Lu1sDV
UserPersonal SKILLS.md collection
Categories
Indexed Skills (34)
vuln-research
Use when performing security-focused vulnerability research, bug bounty hunting, penetration testing, or exploit development on a specific target codebase or binary. Covers taint analysis across 30+ attack domains, sink analysis for 10+ languages, SAST/DAST integration, agent sweep, DuckDB-persisted phase pipeline, fuzzing harness, stateful fuzzing, directed symbolic execution, history-driven fuzzing, FuzzGPT, generate edge-case test programs, differential / metamorphic oracle, continuous / perpetual / self-firing vuln discovery, keep hunting until N high/critical confirmed, patch diffing, supply chain attack surface, find me zero days, sweep everything, memory corruption, ROP, firmware audit, kernel driver. SKIP for: generic code reading, writing new features, refactoring, single-diff review without a security goal, or infra config not being audited for vulnerabilities — use code-review or a general coding skill instead.
codeql
Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "codeql analysis", "build codeql database", or "find vulnerabilities with codeql". Supports "run all" (security-and-quality + security-experimental suites) and "important only" (high-precision security findings) scan modes. Also handles creating data extension models and processing CodeQL SARIF output.
cook
Use when user says "cook", "let it cook", wants iterative refinement with quality gates, wants to race multiple approaches and pick the best, needs repeat passes, or wants autonomous task-list completion. Triggers: cook, let it cook, review loop, race approaches, ralph, iterate until done.
debate
Use when a technical decision has 2–4 nameable positions and the user wants a recommendation, not open-ended exploration. Triggers include "X vs Y", "A or B", "pick one", "contested trade-off", adversarial review, and decide-between requests. Skip when analysis is open-ended (use superpowers:brainstorming) or the question has no real contest. Keywords: debate, decision, contested, trade-off, versus, steelman, adversarial, argue.
tavily-web
Web search, content extraction, site crawling, URL discovery, and AI-powered research using Tavily API via curl. Use when user needs web search results, current events, news, finance data, content from URLs, site-wide extraction, or multi-topic research with citations. Trigger phrases: 'search the web', 'find online', 'extract from URL', 'crawl site', 'research topic', 'latest news about', 'web search', 'tavily'.
universal-skill-finder
Use when finding, browsing, or installing community skills across marketplaces, or when a needed capability might exist as a marketplace skill. Triggers on "find a skill", "search skills", "install skill", "skillsmp", "skills.sh", or "marketplace".
bugbounty-poc-video-runner
Designs a one-command, triager-friendly live security PoC video runner with staged evidence, expected-versus-actual output, a negative control, optional UI pause, and cleanup proof.
obsidian-spaced-repetition
Use when creating or editing Obsidian Spaced Repetition flashcards, organizing decks, starting card or whole-note reviews, inspecting scheduling metadata, or troubleshooting missing cards through the official Obsidian CLI. Covers st3v3nmw/obsidian-spaced-repetition, cloze cards, #flashcards, #review, and obsidian command/eval workflows; not Anki or third-party obsidian-cli tools.
rust-performance
Use when Rust code is slow, allocates too much, regresses latency or throughput, or has bloated binaries and long compile times. Covers the evidence pipeline (workload contract, reproducible baseline, profiling, single-cause change, re-measurement), optimization priority from algorithm down to SIMD, and concrete fixes for allocation, cache, false sharing, lock contention, and NUMA. Triggers: cargo bench, Criterion, samply, perf, flamegraph, heaptrack, DHAT, cargo-bloat, p99, hot path.
bug-bounty-reporting
A skill for creating a report in a bug bounty vulnerability assessment.Use when an agent drafts, revises, freezes, or independently verifies a bug bounty vulnerability report for source code, application or live assesment, executable PoC, CVSS or cleanup proof for HackerOne, Bugcrowd, Intigriti, or a vendor-managed program.
vast-experiment-ops
Use when running or reporting ML experiments on rented Vast.ai GPU instances — diagnosing strict FP32 equivalence checks that pass on CPU but fail on CUDA (cuDNN TF32), parsing JSON metrics collected over SSH, and keeping held-out/test-scope reporting accurate.
