Skill UI

This skill provides comprehensive guidance on hardening GitHub Actions CI/CD pipelines against modern supply chain attacks, credential theft, and privilege escalation. It teaches best practices such as pinning actions to immutable SHA digests, minimizing GITHUB_TOKEN permissions, preventing script injection from untrusted inputs, and implementing required approval gates for critical deployments.

This tool systematically tests API endpoints for mass assignment (over-posting) vulnerabilities. It simulates an attacker injecting undocumented or privileged fields (such as 'role' or 'balance') into standard API requests. By analyzing the server's response, it determines if the API binds all client-supplied parameters to the data model without proper filtering, which could allow unauthorized privilege escalation or data modification. This is critical for achieving OWASP API Top 10 compliance.

The /hub:spawn command launches N subagents that work on the same task simultaneously. Each agent operates within an isolated git worktree, ensuring true parallelism and resource separation. Users can optionally specify templates (e.g., `optimizer`, `refactorer`) to guide agents toward specific strategies for improving code quality, performance, or test coverage. Ideal for complex software engineering tasks requiring diverse, competing approaches.

MCPB is a specialized local server bundle that packages the entire runtime environment (Node.js or Python) alongside the server code. It allows developers to distribute and run complex MCP services directly on a user's machine without requiring the user to pre-install specific runtimes or toolchains. Use this when the server must interact with the local filesystem, desktop applications, or OS-level APIs.

A comprehensive guide to diagnosing and resolving performance bottlenecks in React applications. This skill teaches advanced techniques like state isolation, memoization (using `useMemo`, `useCallback`, and `React.memo`), and list virtualization. It guides users through profiling using React DevTools to identify render hotspots, ensuring components render efficiently and maintain high application responsiveness.

This expert reviews and rectifies complex Swift Concurrency issues, such as actor isolation violations, Sendable safety breaches, and data races. It applies modern patterns (like `@MainActor` and `actor` usage) to ensure code adheres to Swift 6.2+ standards while minimizing behavior changes. Use it when debugging concurrency warnings or migrating legacy codebases.

A comprehensive guide detailing how to refactor large, complex SwiftUI views into smaller, more stable, and explicit components. It emphasizes adopting a lightweight state approach (favoring local state and environment variables over excessive view model layers) to improve data flow, readability, and overall code maintainability in modern iOS development.

This skill enforces a rigorous, 5-phase debugging protocol (Reproduce, Isolate, Root Cause, Fix, Verify) for AI coding agents. It forces a disciplined approach, preventing agents from guessing fixes or making premature edits. Use this when debugging complex, intermittent, or hard-to-isolate bugs to ensure the root cause is fully confirmed before any code changes are applied, maximizing debugging accuracy.

Gradio is a powerful Python library designed for creating interactive web user interfaces and showcasing machine learning demos quickly. This skill covers core patterns like Interface, Blocks, and ChatInterface, allowing users to build complex applications, components, and event-driven chatbots with minimal effort. Ideal for rapid prototyping and deep learning model visualization.

This comprehensive skill guides the user through the entire process of creating a deep, multi-layered AI persona (Soul.md). It helps define the identity, core rules, name, and visual prompts for agents designed for the OpenClaw platform. Users can initiate character creation via guided prompts or a random 'gacha' draw, ensuring a cohesive and compelling character profile.

This skill detects malicious Command and Control (C2) communications tunneled through the DNS protocol. It analyzes DNS query logs for indicators such as DNS tunneling tools (Iodine, dnscat2), Domain Generation Algorithms (DGA), and encoded payloads within TXT/CNAME records. Techniques include Shannon entropy analysis of subdomains, statistical anomaly detection, and machine learning classification. Ideal for network security analysts conducting deep threat hunting and forensic investigations.

This guide details the Hexagonal Architecture (Ports and Adapters) pattern, a robust method for decoupling core business logic from external infrastructure concerns. It teaches how to structure applications to make the domain model independent of databases, UI frameworks, or message queues. Implementing this pattern drastically improves testability, maintainability, and the ability to swap out external services without rewriting business rules.