文件操作
文件系统与批量文件任务
ssh
OpenHands
Establish and manage SSH connections to remote machines, including key generation, configuration, and file transfers. Use when connecting to remote servers, executing remote commands, or transferring files via SCP.
vercel-composition-patterns
openstatusHQ
React composition patterns that scale. Use when refactoring components with
copywriting
openstatusHQ
When the user wants to write, rewrite, or improve marketing copy for any page — including homepage, landing pages, pricing pages, feature pages, about pages, or product pages. Also use when the user says "write copy for," "improve this copy," "rewrite this page," "marketing copy," "headline help," or "CTA copy." For email copy, see email-sequence. For popup copy, see popup-cro.
windows-credential-harvesting
blacklanternsecurity
Harvest stored credentials from a Windows system for privilege escalation or lateral movement.
ldap-injection
blacklanternsecurity
Exploit LDAP injection vulnerabilities during authorized penetration testing.
skill-creator
HKUDS
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
apply-job
theaayushstha1
Automated job applications with AI-powered resume tailoring, cover letters, and recruiter outreach via email and LinkedIn.
web-design-patterns
jezweb
"Design patterns for website sections — heroes, cards, CTAs, trust signals, testimonials. Principle-based patterns that avoid AI-generated aesthetics. Pair with web-design-methodology for implementation."
opencode-primitives
different-ai
Reference OpenCode docs when implementing skills, plugins, MCPs, or config-driven behavior.
qmd
tobi
Search markdown knowledge bases, notes, and documentation using QMD. Use when users ask to search notes, find documents, or look up information.
av-edr-evasion
blacklanternsecurity
Bypass antivirus and EDR detection for payload delivery during exploitation. Covers custom payload compilation (mingw C, Go), AMSI bypass, shellcode alternatives, and ETW patching. Route here when an agent reports a payload was quarantined, blocked, or detected by endpoint protection.
credential-dumping
blacklanternsecurity
Extracts credentials from Active Directory: DCSync replication, NTDS.dit database extraction, SAM hive dump, Azure AD Connect (ADSync) credential extraction, LAPS passwords (legacy + Windows LAPS), gMSA passwords (KDS root key + GoldenGMSA), dMSA exploitation (BadSuccessor CVE-2025-21293), and DSRM credentials.
command-injection
blacklanternsecurity
Guide OS command injection exploitation during authorized penetration testing.
windows-service-dll-abuse
blacklanternsecurity
Exploit Windows service misconfigurations and DLL hijacking for local privilege escalation.
agent-memory
yamadashy
"Use this skill when the user asks to save, remember, recall, or organize memories. Triggers on: 'remember this', 'save this', 'note this', 'what did we discuss about...', 'check your notes', 'clean up memories'. Also use proactively when discovering valuable findings worth preserving."
elixir-thinking
georgeguimaraes
This skill should be used when the user asks to "implement a feature in Elixir", "refactor this module", "should I use a GenServer here?", "how should I structure this?", "use the pipe operator", "add error handling", "make this concurrent", or mentions protocols, behaviours, pattern matching, with statements, comprehensions, structs, or coming from an OOP background. Contains paradigm-shifting insights.
file-upload-bypass
blacklanternsecurity
Guide file upload restriction bypass during authorized penetration testing.
orchestrator
blacklanternsecurity
USE THIS SKILL when the user provides a target or list of targets (IPs, hostnames, URLs, subnets) and asks to attack, pentest, hack, scan, assess, or test them. ALSO USE THIS SKILL when the user references an existing engagement — resuming, continuing, picking up, checking status, or asking about next steps. Trigger phrases: "attack X", "pentest X", "hack X", "scan X", "start testing X", "pop X", "CTF target X", "engage X", "these targets", "resume engagement", "pick it up", "continue testing", "next steps", "where were we", "resuming", "advise next steps", "what should we do next", "engagement status". This is the entry point for all multi-phase penetration tests — handles recon, attack surface mapping, vulnerability chaining, and routes to technique skills for exploitation. Do NOT use when the user names a specific single technique (e.g., "run kerberoasting against X").
lfi
blacklanternsecurity
Guide Local File Inclusion (LFI) and Remote File Inclusion (RFI) exploitation during authorized penetration testing.
ajp-ghostcat
blacklanternsecurity
Exploit Apache JServ Protocol (AJP) misconfigurations and Ghostcat (CVE-2020-1938) for file read and remote code execution on Apache Tomcat. Use when port 8009 is open or AJP connector is exposed.
domain-hunter
ReScienceLab
Search domains, compare prices, find promo codes, get purchase recommendations. Use when user wants to buy a domain, check domain prices, find domain deals, compare registrars, or search for .ai/.com domains.
deserialization-php
blacklanternsecurity
Exploit PHP deserialization vulnerabilities during authorized penetration testing.
add-replacement-effect
phase-rs
Use when adding or modifying replacement effects — ETB-tapped, shock lands, damage prevention, "as enters" choices, or any event-modifying ability. Covers ReplacementDefinition wiring, the pipeline flow, post-replacement effects, and interactive pre-zone-change choices.
oracle-parser
phase-rs
"Use when doing any parser work — adding new Oracle text patterns, verb forms, phrase helpers, target patterns, subject handling, effect chain composition, fixing Unimplemented fallbacks, or understanding the parser architecture. This is the SINGLE SOURCE OF TRUTH for all oracle parser knowledge. Covers the nom combinator mandate, parsing priority system, AST type system, all helper modules, and contribution checklists."