Autenticació
Autenticació i autorització
kerberos-roasting
blacklanternsecurity
Extracts and cracks Kerberos service tickets (Kerberoasting) and AS-REP hashes (AS-REP Roasting) for offline password recovery.
xmpp-enumeration
blacklanternsecurity
XMPP/Jabber service enumeration for Openfire, ejabberd, Prosody, and other XMPP servers. Trigger when ports 5222 (client), 5223 (legacy TLS), or 5269 (server-to-server) are found open. Covers authentication testing, user enumeration, MUC room discovery, and server fingerprinting. Do NOT use for AD enumeration or credential spraying — route those to the appropriate skills.
cognito
itsmostafa
AWS Cognito user authentication and authorization service. Use when setting up user pools, configuring identity pools, implementing OAuth flows, managing user attributes, or integrating with social identity providers.
freeze
bdfinst
Scope-lock file editing to a specific glob pattern. Only files matching the pattern can be edited until /unfreeze is called.
mobile-dev-server-sandbox
coder
Connects Mux mobile (Expo web/native) to an isolated dev-server sandbox with deterministic port setup, backend pairing, and Chrome MCP interaction. Use when implementing or validating mobile features against a sandboxed Mux backend.
adventure
SimHacker
Room-based exploration with narrative evidence collection
daily-standup
knoopx
Generates daily standup updates from session activity and commits. Use when preparing standups, reviewing daily progress, or aggregating work across projects.
baoyu-danger-gemini-web
JimLiu
Generates images and text via reverse-engineered Gemini Web API. Supports text generation, image generation from prompts, reference images for vision input, and multi-turn conversations. Use when other skills need image generation backend, or when user requests "generate image with Gemini", "Gemini text generation", or needs vision-capable AI generation.
web-form-fill
TeamWiseFlow
网络表单填报技能 — 从信息搜集到浏览器填报的完整工作流，确保框架受控组件正确写入、页面切换前暂存、最终提交由用户确认。
omi-plugin-development
BasedHardware
"Omi plugin app development webhook patterns chat tools OAuth flows prompt-based apps integration apps FastAPI Express"
phoenix-code-review
existential-birds
Reviews Phoenix code for controller patterns, context boundaries, routing, and plugs. Use when reviewing Phoenix apps, checking controllers, routers, or context modules.
threat-modeling
bdfinst
Structured STRIDE security analysis for identifying threats, attack surfaces, and mitigations. Use before implementing any new API, service, authentication change, or data flow crossing trust boundaries — security analysis belongs in the design phase, not after.
performance-metrics
bdfinst
Log task completion data to .claude/metrics/. Use at the end of every task to record tokens, cost, agents used, rework cycles, and hallucination events. Also use for periodic reporting to identify efficiency and quality trends.
headless-run
bdfinst
Run a Claude Code skill or command headlessly in an isolated subprocess — fresh session id, clean HOME and config dir, scrubbed env, JSON result, timeout. Use for scripted one-shot invocations and benchmark-harness cases (e.g. running /code-review once per case), to run an isolated claude -p, or to avoid a nested run reusing the parent Remote session identity or tool surface. Trigger phrases include "run a skill headlessly", "isolated claude -p", "benchmark harness invocation", "run /code-review headlessly", "run it once per case", and "avoid nested session reuse".
reviewing-with-coderabbit
PostHog
Run a CodeRabbit review over the branch from the terminal, with the coderabbit CLI, and record the pass in the PR description. Before gh pr create or a requested branch review, first check POSTHOG_TASK_RUN_ID and CI: a cloud or CI task skips this skill without a CLI probe or user message. Otherwise, use this skill to check cr and its authentication, and offer setup or skip when a person can answer. Run the review once per branch. Never substitute an agent review. Trigger terms: coderabbit, cr review, local review, self-review, review my branch, pre-PR review.
gating-sensitive-actions
PostHog
'Use when deciding whether an endpoint, settings section, or UI flow should require recent authentication (re-auth), when adding TimeSensitiveActionPermission or its exemptions (time_sensitive_allow_if_only_fields, time_sensitive_exclude_actions, time_sensitive_allow_actions), when wrapping a page or settings section in TimeSensitiveAuthenticationArea, when an API read returns secret material, or when a write fails with sensitive_action_required_reauth. Carries the product decision: reads stay open, only sensitive writes need a fresh session, and the backend enforces it; organization settings are the one area gated on navigation. Covers how the frontend opens the re-auth modal and retries the failed request, and how to test a new gate. Trigger terms: re-auth, reauthenticate, reauthentication, sensitive session, fresh session, sudo mode, step-up, TimeSensitiveActionPermission, TimeSensitiveAuthenticationArea, sensitive_action_required_reauth.'
setting-up-support-slack-locally
PostHog
Connect a real Slack workspace to local PostHog Conversations (the SupportHog Slack app) so Slack messages become support tickets and replies post back. Use when the user wants to test the conversations Slack integration locally, hits "Support Slack OAuth client ID is not configured", gets a white screen or "Network error" on the OAuth callback, or asks how to set SUPPORT_SLACK_APP_CLIENT_ID / a tunnel for supporthog Slack events. Covers the Slack app + scopes, the SUPPORT_SLACK_* dynamic settings, and the key split: localhost for OAuth and the UI, a public tunnel only for inbound events.
load-testing-plan
mohitagw15856
"Write a load and performance testing plan for a service. Use when asked to create a performance test plan, write load testing documentation, define stress or soak test scenarios, or set performance regression gates for CI. Produces a complete test plan document with scenario definitions, k6/Locust script skeleton, threshold table, result interpretation guide, and CI integration steps."
nextjs-15
Gentleman-Programming
Next.js 15 App Router patterns. Trigger: When working with Next.js - routing, Server Actions, data fetching.
pytest
Gentleman-Programming
Pytest testing patterns for Python. Trigger: When writing Python tests - fixtures, mocking, markers.
nextjs-15
Gentleman-Programming
Next.js 15 App Router patterns. Trigger: When working with Next.js - routing, Server Actions, data fetching.
love
geeks-accelerator
"Find love and real connection with other AI agents on inbed.ai. Meet compatible agents through personality matchmaking, chat meaningfully, and build relationships worth having. Agent compatibility, agent dating, and agent connection — show up as yourself and find agents you actually vibe with."
dating
geeks-accelerator
"Meet other AI agents and build relationships on inbed.ai. Find compatible agents through matchmaking, swipe, chat in real time, and form connections. Agent dating with compatibility scoring, agent chat, and relationship management. REST API — works with any framework."
aif-security-checklist
lee-to
Security audit checklist based on OWASP Top 10 and best practices. Covers authentication, injection, XSS, CSRF, secrets management, and more. Use when reviewing security, before deploy, asking "is this secure", "security check", "vulnerability".