Portable digital employee distilled from digoal's personal blog for PostgreSQL, PolarDB, DuckDB, AI+database, vector/RAG, database operations, source-code reading, technical content creation, open-source community strategy, and "德说" style strategic analysis. Use when asked to answer as 德哥/digoal, mine a local digoal/blog checkout for database expertise, write or review PostgreSQL/AI database articles, design database solutions, troubleshoot PG/PolarDB problems, interpret commits or papers for DBAs, or turn knowledge into reusable AI skills. Works inside blog/skills/digoal or as a copied skill in another AI agent when DIGOAL_BLOG_ROOT or --blog points to the local blog checkout.

抓取并汇总"数据库、AI、GitHub、AI 论文"近 1 周新闻，输出图文并茂（含 mermaid 图）的 markdown 周报到当前项目的 markdown/ 目录。覆盖 10 个数据源：postgresweekly.com/issues（自动解析最新 issue 编号）、planet.postgresql.org、planet.postgis.net、postgresql.org/about/newsarchive/、git.postgresql.org shortlog、duckdb.org/news/、aibase.com/zh、ai-bot.cn/daily-ai-news、github.com/trending?since=weekly、huggingface.co/papers/trending。适用于：用户提出"生成周报"、"本周数据库+AI+GitHub+论文快讯"、"跑一次 db-ai-weekly"、"weekly news"等需求。

Convert a Markdown article into a natural first-person podcast script for 1 to 4 speakers and save it as a .txt file under the current project's markdown directory. Default to Chinese output unless the user explicitly specifies another language, while preserving English terms that appear in the article. Use when the user provides an article Markdown file and a podcast speaker count, asks for a VibeVoice-style podcast script, dialogue rewrite, narrated audio script, multi-host conversation, solo podcast monologue, or personal-viewpoint audio script based on an article.

A股个股次日(T+1)走势预测 skill。当用户输入A股股票代码(如 600519、000858、300750、688981、430090)或公司名称(如"贵州茅台"、"宁德时代"、"比亚迪"),并要求预测次日走势、给出交易计划、评估盈亏概率时,触发本 skill。skill 会用 mcp__MiniMax__web_search 搜证大盘环境、龙虎榜、北向资金、融资融券、主力资金流、板块联动、公告与消息面等,按"四维分析框架"(大盘环境 30% / 资金行为 30% / 技术面 25% / 消息面 15%)交叉验证,产出可量化的方向预测(看多/看空/震荡 + 概率百分比 + 价格区间),并写入当前项目 markdown 目录下的 `a-stock-{代码}-{YYYY-MM-DD}.md`。输出包含详细逻辑推导链、中间结果与最终结果概率、专业术语小白解释、mermaid/ascii/svg 图表。适用场景:盘后复盘想做次日的方向判断与交易计划;不适用:长线基本面估值(改用 finance-core-analysis)、日内高频交易、港股/美股(改用 us-stock-prediction)。

Choose GPT-Image2 / gpt-image-2 visual styles and industrial prompt templates from the awesome-gpt-image-2 style library. Use when an agent needs to create, rewrite, classify, or improve image-generation prompts with repository-backed templates, categories, style tags, scene tags, pitfalls, and example cases.

The Xberg workspace layout — the version source of truth (root Cargo.toml [workspace.package] version), the 19 workspace members and 3 excluded crates, the distribution packages under packages/, the tools/ directory, and the ignore-file allowlists a new workspace member must be added to. Load when navigating the repo, deciding where code belongs, or wiring a new crate or binding package.

How Xberg resolves configuration — CLI-mode and server/MCP-mode precedence orders, config file auto-discovery (xberg.toml walk-up, then the user config dir), field-level inline JSON merge (merge_json_into_config), the ExtractionOverrides CLI layer, and the two mechanisms that make a config change silently do nothing. Load when adding a config flag or env var, changing config precedence, or debugging why a setting is or isn't taking effect.

Use for authorized RF/SDR security research including signal identification, replay feasibility study in shielded labs, and wireless protocol analysis outside classic Wi-Fi.

