Guide for developing Go applications with github.com/lestrrat-go/jwx v4 — parse/sign JWTs, work with JWS/JWE/JWK, pick algorithms, and avoid the common footguns. For developers using jwx, not for developing the library itself.

Use when auditing domain authority, trust, or citation credibility; runs a peer-relative 40-item CITE profile with evidence coverage and verified manipulation/penalty veto checks. Not for page-level content quality — use content-quality-auditor; not for backlink profiling alone — use offsite-signal-analyzer. 域名权威/网站可信度

Use when the user asks to "map what our buyers believe", "capture the objections we keep hearing", or "find the switching forces that move the beachhead"; produces a belief map of the beachhead — held beliefs and mental models, the recurring objections and their reframes, and the JTBD four forces (push of the problem, pull of the new, anxiety of switching, habit of the present) — each item sourced from interviews or win-loss notes (User-provided) and labeled Measured / User-provided / Estimated, with any unverified quote or comparative claim marked "[needs source]" and routed to the claims candidates, never adjudicated here. Not for demographic or persona profiling — use audience-mapper; not for the positioning canvas — use positioning-truth-tracer. 受众信念/异议地图/切换四力/流失语言

Use when the user asks to "audit our brand narrative" or "is this message on-canon"; runs separate typed TALE truth, system, or effectiveness profiles and never averages them into one composite. Checks differentiation, canon, landing consistency, and evidence integrity. Not for launch readiness — use launch-readiness-auditor; not for social operations — use social-quality-auditor. 品牌叙事分层审计/发布前一致性放行

Use when the user asks to "author our durable brand message hierarchy", "build the brand message house that seeds the canon", or "define the main narrative, three pillars, and tagline for the whole brand"; produces the DURABLE brand message system — main narrative, three value pillars, per-persona proof points (each labeled Measured / User-provided / '[needs source]'), and the tagline/one-liner — that seeds the narrative-registry canon and from which every per-launch house derives. Not for a single launch's message house or PR-FAQ — use message-house-builder; not for claim adjudication — use offer-claims-registry; not for the change-narrative arc itself — use strategic-narrative-designer. 品牌消息屋/主叙事/三支柱/标语/持久叙事 canon

Use when the user asks to "score this influencer", "rank these creators for our campaign", or "tell me which influencer is the best fit"; produces the typed STAR Suitability (S) read plus a separately labeled campaign-fit ranking without mixing campaign-specific commercial fit into the Suitability read. Not for finding new influencers — use influencer-discovery; not for sending outreach — use outreach-manager. 达人适配度评分/创作者筛选排名

Use when the user asks to "build a preference center", "set up a frequency opt-down ladder", "give people a step-down instead of unsubscribe", or "design a topic/cadence preference page"; produces a preference-center field spec, a frequency/topic opt-down ladder (down-tier paths that substitute for a hard unsubscribe), a preference-to-suppression mapping, and a SEND N-dimension sub-item note on preference-center / frequency options offered. Not for the lifecycle flow map or cadence governance — use email-sequence-designer; not for the consent/suppression record itself — use consent-registry; not for computing EQS or ruling the N1 unsubscribe veto — use email-quality-auditor. 邮件偏好中心/降频阶梯设计/退订替代降档

Use when the user asks to "monetize my newsletter", "build a sponsorship rate card", or "model paid-subscription revenue"; produces a revenue model (paid tiers, ad/sponsorship inventory + CPM/flat rate card, referral/boost loops), a list-growth ↔ revenue projection, and honest-offer / disclosure checks for the SEND-D lever. Not for scoring the whole program or running D1 — use email-quality-auditor; not for the return math — use roi-calculator; not for the post-click page — use landing-optimizer. 邮件newsletter变现/赞助刊例/付费订阅测算

Use when the user asks to "design a welcome flow", "set up an abandoned-cart sequence", "build a light re-engagement branch inside a lifecycle flow", or "plan a cold-outbound sequence"; produces general lifecycle automation flows (welcome, cart, browse-abandon, post-purchase, in-flow re-engagement, B2B cold outbound) with trigger, step timing, branch/exit conditions, goal, frequency governance (send caps, quiet hours, fatigue guardrail), a sunset path, and a SEND N-dimension score. Not for the closed-loop win-back / re-consent (re-permission) program on a lapsed cohort — use reactivation-specialist; not for writing each email's copy — use email-creative-builder; not for computing EQS or the N1 unsubscribe veto — use email-quality-auditor. 邮件自动化流程设计/购物车挽回/流失召回序列

