CMS-specific scans — WordPress (wpscan), Joomla, Drupal version detection.

Pre-merge review checklist based on recurring AI reviewer feedback patterns

Overrides the auto-detected project scope to read and write memories under a different project ID, or enables global search to access all memories across all users and projects. Use when working across multiple projects, accessing memories from another repo, enabling team-wide memory access, or when auto-detection resolves to the wrong project.

Imports memories from an exported Markdown file or MEMORY.md into the current project. Use when migrating from another project, restoring from backup, importing Claude Code native MEMORY.md content, or setting up a new project with existing knowledge.

Systematic firmware extraction from IoT and embedded targets — vendor portals, OTA interception, SPI flash dumping with flashrom/CH341A, eMMC chip-off, and UART/JTAG console dumps. Covers the full acquisition chain from zero hardware access to a raw binary ready for static analysis.

Runtime memory access and manipulation on embedded Linux via /dev/mem, /dev/kmem, and MTD devices. Covers physical memory reads/writes, kernel symbol resolution via /proc/kallsyms, live firmware patching with mtd_debug and flashcp, and bypassing memory-access restrictions (CONFIG_STRICT_DEVMEM, kernel.perf_event_paranoid).

Use when the engagement target is IoT, embedded Linux, RTOS, or any device reachable via UART/JTAG/SWD or by extracting its firmware. Covers firmware acquisition, binwalk extraction, filesystem mounting, default-credential hunting, bootloader attacks, wireless protocol sidebands (BLE, Zigbee, Z-Wave, LoRaWAN, sub-GHz).

Guides using bun_sys for system calls and file I/O in Rust. Use when implementing file operations, opening fds, or any syscall path instead of std::fs or libc.

Implements JavaScript classes in C++ using JavaScriptCore. Use when creating new JS classes with C++ bindings, prototypes, or constructors.

XML External Entity (XXE) injection — local file reading via XML parsers, SOAP/WSDL API exploitation, blind out-of-band exfiltration, SVG/DOCX/XLSX upload XXE. Use for any challenge involving XML processing, SOAP endpoints, WSDL services, or XML-based file upload parsing.

Server-Side Template Injection (SSTI) — RCE through template engines. Covers Jinja2 (Python/Flask), Twig (PHP/Symfony), Freemarker (Java), ERB (Ruby), Razor (.NET). Includes engine fingerprinting, MRO chain construction, and filter bypass.

Use when code changes may have made documentation outdated, when reviewing docs for consistency, or when the user asks to sync or audit documentation.

XML sitemap audit — find and fix the sitemap problems that quietly waste crawl budget and slow indexing. Discovers the sitemap (robots.txt, /sitemap.xml, sitemap index), validates structure and size limits, and cross-checks the URLs it lists against reality: non-200 / redirected / noindex / canonicalized-away URLs that shouldn't be in a sitemap, plus indexable pages that are missing from it. Reviews lastmod accuracy, sitemap-index organization, and robots.txt reference. Use this skill whenever the user asks about sitemaps, sitemap errors in Search Console, "sitemap couldn't fetch / has errors", crawl budget, pages not getting indexed, or whether their sitemap is clean. Trigger on: "sitemap", "sitemap.xml", "XML sitemap", "sitemap errors", "sitemap audit", "couldn't fetch sitemap", "crawl budget", "pages not indexed sitemap", "sitemap index", "lastmod", "robots.txt sitemap", or any sitemap/crawl-coverage question. For a full-site SEO audit use /seo-analysis; for broken links use /broken-link-checker.

Hunt improper LLM output handling (OWASP LLM05:2025) — downstream code that trusts unstructured model output and renders / executes / shells it without sanitisation, producing XSS, SSRF, SQL injection, RCE, and SSTI via the model channel.

飞书插件问题排查工具。包含常见问题 FAQ 和深度诊断命令（/feishu_doctor）。 常见问题可随时查阅。诊断命令用于排查复杂问题（多次授权仍失败、自动授权无法解决等）， 会检查账户配置、API 连通性、应用权限、用户授权状态，并生成详细的诊断报告和解决方案。

Weekly vault defragmentation. Runs a 5-phase structural audit: inbox hygiene, area completeness, project archival, MOC refresh, tag consistency, structure evolution, and generates a report. Triggers: EN: "defragment the vault", "reorganize the vault", "structural maintenance", "vault defrag", "weekly defrag". IT: "deframmenta il vault", "riorganizza il vault", "manutenzione strutturale", "defrag settimanale". FR: "defragmenter le vault", "reorganiser le vault". ES: "desfragmentar el vault", "reorganizar el vault". DE: "Vault defragmentieren", "Vault reorganisieren". PT: "desfragmentar o vault", "reorganizar o vault".

Sync a person to Apple Contacts. Searches by name/email, creates if missing, updates if info is incomplete. Designed to be called by the dispatcher after email interactions (drafting replies, processing emails) or on demand. Triggers: EN: "sync contact", "add to contacts", "save contact", "update contact", "is this person in my contacts". IT: "sincronizza contatto", "aggiungi ai contatti", "salva contatto", "aggiorna contatto". FR: "synchroniser le contact", "ajouter aux contacts", "sauvegarder le contact". ES: "sincronizar contacto", "agregar a contactos", "guardar contacto". DE: "Kontakt synchronisieren", "zu Kontakten hinzufuegen", "Kontakt speichern". PT: "sincronizar contato", "adicionar aos contatos", "salvar contato".

Private built-in CCB configuration skill for agentroles.ccb_self. Design, edit, validate, and prepare reloads for .ccb/ccb.config, role bindings, providers, windows, workspaces, tool windows, sidebar, and provider startup inputs. Use only inside ccb_self; non-self agents should delegate CCB config changes to ccb_self.

Use this skill when conducting research on a topic from scratch — literature review, competitive analysis, technical due diligence, or fact-finding. Apply before starting any open-ended research task.

Schema lifecycle management for Basic Memory: discover unschemaed notes, infer schemas, create and edit schema definitions, validate notes, and detect drift. Use when working with structured note types (Task, Person, Meeting, etc.) to maintain consistency across the knowledge graph.