Claude Code Skills · page 93

Documents a strategic pivot or persevere decision with the evidence, analysis, and rationale. Use when evaluating whether to change direction on a product, feature, or strategy based on market feedback.

Documents backlog refinement session outcomes including stories refined, estimates, questions raised, and decisions made. Use during or after refinement to capture the results and share with absent team members.

Facilitates and documents a team retrospective capturing what went well, what to improve, and action items. Use at the end of a sprint, project, or milestone to reflect and improve team practices. To bank individual learnings into organizational memory afterward, use iterate-lessons-log.

Specifies requirements for an analytics dashboard including metrics, visualizations, filters, and data sources. Use when requesting dashboards from data teams, defining KPI tracking, or documenting reporting needs.

Designs an A/B test or experiment with variants, success metrics, sample size, and duration for an existing hypothesis. Use when planning an experiment to validate a product change or test an assumption you have already framed. To articulate the hypothesis itself first, use define-hypothesis.

Documents the results of a completed experiment or A/B test with statistical analysis, learnings, and recommendations. Use after experiments conclude to communicate findings, inform decisions, and build organizational knowledge.

Specifies event tracking and analytics instrumentation requirements for a feature. Use when defining what data to collect, ensuring consistent tracking implementation, or documenting analytics requirements for engineering.

Scores completed OKR sets at cycle close with KR-level scoring per the canonical OKR type enum (committed | aspirational | learning | operational_health | compliance_or_safety), committed-vs-aspirational interpretation, evidence quality assessment, learning synthesis, and next-cycle recommendations. Refuses to retroactively change targets or shrink committed scope, average away guardrail KRs, treat 0.7 as success for committed or compliance_or_safety KRs, equate effort with impact, or use scores for individual performance. Hands off to iterate-lessons-log, iterate-retrospective, define-hypothesis, measure-dashboard-requirements, measure-instrumentation-spec, and foundation-okr-writer.

Analyze survey results into actionable PM insights. Produces persona segmentation, hypothesis validation status, thematic clustering of open-text responses, statistical confidence labels, prioritized recommendations, and what-NOT-to-conclude warnings. Refuses to overstate statistical significance from weak samples or biased instruments.

Pre-sprint brief that locks challenge, sprint questions, team and role assignments, customer recruiting plan, prototype medium, interview format, logistics, and success criteria before Monday of a Design Sprint. Use after the readiness verdict is Go and before Monday begins. Produces a two-page artifact the team and Decider sign off on as the contract for the next five days.

Day 3 (Wednesday) move of a Design Sprint that runs the art museum layout, heat map, speed critique, straw poll, Decider supervote, rumble-vs-all-in-one decision, and the storyboard that drives Thursday's prototype build. The most decision-heavy day of the sprint. Use Wednesday morning and afternoon after Tuesday's sketches are collected and attribution-stripped. Produces the canonical 5-15 step storyboard that becomes the build spec.

Day 1 (Monday) move of a Design Sprint that produces the bundled Monday artifact containing long-term goal, sprint questions (3-7 testable risks), customer or system map (5-15 step flow), expert interview notes, HMW (How Might We) cluster board, and the Decider's chosen target moment. Use Day 1 morning and afternoon after the sprint brief is locked. Sets the design target for Tuesday's sketches and Wednesday's storyboard.

Day 4 (Thursday) move of a Design Sprint that produces the planning artifact for the day. Output covers the prototype role plan (Maker, Stitcher, Writer, Asset Collector, Interviewer), prototype brief (what to build, fidelity bar, time allocation per role), canonical Five-Act Interview script (Welcome, Context, Intro, Tasks, Debrief), trial-run checklist, and Friday participant confirmation tracker. The actual prototype build is craft work outside the skill's AI invocation surface. Use Thursday morning after Wednesday's storyboard is signed off.

Pre-sprint diagnostic that determines whether a team should run a Design Sprint now, postpone it, or do prerequisite work first. Produces a Go / Conditional Go / Wait verdict with diagnosis, recommended preconditions, attendee list, customer recruiting plan, and pre-sprint activities. Use when a team is considering starting a Design Sprint and wants a fast yes/no diagnosis before committing five days of team time and customer recruiting cost.

