Use for authorized security assessment of LLM applications and AI agents, including prompt injection, tool abuse, RAG exposure, memory poisoning, and model supply-chain risks.

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for image, audio, video, document, and container steganography. Use when the user asks to inspect metadata, alpha or palette channels, LSBs, thumbnails, appended trailers, QR fragments, transcoding artifacts, or recover a hidden payload from media without blind brute force. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for forced-auth coercion, relay chains, target selection, NTLM or related acceptance paths, and coercion-to-privilege transitions. Use when the user asks to trace a coercion primitive, follow a relay path, analyze forced authentication, determine which service accepts relayed auth, or connect a coercion step to resulting privilege, enrollment, or code execution. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for file uploads, imports, previews, archive extraction, format conversion, parser invocation, and deserialization chains. Use when the user asks to inspect an upload or import path, trace archive extraction, preview or converter behavior, explain how a file reaches a parser or deserializer, or connect one uploaded artifact to the decisive backend effect. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

Guided customization of your regulatory practice profile — change one thing without re-running the whole cold-start interview. Adjust watched regulators, policy library index, materiality threshold, gap response process, feed configuration, or matter workspace paths. Use when the user says "change my [thing]", "add a regulator", "update my watchlist", "edit my threshold", or "customize".

Fast "is this a problem?" answer for the quick Slack question — pattern-matches against your calibration. Use when the user says "is this a problem", "quick question", "can we do X", "do I need legal review for", "sanity check", or pastes a PM's question that needs a same-minute fine / needs a look / hold call.

Guided customization of your legal clinic profile — change one thing without re-running the whole cold-start interview. Adjust clinic profile, jurisdiction, supervision style, practice-area templates, semester configuration, or output safeguards. Use when the user says "change my [thing]", "new semester", "add a practice area", "update my config", or "customize".

Guided customization of your law-student study profile — change one thing without re-running the whole cold-start interview. Adjust current classes, learning style, outline preferences, bar prep subjects, seed materials, or study session cadence. Use when the user says "change my [thing]", "add a class", "update my profile", "new semester", or "customize".

Guided customization of your IP practice profile — change one thing without re-running the whole cold-start interview. Adjust risk posture, escalation contacts, portfolio scope, brand protection strategy, enforcement posture, clearance thresholds, OSS review rules, or matter workspace paths. Use when the user says "change my [thing]", "update my profile", "edit my config", or "customize".

Diff a proposed handbook change against the current version, flag ripple effects and state supplement impacts. Use when user says "update the handbook", "add this to the handbook", "handbook change", or has a policy ready for insertion.

Aggregate diligence findings into a deal team briefing at the right altitude for the audience — exec summary for leadership, working summary for the team. Use when user says "brief the deal team", "what's the state of diligence", "summarize findings for [audience]", "deal update", or on the briefing cadence.

Run Ginkgo suites with the ginkgo CLI — run, -r, -p, --dry-run, watch, build (precompiled .test binaries), generate, outline, unfocus, labels, version; spec randomization (--randomize-all/--randomize-suites/--seed); running multiple suites (--keep-going/--skip-package/--compilers); previewing (--dry-run, PreviewSpecs); and parameterizing a suite via env vars or init()-registered flags after -- plus GinkgoConfiguration() overrides. Use when running suites locally, precompiling, watching for changes, or parameterizing a run from the command line. For a CI configuration see ginkgo:ci.

Control spec ordering and manage flaky specs — Serial, Ordered containers with BeforeAll/AfterAll/ContinueOnFailure, OncePerOrdered, SpecPriority, plus FlakeAttempts/--flake-attempts, MustPassRepeatedly, --repeat, and --until-it-fails. Use when specs must run in a fixed order, you need once-per-group setup, you're combining Serial+Ordered, a spec is flaky, or you want to hunt order-dependence with --until-it-fails -p --randomize-all.

Build with Aurora DSQL — manage schemas, execute queries, handle migrations, diagnose query plans, load data, and develop applications with a serverless, distributed SQL database. Covers IAM auth, multi-tenant patterns, MySQL-to-DSQL and PostgreSQL-to-DSQL schema conversion, FK replacement code generation, OCC retry patterns, ORM migration (Django/Hibernate/Rails), DDL operations, query plan explainability, SQL compatibility validation, and bulk data loading. Triggers on phrases like: DSQL, Aurora DSQL, create DSQL table, DSQL schema, migrate to DSQL, distributed SQL database, serverless PostgreSQL-compatible database, DSQL query plan, DSQL EXPLAIN ANALYZE, why is my DSQL query slow, DSQL foreign key, DSQL OCC retry, DSQL multi-region, load into DSQL, load CSV into DSQL, bulk load DSQL, aurora-dsql-loader.

ET git workflow for preparing commits and reviewing changes. Use when checking git status or diff, filtering unrelated files, staging task-scoped changes, writing Chinese commit messages, or synchronizing with remotes using rebase instead of merge.

ET build, analyzer, proto export, server startup, and publish workflow. Use when compiling WOW with dotnet build ET.sln, exporting Proto to C#, starting ET.App, publishing, or validating analyzer/build results.

Serve MiniCPM5-1B via vLLM as an OpenAI-compatible HTTP server. Use when the user wants high-throughput production serving on NVIDIA GPU, asks for "vLLM", "OpenAI server", "REST API for MiniCPM5", or "production deployment".

Run MiniCPM5-1B via Ollama on macOS / Linux laptop using the released GGUF. Use when the user wants "ollama run", "ollama pull", a Modelfile-driven setup, or one-line laptop deployment.

Track and visualize ML training experiments with Trackio. Use when logging metrics during training (Python API), firing alerts for training diagnostics, or retrieving/analyzing logged metrics (CLI). Supports real-time dashboard visualization, alerts with webhooks, HF Space syncing, and JSON output for automation.

Use when the user asks about finding the best, top, or recommended model for a task, wants to know what AI model to use, or wants to compare models by benchmark scores. Triggers on: "best model for X", "what model should I use for", "top models for [task]", "which model runs on my laptop/machine/device", "recommend a model for", "what LLM should I use for", "compare models for", "what's state of the art for", or any question about choosing an AI model for a specific use case. Always use this skill when the user wants model recommendations or comparisons, even if they don't explicitly mention HuggingFace or benchmarks.