Implement authentication and authorization with Better Auth - a framework-agnostic TypeScript authentication framework. Features include email/password authentication with verification, OAuth providers (Google, GitHub, Discord, etc.), two-factor authentication (TOTP, SMS), passkeys/WebAuthn support, session management, role-based access control (RBAC), rate limiting, and database adapters. Use when adding authentication to applications, implementing OAuth flows, setting up 2FA/MFA, managing user sessions, configuring authorization rules, or building secure authentication systems for web applications.

Build or review caddy-security Caddyfiles and select focused configuration skills. Use for security app declarations and authenticate/authorize route wiring.

Compozy visual-design authority for production UI, static artifacts, prototypes, and reviews. Use when creating or reviewing a Compozy surface or changing tokens, typography, spacing, depth, icons, or motion. Do not use for capture-only verification; use eng-ui-screenshot.

Control Herdr, a terminal multiplexer for coding agents. Use only when the user explicitly mentions Herdr or asks to use Herdr to inspect or control panes, tabs, workspaces, commands, or another agent. Do not use merely because a task could benefit from a background terminal, delegation, or parallel work. Requires HERDR_ENV=1.

Use when the user asks to "figure out where our direct traffic really comes from", "measure dark social", "add a how-did-you-hear-about-us field", or "show social drives signups without click data"; produces a share-link/UTM hygiene spec for owned share surfaces, a self-reported attribution field design that replaces an existing form field (free-text first, coded later), a GA4 direct-traffic decomposition read (deep-URL directs, mobile-app skew, private-push correlation) with every derived number hard-labeled Estimated/proxy, and a branded-search-lift proxy from GSC plus Wikipedia pageviews — the declared dark-social method behind ECHO O2. Not for paid-channel attribution reconciliation (platform-claimed vs analytics conversions) — use attribution-reconciler. 暗社交归因/直接流量分解/自报来源字段/分享链路UTM

Use when the user asks to "check if our surfaces have drifted from the canon", "watch for competitor repositioning", or "define when we should reposition"; produces a drift report — self-drift per flagship surface vs the narrative-registry canon over time (via wayback.py, change history Measured with as-of dates), competitor-repositioning alerts, an explicit repositioning-trigger condition set, and a D1/W1/M1 message-shift retro (intended vs actual pull-through, evidence-labeled) — feeding the TALE L drift-audit sub-items and the narrative-whiplash guardrail fact base. Not for the first-time consistency check before a surface ships — use narrative-cascade-planner; not for computing the TALE profile result or running the vetoes — use narrative-quality-auditor; not for echo-rate / AI-answer resonance measurement — use narrative-resonance-monitor. 自漂移监测/竞品重定位告警/重定位触发/叙事漂移复盘

Use when the user asks to "plan my launch tier", "how big should this launch be", or "build a launch risk register with kill criteria"; produces a tier decision (Tier 1 flagship all-channel / Tier 2 targeted / Tier 3 changelog-level), a launch-type declaration (new-product / feature / relaunch / partnership with co-marketing split), an effort calibration matrix (tier to channel intensity and asset scope), D0/W1/M1 KPI targets (labeled Estimated), a risk register (likelihood x blast-radius, owners, mitigations, kill criteria / rollback thresholds), and a T-8w to T+4w timeline skeleton. Not for picking the launch date or window — use launch-window-planner; not for creator-channel launch campaigns — use campaign-planner. 发布分级/发布类型/风险登记册/kill criteria

Use when the user asks to "run a deliverability pre-flight before I send", "check my SPF/DKIM/DMARC/BIMI", "why am I landing in spam / promotions", or "score my sender reputation and list hygiene"; runs the ONE-TIME pre-send SEND S1 authentication pre-flight and builds the SEND S (Sender-integrity / Deliverability) evidence read — DNS + DMARC-RUA auth, domain/IP reputation, inbox placement, content/link/render, and point-in-time bounce/complaint hygiene — using Pass/Partial/Fail/Unknown/N/A states and scoring only at complete applicable coverage. Not for the recurring hygiene trend — use list-hygiene-monitor; not for final EQS or veto verdicts — use email-quality-auditor; not for segments/suppression lists — use list-segment-builder. 邮件送达率预检/SPF DKIM DMARC认证/发件域声誉