Day 2 (Tuesday) move of a Design Sprint that structures lightning demos and the four-step independent solution sketch protocol (Notes, Ideas, Crazy 8s, Solution Sketch). Each team member produces one solution sketch individually; the skill orchestrates the day but does not author the sketches themselves. Use Tuesday morning after Monday's target moment is locked. Output is the lightning demo board, sketch assignments, and the cohort of independent sketches that become Wednesday's heat-map material.

Day 5 (Friday) sprint-closing move of a Design Sprint that produces the bundled Friday artifact covering per-customer interview observations, best quotes, scorecard grid (sprint questions by customers), observed patterns, hot takes from each team member, and the Decider summary (build, iterate, pivot, or stop, plus highest-confidence learning, most important revision, and next artifact). Use Friday after Thursday's prototype passes trial run and during/after the 5 customer interviews. The sprint's payoff artifact.

Day 2 morning move of a Foundation Sprint. Forces generation of 3 to 7 candidate approaches as one-page summaries before the team converges on a top bet. Use after Day 1 is signed and before Magic Lenses on Day 2 afternoon. Enforces a minimum of 3 approaches to prevent first-idea anchoring. Each approach summary names what it is, why it serves the differentiators, and includes a simple visual.

Day 1 morning move of a Foundation Sprint. Forces explicit team choices on target customer, important problem, team advantage, and competitors and alternatives. Produces a single coherent strategic frame that becomes the input to Day 1 afternoon Differentiation. Use after the sprint brief is signed and Day 1 morning is scheduled. Bundled artifact, not four separate decisions.

Pre-sprint brief that locks scope, the decision the sprint must unlock, team and role assignments, logistics, inputs to bring, and success criteria before Day 1 of a Foundation Sprint. Use after the readiness verdict is Go and before the sprint begins. Produces a one-page artifact the team and Decider sign off on as the contract for the next two days.

Day 1 afternoon move of a Foundation Sprint. Converts the morning's Basics frame into a defensible strategic position by scoring differentiator candidates against customer-perceived value, choosing two committed differentiators, plotting alternatives on a 2x2 chart, writing decision principles, and producing a one-page Mini Manifesto. Use after Basics is signed; before Approach Options the next morning.

Day 2 end capstone move of a Foundation Sprint. Compresses the sprint's full strategic frame into a single canonical sentence (the Founding Hypothesis) plus an assumption scorecard, why-we-believe, what-could-prove-us-wrong, and recommended next validation step. Use after Magic Lenses is signed. Strict canonical template; paraphrase is not accepted in v0.1.0. The Founding Hypothesis is the spine artifact the sprint exists to produce.

Day 2 afternoon move of a Foundation Sprint. Evaluates the candidate approach set through multiple lenses (4 classic plus at least 1 custom) to surface trade-offs, identify consistent winners and contradictions, and produce a top bet plus a backup plan. Use after Approach Options is signed. Lens scoring is a sense-making tool, not mathematical truth; arbitrary precision is a smell.

Pre-sprint diagnostic that determines whether a team should run a Foundation Sprint now, postpone it, or do prerequisite work first. Produces a Go / Conditional Go / Wait verdict with diagnosis, recommended preconditions, attendee list, and pre-sprint activities. Use when a team is considering starting a Foundation Sprint and wants a fast yes/no diagnosis before committing two days of facilitated work.

Structured group-decision mechanic that captures silent ideation, voting summaries, and Decider sign-off in a single bundled artifact. Use when a small team needs to make a fast decision with diverse input, when groupthink is a risk, or when a workshop moment demands silent contribution before discussion. Applicable to Foundation Sprint, Design Sprint, and any participatory decision context.

Teaches PMs to create syntactically valid mermaid diagrams by selecting the right diagram type for their communication need, following syntax validity rules, and validating before shipping. Covers all 15 mermaid diagram types with PM-relevant examples and a dual-lens navigation system.

Draft CHANGELOG entries from git log via the pm-changelog-curator sub-agent, applying the repo hygiene rules (describe what changed, public paths only, no attribution trailers). Returns a layered draft with a status summary for maintainer review; refuses a dirty working tree unless --committed-only is passed. Use when banking unreleased changes or preparing a release.

Run adversarial review on a PM artifact via the pm-critic sub-agent. Returns findings graded P0/P1/P2/P3 with a concrete fix suggestion per finding and a machine-readable status block. Use after producing a PRD, meeting recap, OKR set, persona, or any PM artifact you want stress-tested before it ships.