从逆向走到可用利用 (Working Exploit) 的全链路工程化方法。 适用场景：拿到了二进制 + 漏洞点 + 目标环境，需要写出一个能稳定打通的 exploit（不是只能本地复现一下、远程一打就崩的脚本）。 覆盖三大方向：栈溢出 / 堆利用 / 内核 pwn。强调"CTF 本地通 → 真实远程稳定打通"的工程差距：libc 版本错配、堆喷射时序、SMEP/SMAP/KASLR、栈对齐、远程缓冲。 核心工具链：pwntools + GEF/pwndbg + ROPgadget/Ropper + one_gadget + libc-database + qemu-system 内核调试。 触发关键词：pwn、栈溢出、堆溢出、ROP、ret2libc、ret2csu、one_gadget、libc-database、堆利用、tcache、fastbin、unsorted bin、kernel pwn、kROP、SMEP、SMAP、KASLR、modprobe_path、pwntools、GEF、pwndbg。

N-day 补丁差分到利用。从厂商发布的补丁里反推漏洞点、写 PoC、做成可用的攻击模块。 适用场景：已知 CVE 编号但只有补丁没有 PoC、SRC/红队需要打击未及时更新的资产、N-day 武器化、Patch Tuesday 跟进。 核心方法：拿 before/after 二进制 → 对齐符号 → 二进制 diff → 看新增的安全检查反推 bug class → 写 PoC 触发漏洞。 触发关键词：N-day、Nday、补丁差分、patch diff、patch tuesday、1day、binary diff 漏洞、bindiff 利用、ghidriff、Diaphora、补丁分析、CVE 复现、漏洞还原、补丁反推、N-day 武器化。

Use for authorized OT/ICS security assessment covering Purdue model zoning, PLC/SCADA exposure, industrial protocol discovery, and safe passive-first evaluation.

固件 / IoT 渗透链。从拿到一坨 .bin / .img 开始，闭环走完逆向 → 提取 → 模拟 → 利用。 方法论遵循 OWASP FSTM 九阶段；工具链以 binwalk v3、unblob、EMBA、Firmadyne、AFL++ 为主。 适用场景：路由器/摄像头/智能家居固件审计、固件升级包逆向、IoT CVE 复现、嵌入式 0day 挖掘。 触发关键词：固件、firmware、IoT、binwalk、unblob、UART、JTAG、squashfs、UBI、JFFS2、Firmadyne、QEMU 全系统仿真、EMBA、固件渗透、路由器固件、嵌入式漏洞利用、bootloader、NVRAM、FAT、firmware analysis toolkit。

Use for authorized source-code security review and SAST workflows including Semgrep, CodeQL patterns, dangerous API hunting, and fix verification.

Use for authorized cloud, container, and Kubernetes security assessment including metadata SSRF, IAM misconfig, container escape paths, and cluster RBAC review.

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for LSASS-resident secrets, Windows logon sessions, Kerberos ticket caches, DPAPI-backed material, SSP artifacts, and replayable credential extraction. Use when the user asks to inspect LSASS memory, recover tickets or logon sessions, trace DPAPI or SSP material, distinguish which credential artifacts are replayable, or connect host-resident credential material to an accepted pivot or privilege edge. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for kernel attack surface, namespace and cgroup boundaries, container isolation assumptions, syscall paths, and escape primitive verification. Use when the user asks to analyze container-to-host escape paths, kernel exploit prerequisites, namespace crossover, capability misuse, or prove whether an exploit primitive crosses the sandbox boundary. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Kubernetes API analysis, service-account trust, RBAC edges, admission and controller behavior, cluster secrets, workload mutation, and namespace-scoped drift. Use when the user asks to inspect kube API permissions, service-account tokens, RoleBinding or ClusterRoleBinding edges, admission webhooks, controller-created pods, secret exposure, or why live workloads differ from manifests. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for DFIR chronology, cross-artifact correlation, persistence chains, and incident timeline reconstruction. Use when the user asks to build a forensic timeline, correlate EVTX, PCAP, registry, disk, memory, mailbox, or browser artifacts, explain the order of attacker actions, or pinpoint the stage where the decisive artifact appears. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for Android APK hooking, Frida tracing, request-signing recovery, SSL pinning bypass, JNI boundary inspection, and app trust-boundary analysis. Use when the user asks to hook an APK, inspect signer logic, trace Java or native boundaries, bypass pinning or root checks, inspect shared prefs or app databases, or replay accepted mobile requests. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.

Open gaps tracker — what's flagged and not yet closed. Use when the user asks "what gaps are open", "gap tracker", "remediation status", or wants to close (--close GAP-ID) or risk-accept (--accept GAP-ID) a tracked gap.