认证鉴权
认证与授权
performance-metrics
bdfinst
Log task completion data to .claude/metrics/. Use at the end of every task to record tokens, cost, agents used, rework cycles, and hallucination events. Also use for periodic reporting to identify efficiency and quality trends.
headless-run
bdfinst
Run a Claude Code skill or command headlessly in an isolated subprocess — fresh session id, clean HOME and config dir, scrubbed env, JSON result, timeout. Use for scripted one-shot invocations and benchmark-harness cases (e.g. running /code-review once per case), to run an isolated claude -p, or to avoid a nested run reusing the parent Remote session identity or tool surface. Trigger phrases include "run a skill headlessly", "isolated claude -p", "benchmark harness invocation", "run /code-review headlessly", "run it once per case", and "avoid nested session reuse".
ldap-injection
blacklanternsecurity
Exploit LDAP injection vulnerabilities during authorized penetration testing.
reviewing-with-coderabbit
PostHog
Run a CodeRabbit review over the branch from the terminal, with the coderabbit CLI, and record the pass in the PR description. Before gh pr create or a requested branch review, first check POSTHOG_TASK_RUN_ID and CI: a cloud or CI task skips this skill without a CLI probe or user message. Otherwise, use this skill to check cr and its authentication, and offer setup or skip when a person can answer. Run the review once per branch. Never substitute an agent review. Trigger terms: coderabbit, cr review, local review, self-review, review my branch, pre-PR review.
gating-sensitive-actions
PostHog
'Use when deciding whether an endpoint, settings section, or UI flow should require recent authentication (re-auth), when adding TimeSensitiveActionPermission or its exemptions (time_sensitive_allow_if_only_fields, time_sensitive_exclude_actions, time_sensitive_allow_actions), when wrapping a page or settings section in TimeSensitiveAuthenticationArea, when an API read returns secret material, or when a write fails with sensitive_action_required_reauth. Carries the product decision: reads stay open, only sensitive writes need a fresh session, and the backend enforces it; organization settings are the one area gated on navigation. Covers how the frontend opens the re-auth modal and retries the failed request, and how to test a new gate. Trigger terms: re-auth, reauthenticate, reauthentication, sensitive session, fresh session, sudo mode, step-up, TimeSensitiveActionPermission, TimeSensitiveAuthenticationArea, sensitive_action_required_reauth.'
setting-up-support-slack-locally
PostHog
Connect a real Slack workspace to local PostHog Conversations (the SupportHog Slack app) so Slack messages become support tickets and replies post back. Use when the user wants to test the conversations Slack integration locally, hits "Support Slack OAuth client ID is not configured", gets a white screen or "Network error" on the OAuth callback, or asks how to set SUPPORT_SLACK_APP_CLIENT_ID / a tunnel for supporthog Slack events. Covers the Slack app + scopes, the SUPPORT_SLACK_* dynamic settings, and the key split: localhost for OAuth and the UI, a public tunnel only for inbound events.
load-testing-plan
mohitagw15856
"Write a load and performance testing plan for a service. Use when asked to create a performance test plan, write load testing documentation, define stress or soak test scenarios, or set performance regression gates for CI. Produces a complete test plan document with scenario definitions, k6/Locust script skeleton, threshold table, result interpretation guide, and CI integration steps."
nextjs-15
Gentleman-Programming
Next.js 15 App Router patterns. Trigger: When working with Next.js - routing, Server Actions, data fetching.
pytest
Gentleman-Programming
Pytest testing patterns for Python. Trigger: When writing Python tests - fixtures, mocking, markers.
nextjs-15
Gentleman-Programming
Next.js 15 App Router patterns. Trigger: When working with Next.js - routing, Server Actions, data fetching.
2fa-bypass
blacklanternsecurity
Bypass two-factor authentication (2FA/MFA) during authorized penetration testing.
ad-discovery
blacklanternsecurity
Enumerates Active Directory domains and maps attack surface for penetration testing.
love
geeks-accelerator
"Find love and real connection with other AI agents on inbed.ai. Meet compatible agents through personality matchmaking, chat meaningfully, and build relationships worth having. Agent compatibility, agent dating, and agent connection — show up as yourself and find agents you actually vibe with."
dating
geeks-accelerator
"Meet other AI agents and build relationships on inbed.ai. Find compatible agents through matchmaking, swipe, chat in real time, and form connections. Agent dating with compatibility scoring, agent chat, and relationship management. REST API — works with any framework."
aif-security-checklist
lee-to
Security audit checklist based on OWASP Top 10 and best practices. Covers authentication, injection, XSS, CSRF, secrets management, and more. Use when reviewing security, before deploy, asking "is this secure", "security check", "vulnerability".
pytest
prowler-cloud
Pytest testing patterns for Python. Trigger: When writing or refactoring pytest tests (fixtures, mocking, parametrize, markers). For Prowler-specific API/SDK testing conventions, also use prowler-test-api or prowler-test-sdk.
playwright
prowler-cloud
Playwright E2E testing patterns. Trigger: When writing Playwright E2E tests (Page Object Model, selectors, MCP exploration workflow). For Prowler-specific UI conventions under ui/tests, also use prowler-test-ui.
xmpp-enumeration
blacklanternsecurity
XMPP/Jabber service enumeration for Openfire, ejabberd, Prosody, and other XMPP servers. Trigger when ports 5222 (client), 5223 (legacy TLS), or 5269 (server-to-server) are found open. Covers authentication testing, user enumeration, MUC room discovery, and server fingerprinting. Do NOT use for AD enumeration or credential spraying — route those to the appropriate skills.
playwright
Gentleman-Programming
Playwright E2E testing patterns. Trigger: When writing E2E tests - Page Objects, selectors, MCP workflow.
playwright
Gentleman-Programming
Playwright E2E testing patterns. Trigger: When writing E2E tests - Page Objects, selectors, MCP workflow.
uipath-test
UiPath
"UiPath Test Manager — manage test projects, cases, sets, executions; generate reports; package and run external Playwright test suites. For Orchestrator→uipath-platform. For Studio/RPA test automation authoring→uipath-rpa."
uipath-admin
UiPath
"UiPath Admin via uip admin — Identity Server (users, groups, robot accounts, external OAuth2 apps, secrets, PATs, SMTP), Authorization (custom roles, role assignments, permission catalog, effective-access check-access PDP), OMS (org read/update, tenant lifecycle, service provisioning, regions, async op polling), IP Restriction (allowlist, enforcement, bypass rules, lockout safety), and Audit via uip admin audit (event sources, paginated queries, JSON-folder or CSV export, exclusion rules). Troubleshoot access-denied, login failures, role misconfig, IP lockout, PAT/app auth. Owns ALL org/tenant/identity audit — use uip admin audit, NOT uip or audit-logs, for any audit logs / audit trail / audit events / export / login history / who-did-what request. Also owns audit exclusion rules: stop, suppress, or mute recording of chosen audit events (audit org exclusions). Orchestrator-specific roles/permissions/folders/jobs→uipath-platform. RPA workflows→uipath-rpa."
uipath-tasks
UiPath
"UiPath Action Center human-in-the-loop tasks via uip tasks: list, assign, complete, plus task catalogs, comments, labels, metadata, and task data (get/save). For authoring HITL nodes in flows/agents→uipath-human-in-the-loop. For Orchestrator→uipath-platform, codedapp→uipath-coded-apps. Skip Document Understanding."
pytest
Gentleman-Programming
Pytest testing patterns for Python. Trigger: When writing Python tests - fixtures, mocking, markers.