Performs authorized fuzz testing of binary formats and network protocols to uncover parser vulnerabilities, memory safety defects, and denial-of-service conditions. Use when assessing protocol handlers, file parsers, and service robustness against malformed inputs.

Automatically update Clawdbot and all installed skills once daily. Runs via cron, checks for updates, applies them, and messages the user with a summary of what changed.

Spotify control via uni CLI. Use when user wants to control Spotify playback, search music, view playlists, or check what's playing. Note: Playback control (play/pause/next/prev/queue/volume) requires Spotify Premium. Search and playlists work for all users.

Research tools via uni CLI. Use when user wants to search the web, find academic papers, browse Reddit, read Hacker News, or look up Wikipedia. Services: exa (web search), arxiv (papers), reddit, hn (Hacker News), wiki (Wikipedia).

Diagnose Kotlin + Spring failures from stack traces, startup logs, runtime logs, and related metric anomalies, then separate root cause from wrapper exceptions and propose safe next steps. Use when the application fails to start, an endpoint crashes, logs are noisy or deeply nested, or the agent must produce both a quick mitigation and a proper long-term fix without guessing.

Design and audit Spring Security configurations for Kotlin plus Spring services, including filter chains, JWT or OAuth2 resource server setup, method security, CORS, CSRF rationale, and public endpoint exposure. Use when adding or reviewing authentication and authorization, narrowing access rules, validating token handling, or checking for insecure defaults and accidental exposure.

Diagnose Spring application context startup failures, bean graph problems, missing or duplicate beans, circular dependencies, conditional auto-configuration mismatches, and profile-related wiring issues in Kotlin + Spring projects. Use when the app does not start, a bean is not created or is created unexpectedly, auto-configuration behaves strangely, or a minimal DI fix is needed instead of a broad rewrite.

Create and edit presentation slide decks (`.pptx`) with PptxGenJS and render/validation utilities. Use when tasks involve building a new PowerPoint deck, recreating slides from screenshots/PDFs/reference decks, modifying slide content while preserving editable output, adding charts/diagrams/visuals, or diagnosing layout issues such as overflow, overlaps, and font substitution.

Plan safe database schema evolution and zero-downtime change rollout for Kotlin plus Spring systems using Flyway, Liquibase, or equivalent migration tooling. Use when changing tables, columns, constraints, indexes, or data shape in systems with live traffic, rolling deploys, large datasets, or backward-compatibility requirements between old and new application versions.

Use when the task requires automating a real browser from the terminal (navigation, form filling, snapshots, screenshots, data extraction, UI-flow debugging) via `playwright-cli` or the bundled wrapper script.

Use when the user asks to create, scaffold, or edit Jupyter notebooks (`.ipynb`) for experiments, explorations, or tutorials; prefer the bundled templates and run the helper script `new_notebook.py` to generate a clean starting notebook.

Diagnose and design JSON serialization and deserialization behavior for Kotlin plus Jackson in Spring applications. Use when DTOs fail to deserialize, default parameters or nullability behave unexpectedly, date-time or enum formats drift, polymorphic payloads are involved, PATCH semantics must distinguish null from absent, or ObjectMapper changes risk breaking existing API or message contracts.

Use the Figma MCP server to fetch design context, screenshots, variables, and assets from Figma, and to translate Figma nodes into production code. Trigger when a task involves Figma URLs, node IDs, design-to-code implementation, or Figma MCP setup and troubleshooting.

Load when debugging crashes, memory errors, data races, undefined behavior, or performance issues in C++ code, or when performing a systematic safety audit.

Maintain, debug, and recover MTGA's Trae native custom-model route. Use when Trae native integration fails, Trae updates shift ai_agent.dll hook offsets, errors such as 4028/4054/429 appear, native rewriter or SseOpenPayload URL rewriting needs diagnosis, or Codex needs to avoid repeating prior renderer-JS/private-protocol dead ends.

Scan an iOS/macOS Xcode project for common App Store rejection patterns before submission. Use when preparing an app for App Store review, after receiving a rejection from Apple, or when auditing metadata, subscriptions, privacy manifests, entitlements, or design compliance. Integrates with the asc CLI for metadata inspection.

Read-only evo run reporting. Use when the user invokes /evo:report, asks what happened overnight, asks what improved recently, asks for the best/frontier candidates, asks for a quick score chart without opening the dashboard, or wants the scatter plot in chat output. Never run benchmarks, gates, Slurm commands, evo run, or ad-hoc verification scripts for report requests.

Use for shot-by-shot planning, storyboard generation, camera coverage, blocking, and precise visual sequencing for multi-shot videos.

Use for combat, chase, transformation, impact-heavy, or high-kinetic action video prompts that need 15-second temporal slicing, exact hit marks, physical feedback, non-centered camera choreography, and cinematic impact readability.

在 DevUtils 工程（仓库布局契约 DEPS_ROOT=file/gradle、DEPS_MANIFEST=file/deps）中 新增或引用 Gradle 依赖时，先查 {DEPS_ROOT}/config.gradle、config_kotlin.gradle、 config_androidx.gradle 与 config_libs.gradle 是否已有坐标；按官方/非官方规则写入对应文件分组， 并在 {DEPS_MANIFEST}/deps_android.gradle 或 deps_project.gradle 中按现有风格引用。在用户要求添加 AndroidX、CameraX、Kotlin、Jetpack、第三方 Maven 依赖或修改 deps 清单时使用。