fuzzgpt
Use when you want to fuzz any software target — library, compiler, interpreter, parser, kernel/syscall, DB engine, SMT solver, binary/file format, or network protocol — by priming an LLM with that target's HISTORICAL bug-triggering code to generate unusual, edge-case inputs (history-driven LLM fuzzing). FuzzGPT-derived: retrieval replaces fine-tuning (Deng et al., arXiv:2304.02014): mine bug reports → auto-label each snippet's buggy fuzz target → few-shot / zero-shot / retrieval generation → crash + differential oracles. Trigger on "FuzzGPT", "fuzz this library/compiler/parser/protocol", "generate edge-case test programs", "history-driven fuzzing", or when pairing with vuln-research to turn a target's bug history into fresh fuzzing inputs. Target-agnostic: the "fuzz target" is whatever unit you point generation at — an API in the paper's DL study, but equally a compiler flag, SQL feature, syscall, opcode, or protocol field.
hermes-mr-watch
Use when adding GitLab MRs to the Hermes watcher on ssh-vhs, editing or redeploying watch_gitlab_mr_findings.py, diagnosing missed/duplicate MR status messages in Telegram, or verifying the Hermes no-agent cron.
jev
Use when writing or improving Jev programs — the TypeSafe judgment model behind POST /v1/systemone. Covers primitive selection (noul, choice, score), instruction and criteria writing, minimal state and token budgets, the raw HTTP API, confidence-gated composition, speculative fan-out, and the symptom-to-fix revision table. Triggers: jev, judgment model, typesafe, systemone, noul, choice, score, confidence floor, jaggedness.
security-fix-oracle
Use when turning a real project's git history into a labeled, enriched, leakage-free security-fix dataset ("oracle") for a vulnerability classifier, rule-authoring feed, or risk-prioritization model. Triggers: "mine commits for security fixes", "build a vuln dataset / training corpus from git history", "label commits by CWE / vuln category", "SZZ", "blame who introduced the vulnerability", "vulnerability-introducer attribution", "skill-gap analysis", "CVSS scoring of commits", "diff-verified gold vs message-only weak labels", "git blame on a blobless / partial clone is slow". Also load when extending the vuln-research Ruby rule MegaDB oracle.
ctfd
Use when developing, debugging, deploying, or maintaining any CTFd instance or fork - Docker stack issues, plugin development, CSRF 302 errors, theme customization, database migrations, nginx proxy misconfig, SQLAlchemy 1.4 gotchas, pytest test infrastructure, or API 500 responses
feature-engineering
Use when building or improving time series forecasting models and the user asks about exogenous variables, calendar features, rolling statistics, cyclical encoding, differencing, or feature scaling — or when forecast accuracy has plateaued and new features may help.
glitchtip
Use when deploying, configuring, integrating, or troubleshooting GlitchTip — including self-hosted installation, SDK setup, source maps, sentry-cli, uptime monitoring, alerting, environment variables, Docker Compose, Helm, social auth, and migration from Sentry
hermes-self-evolution
Replicate the Hermes Agent self-evolving loop for agents that should learn from experience: persistent declarative memory, session recall, agent-managed procedural skills, and post-task review that creates or patches reusable skills. Use when designing, evaluating, or operating an AI agent workflow that should save durable user/project facts, recall prior conversations, turn successful non-trivial workflows into skills, and improve stale skills during use.
llm-domain-speedrun
Use when someone needs to rapidly learn an unfamiliar technical domain under a tight deadline, when previous attempts through books, courses, or unstructured practice have failed, or when bridging a fundamental knowledge gap using an LLM as a private tutor
oauth-audit
Use when auditing OAuth 2.0 / OIDC implementations against RFC 9700 (OAuth Security BCP), reviewing client or authorization-server code, evaluating PKCE / state / redirect-URI handling, hardening token exchange and refresh flows, or triaging suspected OAuth vulnerabilities (CWE-352 CSRF, CWE-287 broken auth).
