing) — generate QR lures embedding credential-harvest URLs, embed in PDF or email bodies, bypass email gateway URL scanners that cannot parse QR image payloads.

Run cargo check on the current Rust project to find compile errors

Web crypto exploitation — padding-oracle (Vaudenay), AES-CBC bit-flipping / IV manipulation, AES-ECB pattern attacks (cut-and-paste, prefix/suffix recovery), HMAC bypass, hash-length extension, JWT alg confusion. Covers detection signals, working in-file Python harnesses (concurrent.futures, timeout=5, python3 -u, bounded request budget), and the confirm-oracle gate that must fire before iteration.

PROFINET (L2 EtherType 0x8892 / DCP) attack playbook — DCP Identify-All broadcast enumeration, device fingerprinting, station-name and IP reassignment (breaks IO-controller mapping), flash-LED physical location, factory-reset, RT frame injection/replay for cyclic-IO spoofing. Siemens/EU fieldbus peer of S7Comm; requires same L2 broadcast domain.

Maintain the OpenClaw memory wiki vault with deterministic pages, managed blocks, and source-backed updates.

Benchmark, diagnose, and optimize OpenClaw test and plugin-suite runtime, import hotspots, CPU/RSS, heap growth, and slow coverage paths.

Prepare, snapshot, run, rerun, debug, or interpret OpenClaw Parallels guest install, onboarding, gateway smoke, and upgrade checks across macOS, Windows, and Linux.