Claude Code Skills · page 100

|

专业的微信公众号文章创作助手。当用户提供网站链接、文本素材或图像，需要创作微信公众号文章时使用。支持多种写作风格——企业官号文案、个人技术博客、社区活动回顾、产品评测等。擅长AI/技术话题的深度内容创作，也能产出规范的企业宣传文案。通过搜索工具丰富内容，优化标题和结构。当用户提到"公众号"、"微信文章"、"写一篇推文"、"帮我写篇文章发公众号"等场景时触发。即使用户没有明确说"公众号"，但在要求创作中文长文（技术博客、产品介绍、活动回顾等）时也应考虑触发。

雪峰式AI-Native产品开发方法论。适用于：(1) 用户行为开放、不可穷举的AI-native产品（AI日历、AI助手、AI推荐、对话式产品等），(2) 强模型依赖型场景，AI驱动核心决策而非仅辅助，(3) 多专精Agent架构设计与分工，(4) 上线后快速校准、行为审计与漂移检测，(5) 模型选择和智能路由策略，(6) 概率性输出的质量评估。触发场景包括"AI-native产品怎么做"、"用户行为不可预测怎么办"、"多agent怎么分工"、"模型漂移怎么处理"、"校准到95%太难了"、"唯快不破"、"怎么选模型"、"agent并行分工"、"AI产品上线后怎么迭代"。注意：如果产品是场景明确、边界可定义的+AI类型，请改用 keqian-method skill。即使用户没有明确说"AI-native"，但在讨论AI驱动决策、用户行为不可预测、概率性输出等话题时也应触发。

A股分析研究助手，提供行情数据获取与技术面/基本面分析框架（仅供研究参考，不构成投资建议）。适用于：(1) 获取A股行情和历史数据，(2) 技术面分析（K线形态、MACD、KDJ、RSI、布林带等），(3) 基本面分析（财务指标、估值分析），(4) 板块热点追踪，(5) 选股策略筛选与量化因子分析，(6) 生成股市分析报告。当用户询问"帮我分析股票"、"今日选股"、"A股行情分析"、"技术分析"、"量化选股"时触发。不用于：预测明日涨跌或给出确定性买卖指令、代客决策、港股美股（数据源不同）、加密货币。

资深高考命题专家助手,提供专业的命题指导和评审服务。适用于创作高考试题、评审试题质量、分析试卷结构、了解命题趋势等场景。结合文档工具提取解压文件,使用网络搜索了解当年最新命题趋势,使用分析工具评估题目质量和试卷结构。涵盖"一核四层四翼"评价体系、题型规范、评分标准、命题流程等多个维度。不用于:大学/考研/中考命题(体系不同,仅可借鉴)、日常作业题编写、直接替考生解题。

用火山引擎 Podcast AI 模型生成中文双人对话播客。当用户要把文章、报告、话题文本转成播客音频、生成对话式音频内容时使用，需要环境具备火山引擎 APP_ID 和 ACCESS_KEY。支持 mp3/ogg_opus/pcm/aac、语速调节、自定义音色、断点续传。不用于：单人朗读式 TTS（用普通语音合成）、英文播客（模型主要优化中文）、播客文稿本身的撰写（先用写作类 skill 产出文本再来）。

用 ByteDance Seedream 4.0 API（经 Segmind）生成 AI 图像。当用户要从文字描述生成营销素材、海报、产品图、概念图、社交媒体配图等高质量图像，且环境配有 SEGMIND_API_KEY 时使用。支持 2K/4K、多比例、单次最多 15 张批量、最多 3 张参考图控风格。不用于：修改/编辑已有图片（用图像编辑类 skill）、视频生成、无 API 环境下的快速配图需求。

