How to safely update SQLx offline query cache. MUST use when SQL queries change.

Svelte coding guidelines for the Windmill frontend. MUST use when writing or modifying code in the frontend directory.

Rust coding guidelines for the Windmill backend. MUST use when writing or modifying Rust code in the backend directory.

Update OS version references in Helix queue definitions to add new versions, replace EOL versions, or audit coverage against the supported-os matrix. USE FOR: adding new OS versions to Helix queues, replacing EOL OS versions, upgrading "oldest" or "latest" version references, auditing Helix coverage. DO NOT USE FOR: creating new container images (that's dotnet-buildtools-prereqs-docker), updating supported-os.json (that's the update-supported-os skill in dotnet/core).

Investigate CI failures for dotnet/maui PRs and the nightly/official signed build — build errors, Helix test logs, and binlog analysis. Use when asked about failing checks, CI status, test failures, 'why is CI red', 'build failed', 'what's failing on PR', 'is this PR ready to merge', Helix failures, device test failures, or 'nightly is broken', 'nightly build failing', 'inflight feed stale', 'dogfood feed stopped updating', 'official build failed'.

Migrate several repos to a target nx version (e.g. 23.0.0-beta.25) in one coordinated pass — delegates `nx migrate` + migrations to a Polygraph child agent per repo, then pushes branches and opens linked draft PRs. Use when asked to upgrade/migrate multiple repos to a specific nx version, or when working a Polygraph session whose goal is an nx version bump across repos.

Create a GitHub issue in the tldraw repository from a user description, then mature it through follow-up questions. Use when the user invokes issue, asks to create an issue, report a bug, file a feature request, or answers follow-up questions for an issue created by this skill.

Searches and injects relevant memories into context before starting work on a task. Use when beginning a new task, switching context, or when project history, past decisions, or coding conventions need to be loaded.

Create form-based UI for your Command Palette extension using Adaptive Cards. Use when asked to add forms, user input fields, toggle switches, text inputs, dropdown menus, data entry, surveys, configuration dialogs, or interactive content pages. Supports the Adaptive Cards Designer for visual form building.

Toolkit for generating PowerToys stable or preview release notes from GitHub milestones, commit ranges, or Azure DevOps release-candidate builds. Use when asked to create release notes, summarize milestone PRs, generate changelog, prepare a draft preview release, calculate PR deltas across main and stable, update release documentation, manage PR milestones, or prepare and validate release assets.

Path traversal and Local File Inclusion (LFI) — arbitrary file reading via directory traversal, PHP filter/input/data wrappers for RCE, log poisoning, static resource disclosure, and information leakage. Use for any challenge involving file path manipulation, ../ traversal, local file read, PHP wrappers, or sensitive file disclosure.

DNS rebinding attack to bypass browser same-origin policy and reach IMDS/localhost/internal services: TTL=0 rebind mechanics, rbndr.us/singularity tooling, browser DNS cache pinning, chaining into AWS/GCP/Azure IMDS credential pivot. Use when SSRF is blocked but a victim browser can be induced to make requests, or when a localhost service is exposed. Triggers on: 'dns rebinding', 'rebind', 'DNS TTL 0', 'singularity', 'rbndr', 'localhost bypass via browser', 'imds via browser', 'SSRF via DNS'.

Known CVE exploitation — fingerprint CMS/framework/plugin version, look up CVE candidates via cve_lookup, retrieve PoCs via cve_poc_lookup, adapt the public exploit to the target, and confirm RCE. Use whenever the challenge tag is `cve`, recon fingerprinted a versioned service, or the challenge name hints at known vulnerable software (WordPress, Joomla, Apache Struts, Spring4Shell, Log4j, etc.).

Hunt ReDoS (CWE-1333, Catastrophic Backtracking) — identify regexes with nested quantifiers or overlapping alternation that cause super-linear matching time, trace tainted input paths to regex sinks, demonstrate timing PoC, and validate with response-time delta. Covers PCRE/RE2/V8/Python re engine differences. Triggers on: 'ReDoS', 'regex denial', 'catastrophic backtracking', 'redos', 'regex complexity', 'nested quantifiers', 'regex amplification', 'CWE-1333'.

Use when the user asks the openkb chat to make a deck / slide presentation / PPT / slides / 演示稿 / 幻灯片 from their compiled KB content AND wants a dark, high-tech, neon / glow / glassmorphism look (赛博 / 科技风 / 暗色 / 霓虹 / 炫酷). Generates a polished single-file HTML deck in the Aurora Glass visual direction (near-black background, teal/sky/magenta/amber neon accents, glassmorphism panels, aurora gradient atmosphere) — opened in a browser, full-screened, shared. For the warm, printed, serif look use openkb-deck-editorial instead. Does NOT apply to generating skills (`openkb skill new`), research reports, or scrolling long-form documents.

SEO drift monitoring — snapshot a site's SEO state and detect regressions over time. Captures a baseline (rankings/positions, indexed page count, titles & meta descriptions, canonical/robots directives, schema presence, key on-page elements) and on later runs diffs against it to surface what changed: ranking drops, pages that fell out of the index, titles/metas that were accidentally overwritten (a CMS/redeploy classic), canonicals or noindex flipped, schema that disappeared. Use this skill when the user wants to monitor SEO over time, catch regressions after a site change / migration / redeploy, set a baseline, diff against a previous state, or asks "what changed on my site's SEO" or "did my redesign break SEO". Trigger on: "SEO drift", "SEO monitoring", "track SEO over time", "did my site change break SEO", "after migration SEO", "SEO regression", "baseline my SEO", "compare SEO to last month", "my titles changed", "pages fell out of the index". For a one-time full audit use /seo-analysis.

Search the public web through Serper instead of the built-in WebSearch tool. Use when an agent needs current information, general web sources, or URLs not available from local files and project APIs. SERPER_API_KEY is available in the environment.

Polish, restructure, or translate academic prose into Nature-leaning English using the paper-architecture and writing-strategy principles from Scientific English Writing & Communication, with phrase-level support from Academic Phrasebank. Use whenever the user asks to polish a manuscript paragraph, abstract, introduction, results, discussion, conclusion, title, methods section, or Chinese academic draft for publication-quality English.

Send feedback to the Nexu team. Use when the user says /feedback followed by their message.

Process audio recordings, meeting transcripts, podcasts, or lectures. Runs an intake interview (date, mode, speakers, language) then processes into structured notes with action items, decisions, and glossary. Triggers: EN: "transcribe", "I have a recording", "process this audio", "meeting notes from recording", "summarize the call", "lecture notes", "podcast summary". IT: "trascrivi", "ho una registrazione", "processa questo audio", "note della riunione", "riassumi la call". FR: "transcrire", "j'ai un enregistrement", "résumer l'appel". ES: "transcribir", "tengo una grabación", "resumir la llamada". DE: "transkribieren", "Aufnahme verarbeiten". PT: "transcrever", "tenho uma gravação".