最高评分
社区最喜爱的高星技能，质量有保障。
babysit-pr
openai
Babysit a GitHub pull request after creation by continuously polling review comments, CI checks/workflow runs, and mergeability state until the PR is merged/closed or user help is required. Diagnose failures, retry likely flaky failures up to 3 times, auto-fix/push branch-related issues when appropriate, and keep watching open PRs so fresh review feedback is surfaced promptly. Use when the user asks Codex to monitor a PR, watch CI, handle review comments, or keep an eye on failures and feedback on an open PR.
test-tui
openai
Guide for testing Codex TUI interactively
instrumenting-first-party-metrics
PostHog
"How to instrument PostHog's own Metrics product from PostHog-owned code — record counters, gauges, and histograms that land in posthog.metrics, the same way customers do. Use when adding application metrics in this monorepo (web, Celery, Temporal), when asked to push or ship metrics into posthog metrics, or when unsure whether the SDK in this environment supports posthog.metrics yet. Covers the environment decision (SDK-first per the public docs, OTel fallback when the SDK path is not available), the exact version gates per SDK, what is already wired internally, and how to validate metrics actually arrive."
writing-skills
PostHog
'Guide for writing PostHog agent skills — job-to-be-done templates that teach agents how to use MCP tools to achieve a goal. Use when adding new product functionality that agents should know how to work with, creating a new skill, or updating existing skills in products/*/skills/.'
isolating-product-facade-contracts
PostHog
Plan and execute product isolation migrations to a facade plus contract layer in PostHog, following the Visual review architecture. Use when a product still exposes internals (models/logic/views) across boundaries and needs migration toward contracts.py + facade/api.py + presentation separation, with a PR strategy that minimizes review latency and conflicts with parallel work.
implementing-mcp-tools
PostHog
'Guide for exposing PostHog product endpoints as MCP tools. Use when creating new or updating API endpoints, adding MCP tool definitions, scaffolding YAML configs, or writing serializers with good descriptions. Covers the full pipeline from Django serializer to generated TypeScript tool handler.'
monitoring-ingestion-pipeline
PostHog
Guide for using the Grafana MCP to monitor and diagnose the Node.js ingestion pipeline workers in production. Use when investigating event lag, drops, pipeline errors, person/group processing, Kafka consumer health, Redis, Postgres, ClickHouse downstream health, or any ingestion worker question. Covers prod-us and prod-eu environments.
querying-tophog
PostHog
Query tophog — the ingestion pipeline's heavy-hitter store in ClickHouse — to identify hot or expensive actors (team_id, distinct_id, session_id, partition) during incident triage. Use when investigating ingestion lag, a hot or lagging Kafka partition, expensive person processing, merge storms, or any "which team or distinct_id is causing this" question. Covers the internal Metabase access path (SSO via hogli), the tophog schema, and the cost-vs-volume query lens. Internal-only: results contain cross-customer identifiers.
optimizing-clickhouse-and-hogql-queries
PostHog
Workflow for optimizing ClickHouse and HogQL queries. Use when a HogQL query, query runner, insight, or report is too slow; when a hand-written ClickHouse query (via sync_execute or in a migration) is too slow; when ClickHouse times out or hits memory limits; when investigating a slow system.query_log row; or when reviewing a proposed HogQL printer change for performance. Covers extracting the ClickHouse SQL, common smells (FROM ... FINAL, JSONExtract over properties, missing skip indexes, self-joins, CTE blow-up), measuring against a real cluster, and applying the fix at the right layer (printer, query runner, or migration). Does NOT cover Postgres / Django ORM / app-database queries; those need pganalyze and the Postgres section of query-performance-optimization.md.
playwright-test
PostHog
Write a playwright test, make sure it runs, and is not flaky.
analyzing-malware-sandbox-evasion-techniques
mukul975
Detect sandbox evasion techniques in malware samples by analyzing timing checks, VM artifact queries, user interaction
omarchy
basecamp
REQUIRED for end-user customization of Linux desktop, window manager, or system config. Use when editing ~/.config/hypr/, ~/.config/waybar/, ~/.config/walker/, ~/.config/alacritty/, ~/.config/kitty/, ~/.config/ghostty/, ~/.config/mako/, or ~/.config/omarchy/. Triggers: Hyprland, window rules, animations, keybindings, monitors, gaps, borders, blur, opacity, waybar, walker, terminal config, themes, wallpaper, night light, idle, lock screen, screenshots, layer rules, workspace settings, display config, and user-facing omarchy commands. Excludes Omarchy source development in ~/.local/share/omarchy/ and omarchy-dev-* workflows.
analyzing-azure-activity-logs-for-threats
mukul975
'Queries Azure Monitor activity logs and sign-in logs via azure-monitor-query to detect suspicious administrative
analyzing-memory-forensics-with-lime-and-volatility
mukul975
'Performs Linux memory acquisition using LiME (Linux Memory Extractor) kernel module and analysis with Volatility
analyzing-browser-forensics-with-hindsight
mukul975
Analyze Chromium-based browser artifacts using Hindsight to extract browsing history, downloads, cookies, cached
analyzing-cyber-kill-chain
mukul975
'Analyzes intrusion activity against the Lockheed Martin Cyber Kill Chain framework to identify which phases
analyzing-macro-malware-in-office-documents
mukul975
'Analyzes malicious VBA macros embedded in Microsoft Office documents (Word, Excel, PowerPoint) to identify download
acquiring-disk-image-with-dd-and-dcfldd
mukul975
Create forensically sound bit-for-bit disk images using dd and dcfldd while preserving evidence integrity through
analyzing-disk-image-with-autopsy
mukul975
Perform comprehensive forensic analysis of disk images using Autopsy to recover files, examine artifacts, and
analyzing-campaign-attribution-evidence
mukul975
Campaign attribution analysis involves systematically evaluating evidence to determine which threat actor or
analyzing-outlook-pst-for-email-forensics
mukul975
Analyze Microsoft Outlook PST and OST files for email forensic evidence including message content, headers, attachments,
analyzing-dns-logs-for-exfiltration
mukul975
'Analyzes DNS query logs to detect data exfiltration via DNS tunneling, DGA domain communication, and covert
analyzing-network-covert-channels-in-malware
mukul975
Detect and analyze covert communication channels used by malware including DNS tunneling, ICMP exfiltration,
analyzing-apt-group-with-mitre-navigator
mukul975
Analyze advanced persistent threat (APT) group techniques using MITRE ATT&CK Navigator to create layered heatmaps