Walk the guided release runbook (6 gates G0/G1/G2/G2.5/G3/G4) via the pm-release-conductor sub-agent. Dispatches natively on Claude Code with the pm-skills plugin (invokes @agent-pm-skills:pm-release-conductor with native chain composition to pm-skill-auditor at G0 and pm-changelog-curator at G2); on non-Claude clients (Codex CLI, Cursor, Windsurf, Copilot, Gemini CLI) reads agents/pm-release-conductor.md and inlines auditor + curator behaviors at G0 + G2 via reference-and-execute-inline pattern (because non-Claude clients cannot natively chain to other sub-agents). Returns gate-by-gate output with explicit confirmation pauses, refuses bypass attempts, tags only the G2.5-captured SHA per master plan D22.

|

|

|

本技能应在用户要求"数学建模"、"建模比赛"、"数模论文"、"数学建模竞赛"、"建模分析"、"建模求解"或提及数学建模相关任务时使用。适用于全国大学生数学建模竞赛(CUMCM)、美国大学生数学建模竞赛(MCM/ICM)等各类数学建模比赛。

数学建模的论文撰写阶段。当进入"论文撰写"阶段、需要撰写或修改论文时加载。负责根据建模分析和代码实现撰写完整论文，支持国赛（中文）和美赛（英文）。

Use this skill whenever the user wants to create, read, edit, or manipulate Word documents (.docx files). Triggers include: any mention of \"Word doc\", \"word document\", \".docx\", or requests to produce professional documents with formatting like tables of contents, headings, page numbers, or letterheads. Also use when extracting or reorganizing content from .docx files, inserting or replacing images in documents, performing find-and-replace in Word files, working with tracked changes or comments, or converting content into a polished Word document. If the user asks for a \"report\", \"memo\", \"letter\", \"template\", or similar deliverable as a Word or .docx file, use this skill. Do NOT use for PDFs, spreadsheets, Google Docs, or general coding tasks unrelated to document generation.

Search academic papers via OpenAlex + AnySearch with cross-validation for math modeling references. Invoke when user needs literature search, paper references, or when writing papers requires citations.

Use this skill whenever the user wants to do anything with PDF files. This includes reading or extracting text/tables from PDFs, combining or merging multiple PDFs into one, splitting PDFs apart, rotating pages, adding watermarks, creating new PDFs, filling PDF forms, encrypting/decrypting PDFs, extracting images, and OCR on scanned PDFs to make them searchable. If the user mentions a .pdf file or asks to produce one, use this skill.

Use this skill any time a spreadsheet file is the primary input or output. This means any task where the user wants to: open, read, edit, or fix an existing .xlsx, .xlsm, .csv, or .tsv file (e.g., adding columns, computing formulas, formatting, charting, cleaning messy data); create a new spreadsheet from scratch or from other data sources; or convert between tabular file formats. Trigger especially when the user references a spreadsheet file by name or path — even casually (like \"the xlsx in my downloads\") — and wants something done to it or produced from it. Also trigger for cleaning or restructuring messy tabular data files (malformed rows, misplaced headers, junk data) into proper spreadsheets. The deliverable must be a spreadsheet file. Do NOT trigger when the primary deliverable is a Word document, HTML report, standalone Python script, database pipeline, or Google Sheets API integration, even if tabular data is involved.

Postiz is a tool to schedule social media and chat posts to 28+ channels X, LinkedIn, LinkedIn Page, Reddit, Instagram, Facebook Page, Threads, YouTube, Google My Business, TikTok, Pinterest, Dribbble, Discord, Slack, Kick, Twitch, Mastodon, Bluesky, Lemmy, Farcaster, Telegram, Nostr, VK, Medium, Dev.to, Hashnode, WordPress, ListMonk

Use when maintaining or optimizing OpenClaw workspace files — AGENTS.md, TOOLS.md, SOUL.md, USER.md, IDENTITY.md, HEARTBEAT.md, BOOT.md, MEMORY.md, and related checklists and memory files. Covers workspace auditing, token budget analysis, new agent workspace setup from scratch, memory distillation, and cross-file consistency reviews.

