Detect Cross-Site Scripting (XSS) vulnerabilities in a codebase using a three-phase approach: recon (find HTML/JS/DOM sink sites), batched verify (trace user input to sinks in parallel subagents, 3 sink sites each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/xss-results.md. Use when asked to find XSS or cross-site scripting bugs.

Detect missing authentication and broken function-level authorization vulnerabilities in a codebase using a three-phase approach: recon (map endpoints and the role/permission system), batched verify (check auth/authz in parallel subagents, 3 endpoints each), and merge (consolidate batch results). Covers unauthenticated access and vertical privilege escalation (e.g., regular user accessing admin-only functions). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/missingauth-results.md. Use when asked to find missing auth, broken access control, or privilege escalation bugs.

Detect insecure file upload vulnerabilities in a codebase using a three-phase approach: discovery (find all upload sites), batched verify (check extension bypass and related issues in parallel subagents, 3 sites each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/fileupload-results.md. Use when asked to find file upload, unrestricted upload, or extension bypass bugs.

WCAG 2.2 Accessibility Audit skill that systematically evaluates web pages against 8 core Success Criteria (1.1.1, 1.4.3, 1.4.11, 2.1.1, 2.1.2, 2.4.3, 2.4.7, 4.1.2) using accessibility tree inspection and visual analysis. Use this skill when you need to perform accessibility testing/auditing on a live webpage.

Chinese-platform last-30-days research skill covering Weibo, Xiaohongshu, Bilibili, Zhihu, Douyin, WeChat, Baidu, and Toutiao. Includes Markdown, JSON, compact context, and Guizang-inspired Swiss/IKB HTML report output.

为小红书笔记生成高质量配图。默认AI生成（Gemini），仅精确数据表格用HTML兜底。当用户提到"小红书配图"、"小红书封面"、"小红书图片"、"做张小红书图"、"笔记配图"时使用此技能。

演讲与分享教练。基于Patrick Winston（MIT AI教授）的How to Speak方法论，帮助准备线下培训、技术分享、B站教程视频等演讲场景。当用户提到"演讲"、"分享"、"培训"、"讲课"、"PPT演讲"、"开场"、"结尾"、"如何讲"、"演讲结构"时使用此技能。

数据分析与办公提效全能助手。覆盖数据处理、分析洞察、报告撰写、PPT制作、数据可视化的端到端工作流。 始终从专家视角出发，帮用户多想一步。遇到不确定的问题主动与用户确认。 支持：Excel数据分析、投放数据复盘、ROI测算、数据可视化、报告生成、PPT制作、公式生成。 当用户提到"分析数据"、"做报告"、"做PPT"、"Excel"、"投放分析"、"ROI"、"复盘"、 "周报"、"月报"、"数据处理"、"图表"、"可视化"、"汇报"、"表格"、"公式"时使用此技能。

Audits a live website for AI-engine discoverability (AEO/GEO). Crawls the site, runs 16 deterministic checks plus a 6-dimension content evaluation, and produces a scored report (A-F) with prioritized fixes. Use to get a baseline before improve-aeo-geo, or to measure progress after changes.

Create new skills for FastClaw agents. Use when the user asks to create a skill, turn a workflow into a skill, or build reusable automation. Also use when discussing skill format, structure, or best practices.

节点分解。当一个节点体积过大、或塞了多个不相关概念导致disclosure无法覆盖时使用。

Must be used for WeChat Official Account writing, Xiaohongshu-to-WeChat expansion, WeChat rich-text formatting, public-account draft preparation, binding checks, and draft publishing decisions.

从 Word 文档中提取所有图片并保存到指定目录。当用户提到 Word 提取图片、docx 抠图、Word 取图时使用。

将旧版 Word 文档（.doc）转换为新版（.docx）。当用户提到 doc 转 docx、旧 Word 转新 Word 时使用。

将内容从一种语言翻译为另一种语言。当用户提到翻译、中英互译、多语言翻译、自动翻译时使用。

生成 WiFi 密码字典列表。当用户提到 WiFi 密码字典、WiFi 破解字典、密码字典时使用。

将 PowerPoint 转换为图片，可合并为一张长图或多张图。当用户提到 PPT 转图片、PPT 截图、PPT 转长图、幻灯片截图时使用。

将多个 PowerPoint 文件合并为一个 PPT。当用户提到 PPT 合并、合并幻灯片、合并 PPTX 时使用。

将 PDF 文件转换为 Word 文档（.docx），支持单文件和批量转换。当用户提到 PDF 转 Word、PDF 转 docx 时使用。

批量修改文件/文件夹名称，替换或删除指定内容。当用户提到批量重命名、批量改名、文件替换、文件名替换时使用。