全部能力

Create, modify, and organise Grafana dashboards including panels, variables, transformations,

Use when working with iOS/macOS Keychain Services (SecItem queries, kSecClass, OSStatus errors), biometric authentication (LAContext, Face ID, Touch ID),…

Run loan, investment, NPV, retirement, savings, and risk calculations with schedules and charts. Use for deterministic financial modeling tasks.

在执行 /clear、/compact、恢复会话或上下文丢失后使用。在分支上下文过时或未知时使用。在现有工作树中开始工作时使用。

使用 JWT、OAuth 2.0、API 密钥和会话管理实现安全的 API 认证。适用于保护 API、管理令牌或实现用户认证流程的场景。

在 Arize 上处理 LLM-as-judge 评估工作流，包括创建/更新评估器、在 span 或 experiment 上运行评估、管理任务等。

面向 QQ 邮箱的 IMAP 收邮件、SMTP 发邮件；账号与授权码从环境变量 QQ_EMAIL_ACCOUNT、QQ_EMAIL_AUTH_CODE 读取。在用户要发 QQ 邮件、收邮件、查邮件、代发邮件或配置 QQ 邮箱时使用。

Apply modern web development best practices for security, compatibility, and code quality. Use when asked to "apply best practices", "security audit",…

Security auditor for Laravel applications. Analyzes code for vulnerabilities, misconfigurations, and insecure practices using OWASP standards and Laravel…

Django REST Framework patterns. Trigger: When implementing generic DRF APIs (ViewSets, serializers, routers, permissions, filtersets). For Prowler API specifics (RLS/RBAC/Providers), also use prowler-api.

Audit claude-skills with systematic 9-phase review: standards compliance, official docs verification, code accuracy, cross-file consistency, and version drift detection. Use when investigating skill issues, major updates detected, skill not verified >90 days, or before marketplace submission.

Manage issues, projects & team workflows in Linear. Use when the user wants to read, create or updates tickets in Linear.

Master essential security scanning tools for network discovery, vulnerability assessment, web application testing, wireless security, and compliance…

Implement authentication with auth handlers and gateways in Encore.ts.

Claims-based authorization for agents and operations. Grant, revoke, and verify permissions for secure multi-agent coordination. Use when: permission management, access control, secure operations, authorization checks. Skip when: open access, no security requirements, single-agent local work.

Electron development guidelines for building cross-platform desktop applications with JavaScript/TypeScript

Checks unreachable code, unused imports/variables/functions, commented-out code, unsupported patterns. Use when auditing dead code.

Reverse-engineer and clone one or more websites in one shot — extracts assets, CSS, and content section-by-section and proactively dispatches parallel builder…

Generate comprehensive PR descriptions following repository templates

Security audit workflow - vulnerability scan → verification