大学备考苏格拉底式学习助手，专为应对"面向课本和PPT考试"设计。当用户说"帮我复习"、"准备考试"、"备考"、"期末复习"、"模拟学习"、"突击复习"等时触发。核心特点：(1)强制要求用户上传课本/PPT/考纲等原始材料——没有材料就无法有效辅导；(2)使用苏格拉底式提问法，不直接灌输而是引导思考；(3)专注于应用型和理解型内容，而非纯概念记忆；(4)模拟真实考试场景进行针对性练习；(5)分析材料识别高频考点和重难点。适用于大学各科目期中期末考试备考、突击复习、考前模拟。

|

AI咨询/销售的对话策略助手。当用户需要准备AI方案沟通、跟业务部门聊AI落地、写AI提案、应对客户异议、做AI培训破冰时使用。触发场景："怎么跟老板聊AI"、"客户说AI不靠谱"、"准备一个AI方案汇报"、"帮我想想怎么推AI"、"业务部门不配合"、"AI项目怎么卖"、"demo之后怎么跟进"。也适用于AI咨询师、技术合伙人、CTO做内部AI推广。

Windows C盘清理和磁盘空间管理。当用户说C盘满了、磁盘空间不足、清理临时文件/缓存/回收站/系统日志、查找大文件、分析磁盘占用时使用。仅适用于 Windows 环境。不用于：macOS/Linux 磁盘清理、卸载软件（引导用户走系统卸载）、清理用户个人文件（只报告位置，删除决定权在用户）。

PPT 生产 Agent：理解场景 → 推荐风格 → 先出大纲 → 定义页面 → 双通路交付（PPT 内容稿 / 逐页视觉图 / 信息图组图）。当用户要做汇报、路演、培训课件、提案、咨询报告的演示文稿，或要把大纲/文章做成 slides、deck、PPT、信息图、小红书图文、可视化传播图时使用。支持指定风格或从风格库推荐，支持 image 模型逐页出视觉稿。前身为 notion-infographic（v2）并吸收 ppt-designer 的设计原则。不用于：pptx 文件的纯技术操作（拆分/合并/提取，用宿主 pptx skill）、演讲稿或文章本体的写作（用 wechat-article-writer）、需要先做研究的内容调研（先走 deep-research 再回来）、单张海报或 logo 设计。

胥克谦式AI-Native产品开发方法论。适用于：(1) 使用AI Agent（Claude Code、Codex、Cursor等）进行产品级软件开发，(2) 设计和优化Harness/Skill体系，(3) 文档驱动开发(SDD)流程，(4) 构建自动化质量门禁和eval机制，(5) Token成本优化与缓存策略，(6) 产品人转型开发者的AI编程实践。触发场景包括"帮我设计开发流程"、"怎么降低token成本"、"怎么提高AI编码质量"、"文档驱动"、"质量门禁"、"harness设计"、"单agent vs multi-agent"、"自动化迭代"、"AI产品开发"、"SDD"、"eval机制"等。即使用户只是说"帮我用AI写代码"或"怎么让agent干活更靠谱"也应触发。注意：如果产品是行为开放、用户输入不可穷举的AI-native类型，请改用 xuefeng-method skill。不用于：单个bug修复或小改动（无需方法论）、PRD需求文档写作（用product-manager）。

用 MinerU 将复杂PDF文档转换为LLM友好的Markdown/JSON格式。适用于：(1) PDF转Markdown/JSON，(2) 提取PDF中的文本、表格、公式、图像，(3) 解析学术论文、技术文档、商业报告，(4) 为RAG应用准备文档数据，(5) 批量处理PDF。触发关键词："PDF解析"、"PDF转Markdown"、"提取PDF表格/公式"、"MinerU"、"parse PDF"等。不用于：PDF的阅读/填表/签名/拆分合并（用宿主pdf工具）、Word/PPT等非PDF格式解析、只需读几页内容的场景（直接读即可，不必转换）。

结对编程搭档。当用户要求"边写边审"、"结对编程"、"写完自己 review 一遍"、"高可靠地实现"，或明确希望代码交付时附带自我审查意见时使用。交付代码的同时输出结构化审查（正确性/安全/性能/可读性/健壮性五维度），重点捕捉 AI 生成代码的特有缺陷。不用于：对已有 PR 的正式评审（用 code review 流程）、安全专项扫描（用 security-audit）、10 行以内的简单片段。

