vulnerability-triage-brocards — This skill should be used when the user asks to "triage a vulnerability report", "assess a CVE", "evaluate a bug bounty submission".
waf — Configures AWS WAF to filter web traffic: creating web access control lists (web ACLs) on CloudFront, Application Load Balancers, API Gateway, and AppSync.
web-artifacts-builder — ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn/ui).
web-perf — Audit, diagnose, or optimize website loading and interaction performance, Core Web Vitals, and Lighthouse performance scores.
webapp-testing — Toolkit for interacting with and testing local web applications using Playwright.
websocket-engineer — IO. Invoke for bidirectional messaging, horizontal scaling with Redis, presence tracking, room management.
windows-remote-desktop-connection-doctor — Diagnose Windows App (Microsoft Remote Desktop / Azure Virtual Desktop / W365 / direct PC) connection issues on macOS.
wordpress-pro — Develops custom WordPress themes and plugins, creates and registers Gutenberg blocks and block patterns, configures WooCommerce stores.
workers-best-practices — Cloudflare Workers best practices for production applications. Use when writing, reviewing, or configuring Workers.
wps-doc-scraper — pof mind maps and canvases, as raw source data, original SVG/PNG, and Markdown.
wrangler — Run or troubleshoot Wrangler CLI commands and configure Worker projects for local development, deployment, and Cloudflare resource management.
writing-guidelines — Review docs/prose for Writing Guidelines compliance.
writing-lean-proofs — Writes and reviews structured Lean 4 proofs and designs Lean libraries following Mathlib conventions.
writing-plans — Use when you have a spec or requirements for a multi-step task, before touching code
writing-skills — Use when creating new skills, editing existing skills, or verifying skills work before deployment
wwas — Create product backlog items in Why-What-Acceptance format — independent, valuable, testable items with strategic context.
wycheproof — Validates cryptographic implementations against Project Wycheproof's test vectors, which encode known attacks and edge cases across AES, RSA, ECDSA, ECDH.
xlsx — Use this skill any time a spreadsheet file is the primary input or output.
yara-rule-authoring — Guides authoring of high-quality YARA-X detection rules for malware identification. Use when writing, reviewing, or optimizing YARA rules.
youtube-downloader — Download YouTube videos and HLS streams (m3u8) from platforms like Mux, Vimeo, etc. using yt-dlp and ffmpeg.
zeroize-audit — Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis.