安全

flutter-use-http-package

2.8Ksecurity

使用 `http` 包发起 GET、POST、PUT 或 DELETE 请求。适用于需要向 REST API 请求或提交数据的场景。

flutter

ctf-ai-ml

2.8Kagent-workflows

提供用于CTF挑战的AI和机器学习技术。在攻击ML模型、制作对抗样本、执行模型提取、提示注入、成员推断、训练数据投毒、微调操纵、神经网络分析、LoRA适配器利用、LLM越狱或解决AI相关谜题时使用。

ibd-distribution-day-monitor

Detect IBD-style Distribution Days for QQQ/SPY (close down at least 0.2% on higher volume), track 25-session expiration and 5% invalidation, count d5/d15/d25 clusters, classify market risk (NORMAL/CAUTION/HIGH/SEVERE), and emit TQQQ/QQQ exposure recommendations. Use after market close, before TQQQ exposure changes, or as input to FTD/market-state frameworks. Does not execute trades.

tradermonty

ctf-writeup

2.7Kagent-workflows

生成一份标准化的提交式CTF解题报告，用于比赛交接和组织者审阅。在解决CTF挑战后使用，以结构化格式记录解决步骤、所用工具和经验教训。

content-quality-auditor

Use when auditing content quality, E-E-A-T, or publish readiness; runs a typed 80-item CORE-EEAT profile with evidence coverage, veto checks, and a fix plan. Not for structural tags/headers alone — use on-page-seo-checker; not for domain/citation trust — use domain-authority-auditor. 内容质量/EEAT评分

aaron-he-zhu

ctf-crypto

提供适用于 CTF 竞赛的密码学攻击技术指南。当需要应对涉及 RSA、AES、ECC、格（Lattice）、LWE、CVP、数论、Coppersmith、Pollard、Wiener、填充提示攻击（Padding Oracle）、GCM、密钥派生或流/分组密码缺陷等加密、哈希、签名、零知识证明（ZKP）、伪随机数生成器（PRNG）及数学密码难题时使用。

ctf-osint

为CTF挑战提供开源情报技术。当需要从公开来源、社交媒体、地理位置、DNS记录、用户名枚举、反向图片搜索、Google Dorking、Wayback Machine、Tor中继、FEC备案或识别未知数据（如哈希和坐标）时使用。

ctf-forensics

2.7Kdevops-cloud

提供面向 CTF 竞赛的数字取证与信号分析技术。适用于分析磁盘镜像、内存转储、事件日志、网络抓包、加密货币交易、隐写术、PDF 分析、Windows 注册表、Volatility、PCAP、Docker 镜像、coredump、侧信道功耗轨迹、DTMF 音频频谱图、数据包时间间隔分析、CD 音轨镜像，以及恢复已删除的文件和凭据。

solve-challenge

2.7Kagent-workflows

通过执行初步分类、识别主要类别，并将执行路由到正确的专用 ctf-* 技能来解决 CTF 挑战。当用户提供挑战包、远程服务、可疑文件或仅模糊的挑战描述，且你必须确定从何处开始时使用。当类别已明确且可以直接调用专用技能时不要使用；这是调度和侦察入口点，不是类别特定技术的最深层参考。

ctf-misc

提供无法明确归入各大常规分类的 Misc（杂项）类 CTF 题目解题技巧。适用于编码谜题、pyjail（Python 逃逸）、bash jail（Bash 逃逸）、无线电/SDR（RF/SDR）、DNS 奇技淫巧、Unicode 技巧、脑洞/奇葩语言（esoteric languages）、二维码或音频解密、约束求解、博弈论、各种奇特沙盒逃逸以及混合逻辑谜题。如果题目主要偏向 Web、Pwn、逆向（Reverse）、取证（Forensics）、恶意软件（Malware）、情报收集（OSINT）或密码学（Crypto），请优先使用更具体的专属 Skill。本 Skill 应作为处理真正跨学科或边缘冷门题目的兜底方案，而非首选起点。

ctf-malware

提供针对CTF挑战的恶意软件分析和网络流量技术。用于分析混淆脚本、恶意软件包、自定义加密协议、C2流量、PE/.NET二进制文件、RC4/AES加密通信、YARA规则、shellcode分析、恶意软件内存取证（Volatility malfind、进程注入检测）、反分析技术（VM/沙箱检测、定时规避、API哈希、进程注入、环境检查），或提取恶意软件配置和入侵指标。

ctf-reverse

2.7Ktesting-qa

提供CTF挑战的逆向工程技术。当主要任务是理解编译、混淆、加壳或虚拟化目标的工作原理，以便后续利用或解决时使用，包括二进制文件、APK、WASM、固件、自定义虚拟机、字节码、游戏客户端、类似恶意软件的加载器以及反调试或反分析逻辑。当漏洞已经理解且剩余任务仅为利用时，请勿使用，应改用pwn。不适用于纯Web工作流、日志或磁盘取证、或独立的密码学问题，除非逆向实现是真正的障碍。

ctf-web

提供CTF挑战中的Web利用技术。当目标主要是HTTP应用程序、API、浏览器客户端、模板引擎、身份流程或智能合约前端/后端攻击面时使用，包括XSS、SQLi、SSTI、SSRF、XXE、JWT、认证绕过、文件上传、请求走私、OAuth/OIDC、SAML、原型污染及类似的Web漏洞。不要用于原生二进制内存破坏、独立可执行文件逆向工程、磁盘或内存取证，或纯密码分析，除非Web漏洞仍然是获取flag的主要路径。

