Validates inputs, sanitizes outputs, enforces permission boundaries, and detects prompt injection. Use when performing security reviews, protecting against adversarial attacks, hardening agent safety, or validating untrusted data/code.

ClickHouse database patterns, query optimization, analytics, and data engineering best practices for high-performance analytical workloads.

Access NCBI GEO for gene expression/genomics data. Search/download microarray and RNA-seq datasets (GSE, GSM, GPL), retrieve SOFT/Matrix files, for transcriptomics and expression analysis.

Generic release assistant — analyzes repo release rules, caches them in .omc/RELEASE_RULE.md, then guides the release

Install or refresh oh-my-claudecode for plugin, npm, and local-dev setups from the canonical setup flow

Generate a Node.js (Express) backend API with Swagger/OpenAPI documentation. Use for: REST APIs, backend scaffolds, CRUD endpoints, in-memory or PostgreSQL storage. Triggers: build a backend API, generate Express endpoints, backend with Swagger, Node.js API, create endpoints, REST API.

Deactivate DuploCloud context and clear credentials

Production deployment principles and decision-making. Safe deployment workflows, rollback strategies, and verification. Teaches thinking, not scripts.

Socratic questioning protocol + user communication. MANDATORY for complex requests, new features, or unclear requirements. Includes progress reporting and error handling.

Create custom layer types by extending BaseLayerView2D/3D with WebGL rendering, custom tile layers, and blend layers. Use for advanced visualizations and custom data sources.

Configure FeatureTable widget and FormTemplate with input elements. Use for displaying attribute data in tables, customizing edit forms, and configuring field inputs.

Scaffold ArcGIS Maps SDK applications with TypeScript and Vite. Includes both a minimal quick-start setup and a production-ready configuration with ESLint, Prettier, git hooks, and GitHub Actions CI/CD.

Build and configure a resilient command-and-control infrastructure using BishopFox's Sliver C2 framework with redirectors, HTTPS listeners, and multi-operator support for authorized red team engagements.

Parse Apache and Nginx access logs to detect SQL injection attempts, local file inclusion, directory traversal, web scanner fingerprints, and brute-force patterns. Uses regex-based pattern matching against OWASP attack signatures, GeoIP enrichment for source attribution, and statistical anomaly detection for request frequency and response size outliers.

Master Python asyncio, concurrent programming, and async/await patterns for high-performance applications. Use when building async APIs, concurrent systems, or I/O-bound applications requiring non-blocking operations.

When the user wants a summary of what's trending on Product Hunt, Hacker News, Indie Hackers, or other product/startup communities. Also use when the user mentions "what launched today", "trending products", "HN front page", or "keep up with the market".

When the user needs to design, improve, or audit a post-signup activation flow to get new users to their first value moment. Activate when activation is lagging, time-to-value feels excessive, or first sessions lack impact.