Daytona secrets, provider key, OpenAI key, Anthropic key, real model e2e, voice e2e, eval secrets, /daytona-secrets, openwork-eval-secrets. Use for real provider tests in Daytona.

Full audit of Agent Zero plugins in usr/plugins/. Reviews manifest validity, directory structure, code patterns (Store Gating, notifications, imports), security, and duplicate detection against the community index. Use when asked to review, audit, validate, or check an existing plugin before using or contributing it.

Main entry point for all Agent Zero plugin tasks. Routes to specialist skills for creating, reviewing, contributing, managing, or debugging plugins. Use when the user mentions plugins, asks how the plugin system works, wants to build/install/uninstall/publish/debug a plugin, or asks about the Plugin Hub.

Create or update Agent Zero slash commands for the built-in Commands plugin. Use when the user asks to add, edit, duplicate, or refine a reusable /command backed by YAML config plus text/python content files.

Guide safe use of code_execution_remote for shell-backed execution on the connected A0 CLI host. Use when the user asks for their computer, local terminal, CLI host, remote shell, not Docker, or host-side Python/Node/terminal commands.

Use when driving a WeKnora RAG server through the `weknora` CLI as an agent — authenticating, managing knowledge bases / documents / sessions / agents, running search or chat, or interpreting the CLI's JSON envelopes and exit codes. Read this before any other weknora-* skill.

Use for Ding-style (钉内/钉外) workplace reminders rooted in the 7.5万字 essay 《置身钉内》 and VP response 《置身钉外》. Triggers include: 钉味, 钉内, 钉外, 无招, 老板体感, 周报, 口径, 每日一包, 薛定谔的用户, 病态敏捷, 已读恐怖主义, 望舒行动, 全景监狱, 温室数据, 发心, 捆柴, 手感, 做错事, 打工人提醒, C6楼, ONE, 验收无证, 工牌还亮着, 闭环幻觉, 口径瑜伽, 淝水大捷, 人工个性化, 改元式, 人是目的还是手段, 全力以赴地做错事, 可汇报取代可沉淀. Do not use for pure coding tasks with no workplace/org/delivery context.

Pi-compatible PUA high-agency governance skill. Use for explicit PUA/PIP requests, repeated failures, passive/giving-up behavior, user frustration, or unverified completion. Pair with /pua-on extension command when persistent pressure is desired.

Use when you need to visually interact with a GUI — test buttons, fill forms, verify visual layouts, fuzz web pages, automate user flows, take screenshots, or perform end-to-end QA on any application. Works on cloud VMs, Docker containers, local machines, and sandboxes. Install: pip install cua.

Build or update an Opik integration that lives OUTSIDE this repo — a standalone opik-* package (e.g. opik-openclaw, opik-claude-code-plugin) or Opik support contributed into a third-party project (e.g. LiteLLM, Dify). Use ONLY when the user names an external repository or external package as the target; for integrations under sdks/ use the opik-integrations skill instead.

Review a PR, or a PR linked to an issue, for security risks. Check nine categories and report PASS, WARNING, or FAIL. Use when reviewing code for vulnerabilities, secrets, injection, authorization bypasses, or unsafe configuration. Trigger keywords - security review, code review, appsec, vulnerability assessment, security audit, review PR security.

Analyze recorded product feedback into evidence for bugs and requirements. Use when a Riffrec capture or other screen, voice, or notes artifact needs interpretation. Use for Riffrec setup, capture, or sharing help when no recording exists yet.

Create a git commit with a clear, value-communicating message. Use when the user asks to commit/save staged or unstaged changes with a repo-appropriate message.

Guide for disabling Chromium tests (C++ or WebUI). Use this skill when you need to disable a failing or flaky test case.

Use this skill to get a link to a Gerrit Changelist (CL) from a given commit hash in the Chromium repository. Use when you need to find the review discussion, comments, or related issues for a specific commit. Don't use for linking to files or code lines.

Use this skill when you need to link to files or specific lines in the Chromium codebase within a document intended for external sharing (e.g., Google Docs, Buganizer). This skill ensures links use the stable `source.chromium.org` format with line numbers and commit hashes for accessibility, even if the user doesn't explicitly specify the format. Do not use for internal or purely local notes where file:/// links are preferred.

Diagnose frozen, stuck, or slow Qwen Code sessions on this machine. Scans for problematic processes, high CPU/memory usage, hung subprocesses, and debug logs. Use /stuck or /stuck <PID> to focus on a specific process.

Diagnose memory leaks in the Qwen Code CLI using heap snapshots and the chrome-devtools CLI. Use when investigating high memory usage, unbounded growth, or suspected object retention issues.

Guide for running end-to-end tests of the Qwen Code CLI, including headless mode, MCP server testing, and API traffic inspection. Use this skill whenever you need to verify CLI behavior with real model calls, reproduce user-reported bugs end-to-end, test MCP tool integrations, or inspect raw API request/response payloads. Trigger on mentions of E2E testing, headless testing, MCP tool testing, or reproducing issues.

Fix a bug from a GitHub issue, following the reproduce-first workflow. Use when the user asks to fix a bug, investigate a GitHub issue, or debug a user-reported problem. Takes a GitHub issue URL or number as input.