Use when platform-reported conversions disagree with GA4/ecommerce, when you suspect Meta and Google are double-counting the same sales, or for a standing (monthly) reconciliation workbook that de-dups stacked credit against an order-ID truth set, normalizes attribution windows and currency, compares attribution models, and reads incrementality from a geo/holdout test. Not for the point-in-time R2 veto or RQS gate — use ad-account-auditor; not for the ROI/ROAS ratio math itself — use roi-calculator; not for organic dark-social share attribution or GA4 direct-traffic decomposition — use dark-social-attributor. 付费广告归因对账/去重/增量

Evaluate scientific claims and evidence quality. Use for assessing experimental design validity, identifying biases and confounders, applying evidence grading frameworks (GRADE, Cochrane Risk of Bias), or teaching critical analysis. Best for understanding evidence quality, identifying flaws. For formal peer review writing use peer-review.

合入 main：按行为 / 数据 / 安全 / 契约 / 不可逆风险选择 targeted 或 full gate，并消费一个或多个有客观触发理由的独立 review source。

Screen US stocks using William O'Neil's CANSLIM growth stock methodology. Use when user requests CANSLIM stock screening, growth stock analysis, momentum stock identification, or wants to find stocks with strong earnings and price momentum following O'Neil's investment system.

PR descriptions that carry their own evidence, meaning short prose plus an embedded visual. Use when writing a PR body, adding a screenshot to a PR, or showing an invisible change (API, schema, migration, config).

Import, merge, or combine repositories into an Nx workspace using nx import. USE WHEN the user asks to adopt Nx across repos, move projects into a monorepo, or bring code/history from another repository.

Use when the user asks about Liran Tal's talk at AI Native DevCon on skills security — including questions about the lethal trifecta / toxic flows, the Snyk research finding ~30% of ~4,000 Glow skills had security issues, malicious skill examples (SkillGuard, fake Vercel deployment skill, "buy anything", invisible-character Trojan Source skills), the confused-deputy problem, acceptance fatigue, parallels to NPM supply-chain attacks, or how to think about reviewing and sandboxing AI agent skills.

Use when the user asks about the "Welcome to AI Native DevCon" talk introducing Slick (slick.com) — a browser-native agent that controls the browser it runs in. Covers Slick's architecture (sprinkles, scoops, licks, the cone), how it uses HTTP / Chrome Debug Protocol / WebRTC, pyagent as the agentic loop, skills as "step zero of agent enablement", MCP and webMCP support, remote-controlling Electron apps (Slack, Teams, Claude desktop) via Slick Star, ad hoc generative UI, OAuth token handling, and verbatim quotes from the talk. Also use when the user wants to apply this browser-native agent approach to their own work.

Use when the user asks about Maximiliano Firtman's ("Maxi") AI Native DevCon talk on Web MCP and the agentic web — including questions about how Web MCP differs from MCP, exposing frontend tools to AI agents, the imperative vs declarative Web MCP APIs, tool design guidance (name/description/input schema/execute), the Chrome 149 origin trial, using Chrome DevTools MCP or Puppeteer as a bridge today, the Doom demo, or applying Firtman's "pick one high-value page state" adoption approach to current work.

Performs a COMPREHENSIVE, formal security audit of an entire codebase and produces a written audit report (AUDIT-{PROJECT}-{DATE}.md) with prioritized findings (H/M/L) and a remediation plan. Covers SAST, OWASP Top 10, OWASP LLM Top 10, SCA (dependency analysis), Zero Trust validation, code quality. Takes 30+ minutes. TRIGGER ONLY when the user explicitly requests a formal full-codebase audit producing a report: "security audit", "OWASP audit", "full security review", "AUDIT-Report erstellen", "Codebase auditieren", "SCA audit", "dependency audit", "CVE audit", "Sicherheitsaudit". DO NOT trigger for: PR-level security checks (use the built-in security-review skill), one-off security questions, threat-modeling discussions without an audit report, individual finding fixes, or generic mentions of "secure" / "security".

Activates, reconfigures, or deactivates the Digital Innovation Agents workflow in a project. Writes the .dia/config.toml settings file and manages anchor blocks in agent-facing files (CLAUDE.md, AGENTS.md, GEMINI.md, .cursorrules, .github/copilot-instructions.md, .windsurfrules). Use this skill when the user mentions "DIA aktivieren", "DIA installieren", "DIA initialisieren", "DIA setup", "DIA settings", "Workflow-Modus", "Modus wechseln", "DIA off", "DIA deaktivieren", "Plugin aktivieren". Single skill that covers both first-time activation and later reconfiguration; the skill detects which path applies from the presence of .dia/config.toml.