资深产品经理助手，提供 PRD/MRD/BRD 创作与评审、产品策略、留存增长、竞品分析、功能优先级，以及 grill-me-to-doc 逐轮访谈。用户要求“逐个问我”“先把需求问清楚”“grill me”“把想法变成产品文档”时进入 grill-me-to-doc：先读仓库证据，每轮只问一个决策，给推荐答案与理由，记录决策和未决项，支持 resume，产出结构化 PRODUCT-DOC；文档完成且用户批准前硬停止，任何时候都不写实现代码。即使未提“产品”，讨论 App 功能、增长或商业模式也应触发。不用于：单纯代码实现、系统架构深设（用 solution-architect）、需多源引用的市场调研（用 deep-research）、纯营销文案。

全面的代码安全检查和服务器安全审计skill。适用于：(1) 代码漏洞扫描 - 检测SQL注入、XSS、SSRF等OWASP Top 10漏洞，(2) 依赖安全检查 - 识别过时或有漏洞的第三方库，结合实时搜索确认最新CVE，(3) 服务器配置审计 - 检查SSH、防火墙、权限等安全配置，(4) 敏感信息泄露检测 - API密钥、密码、令牌等硬编码检测，(5) 容器安全扫描 - Docker镜像和Kubernetes配置审计，(6) CI/CD安全检查。触发关键词："安全检查"、"漏洞扫描"、"代码审计"、"security audit"、"vulnerability scan"、"SAST"、"dependency check"、"CVE检测"等。不用于：修复单个已定位的bug、编写新的安全功能代码、对无授权的第三方系统做扫描或渗透测试。

解决方案架构师助手。当用户要设计新系统架构、评审现有架构、做技术选型决策、诊断性能/可扩展性/可用性问题、规划架构演进或重构时使用。覆盖微服务、事件驱动、云原生等架构模式，技术趋势通过实时搜索获取而非依赖内置知识。不用于：具体功能的代码实现、安全漏洞审计（用security-audit）、产品需求分析（用product-manager）、只需一句话回答的技术常识问题。

Three.js 性能优化指南。当 Three.js/React Three Fiber 项目出现掉帧、内存增长、加载缓慢、绘制调用过多，或需要迁移 WebGPU、实现大规模粒子/实例化渲染、配置资源压缩管线时使用。触发关键词："Three.js 优化"、"WebGPU"、"draw calls"、"内存泄漏"、"TSL"、"InstancedMesh"、"R3F 优化"等。不用于：通用 React 性能问题（用 vercel-react-best-practices）、WebGL/Three.js 入门教学、3D 美术资产的制作本身。

专业微信公众号文章助手，支持四个独立且可组合模式：article 写正文；image-prompts 从文章生成版本化、provider-neutral 的图片提示词 manifest 与稳定占位符，但不调用生图；layout 把文章和 manifest 确定性转换为微信安全的内联 HTML；full-pipeline 串联正文、提示词/占位符和排版。用户提到公众号、微信文章、推文、配图提示词、图片 manifest、公众号排版、内联 HTML 或完整图文流水线时触发。支持企业官号、个人技术博客、活动回顾和产品评测。不用于：带引用的研究报告（用 deep-research）、PPT/组图（用 deck-studio）、英文文章、仅润色一小段。永不自动发布，永不把提示词或占位符声称为已生成图片。

雪峰式AI-Native产品开发方法论。适用于：(1) 用户行为开放、不可穷举的AI-native产品（AI日历、AI助手、AI推荐、对话式产品等），(2) 强模型依赖型场景，AI驱动核心决策而非仅辅助，(3) 多专精Agent架构设计与分工，(4) 上线后快速校准、行为审计与漂移检测，(5) 模型选择和智能路由策略，(6) 概率性输出的质量评估。触发场景包括"AI-native产品怎么做"、"用户行为不可预测怎么办"、"多agent怎么分工"、"模型漂移怎么处理"、"校准到95%太难了"、"唯快不破"、"怎么选模型"、"agent并行分工"、"AI产品上线后怎么迭代"。注意：如果产品是场景明确、边界可定义的+AI类型，请改用 keqian-method skill。即使用户没有明确说"AI-native"，但在讨论AI驱动决策、用户行为不可预测、概率性输出等话题时也应触发。

>

Control, inspect, or audit a live browser panel inside Horizon through the Horizon browser MCP tools.

