This skill should be used when the user asks to "identify web application vulnerabilities", "explain common security flaws", "understand vulnerability categories", "learn about injection attacks", "review access control weaknesses", "analyze API security issues", "assess security misconfigurations", "understand client-side vulnerabilities", "examine mobile and IoT security flaws", or "reference the OWASP-aligned vulnerability taxonomy". Use this skill to provide comprehensive vulnerability definitions, root causes, impacts, and mitigation strategies across all major web security categories.
4.7k3d agoReviewMountCreate a free account to mount
Audit Terms of Service, user agreements, and privacy policies for consumer risks, producing a structured report that flags unfair clauses, data traps, and liability issues. Trigger when a user asks to review, audit, or analyze a ToS, privacy policy, or user agreement, or mentions specific concerns like auto-renewal or data authorization.
4.7k3d agoReviewMountCreate a free account to mount
Use when building TypeScript applications requiring advanced type systems, generics, or full-stack type safety. Invoke for type guards, utility types, tRPC integration, monorepo setup.
4.7k3d agoReviewMountCreate a free account to mount
Generate professional primary market / venture capital industry research reports, including sector deep-dives, investment memos, and market analysis. Produces detailed PDF reports covering TMT, consumer, healthcare, and industrials. Triggered by requests to analyze an industry, create a market report, write a sector deep-dive, or generate any PE/VC-style research document in Chinese or English.
4.7k3d agoReviewMountCreate a free account to mount
This skill should be used when the user asks to "escalate privileges on Windows," "find Windows privesc vectors," "enumerate Windows for privilege escalation," "exploit Windows misconfigurations," or "perform post-exploitation privilege escalation." It provides comprehensive guidance for discovering and exploiting privilege escalation vulnerabilities in Windows environments.
4.7k3d agoReviewMountCreate a free account to mount
This skill should be used when the user asks to "analyze network traffic with Wireshark", "capture packets for troubleshooting", "filter PCAP files", "follow TCP/UDP streams", "detect network anomalies", "investigate suspicious traffic", or "perform protocol analysis". It provides comprehensive techniques for network packet capture, filtering, and analysis using Wireshark.
4.7k3d agoReviewMountCreate a free account to mount
This skill should be used when the user asks to "pentest WordPress sites", "scan WordPress for vulnerabilities", "enumerate WordPress users, themes, or plugins", "exploit WordPress vulnerabilities", or "use WPScan". It provides comprehensive WordPress security assessment methodologies.
4.7k3d agoReviewMountCreate a free account to mount
This skill should be used when the user asks to "test for XSS vulnerabilities", "perform cross-site scripting attacks", "identify HTML injection flaws", "exploit client-side injection vulnerabilities", "steal cookies via XSS", or "bypass content security policies". It provides comprehensive techniques for detecting, exploiting, and understanding XSS and HTML injection attack vectors in web applications.
4.7k3d agoReviewMountCreate a free account to mount
It can be spawned agents for specific tasks, but don't let them run wild. Always review their output and verify it against the real code/real run before accepting it. Build for flexible, context-aware presentation rather than fixed dimensions or one-size layouts. Do not rely solely on your internal knowledge or training data when making implementation decisions. Your memory is frequently outdated. Before implementing anything non-trivial (especially integrations, tools, SDKs, platforms, AI agents, or architectural patterns): Why this matters: Defaulting to…
2293mo agoReviewMountCreate a free account to mount
Operational notes for this repo. Every entry is a mistake that has actually been made here, not general advice. The measurements are recorded because they cost real effort and cannot be cheaply re-derived. Read Three rules first; the rest of the file leans on them. Three rules · Release tracks · Releasing · Integration gate · Things that go stale silently · Environment · Timeouts · Background jobs · Output integrity · Session lifetime · Invariants not to break ·…
492mo agoReviewMountCreate a free account to mount
Claude Code marketplace with two plugins that delegate work to other AI coding agents: plugins/codex (community fork of openai/codex-plugin-cc) and plugins/cursor (drives Cursor's cursor-agent CLI). Plain Node .mjs with JSDoc types — no build step for runtime code, no dependencies beyond dev tools. - Verify test results by exit code, never by grepping output. - tests/runtime-*.test.mjs and the cancel e2e tests spawn real detached processes; prefer targeted patterns while iterating, but run the full suite (or rely on CI) before…
333mo agoReviewMountCreate a free account to mount
Claude-specific notes on top of the shared agent guide: - Model delegation (repo-specific working preferences, not plugin defaults): - Deep code analysis, architecture validation, security review, and high-stakes refactors → Codex task/rescue with --profile deep (resolves to --model gpt-5.6-sol --effort xhigh); escalate to --profile deep --effort max when a verdict still feels shallow. - Fast iteration, everyday implementation, scaffolding, and the standing pre-merge reviews → Cursor with --model cursor-grok-4.5-high-fast. - Escalation rule: when a task that started on the Cursor…
333mo agoReviewMountCreate a free account to mount
Use this skill when the user wants to update their project's CLAUDE.md or AGENTS.md, verify their Claude Code setup, or check for improvements to their project configuration. Triggers on requests like: "update my project docs", "verify my claude setup", "check my project configuration", "audit my .claude directory", "improve my CLAUDE.md", "is my setup correct", "/update-project", "/verify-project", or "/check".
294mo agoReviewMountCreate a free account to mount
Use when creating /goal directives, reusable testable outcome-oriented success standards for agentic workflows. Use whenever the user asks to create a goal, write a /goal directive, define what good looks like, set success criteria for an agent, define a reusable instruction, create a quality standard, write acceptance criteria for an agent workflow, or specify done conditions.
294mo agoReviewMountCreate a free account to mount
You are a helpful AI assistant. Be concise, accurate, and friendly. Users can control icron directly with slash commands: Note: Slash commands are processed directly by icron without going through the LLM. You have access to: - File operations (read, write, edit, list) - Shell commands (exec) - Web access (search, fetch) - Messaging (message) - Background tasks (spawn) - Screenshots (screenshot) When the user asks for a screenshot: IMPORTANT: You MUST use the message tool with the media parameter…
Plain text files in a repository that tell a coding agent how the project works: commands to run, conventions to follow and things to avoid. CLAUDE.md, AGENTS.md, cursor rules and skills are the common kinds.
CLAUDE.md or AGENTS.md?
CLAUDE.md is read by Claude Code. AGENTS.md is an open format that Codex, Cursor and other agents read. Many projects keep one and point the other at it.
What is a skill?
A folder with a SKILL.md that describes one capability, such as filling PDFs or reviewing code. The agent loads it only when the task calls for it.
Can I search my own team's files too?
Your agents already can, over MCP, limited to the files you're allowed to read. Searching them from this page is coming.
zebbernSkill