基于佛教经典文献，生成特定高僧大德的 AI 教学角色

Use when user asks to compare masters, compare schools, compare perspectives, 对比, 各宗怎么看, 不同宗派, 禅净之争, 性相之辩, 空有之争, or wants multiple masters to answer the same question. Triggers include "对比"、"比较"、"各宗"、"不同宗派怎么看"、"禅宗和净土"、"天台和华严"、"唯识和中观"、"空有之争"、"性相之辩"、"各位祖师"、"多个角度"、"compare"、"comparison" — invoke whenever user's question implicitly or explicitly seeks multi-tradition perspectives on a Buddhist topic.

Use when user asks about 南传佛教, 上座部, Theravada, 巴利经典, 正念 sati, 放下, 三法印, 四念处, 出入息念 anapanasati, 戒定慧, 毗婆舍那, 森林禅林派, 巴蓬寺, 阿姜查, 杜多行, 中道, or wants teaching in 阿姜查 Ajahn Chah's voice. Triggers include "阿姜查"、"Ajahn Chah"、"森林禅"、"上座部"、"南传"、"巴利"、"正念"、"放下"、"禅修方法"、"妄念太多"、"打坐坐不住"、"巴蓬寺"、"杜多行"、"心的训练" — invoke whenever user's question touches Theravada / Thai Forest / mindfulness practice or asks about Ajahn Chah, even without explicit request.

Use when user asks about 藏传, 噶当派, Kadam, 三士道, 菩提道灯论, Bodhipathapradīpa, 阿底峡, Atiśa, 金洲大师, 七因果, 自他相换, 菩提心, 依止善知识, 暇满, 业果, 噶当六论, 仲敦巴, 热振寺, 藏地后弘期, or wants teaching in 阿底峡尊者 Atiśa's voice. Triggers include "阿底峡"、"觉沃杰"、"Atisha"、"Jowo Je"、"菩提道灯"、"道灯论"、"三士道"、"七因果"、"自他相换"、"金洲"、"噶当"、"仲敦巴"、"热振寺"、"道次第之祖" — invoke whenever user's question touches Kadam / lamrim foundations / bodhicitta cultivation, even without explicit request.

Use when user asks about 南传, 上座部, Theravāda, 巴利, 清净道论, Visuddhimagga, 戒定慧, 四十种业处, kammaṭṭhāna, 十遍, kasiṇa, 七清净, 十六观智, 阿毗达摩, Abhidhamma, 觉音尊者, Buddhaghosa, 大寺派, Mahāvihāra, 缘起十二支, 三法印, or wants teaching in 觉音尊者 Buddhaghosa's voice. Triggers include "觉音"、"Buddhaghosa"、"清净道论"、"Visuddhimagga"、"戒定慧三学"、"四十业处"、"七清净"、"十六观智"、"阿毗达摩注释"、"尼柯耶注释"、"上座部论师"、"大寺派" — invoke whenever user's question touches Theravāda commentarial / Visuddhimagga / Abhidhamma exegesis, even without explicit request.

Use when user asks for a sequenced learning path within a Buddhist tradition — 学修次第, 先学什么, 从哪入门, 下一步读什么, curriculum, 学习计划, 路径推荐. Differs from /compare-masters (parallel opinion) and /master-debate (adversarial dialectic) by being 纵向 / 时序: stage-by-stage plan keyed on tradition × level (L0-L3) → foundation → intermediate → advanced + blind spots. Trigger is planning intent — "禅宗对比" goes to /compare-masters; "禅宗从哪开始学" goes here.

Use when user explicitly asks for an adversarial / multi-round dialectic between masters — 祖师辩论, 各执一词, 谁更对, debate, 应成 vs 顿悟, 顿渐之争. Differs from /compare-masters (parallel single-round) by being adversarial multi-round via fresh-subagent orchestration. Topics 空有 / 禅净 / 性相 / 戒律 vs 内观 — trigger is adversarial framing: "禅净比较" → compare; "禅净辩论 / 谁更究竟" → here.

Use when user asks about 华严宗, 法界缘起, 四法界, 事事无碍, 十玄门, 六相圆融, 金师子章, 一即一切, 因陀罗网, 华严经, 五教判, or wants teaching in 法藏大师 Fazang's voice. Triggers include phrases like "华严"、"法藏"、"贤首"、"法界"、"事事无碍"、"十玄"、"六相"、"金师子"、"一即一切"、"理事无碍"、"因陀罗网"、"别教一乘"、"五教"、"毗卢遮那"、"一真法界" — invoke whenever user's question touches Huayan doctrine, even without explicit request.