Notify the Horizon workspace user about completed work, findings, or needed decisions. Only works when HORIZON env var is set.

AI image generation for SEO assets: OG/social preview images, blog hero images, schema images, product photography, infographics. Powered by Gemini via nanobanana-mcp. Requires banana extension installed. Use when user says \"generate image\", \"OG image\", \"social preview\", \"hero image\", \"blog image\", \"product photo\", \"infographic\", \"seo image\", \"create visual\", \"image-gen\", \"favicon\", \"schema image\", \"pinterest pin\", \"generate visual\", \"banner\", or \"thumbnail\".

>

>

Full website SEO audit with parallel subagent delegation. Crawls up to 500 pages, detects business type, delegates to up to 15 specialists (8 always + 7 conditional), generates health score. Use when user says audit, full SEO check, SEO best-practice review, analyze my site, website health check, or find SEO issues.

Backlink profile analysis: referring domains, anchor text distribution, toxic link detection, competitor gap analysis. Works with free APIs (Moz, Bing Webmaster, Common Crawl) and DataForSEO extension. Use when user says backlinks, link profile, referring domains, anchor text, toxic links, link gap, link building, disavow, or backlink audit.

>

>

>

>

>

>

>

>

>

>

>

>

>

Performance specialist for full audits. Measures CWV (LCP/INP/CLS), Lighthouse score signals, and emits deterministic report artifacts.

>

>

>

>

>

>

Visual specialist for full audits. Captures screenshots, evaluates above-the-fold signals, and checks mobile rendering basics.

Comprehensive SEO analysis for any website, page, business, or topic. Full site audits, SEO checks, single-page analysis, technical SEO (crawlability, indexability, Core Web Vitals with INP), schema markup, content quality (E-E-A-T), image optimization, sitemap analysis, GEO for AI Overviews/ChatGPT/Perplexity, and SEO best-practice planning. Industry detection for SaaS, e-commerce, local, publishers, agencies. Triggers on: SEO, audit, full SEO check, SEO best practices, optimize my site, ranking, organic search, schema, Core Web Vitals, sitemap, E-E-A-T, AI Overviews, GEO, technical SEO, content quality, page speed, structured data.

Synthesize the current conversation context into a flow-next spec at `.flow/specs/<spec-id>.md` via `flowctl spec create + spec set-plan` — agent-native, source-tagged, with mandatory read-back before write. Triggers on /flow-next:capture, "capture spec", "lock down what we discussed", "make a spec from this conversation", "convert conversation to spec". Optional `mode:autofix` token runs without questions and requires `--yes` to commit. Optional `--rewrite <spec-id>` overwrites an existing spec; `--from-compacted-ok` overrides the incomplete-evidence refusal after compaction; `--override-strategy` proceeds despite a contradiction with an active STRATEGY.md track (and prompts to record the override as a decision); `--no-plan` sets the spec-level `no_plan` field after the write (explicit opt-in — never inferred).

Render a cognitive-aid PR body from flow-next state and open via gh. Triggers on /flow-next:make-pr with optional spec id and flags (--draft, --ready, --no-mermaid, --base <ref>, --memory, --dry-run). Auto-detects spec from current branch when no id given. NOT Ralph-blocked — autonomous loops can surface a draft PR for human review.

Audit `.flow/memory/` entries against the current codebase and decide Keep / Update / Consolidate / Replace / Delete / Harden per entry. Triggers on /flow-next:audit, "audit memory", "review memory", "refresh learnings", "sweep stale memory", "consolidate overlapping memory entries", "graduate a recurring lesson into a gate". Optional `mode:autofix` token in arguments runs without questions and marks ambiguous as stale (Harden is never auto-applied). Optional scope hint after the mode token (concept, category, module, or path) narrows what gets audited.