Use when the user asks to "mine my search terms", "find new keywords from converting queries", "build a negative-keyword list", or "cut wasted paid spend"; harvests converting queries into new keywords/ad-groups, builds a standing negative-keyword list and an n-gram waste report from the search-terms export, and delivers a maintenance diff (add / negate / move). Not for account structure — use campaign-architect; not for budget split — use budget-optimizer; not for computing the final RQS — use ad-account-auditor. 付费广告搜索词挖掘/否定关键词/浪费词清单

围绕计划、decision 或 idea 持续追问用户。适用于用户想对自己的思路做压力测试，或使用任何 “grill” 触发措辞时。

Turns a topic, article, document or dataset into a 45 to 120 second narrated explainer video - HTML, CSS and GSAP scenes rendered to MP4 with HyperFrames - in one of three looks (paper collage, whiteboard line drawing, or data story with animated charts), with a voiceover in any of 12 languages and captions timed to the spoken words. Use it when someone wants to explain an idea, a process, a product or a set of numbers in a short video for a site, a course, a launch post or a team update. The agent outlines, scripts at a measured pace, gets a storyboard approved, then times every scene and caption to the real voiceover and checks sync, pacing, facts and loudness before delivery. The skill is free; generating voiceover, transcription, music and images through the PopNow API is paid from the separate API USD balance, and the agent quotes USD before any paid run.

Turns one message into a full set of share images - Open Graph 1200x630, X 1600x900, LinkedIn 1200x627, RedNote 1080x1440, YouTube thumbnail 1280x720, Instagram 1080x1350 and optional App Store 1290x2796 screenshots - as exact-size PNG and WebP files with a contact sheet. Every word is real HTML text in bundled fonts, so nothing is misspelled; only backgrounds and subjects come from image generation. Seven layout systems, per-platform safe areas, and checks for fit, contrast, reserved zones, pixel size and file weight. Use it for launch posts, article and docs link previews, video thumbnails and store screenshots. The skill is free; generating images through the PopNow API is paid from the separate API USD balance, and the agent quotes USD before any paid run.

X (Twitter) integration for NanoClaw. Post tweets, like, reply, retweet, and quote. Use for setup, testing, or troubleshooting X functionality. Triggers on "setup x", "x integration", "twitter", "post tweet", "tweet".

Switch from Docker to Apple Container for macOS-native container isolation. Use when the user wants Apple Container instead of Docker, or is setting up on macOS and prefers the native runtime. Triggers on "apple container", "convert to apple container", "switch to apple container", or "use apple container".

Reference for writing a Workflow tool script (script API and gotchas, pipeline-vs-barrier rules, quality patterns, worked examples). Load before authoring a script for a workflow the user already opted into; it does not itself authorize running one.

Diagnose and repair MemFS repository setup, remote sync, authentication failures, optional backup remotes, or merge/rebase conflicts. Do not load for routine memory reads or edits.

Creates, edits, and migrates Letta Code statusline mods. Use when handling the /statusline command or continuing work started by /statusline.

Manages Google Workspace operations across 12 services (Gmail, Drive, Calendar, Docs, Sheets, Slides, Forms, Tasks, Contacts, Chat, Apps Script, Custom Search). Supports MCP tools or the workspace-cli client. Provides tool routing, workflows, and parameter guidance for every tool. Triggers for "check my email", "find a file", "schedule a meeting", "update the spreadsheet", "share a doc", "create a presentation", "add a task", "look up a contact", or any mention of Google Workspace services.

Build and review Remix 3 applications using the `remix` npm package and subpath imports. Use when working on Remix app structure, routes, controllers, middleware, validation, data access, auth, sessions, file uploads, server setup, UI components, hydration, HMR, navigation, or tests.

Verify a published release of the C# MCP SDK. Monitors the Release and Publish Docs workflows triggered by publishing a GitHub release, confirms the packages are listed on NuGet.org, and confirms the versioned documentation site reflects the release. Use when asked to verify a release, check whether a release published correctly, monitor the release or docs workflow, confirm packages on NuGet, or check whether the docs site updated.