安全

monetizing-innovation

2Ksecurity

Design products and pricing around validated willingness to pay, from Ramanujam & Tacke''s "Monetizing Innovation". Use when the user mentions "pricing", "how much should we charge", "willingness to pay", "pricing page", "packaging", "freemium vs free trial", "are we leaving money on the table", "nobody buys at this price", "price increase", or "good-better-best". Also trigger when designing or auditing pricing and packaging, validating willingness to pay before building, segmenting customers by value, or choosing between subscription, usage-based, and freemium models. Covers price-before-product, willingness-to-pay talks, the four failures (feature shock, minivation, hidden gem, undead), leader/filler/killer packaging, and behavioral pricing. For offers and guarantees, see hundred-million-offers. For what customers value, see jobs-to-be-done.

wondelai

wp-plugin-directory-guidelines

2Ksecurity

Use when reviewing WordPress plugins for GPL compliance, checking license headers or compatibility, evaluating upsell/freemium/trialware patterns, validating plugin naming or trademark rules, checking plugin slugs, understanding why a plugin was rejected from WordPress.org, or answering any question about the 18 WordPress.org Plugin Directory guidelines — even if the user doesn't mention 'guidelines' explicitly.

wordpress

wp-rest-api

1.9Ksecurity

适用于构建、扩展或调试 WordPress REST API 端点/路由场景：包含 register_rest_route 的注册与使用、WP_REST_Controller 控制器类继承、Schema 及请求参数校验、permission_callback 与权限认证、响应数据格式化（response shaping）、register_rest_field/register_meta 扩展自定义字段，以及通过 show_in_rest 暴露自定义文章类型（CPT）或分类法（Taxonomy）。

wordpress

oauth

1.9Ksecurity

Implements OAuth 2.0/2.1 authorization flows in Fastify applications — configures authorization code with PKCE, client credentials, device flow, refresh token rotation, JWT validation, and token introspection/revocation endpoints. Use when setting up authentication, authorization, login flows, access tokens, API security, or securing Fastify routes with OAuth; also applies when troubleshooting token validation errors, mismatched redirect URIs, CSRF issues, scope problems, or RFC 6749/6750/7636/8252/8628 compliance questions.

mcollina

app-rejection-recovery

1.8Ksecurity

eronred

warp-delegate

1.8Ksecurity

Delegate a coding task to the Warp Agent CLI (`oz`) as a background implementer, then review its diff and land it yourself. Use this whenever the user wants to hand implementation work to Warp - phrasings like "have Warp implement X", "delegate this to the Warp CLI", "run it through Warp", "use oz to implement/fix/refactor" - or wants to run a queue of coding tasks through Warp while staying the reviewer. DO NOT USE for tasks small enough to do inline, when the user wants the code written directly without delegating, or for the interactive `warp` TUI (this skill drives the headless `oz agent run`, not the terminal app).

negotiation

使用战术共情、校准问题和阿克曼方法准备和执行谈判。当用户提到“薪资谈判”、“合同条款”、“处理异议”、“镜像与标注”、“艰难对话”、“交易条款”、“BATNA”、“锚定”、“如何要求加薪”、“获得更好的交易”或“他们不肯在价格上让步”时触发。同样适用于准备供应商谈判、解决定价争议或进行双方都需要被倾听的高风险对话。涵盖指控审计、黑天鹅发现和“说得对”技巧。关于产品和营销中的说服技巧，请参考 influence-psychology。

wondelai

cline-delegate

Delegate a coding task to the Cline coding agent CLI (`cline`) as a background implementer, then review its diff and land it yourself. Use this whenever the user wants to delegate implementation work to Cline - phrasings like "have Cline implement X", "delegate this to cline", "run it through Cline", or "use cline to implement/fix/refactor" - or wants to run a queue of coding tasks through Cline while staying the reviewer. DO NOT USE for tasks small enough to do inline, or when the user wants the code written directly without delegating.

aider-delegate

Delegate a coding task to Aider (`aider`) as a background implementer, then review its diff and land it yourself. Use this whenever the user wants to hand implementation work to Aider - phrasings like "have Aider do X", "delegate this to aider", "run it through Aider", or "use Aider to implement/fix/refactor" - or wants to run a queue of coding tasks through Aider while staying the reviewer. This includes asking Aider to drive a local or self-hosted OpenAI-compatible endpoint ("have Aider use my local model", "run Aider against llama.cpp / Ollama / vLLM / LM Studio"), which Aider reaches via `--api-base`. DO NOT USE for local-model or coding requests that do not name Aider, for tasks small enough to do inline, or when the user wants the code written directly without delegating.