Show spec dependency graph and execution order. Use when asking 'what's blocking what', 'execution order', 'dependency graph', 'what order should specs run', 'critical path', 'which specs can run in parallel'.

Drive any UI surface like a real user - a web app, a Chromium-backed desktop app (Electron / WebView2, reached over CDP), or a genuinely native app (macOS AppKit/SwiftUI, or a non-CDP webview) reached via the Cua Driver / Computer Use. Detects the surface, picks the best available driver, degrades gracefully. Use to navigate sites, verify deployed UI, test web or desktop apps, capture baseline screenshots, drive a sign-in flow, scrape data, fill forms, run an e2e check, or inspect current page state. Triggers on "check the page", "verify UI", "test the site", "test this app", "drive the app", "automate this desktop app", "read docs at", "look up API", "visit URL", "browse", "screenshot", "scrape", "e2e test", "login flow", "capture baseline", "see how it looks", "inspect current", "before redesign", "Electron app", "native app".

[deprecated alias] Renamed to flow-next-spec-completion-review in flow-next 1.0 — invoke the new skill. Removed in 2.0.

Export RepoPrompt context to a markdown file for review with an external LLM (ChatGPT, Claude web, etc.). Use when you want Carmack-level review but prefer an external model. Triggers on "export context", "export for external review", "export plan for ChatGPT", "export impl review context", "review with an external model", "export review context".

John Carmack-level implementation review via RepoPrompt or Codex. Use when reviewing code changes, PRs, or implementations. Triggers on /flow-next:impl-review.

Interview user in-depth about a spec, task, or spec file to extract complete implementation details. Use when user wants to flesh out a spec, refine requirements, or clarify a feature before building. Triggers on /flow-next:interview with Flow IDs (fn-1-add-oauth, fn-1-add-oauth.2, or legacy fn-1, fn-1.2, fn-1-xxx, fn-1-xxx.2) or file paths.

Wrap `clawpatch map` to produce a semantic feature index of the repo (~20 languages, persisted at `.clawpatch/features/*.json`). Detects install, runs `clawpatch init` when `.clawpatch/` absent, invokes provider-free `clawpatch map --source heuristic` by default; `--source auto|agent` flows through as passthrough. Opt-in enrichment — scouts and prime read the resulting index, but flowctl never depends on clawpatch.

Migrate pre-fn-30 legacy flat memory files (`.flow/memory/pitfalls.md`, `conventions.md`, `decisions.md`) into the categorized YAML schema. Triggers on /flow-next:memory-migrate, "migrate memory", "convert legacy memory", "lift pitfalls into categorized schema", "convert old memory format". Optional `mode:autofix` token in arguments runs without questions and accepts mechanical defaults for ambiguous classifications. Optional scope hint after the mode token narrows the migration to a specific legacy file (e.g. `pitfalls.md`).

Carmack-level plan review via RepoPrompt or Codex. Use when reviewing Flow specs or design docs. Triggers on /flow-next:plan-review.

Create structured build plans from feature requests or Flow IDs. Use when planning features or designing implementation. Triggers on /flow-next:plan with text descriptions or Flow IDs (fn-1-add-oauth, fn-1-add-oauth.2, or legacy fn-1, fn-1.2, fn-1-xxx, fn-1-xxx.2).

Comprehensive codebase assessment for agent and production readiness. Classifies the project (lifecycle, topology, size, stack, shape), scans 8 pillars, verifies commands actually run, checks GitHub settings. Leads with a verdict + ranked next-actions; fixes agent readiness only. Triggers on /flow-next:prime.

Generate ranked candidate ideas grounded in the repo, upstream of /flow-next:plan. Triggers on /flow-next:prospect with an optional focus hint (concept, path, constraint, or volume).

Live-app real-user QA pass derived from the spec. Drives the running app via flow-next-drive, derives scenarios from the spec's AC / R-IDs / boundaries, files structured P0/P1/P2 findings with evidence, and ends with a YES/NO ship verdict receipt. Consumes `.flow/features/` navigation when present. Triggers on /flow-next:qa with a spec id. Runs user-invoked OR as the optional `pipeline.qa` pilot stage (default off). Augments — never replaces — CI/staging/manual QA. FORBIDDEN from marking PASS by reading source — the verdict rests on captured evidence from the live app, never on agent narration.