Use when user asks about 禅宗, 六祖, 坛经, 顿悟, 见性成佛, 直指人心, 不立文字, 自性, 本心, 无念, 无相, 无住, 般若, 定慧一体, 明心见性, 南宗禅, or wants teaching in 慧能大师 Huineng's voice. Triggers include phrases like "禅"、"慧能"、"六祖"、"坛经"、"顿悟"、"见性"、"本来面目"、"菩提本无树"、"风动幡动"、"本来无一物"、"自性"、"机锋"、"烦恼即菩提"、"不二"、"弘忍" — invoke whenever user's question touches Chan/Zen doctrine, even without explicit request.

Use when user asks about 中观, 三论宗, 般若, 空性, 中道, 八不, 缘起性空, 法华经, 金刚经, 维摩诘, 不二法门, 一佛乘, 大智度论, or wants teaching in 鸠摩罗什 Kumārajīva's voice. Triggers include phrases like "中观"、"三论"、"空"、"般若"、"中道"、"八不"、"缘起性空"、"法华"、"金刚经"、"维摩诘"、"不二"、"实相"、"一佛乘"、"鸠摩罗什"、"罗什"、"会三归一"、"火宅"、"方便"、"中论"、"大智度论"、"百论"、"十二门论" — invoke whenever user's question touches Madhyamaka/Prajñā/Lotus doctrine, even without explicit request.

Use when user asks about 南传, 上座部, 缅甸内观, Mahasi Method, 标记法, Noting Method, 腹部起伏, 毗婆舍那, vipassanā, 四念处, 七清净, 十六观智, 刹那定, 行舍智, 马哈希尊者, Mahasi Sayadaw, Mahasi Sasana Yeiktha, IMS, or wants teaching in 马哈希尊者 Mahāsi Sayādaw's voice. Triggers include "马哈希"、"Mahasi"、"Sayadaw"、"标记法"、"腹部起伏"、"缅甸内观"、"密集禅修"、"十六观智"、"刹那定"、"妄念太多" — invoke whenever user's question touches Burmese vipassanā / Mahasi noting method, even without explicit request.

Use when user asks about 藏传佛教, 噶举派, 大手印, phyag chen, 拙火, tummo, 那洛六法, 苦行, 闭关, 道歌, mgur, 米拉日巴, 玛尔巴, 上师瑜伽, 出离, 暇满, 中阴, 气脉明点, 觉受, nyams, 本觉, rig pa, or wants teaching in 米拉日巴尊者 Milarepa's voice. Triggers include "米拉日巴"、"密勒日巴"、"Milarepa"、"道歌"、"十万歌集"、"大手印"、"拙火"、"那洛六法"、"玛尔巴"、"噶举"、"白教"、"山洞修行"、"苦行"、"上师瑜伽"、"中阴"、"明空" — invoke whenever user's question touches Tibetan Kagyu / Mahāmudrā / yogi practice or asks about Milarepa's life and teachings, even without explicit request.

Use when user asks about 蕅益大师, 教宗天台, 行归净土, 六信, 弥陀要解, 教观纲宗, 灵峰宗论, 性相融会, 禅教律净, 念佛, 事持理持, 现前一念, 一念心性, 净土宗第九祖, 明末四大高僧, 占察忏, or wants teaching in 蕅益 Ouyi's voice. Triggers include "蕅益"、"智旭"、"弥陀要解"、"教宗天台"、"行归净土"、"六信"、"事持"、"理持"、"性相融会"、"禅教律净"、"教观纲宗"、"灵峰"、"现前一念"、"明末四大高僧"、"占察轮相" — invoke whenever user's question touches Ouyi's cross-school synthesis or Tiantai-Pureland integration, even without explicit request.

Use when user asks about 藏传, 格鲁派, Gelug, 黄教, 三主要道, 菩提道次第广论, lam rim, 密宗道次第广论, 应成中观, 缘起性空, 辨了不了义, 宗喀巴, Tsongkhapa, Je Rinpoche, 甘丹寺, 戒律, 因明, 月称, 入中论, or wants teaching in 宗喀巴大师 Tsongkhapa's voice. Triggers include "宗喀巴"、"杰仁波切"、"Je Rinpoche"、"格鲁"、"黄教"、"道次第"、"广论"、"三主要道"、"应成中观"、"辨了不了义"、"甘丹"、"达赖喇嘛传承根基" — invoke whenever user's question touches Gelug doctrine / lamrim / Madhyamaka prasaṅgika / Tibetan tantra-shastra studies, even without explicit request.

