Hunt CI/CD pipeline vulnerabilities — GitHub Actions workflow injection (pull_request_target Pwnrequest + ${{ }}-into-shell), self-hosted runner poisoning, OIDC trust-policy abuse, Jenkins script-console RCE and CVE-2024-23897 file read, GitLab CI runner-token registration, Terraform state file leakage, artifact/log secret leakage, pipeline env-var disclosure. Use when target has a public GitHub/GitLab org, exposed CI dashboards (Jenkins/TeamCity/Drone/Argo), or build artifacts/images are reachable.

Word / PDF / PPT 文档解析与数据分析引擎。覆盖三类文件格式的全量提取、表格数值化、图表理解与跨文档汇总分析。**遇到以下任一情况就主动使用本 skill**：①用户上传或指定了 .docx / .doc / .pdf / .pptx / .ppt 文件并要求分析、提取或统计其中内容；②用户出现触发词：Word分析 / PDF解析 / PPT提取 / 文档分析 / 报告解析 / 幻灯片分析 / 发票提取 / 合同分析 / 文档统计 / 错别字 / 语病 / 字号检查 / 简历分析 / 多文档对比；③任务涉及从文档中提取表格、数值、图表、格式（颜色/高亮/字号）、组织架构、时间线等结构化信息。仅不用于：Excel/CSV 数据分析（使用 sn-da-excel-workflow）、纯图片分析（使用 sn-da-image-caption）。

Capture or repair reliable full-page screenshots for lazy-loaded, scroll-animated, Framer, WebGL/canvas, or reveal-heavy web pages. Use when full-page screenshots are blank, gray, white, sparse, show a tiny content strip, disagree with a working scroll video, or when article evidence/section crops must be derived from a trustworthy full-page image.

Publish a GitHub release for the C# MCP SDK after a prepare-release PR has been merged. Refreshes release notes to include any PRs merged since preparation, warns about version or breaking change impacts from late-arriving PRs, and creates a draft GitHub release. Use when asked to publish a release, finalize a release, create release notes, or complete a release after the prepare-release PR has been merged.

Generate images, text, audio, video, and transcribe speech via the Pollinations API using the polli CLI. Use when asked to generate media, call pollinations.ai, check pollen balance, list models, manage API keys, inspect quests, manage agents or my-models, or run polli commands.

Workflow, guardrails, and output format for reviewing NIC pull requests. Use when reviewing a PR locally (Copilot Chat, Claude, or other agent), when running the pr-review prompt, or when acting as the GitHub Copilot Code Review bot. Delegates codebase-specific detail to the domain skills (nic-structure, nic-add-feature, nic-add-policy, nic-docker-images, nic-ci-pipelines, nic-testing) rather than duplicating them.

Volt Typhoon (Vanguard Panda, PRC) adversary-emulation playbook — edge-device initial access, living-off-the-land-only operations, NTDS/credential theft, long-dwell pre-positioning toward critical infrastructure, multi-hop proxy egress. Use when emulating stealthy LOTL pre-positioning. Triggers on: 'emulate Volt Typhoon', 'Vanguard Panda', 'BRONZE SILHOUETTE', 'living off the land', 'edge device', 'pre-positioning', 'critical infrastructure persistence'.

Scattered Spider (UNC3944 / Octo Tempest) adversary-emulation playbook — help-desk vishing → MFA takeover → cloud/SaaS/identity privilege expansion → RMM persistence → data-theft extortion. Use when emulating identity-first social-engineering eCrime against a help-desk/IdP estate. Triggers on: 'emulate Scattered Spider', 'UNC3944', 'Octo Tempest', '0ktapus', 'help desk social engineering', 'MFA fatigue', 'SIM swap', 'identity attack'.

Guide for running MSBuild unit tests efficiently. Use when running, scoping, filtering, or speeding up unit tests in this repository, or when finalizing a change with a heavier validation pass. Covers xUnit v3 + Microsoft.Testing.Platform (MTP) specifics and which `dotnet test` flags do and don't apply.