ctf-pwn

2.7Kagent-workflows

提供CTF挑战中的二进制利用技术。当你已经有一个脆弱的本地目标或服务，需要将内存损坏或底层原语转化为代码执行或权限提升时使用，例如缓冲区溢出、格式化字符串、堆漏洞、ROP、ret2libc、shellcode、内核利用、seccomp绕过、沙箱逃逸或Windows/Linux利用链。当主要障碍是理解二进制文件的功能时不要使用，应首先进行逆向工程。不要用于纯Web漏洞、磁盘或数据包取证、或独立的密码学/数学挑战。

security-audit

对代码库进行安全审计——涵盖 Web 应用、API、服务、CLI 工具、库、守护进程等。当被要求查找安全漏洞、进行安全审查、审计漏洞或对代码进行渗透测试时使用。重点关注可利用且具有实际影响的问题，而非理论问题或行业标准行为。

cloudflare

amazon-braket

2.6Ksecurity

Runs quantum computing workflows on AWS through Amazon Braket — discovering devices (QPUs and simulators) and their availability, building gate-model circuits and analog Hamiltonian programs, submitting quantum tasks, program sets and hybrid jobs, looking up prices, and capping spend with spending limits. Applies to any request about quantum computing, quantum hardware, quantum simulation, AHS, OpenQASM, or running a quantum algorithm on AWS.

xiaohongshu-cli

Use xiaohongshu-cli for ALL Xiaohongshu (Little Red Book, 小红书) operations — searching notes, reading content, browsing users, liking, collecting, commenting, following, and posting. Invoke whenever the user requests any Xiaohongshu interaction.

jackwener

flutter-use-http-package

使用 `http` 包发起 GET、POST、PUT 或 DELETE 请求。适用于需要从 REST API 获取数据或发送数据的场景。

flutter

aws-social-messaging

Manages WhatsApp messaging through AWS End User Messaging Social. Covers managing templates (create, update, delete, library), sending messages (utility/marketing/auth templates and freeform), uploading and managing media, configuring event destinations for delivery tracking, and troubleshooting delivery failures. Applicable when a user needs to send WhatsApp messages, create or manage templates, upload media, configure delivery notifications, or diagnose messaging issues.

amazon-ses

Configures Amazon SES V2 for production email sending — including domain identity creation, DKIM/SPF/DMARC authentication, one-shot DNS record presentation, and Route 53 automation — for developers setting up or troubleshooting SES domain verification and deliverability. Applicable when developers need to send emails from their domain via SES, verify a domain identity, configure email authentication, troubleshoot DKIM verification issues, or ensure their sending setup follows best practices. Not for email-address-only verification, Mail Manager inbound routing, SNS, Pinpoint, or WorkMail.

agents-connect

Use when connecting your agent to external APIs, tools, or services via Gateway, or restricting tool access with Cedar policies. Handles gateway setup, target types, outbound auth (OAuth, API key, IAM), credentials, and Cedar policy authoring. Triggers on: "connect to API", "add gateway", "connect to MCP server", "Lambda tools", "OpenAPI", "gateway target", "Cedar policy", "restrict tools", "policy engine", "gateway auth error", "store API key", "outbound credential", "env var API key", "API key None after deploy", "credential not available after deploy", "should this be a gateway target", "give my agent tools", "add tools to agent". Not for inbound auth (who can call your agent) — use agents-harden. Not for debugging agent behavior — use agents-debug. Not for VPC networking errors (agent can't reach APIs due to VPC) — use agents-build. Not for creating or hosting a new MCP server project — use agents-get-started.

aws-auth

2.4Ksecurity

Adds user authentication to web and mobile apps with Amazon Cognito (user pools and identity pools) and the AWS Amplify client auth libraries. Covers sign-up/sign-in flows and the login page (Cognito-hosted UI / managed login), MFA, password policies, OAuth 2.0 / OIDC flows (auth-code + PKCE, client credentials), social/SAML federation, tokens (ID/access/refresh, rotation, revocation, storage), Cognito Lambda triggers, identity pools (temp AWS creds), and gating API Gateway (or ALB) routes to signed-in users via Cognito/JWT authorizers. Applies when adding a login or sign-up page, configuring a user pool or app client, choosing user pool vs identity pool, wiring social/SAML, refreshing tokens, requiring sign-in on an API Gateway or ALB, or debugging redirect_uri/token/MFA/CORS/federation errors. Does NOT cover Amplify Gen2 backend definitions (defineAuth, npx ampx → aws-amplify), IAM/STS/Identity Center (→ aws-iam), or API Gateway/Lambda resource config beyond the authorizer (→ aws-serverless).

aws-resilience-lifecycle

2.4Ksecurity

Guides the end-to-end AWS resilience lifecycle integrating Resilience Hub v2, Fault Injection Service, and Application Recovery Controller. Covers the Define → Test → Operate workflow: from policy creation through failure mode assessment, to FIS experiment validation, to ARC operational controls. Applicable when the user wants a complete resilience strategy, needs to connect findings to experiments to controls, or is planning a resilience program. Also applicable for the meta question of whether marking NGRH findings as resolved is enough, whether they are "done" after resolving findings, or how to validate findings before resolving them. Not applicable for resolving or remediating a specific individual finding (see resilience-hub-failure-mode-assessment), or when a single service is explicitly named (e.g. "what FIS experiment should I run").