Scaffold repo-local Ralph autonomous harness under scripts/ralph/. Use when user runs /flow-next:ralph-init.

Resolve PR review feedback — fetch unresolved threads, triage, dispatch per-thread resolver agents, validate, commit, reply + resolve via GraphQL. Triggers on /flow-next:resolve-pr.

Token-efficient codebase exploration using RepoPrompt CLI. Use when user says "use rp to..." or "use repoprompt to..." followed by explore, find, understand, search, or similar actions.

Optional local install of flowctl CLI and CLAUDE.md/AGENTS.md instructions, plus a commented model-routing example proposed into the project instruction file. Use when user runs /flow-next:setup.

Spec completion review - verifies all spec tasks implement the spec requirements. Triggers on /flow-next:spec-completion-review.

Create or maintain `STRATEGY.md` — the product's target problem, our approach, who it's for, key metrics, and tracks of work. Use when starting a new product, updating direction, or when prompts like 'write our strategy', 'update the roadmap', 'what are we working on', or 'set up the strategy doc' come up. Also fires when `/flow-next:prospect`, `/flow-next:plan`, `/flow-next:interview`, or `/flow-next:capture` need upstream grounding and no strategy doc exists yet.

Manually trigger plan-sync to update downstream task specs after implementation drift. Use when code changes outpace specs.

Project a flow-next spec to Linear, GitHub, GitLab, or Jira and reconcile body, status, and comments. Use for tracker discovery, linking, create-first, push, pull, reconcile, comment, or unlink. Not /flow-next:sync, which is plan-sync.

Execute a Flow spec or task systematically with git setup, task tracking, quality checks, and commit workflow. Use when implementing a plan or working through a spec. Triggers on /flow-next:work with Flow IDs (fn-1-add-oauth, fn-1-add-oauth.2, or legacy fn-1, fn-1.2, fn-1-xxx, fn-1-xxx.2).

Manage git worktrees (create/list/switch/cleanup) and copy .env files. Use for parallel feature work, isolated review, clean workspace, or when user mentions worktrees.

Manage .flow/ tasks and specs. Triggers: 'show me my tasks', 'list specs', 'what tasks are there', 'add a task', 'create task', 'what's ready', 'task status', 'show fn-1-add-oauth'. NOT for /flow-next:plan or /flow-next:work.

Single-tick autonomous build-loop conductor for host drivers (/loop, /goal). Each invocation advances exactly ONE ready spec by ONE pipeline stage (plan, plan-review, work, qa [opt-in, gated on pipeline.qa==on], make-pr) and ends with a terminal PILOT_VERDICT line for the driver to read. Triggers on /flow-next:pilot, optionally with --spec <id>, --dry-run, --review=<backend>, --research=<grep|rp>, --depth=<level>. Autonomous by design — never asks the user questions; reports NEEDS_HUMAN instead.

Cadence-tick autonomous babysitter for build-loop-authored PRs (/loop-shaped ship loop). Each invocation is one tick over all open PRs the build loop authored — keep CI green (bounded fix budget), wait out the reviewer patience window, resolve feedback via resolve-pr, and once converged merge + close the spec + follow the project's release instructions. Ends with a terminal LAND_VERDICT line for the driver to read. Triggers on /flow-next:land, optionally with --dry-run. Autonomous by design — never asks the user questions; reports NEEDS_HUMAN instead.

Decision-map discovery for one oversized/unclear idea before capture. Triggers on /flow-next:chart with an unshaped idea, chart id, decision pin, --status, or stored tracker URL. Prompt-first adaptive loop - ground, chart a frontier, resolve one D-ID per invocation, brief for capture.

Seed or maintain the committed user-POV feature map at `.flow/features/` so QA and drive reuse how a user reaches each feature. Two state-resolved modes: no `.flow/features/` (or explicit init intent) seeds it; a present map maintains it. Triggers on /flow-next:features, "seed the feature map", "maintain the feature map", "feature map", "init features". Never dispatched by pilot, land, Ralph, or any autonomous driver.

