Use when planning or executing authorized red team engagements, attack path analysis, or offensive security simulations. Covers MITRE ATT&CK kill-chain planning, technique scoring, choke point identification, OPSEC risk assessment, and crown jewel targeting.
Identifies and unpacks UPX-packed malware samples, including binaries with modified UPX magic bytes or headers that block automated decompression, to recover the original executable for static analysis. Use when a sample shows high entropy, minimal imports, or only LoadLibrary/GetProcAddress in its import table, or when preparing a packed binary for disassembly in Ghidra or IDA.
Craft compelling narratives using story frameworks. Use when the user says "help me with storytelling" or "I want to create a narrative through storytelling"
Generate AI-friendly repository documentation with the SourceSage CLI. Use when Codex needs to run `sage` or `sourcesage` to create `.SourceSageAssets/Repository_summary.md`, analyze the current repository or another local repository, switch the output language between English and Japanese, use `--lite` to keep the summary small, change the output directory, or optionally create a deprecated tag-diff release report with `--diff`.
Audits SwiftData/Core Data model layer for field completeness, serialization gaps, relationship integrity, semantic ambiguity, dead fields, and migration safety. Finds model-layer bugs that manifest as workflow bugs. Triggers: "audit models", "model radar", "/data-model-radar".
Onboards a new job search in this Cowork project — intakes a resume, interviews the user for their target roles/industries/locations/companies, publishes the tracker webpage, and schedules recurring scans. Triggers on "set up my job search", "start my job search", "get my job search tracker going", "job-search-copilot setup", or when a resume is uploaded in a project that has this plugin and no tracker yet.
Python expert for writing clean, well-structured, and idiomatic code. Use for: code organization, PEP 8 compliance, type hints, design patterns, best practices, refactoring, testing, and modern Python features. Covers async/await, decorators, context managers, and pythonic idioms.
Use when deploys and configures osquery for real-time endpoint monitoring using SQL-based queries to inspect running processes, open ports, installed software, and system configuration. Use when building visibility into endpoint state, threat hunting across fleet, or implementing compliance monitoring. Activates for requests involving osquery deployment, endpoint visibility, fleet management, or SQL-based endpoint querying.
Answer a question from the wiki's own pages, citing them, with cross-lingual search across the configured languages. Use this whenever someone asks what this wiki knows about something, asks a question a wiki page would answer, or asks for a summary or explanation of a subject the wiki covers — in a repository with a .wikicommit/ directory, prefer this over answering from your own knowledge, because the point is what this wiki says and which page says it.
Integrate Tencent Cloud Hunyuan for text-to-video and image-to-video generation. Use this skill when the application needs AI video generation from text descriptions or static images. Triggers on requests for video generation, text-to-video, image-to-video, image animation, or AI video creation.
Portable Personal AI Assistant core. USE WHEN designing substrate-neutral assistant identity, memory, ISA, skills, learning, or adapters for Codex, Pi.dev, Claude Code, Cursor, or Grok.
Expert context for working on the parapet-ingress-controller repository — a Kubernetes ingress controller built in Go on the parapet middleware framework. Use this skill whenever the user asks to add features, fix bugs, write plugins, update dependencies, refactor code, write tests, or do anything else inside the parapet-ingress-controller codebase. Also trigger when the user mentions annotations, ingress rules, proxy behaviour, rate limiting, TLS handling, or Prometheus metrics in the context of this project.