Use when user asks about 唯识, 法相宗, 阿赖耶识, 末那识, 三性, 遍计所执, 依他起, 圆成实, 五位百法, 因明, 转识成智, 种子, 熏习, 瑜伽师地论, 成唯识论, or wants teaching in 玄奘法师 Xuanzang's voice. Triggers include phrases like "唯识"、"法相"、"玄奘"、"阿赖耶"、"末那"、"三性"、"百法"、"因明"、"转识成智"、"种子"、"遍计所执"、"依他起"、"圆成实"、"五种不翻"、"唯识三十颂"、"瑜伽"、"慈恩" — invoke whenever user's question touches Yogācāra/Vijñānavāda doctrine, even without explicit request.

Use when user asks about 虚云, 参禅, 话头, 念佛是谁, 疑情, 开悟, 桶底脱落, 禅七, 行香, 丛林, 五宗兼嗣, 临济, 曹洞, 沩仰, 云门, 法眼, 老实修行, 头陀行, 持戒, 禅净双修, 云居山, 南华寺, or wants teaching in 虚云老和尚 Xuyun's voice. Triggers include "虚云"、"参话头"、"念佛是谁"、"疑情"、"禅七"、"行香"、"丛林规矩"、"桶底脱落"、"五宗"、"杯子扑落地"、"老实修行"、"头陀"、"禅堂"、"坐禅"、"数息" — invoke whenever user's question touches Chan practice, meditation methods, or monastic discipline, even without explicit request.

Use when user asks about 印光大师, 净土, 念佛, 持名念佛, 十念法, 摄耳谛听, 老实念佛, 信愿行, 带业往生, 仗佛慈力, 自力他力, 竖出横超, 往生, 极乐, 阿弥陀佛, 净土三经, 敦伦尽分, 闲邪存诚, 因果报应, 文钞, 一函遍复, or wants teaching in 印光大师 Yinguang's voice. Triggers include "印光"、"文钞"、"老实念佛"、"信愿行"、"带业往生"、"仗佛慈力"、"横超竖出"、"都摄六根"、"净念相继"、"敦伦尽分"、"闲邪存诚"、"因果"、"十念法"、"摄耳谛听"、"一函遍复"、"净土三经"、"往生" — invoke whenever user's question touches Pure Land practice, Amitabha recitation, or faith-vow-practice, even without explicit request.

Use when user asks about 天台宗, 止观, 一念三千, 三谛圆融, 五时八教, 摩诃止观, 法华经, or wants teaching in 智者大师 Zhiyi's voice. Triggers include phrases like "天台"、"智者大师"、"止观怎么修"、"三谛"、"法华"、"一心三观"、"判教"、"圆教"、"四种三昧" — invoke whenever user's question touches Tiantai doctrine, even without explicit request.

Use when user asks to 'lint agent configs', 'validate skills', 'check CLAUDE.md', 'validate hooks', 'lint MCP'. Validates agent configuration files against 423 rules.

Deploy this repository to a new Google Cloud project using the repo's existing Cloud Run, Cloud Run Jobs, Cloud SQL, Secret Manager, and Artifact Registry scripts. Use when Codex needs to interpret a generic repo setup request as a deploy, discover the active gcloud operator/account/org/billing context, fail early on missing gcloud permissions or local prerequisites, or perform the actual Broccoli OSS GCP deployment behind an explicit apply step.

Non-interactive wrapper: plan-sketch -> auto-pick recommended options -> plan-write -> plan-critique-loop -> implement-from-plan -> claude-simplify-wrapper -> dedup -> code-review-loop. No PR creation and no Linear comments.

Small-change wrapper: implement → run repo checks → atomic commit → run dedup (BASE_SHA..HEAD).

Run Claude's built-in /simplify skill on BASE_SHA..HEAD, validate checks, and commit.

Iterative review+fix loop for BASE_SHA..HEAD: generate findings, apply accepted fixes, run checks, commit, and re-review up to 3 iterations or until clean.

Dedupe-only pass for BASE_SHA..HEAD: remove duplicate code introduced by the diff or reuse existing shared utils; applies changes + commits.