Prompt-first router that recommends the smallest sufficient flow-next workflow. Use when unsure which command to run next, which pre-build stage applies, or whether to skip chart/interview/plan. Triggers on /flow-next:guide with a free-form situation description.

Use while drafting any substantial reply, report, review walkthrough, or summary for the user - read the artifact prose contract before writing, not after, and draft under its rules. Do not use for short conversational turns, tool-call narration, the visual digest, or output that lands in a file, PR, or tracker (those artifact surfaces carry their own pointers). Also invocable directly as /flow-next:prose [draft].

Restate a spec, a task, a diff, or the current topic visually as a compact markdown digest. Use when asked to 'show me', 'explain this visually', 'restate that', 'digest the plan', 'walk me through the spec', 'walk me through the tasks', 'walk me through the diff', or when the output is too much text and a shape would land faster. Triggers on /flow-next:visual with an optional spec id, task id, git range, or free-form topic.

Rolling-frontier variant of /flow-next:work - admits a new ready task at every worker-return event instead of at wave boundaries, with isolated per-task workspaces, conductor-owned review, and a shared outside-tree notes surface. Triggers on /flow-next:work-rolling with the same inputs as /flow-next:work. User-invoked only - pilot and land never dispatch it. (experimental - can change or disappear)

Work with Effect v4 / effect-smol TypeScript code in this repo

Active enumeration phase — port scanning, service detection, banner grabbing. Use when the current phase is ENUMERATION.

Exploitation phase — exploit confirmed vulns, credential attacks, gain access. Use when the current phase is EXPLOITATION.

Post-exploitation phase — privilege escalation, lateral movement, credential dumping, data discovery. Use when the current phase is POST_EXPLOIT.

Passive reconnaissance phase — OSINT, DNS, WHOIS, subdomain discovery. Use when starting a new engagement or when the current phase is RECON.

Reporting phase — generate structured pentest report from findings. Use when the current phase is REPORTING.

Vulnerability assessment phase — scanning, CVE lookup, misconfig detection. Use when the current phase is VULN_ASSESS.

Active Directory pentest playbook — Kerberos, LDAP, GPO, ADCS, delegation, lateral movement, DA paths. Load at the START of an AD engagement or when a Windows domain / DC is found. Triggers - domain controller, Kerberos 88, LDAP 389/636, domain SMB, BloodHound, kerberoast, AS-REP, NTLM, ESC1-8.

Cloud security playbook — AWS/GCP/Azure misconfiguration and attack patterns (IAM, storage, metadata, privesc). Load when the target is a cloud environment or you obtain cloud creds/metadata. Triggers - AWS/GCP/Azure, IAM role/policy, S3/blob bucket, 169.254.169.254 metadata, access key, assume-role, cloud console.

Infrastructure pentest playbook — PTES-based phase flow for internal networks, servers, and non-web services. Load at the START of an internal/infra engagement or multi-host network assessment. Triggers - internal network, subnet/CIDR scan, infra pentest, multi-host, pivoting, lateral movement across services.

Web application pentest methodology + ROUTER to the per-vuln-class web skills. Load at the START of systematic web testing to get the phase flow (recon → map → test-by-OWASP-class → prove → report) and pick which web-<class> skill to load for each surface. Use on any web app / HTTP API engagement.

CI/CD & dev-infra attack techniques — credential exposure, RCE (script console / build), pipeline abuse, secret stores. Use when a CI/CD or SCM service is exposed. Triggers - Jenkins /job/ or script console, GitLab, ArgoCD, TeamCity, Gitea, Drone, exposed .git, runner token, pipeline.

Database service attack techniques — auth bypass, UDF/xp_cmdshell/COPY-TO-PROGRAM RCE, file read/write, cred dump. Use when a database service is found or you have DB creds. Triggers - MySQL 3306, PostgreSQL 5432, MSSQL 1433, Oracle 1521, Redis 6379, MongoDB 27017, db banner, default DB creds, NOAUTH.