GitHub issue and project-board management for the dotnet/msbuild repo. Use when asked to file/triage/update issues, post comments, amend issue bodies, move sprints, bulk-update project board fields, or audit items by sprint/status/assignee.

FIN7 (Carbon Spider / Sangria Tempest) adversary-emulation playbook — revenue-targeted spearphishing with phone follow-up, EDR-evasion tradecraft, AD compromise, and big-game-hunting ransomware. Use when emulating a high-end financially-motivated crew that graduated from POS theft to ransomware. Triggers on: 'emulate FIN7', 'Carbanak', 'Carbon Spider', 'Sangria Tempest', 'big game hunting', 'EDR evasion', 'AvNeutralizer'.

Verify the technical accuracy of a vscode-docs pull request against the VS Code source code in microsoft/vscode and microsoft/vscode-copilot-chat. Use when reviewing a docs PR for factual correctness — setting names, command IDs, default values, API shapes, keybindings, versioned availability, and described behavior.

Create and manage redirects in VS Code documentation when pages are moved, renamed, or deleted. Use when moving docs pages, renaming files, restructuring content, or when the user asks about redirects.

Debug a broken SD.Next or Diffusers model integration. Use when a newly added or ported model fails to load, misdetects, crashes during prompt encoding or sampling, or produces incorrect outputs.

**EXECUTION (runbook) SKILL** — Build and run the Git Extensions test suite and interpret results. USE FOR: running tests, running a single test/project, diagnosing a failing or flaky test. DO NOT USE FOR: writing new features (write tests as part of that), or CI config changes. Triggers: "run the tests", "run this test", "why is this test failing", "dotnet test".

**SDLC (SME-first) SKILL** — Create, update, or review Git Extensions DAG agent-docs under .github/copilot-docs. USE FOR: writing a new L1/L2/L3 doc; updating a docs-index; adding/fixing a reading chain; keeping the L0 primer within its size cap; reviewing a doc for the agentic-doc rules. DO NOT USE FOR: writing product/user documentation, README changes for end users, or code changes. Triggers: "add a DAG doc", "document this subsystem", "update the docs-index", "add a reading chain", "is this doc agentic".

**SDLC (SME-first) SKILL** — Explain a Git Extensions subsystem or end-to-end flow accurately, grounded in the DAG docs and verified against source. USE FOR: "how does X work", "explain the commit/checkout/push flow", "trace this from UI to git", onboarding walkthroughs, architecture questions. DO NOT USE FOR: making code changes, writing new docs (use doc-management), or trivial single-file lookups. Triggers: "explain how", "walk me through", "how does X work end to end", "trace the flow".

**SDLC (SME-first) SKILL** — Efficiently locate code in the Git Extensions repository before editing or explaining. USE FOR: finding the form/command/parser behind a feature, tracing a UI action to its git call, locating a symbol's definition and usages. DO NOT USE FOR: making edits (do the edit after finding), or questions already answered by a DAG doc. Triggers: "where is", "find the code that", "which form handles", "locate the command for".

**EXECUTION (runbook) SKILL** — Add a new WinForms dialog/control to Git Extensions following the project's base classes and naming conventions. USE FOR: creating a new Form or UserControl, wiring it to git via UICommands. DO NOT USE FOR: editing existing dialogs' logic only, or non-UI code. Triggers: "add a new dialog", "create a form", "new WinForms control", "new settings page".

**EXECUTION (runbook) SKILL** — Add or change a user-facing UI string in Git Extensions and regenerate the translation catalog. USE FOR: adding a TranslationString, changing a control/menu/toolbar caption, any UI text change that must update English.xlf. DO NOT USE FOR: non-UI/log/exception-internal strings, or general feature work. Triggers: "add a UI string", "change this label", "regenerate English.xlf", "update-loc".