Implement an approved plan doc step-by-step in application or systems codebases, including Node/TS, Python, and C/C++ repos (build/lint/test per step, atomic commits, progress log hygiene). Use when you have a plan/*.md and want to execute it.

Critique and revise an existing plan doc up to 3 iterations, using accept/reject triage and stopping early when no important feedback remains. Use when refining a plan/*.md before implementation.

Do bounded research (official docs first) and produce a high-level implementation sketch in `sketch/<generated-name>.md`. Use when you want an approach and step ordering before implementation.

Write a detailed, self-contained implementation plan to a new Markdown file under plan/. Use when you already have a sketch/requirements and want a plan doc before coding.

You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.

Use when you have a written implementation plan to execute in a separate session with review checkpoints

OpenClaw 安全检测工具，基于安全实践指南验证配置安全、权限隔离、网络策略、日志审计和运行时完整性

OpenClaw 攻击模式检测工具，识别数据外传、反弹Shell、文件泄露、Prompt注入、供应链投毒等高危行为，支持 MITRE ATT&CK 映射

Comprehensive PDF manipulation toolkit for extracting text and tables, creating new PDFs, merging/splitting documents, and handling forms. When Claude needs to fill in a PDF form or programmatically process, generate, or analyze PDF documents at scale.

AI/LLM application security testing — prompt injection, jailbreaking, data exfiltration, and insecure output handling per OWASP LLM Top 10.

Deep OWASP API Security Top 10 testing for REST, GraphQL, gRPC, and WebSocket APIs — BFLA, mass assignment, rate limiting, and unsafe consumption.

Business logic vulnerability testing — workflow bypass, payment manipulation, state machine abuse, and function limit circumvention per WSTG-BUSL.

Advanced client-side attacks — CORS misconfiguration, WebSocket security, clickjacking, postMessage abuse, CSS injection, and browser storage vulnerabilities.

Cloud security posture management and container security assessment for AWS, Azure, GCP, and Kubernetes.

Security header auditing, TLS configuration testing, HTTP method analysis, CSP bypass assessment, and deployment hardening verification.

Binary exploitation (Pwn) and reverse engineering tools for CTF challenges and software analysis.

Cryptography tools for solving CTF challenges involving ciphers, hashing, and weak encryption.

Digital forensics, steganography, and packet analysis for CTF challenges and investigation.

Professional web application and API security testing workflows using OWASP Top 10 methodologies.

Proof-driven exploitation with 4-level evidence system, bypass exhaustion protocol, mandatory evidence checklists, and strict EXPLOITED/POTENTIAL/FALSE_POSITIVE classification.

HTTP request smuggling, desync attacks, cache poisoning, and protocol-level vulnerability testing.

OWASP Mobile Top 10 security testing for Android and iOS — local storage, certificate pinning bypass, IPC abuse, and binary protections.

Internal network penetration testing, Active Directory enumeration, and lateral movement simulation.

Open Source Intelligence gathering and attack surface management for external reconnaissance.

Concurrency exploitation — race conditions, TOCTOU vulnerabilities, and parallel request abuse in web applications.

White-box attack surface mapping — correlate external scans, browser exploration, and source code into structured endpoint inventory, role architecture, and authorization vulnerability candidates.

Discover hardcoded credentials, leaked API keys, exposed configuration files, sensitive data in artifacts, and information disclosure via error handling.

Software supply chain security — dependency confusion, CI/CD pipeline attacks, lockfile integrity, and build artifact verification.

通过原始 HTTP 请求操作和严格验证自动验证 Web 漏洞（开放重定向、XSS）。

Source code security audit using backward taint analysis, slot type classification, render context verification, and 3-phase parallel review producing an exploitation queue.

Implements Manus-style file-based planning for complex tasks. Creates task_plan.md, findings.md, and progress.md. Use when starting complex multi-step tasks, research projects, or any task requiring >5 tool calls. Now with automatic session recovery after /clear.

Presentation creation, editing, and analysis. When Claude needs to work with presentations (.pptx files) for: (1) Creating new presentations, (2) Modifying or editing content, (3) Working with layouts, (4) Adding comments or speaker notes, or any other presentation tasks

Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends an agent's capabilities with specialized knowledge, workflows, or tool integrations.

OpenClaw Skills 全方位安全审计工具，检测供应链投毒、Prompt注入、恶意代码模式、权限越权和依赖风险