ofelia
Use when scheduling tasks in Docker environments with Ofelia — configuring job-exec, job-run, job-local, job-service-run via INI files or Docker labels, cron scheduling, overlap prevention, logging to Slack/email/disk, Docker Compose integration, Swarm services, and troubleshooting scheduled container jobs
photon-geocoder
Use when geocoding addresses, reverse geocoding coordinates, building address autocomplete, or integrating location search with OpenStreetMap data via Photon API (photon.komoot.io). Triggers on "photon", "geocode", "reverse geocode", "OSM address search".
python-exploitation
Use when escaping a Python sandbox or pyjail, bypassing import/builtins/attribute or character/byte blacklists, recovering builtins after __builtins__ is stripped, exploiting pickle/marshal/PyYAML/multiprocessing deserialization, Python-template SSTI (Jinja2/RestrictedPython/str.format), bypassing PEP 578 audit hooks, crafting or abusing CPython bytecode and code objects, exfiltrating with no stdout, or reversing .pyc files. CTF / security-research focused; covers CPython 3.8–3.13.
sink-research-orchestrator
Use when sink subagents encounter unseen languages or new technique categories that require fresh comprehensive research — not well-known sinks. Orchestrates parallel research swarms with structured JSON citations. Triggers: "comprehensive", "exhaustive", "most complete", "deep dive", "unseen language", "new technique category", "long horizon", "parallel research".
skill-smell-checker
Audits Agent Skill SKILL.md files for the 26 skill smells defined in arXiv:2607.01456, separating five static checks from 21 semantic checks. It applies when reviewing, linting, authoring, or refactoring SKILL.md files; when a skill quality audit is requested; or when terms such as skill smell, SSD, static skill check, context bloat, missing guardrails, or vague skill description appear.
skillsmp-search
Use when finding, browsing, or installing community skills, or when a needed capability might exist as a marketplace skill. Triggers on "find a skill", "search skills", "install skill", "skillsmp", or "marketplace".
ssrf-testing
Use when testing for SSRF in web applications, accessing internal services through SSRF, bypassing SSRF filters, auditing applications that fetch user-supplied URLs, or implementing SSRF prevention. Covers blind and non-blind SSRF, cloud metadata exploitation, protocol smuggling, and defense strategies.
telethon-development
Use when working with Telethon (Telegram MTProto client) — debugging FloodWaitError, mocking for tests, handling None-as-False boolean fields, entity resolution, rate limiting, session management, or version compatibility issues
test-engineering
Use when designing test strategies, planning coverage across the test pyramid, evaluating automation candidates, or improving test quality. Also use when diagnosing flaky tests, slow test suites, or coverage gaps. Framework-agnostic strategy and automation planning.
universal-research-orchestrator
Use when starting research, audit, or investigation tasks needing multi-source coverage — security/sink research, codebase audits, framework deep-dives, market comparison, or any "exhaustive / most complete / long horizon" request. Triggers on "audit", "investigate", "research", "find vulns", "exhaustive", "long horizon", "deep dive", "most complete".
comprehensive-python-sink-research-workflow
Master skill documenting the complete workflow for exhaustive security sink research, from parallel agent spawning through structured citation and source archival. Covers the full lifecycle: research → synthesis → formatting → validation → archival. Use as reference for any "most complete" security analysis project.
zero-dof
Use when directing LLM coding agents on substantial development tasks — establishing executable oracles, designing agent playbooks, constraining agent output quality, or preventing metric gaming. Also use when LLM-generated code has recurring quality or architecture issues that need systematic correction. Triggers: zero dof, zero degrees of freedom, executable oracle, constrain agent, agent quality, LLM coding constraints, playbook design, oracle pipeline.
zeroclaw
Use when building, configuring, deploying, or troubleshooting ZeroClaw AI agent infrastructure — including provider setup, channel binding, memory backends, config.toml authoring, CLI usage, Docker/native runtime, and migration from other agent frameworks
Bio shown is the top-scored skill's repo description as a fallback — real GitHub bios land in a future update.