Elevates the Jetpack Compose user interface through micro-UX improvements, animations, accessibility (a11y) fixes, and UI structural polish. Use this skill to extract hardcoded styles to AppTheme, add TalkBack semantics, implement AnimatedVisibility or micro-animations, extract stateless Composables, and add @Preview annotations.

构建、扩展、审计或迁移可复用的 UI 组件与设计系统。当交付核心是跨页面或跨消费者复用的 token、组件 API、交互与无障碍合同、设计—代码映射、组件文档、分发包、版本治理或采用迁移时使用；若核心是完成一个产品工作流、阅读内容或单项视觉资产，则改用相应领域 Skill。

构建、重构、诊断和验证以玩家能动性为核心的二维游戏与趣味体验。用于二维规则/动作/益智游戏、互动玩具、叙事探索、节奏体验、生成体验和本地多人；按子型选择专业运行时与内容工具，分别验证机制、手感、内容、音频、可访问性、平台和玩家价值，且不以工程通过冒充好玩、公平或复玩价值。

Frequency-domain analysis — FFT, power spectral density (Welch/periodogram), spectrograms, wavelet transforms, and coherence. Use for any signal with periodic, quasi-periodic, or transient frequency content in physics data.

Update dotnet/macios to a new Xcode beta and validate it end-to-end. Use this skill when a user asks to bump Xcode beta versions, update macios SDK/version constants, run xtro-sharpie sanitization, and run introspection tests for iOS/tvOS/macOS/Mac Catalyst.

Researches a topic by breaking it into subtopics, gathering factual information with reasoning, and producing a structured summary with key findings and open questions. Use when the user asks to research, investigate, look up, summarize a topic, or says 'what is known about...' or 'learn about...'

Use when creating flowcharts, architecture diagrams, or conceptual diagrams - generates prompts for image AI

Complete browser automation with Playwright. Auto-detects dev servers, writes reusable test scripts, and supports screenshots, responsive checks, UX validation, login flows, link checks, and arbitrary browser automation. Use when the user wants to test a website, automate browser interactions, validate web functionality, or perform browser-based testing.

Create a GitHub issue for the lowdefy repo. Auto-detects bug vs feature, drafts with appropriate template, and creates with labels. Use when filing bugs, feature requests, or enhancements.

Generate a changeset file for the current branch. Analyzes commits, determines bump types, and writes a user-facing changelog entry. Use when preparing version bumps.

Generate an Acceptance Demo HTML for non-engineer vibecoders right before ship/wait/reject decision. Reads back the acceptance_criteria that were stored as personal-preference.v1 by harness-plan-brief (joined by user_request_hash), then renders a single-file HTML showing each criterion as verified or unverified along with a ship/wait/reject recommendation. Use when the user asks for an acceptance review, wants to decide whether to ship a delivered task, or says: acceptance demo, accept demo, 受け入れ判断, 受入レビュー, ship/wait/reject 判定, 検収レビュー. Do NOT load for: implementation, code review, release work.

Product Owner (Pax). Use for backlog management, story refinement, acceptance criteria, sprint planning, and prioritization decisions

EXECUTE a lean wave — plan story DAG + file-ownership batches via CLI, dispatch full-sdc per story, fan-in check, hand off merge to @devops. Use when: wave-execute, run wave, epic wave, parallel stories SDC.

Analyze how a private SaaS company's ARR valuation multiple changed across funding rounds, and attribute the compression or expansion to rate cycles and macro selloffs, growth deceleration, narrative shifts (including an AI premium), competition, and investor demand, benchmarked against private-market medians and peers. Use this skill whenever the user asks about valuation compression, ARR multiples, round-to-round valuation or multiple changes, down rounds, or wants to compare a VC-backed software company's funding rounds. Research the rounds rather than answering from memory.

Turn a mission or lab idea into a fully researched GitHub issue spec on microsoft/agent-academy, then post it with the GitHub CLI. Use this skill whenever the user wants to propose new Agent Academy content before writing it — course missions (Recruit, Operative, Commander), standalone Special Ops, or Cowork Collective missions. Trigger whenever the user says "write a spec for a mission", "create an issue for a new lab", "I want to propose a Special Ops", "file a mission proposal", "spec out a lab", "open an issue for a new module", or hands over Microsoft Learn URLs and asks to turn them into an Agent Academy lab. This skill handles: mining source documentation, interviewing for scope, repo reconnaissance and duplicate detection across both docs and existing issues, frontmatter and tag validation, writing-style conformance, drafting the issue body, title conventions, milestone and assignee metadata, and posting plus verifying the issue via `gh`.

Write, review, or refactor correct, idiomatic Dart code. Use for Dart source, packages, snippets, tests, public APIs, documentation examples, and modern language features. Pair with the write-flutter skill for Flutter-specific concerns.

Use when you need to run all compiler checks (tests, lint, format) before committing. Detects whether TS or Rust code changed and runs the appropriate checks.

Hunt NTLM/Negotiate information disclosure on internet-reachable IIS/SharePoint/Exchange. Anonymous NTLM Type-2 challenge capture leaks NetBIOS domain, internal DNS forest, computer name, AD timestamp via AV_PAIRS structure. Default Windows-installer hostnames (WIN-XXXXXXXXXXX pattern) signal lazy provisioning. Use when target advertises `WWW-Authenticate: NTLM` or `Negotiate` headers anonymously.

Hunt Kubernetes & Docker — API anonymous access, kubelet 10250 exec (SPDY/WebSocket, NOT plain POST) and the simpler /run primitive, etcd 2379 unauth, dashboard skip-login, RBAC misconfig, secret/SA-token abuse, docker.sock host escape, runc/container-escape (Leaky Vessels CVE-2024-21626), API-server-mediated nodes/proxy RCE, EphemeralContainers node-shell, bound/projected SA-token audience+expiry abuse, admission-controller bypass, Helm/Tiller remnants. Use when target runs containerized infra, exposes K8s ports (6443/10250/10255/2379/8443), or cloud metadata reveals K8s service accounts.

Hunt CI/CD pipeline vulnerabilities — GitHub Actions workflow injection (pull_request_target Pwnrequest + ${{ }}-into-shell), self-hosted runner poisoning, OIDC trust-policy abuse, Jenkins script-console RCE and CVE-2024-23897 file read, GitLab CI runner-token registration, Terraform state file leakage, artifact/log secret leakage, pipeline env-var disclosure. Use when target has a public GitHub/GitLab org, exposed CI dashboards (Jenkins/TeamCity/Drone/Argo), or build artifacts/images are reachable.