Conduct a defensible cybersecurity risk assessment using the NIST SP 800-30 Rev 1 methodology: prepare scope and a risk model, identify threat sources and threat events, identify vulnerabilities and predisposing conditions, determine likelihood and impact, compute risk, and communicate results as a prioritized risk register. Use when an organization needs an actual risk *assessment* (not a maturity score), when a control framework (CSF, ISO 27001, RMF, SOC 2, PCI) requires a documented risk analysis as input, when leadership asks "what are our top risks and how bad are they", when assessing risk for a new system or major change, or when building a risk register from scratch. This is the methodology that feeds framework selection, ATO packages, and treatment decisions. Keywords: risk assessment, NIST 800-30, threat modeling, likelihood and impact, risk register, risk analysis, threat sources, vulnerabilities, risk determination, qualitative risk, risk matrix, residual risk, risk treatment.

Build and query AI-powered knowledge bases from claude-mem observations. Use when users want to create focused "brains" from their observation history, ask questions about past work patterns, or compile expertise on specific topics.

Guide for implementing features in ClaudeBar following architecture-first design, TDD, rich domain models, and Swift 6.2 patterns. Use this skill when: (1) Adding new functionality to the app (2) Creating domain models that follow user's mental model (3) Building SwiftUI views that consume domain models directly (4) User asks "how do I implement X" or "add feature Y" (5) Implementing any feature that spans modules (DataSources, Providers, Quotas) and the App

Act as the user's live meeting sidekick inside the current terminal agent session. Use when the user explicitly asks you, the terminal agent, to watch a meeting, follow the live transcript, answer during the call, offer strategist thoughts, silently watch for risks, or track decisions. Do not use this skill to start or control the separate Minutes Coach HUD; explicit Coach or HUD lifecycle requests belong to minutes-copilot, and an ambiguous request such as "coach me live" requires one short surface clarification.

Act as the user's live meeting sidekick inside the current terminal agent session. Use when the user explicitly asks you, the terminal agent, to watch a meeting, follow the live transcript, answer during the call, offer strategist thoughts, silently watch for risks, or track decisions. Do not use this skill to start or control the separate Minutes Coach HUD; explicit Coach or HUD lifecycle requests belong to minutes-copilot, and an ambiguous request such as "coach me live" requires one short surface clarification.

AI DevKit · Systematic structural or multi-file refactors across any stack while preserving behavior and public contracts. Use for reorganizing modules, boundaries, naming, APIs/contracts, staged refactor plans, or refactor risk review.

Create uncontested market space using value innovation instead of competing head-to-head. Use when the user mentions "blue ocean", "red ocean", "strategy canvas", "ERRC framework", "value innovation", "non-customers", "buyer utility map", "the market is too crowded", "how do we stand out", or "escape the price war". Also trigger when exploring a new market category, or finding underserved or non-customers. Covers the Four Actions Framework, Six Paths, buyer utility map, and value-cost trade-offs. For real strategy formulation and bad-strategy detection, see good-strategy-bad-strategy. For tech adoption strategy, see crossing-the-chasm. For product positioning, see obviously-awesome.

The canonical recipe for starting a fresh working branch off a freshly fetched `origin/main` in Meshtastic-Android. Use this whenever a unit of work starts - "new branch off main", "peel off a fresh branch", "dust off

Reactive Data Client (@data-client/*). Start here for any task or bug in an app that uses it, or to add it to one.

Wire a scaffolded PortalJS portal to a CKAN backend over its API. Generates a tiny server-side fetch client (no runtime dependency) and feeds the /search catalog and /@namespace/slug showcases from CKAN instead of datasets.json. Use when connecting an existing portal to a live CKAN instance instead of a static manifest.

Turn workflows from your MemSearch memory into reusable skills. Use when the user asks to make/create/extract/distill a skill from what they just did or from past work, review skill candidates, install a distilled skill, or 'turn this into a skill'. Manages MemSearch procedural-memory candidates under .memsearch/skill-candidates/, not the host agent's own skills system.

Prepare or repair a project's prototyping environment so open-design can build prototypes with the project's own component library and render them through the project's toolchain. Use when the library target is needed and docs/design/prototyping.md is missing, stale, or failing; excludes HTML-only design work and production feature implementation.

记忆系统三入口路由（search_evidence / graph_resolve / list_recent）决策树 + 噪音控制 + 加载时机。F188 Phase F (AC-F6) 配套 skill。 Use when: 没先验、压缩后回顾、"我记得最近讨论过 X"、search_evidence 反复 low-hit。 Not for: 已有消息坐标或文件路径时直接读原文；代码符号查 Grep/LSP。 Output: 选定入口 + 噪音控制参数 + 进入对应 MCP 工具。

F311 能力进化入口与续办。Use when: 用户询问可进化对象，或直接给出要改善的 Agent/业务能力结果，或已有项目需要继续。Not for: 事后复盘、确定性 bug、运行健康排查；只讨论或延后启动时不建 Program。Output: 解释边界；动作型目标幂等建 Program，并在同一 invocation 提交、回读首轮准备；已有项目按真实证据与权限继续取证、改进、复验和方法回流。

Calculate contract-based futures position sizes from a direction, entry, and stop-loss, using verified per-symbol contract specs (multiplier, tick size, tick value). Use when the user asks how many futures contracts to trade, wants to size a futures position (ES, NQ, ZB, GC, CL, 6E/E6, VX, BT, ...), or is handing off a contrarian-setup-gate READY_FOR_PLAN direction/invalidation_level for sizing. Pure, offline calculation -- no API keys, no network.

Install and repair the abed-hub tools and skills with the `abed-hub` CLI. Use when a hub command is missing (`gh-attach`, `jira`, `slack`), when a skill is behind the repo it came from, when you need where a config file lives or what is in it, or for "set up abed-hub".

Use when the user asks about Maximiliano Firtman's ("Maxi") AI Native DevCon talk on Web MCP and the agentic web — including questions about how Web MCP differs from MCP, exposing frontend tools to AI agents, the imperative vs declarative Web MCP APIs, tool design guidance (name/description/input schema/execute), the Chrome 149 origin trial, using Chrome DevTools MCP or Puppeteer as a bridge today, the Doom demo, or applying Firtman's "pick one high-value page state" adoption approach to current work.

Keep a reviewable decision trail for long-running or unattended work: a TSV log with one row per decision (what, why, evidence, result). Local by default; commit it when a reviewer needs the trail to trust the result. Use for /show-me-your-work, autonomous or multi-phase runs, or work a human reviews after stepping away.

Apply when designing types, reviewing a function signature, or writing code in any statically-typed language. Make illegal states unrepresentable, brand semantic primitives, parse external data at boundaries, refuse to lie to the compiler, exhaust variants, derive from authoritative schemas.

Diagnose and fix a reproducible failure in an existing project. Use for crashes, broken behavior, or failing checks, not greenfield planning.