commit

Create well-formatted commits with conventional commit messages and emoji

neolabhq

blog-taxonomy

Extract, suggest, and sync tags and categories for blog posts across all major CMS platforms. Supports WordPress REST API, Shopify GraphQL, Ghost Content API, Strapi REST/GraphQL, and Sanity GROQ. Generates tag suggestions from content analysis (keyword frequency, heading extraction, semantic grouping), enforces minimum post-count thresholds to prevent thin tag archives, and syncs taxonomy via authenticated API calls. Use when user says "tags", "categories", "taxonomy", "tag suggestions", "sync tags", "WordPress tags", "Shopify tags".

agricidaniel

pi-delegate

1.6Ksecurity

Delegate a coding task to the Pi coding agent CLI (`pi`) as a background implementer, then review its diff and land it yourself. Use this whenever the user wants to delegate implementation work to Pi - phrasings like "have Pi implement X", "delegate this to pi", "run it through Pi", or "use pi to implement/fix/refactor" - or wants to run a queue of coding tasks through Pi while staying the reviewer. DO NOT USE for tasks small enough to do inline, or when the user wants the code written directly without delegating.

mantis-reflect

1.5Kwriting-content

Extracts learnings from execution trajectories at the end of a Mantis loop. Use to parse agent conversations, extract successes, failures, and false assumptions, and append them to workspace/learnings.jsonl. Don't use for analyzing source code or writing patches.

mantis-chain

1.5Kwriting-content

Analyzes individual security findings to identify and construct complex exploit chains. Use after validation stages to see if multiple low-severity bugs can be combined into a higher impact vulnerability. Don't use for initial codebase auditing or writing patch code.

mantis-meta-agent

1.5Kresearch-knowledge

Acts as the persistent supervisor, launching and monitoring the automated review campaign. Use when running a long-running, continuous security review campaign that needs autonomous coordination. Don't use for executing individual review stages directly.

mantis-structural-index

1.5Kprompting-reasoning

Builds a content-addressed semantic-unit index from source code for structural context. Use when a pinned or live codebase is available and structural cross-reference data would improve research quality. Don't use for findings analysis, patching, or reporting.

type-juggling

PHP 类型隐式转换（Type Juggling）与弱类型比较（`==`）绕过技巧。适用于身份验证、HMAC/签名校验或 Token 验证中使用了松散相等判断、强制数值转换或缺乏严格类型的哈希比较场景 —— 常见于旧版 PHP 代码及 CTF 风格的代码路径中。

race-condition

Web 应用的竞态条件（Race Condition）与 TOCTOU 漏洞测试指南。适用于测试一次性操作、高并发 HTTP 滥用、突破频率限制（Rate-limit bypass）、Turbo Intruder 闸门控制（gates）、HTTP/2 单数据包攻击（single-packet attacks）以及 CWE-362 类型的同步漏洞。

csv-formula-injection

CSV / 电子表格公式注入（DDE、Excel/LibreOffice、Google Sheets IMPORT* 函数）。适用于导出、导入或用户自定义字段接入电子表格及报表工具的场景。

clickjacking

点击劫持（Clickjacking）实战指南。适用于测试目标页面是否可被框架嵌套（framed）、X-Frame-Options 或 CSP frame-ancestors 是否正确配置，以及 UI 覆盖劫持攻击（UI redress）能否引发敏感操作。

mantis-architecture

1.5Kdevops-cloud

Synthesizes raw learnings and codebase analysis into an interlinked Markdown Knowledge Base (KB). Use at the beginning of a loop to build or update architecture.md, entities, and vulnerabilities. Don't use for generating threat models or formulating execution plans.

mantis-summarize

1.5Kprompting-reasoning

Pre-processes the repository by generating security-focused summaries (mantis-summary.md) for each directory to make planning and research more efficient. Use when starting a review campaign to map the codebase before threat modeling and planning. Don't use for executing code reviews, writing test scripts, or patching code.

mantis-review

1.5Kprompting-reasoning

Independently reviews findings and filters out false positives. Use when consolidated findings need validation against the actual source code. Don't use for reproducing crashes or patching code.