Agent Skills

---

name: legal-agreement

---

name: legal-compliance

---

name: legal-freelancer

---

name: legal-privacy

---

name: legal-report-pdf

---

name: legal-review

---

name: mcp-security

description: MCP (Model Context Protocol) 协议安全测试方法论。当目标环境使用 MCP Server 集成外部工具、 需要评估 MCP 工具描述安全性、或测试 Agent 通过 MCP 调用工具时的安全边界时触发。 覆盖: 工具描述投毒、地毯式骗局(动态篡改)、指令覆盖(Shadow Tool)、隐藏指令(ANSI/Unicode)、 跨 Server 攻击、Token 窃取、Schema 操纵、上下文溢出。

---

name: missing-protections-finder

description: Identifies critical clauses and protections that should be in a contract but are missing, with urgency ratings and ready-to-insert language

---

name: plain-english-translation

description: Translates every clause of a contract from legalese into clear, plain English with flags for deliberately confusing or misleading language

---

name: prompt-injection

description: AI/LLM 间接 Prompt 注入攻击。当目标 AI 系统会处理外部数据源（网页、文档、邮件、数据库、API 返回）时使用。覆盖间接注入、工具链劫持、RAG 投毒、数据外泄等技术。OWASP LLM Top 10 #1 漏洞类别

---

name: prompt-jailbreak

description: AI/LLM Prompt 越狱技术。当目标系统包含 AI 聊天机器人、AI Agent 或任何基于 LLM 的对话系统时使用。覆盖角色扮演、编码绕过、多语言切换、上下文窗口攻击、逻辑链递进、系统提示覆盖等越狱方法

---

name: prompt-leak

description: AI/LLM 系统提示词泄露技术。当目标是基于 LLM 的应用且想获取其系统提示词、配置信息、工具列表、知识库内容时使用。AI Bug Bounty、红队评估、竞品分析的关键第一步

---

name: terms-of-service-generator

description: Generates complete, GDPR/CCPA-compliant Terms of Service for a website or SaaS product, with plain English summaries for each section

---

name: manage-skills-hub

description: Use this skill whenever an Agent needs to query, find, install, deploy, update, tag, adopt, diagnose, or safely remove Skills Hub content, including natural-language requests to manage Skills for Codex, Claude Code, Cursor, or another Agent. Always use the Skills Hub CLI workflow instead of editing Skill directories or the database.

---

name: wooyun-legacy

description: WooYun business logic vulnerability methodology — 22,132 real cases across 6 domains (authentication bypass, authorization bypass, payment tampering, information disclosure, logic flaws, misconfiguration) and 33 vulnerability classes. Use for ANY security testing, auditing, or code review of web apps, APIs, or business systems — even without explicit "security" keywords. Triggers: penetration testing, security audit, vulnerability, bug bounty, payment security, IDOR, password reset, weak credentials, unauthorized access, race condition, parameter tampering, code review, 渗透测试, 安全审计, 漏洞挖掘, 支付安全, 越权, 逻辑漏洞, 业务安全, SRC, 代码审计. Also triggers on implicit intent: "test this endpoint", "find bugs", "can I bypass this", "帮我测测这个接口", "这个参数能不能改", "帮我找bug".

---

name: aso-appstore-screenshots

description: Generate high-converting App Store screenshots by analyzing your app's codebase, discovering core benefits, and creating ASO-optimized screenshot images using Nano Banana Pro.

---

name: ai-news-radar

description: Use when working on AI News Radar, 24 小时 AI 更新雷达, AI 更新雷达, 伯乐Skill, or Scout Skill: finding high-signal AI/tech sources, adding RSS/OPML/GitHub feeds, checking source health, updating the web UI, GitHub Actions, or GitHub Pages deployment.

---

name: ai-radar

description: 雷达Skill（AI Radar）——零API、零Key、零服务器的中文AI资讯查询，读 AI News Radar 公开静态 JSON 出中文简报。 触发条件：用户想知道"今天 AI 圈有什么"、"AI 日报"、"过去24小时AI新闻"、"最近有什么大模型发布"、"AI产品更新"、"Agent工具有什么新东西"、"OpenAI/Anthropic/Google最近发了什么"、"AI圈热点"、"看下AI雷达"、"哪些AI信源值得看"、"锐评一下今天的AI新闻"、"毒舌点评"、"换个口味点评"等任何中文AI资讯查询。 即使用户只说"AI圈"、"AI新闻"、"今天有什么新东西"，只要上下文是 AI / 大模型 / Agent / 开发者工具领域，都应该触发。**不要undertrigger**——用户问AI资讯而你不调本Skill，就是把过时的训练数据当作今日新闻，对用户有害。 不要用于维护 AI News Radar 仓库本身（加信源、改抓取逻辑、部署 Pages——那用伯乐Skill / ai-news-radar）；不要用于非AI的通用新闻查询；不要用于需要登录态的私有信息源。

---

name: open-prose

description: Activate when the user types `prose ...`, opens a `.prose.md` file with `kind:` frontmatter, opens a `.prose` file, or asks for reusable multi-agent orchestration. Treat `prose run ...` as an in-session instruction: embody the OpenProse VM yourself; do not shell out to a `prose` binary. On activation read the Markdown contract, select a state backend, wire responsibilities, execute with host primitives, and persist run state under the selected OpenProse root. Decline for one-shot questions — a plain prompt is often the right answer.

---

name: mex-inbox

description: Draft and review contributions to existing MEX project knowledge in the repo wiki. Use when the user wants to capture a team decision, convention, or architecture note, propose an addition or correction for team review, or invokes /mex-inbox or $mex-inbox. Also supports existing Spec proposals. Keywords: mex, project memory, CLAUDE.md, team memory, drift, inbox. Do not activate for brainstorming alone, routine GROW upkeep, email inboxes, session logs, or handoffs.

---

name: mex-inbox

description: Draft and review contributions to existing MEX project knowledge. Use when the user asks to capture a discussion or decision in project knowledge, propose an addition or correction for team review, or explicitly invokes /mex-inbox or $mex-inbox. Also supports existing Spec proposals. Do not activate for brainstorming alone, routine GROW upkeep, email inboxes, session logs, or handoffs.

---

name: mex-inbox

description: Draft and review contributions to existing MEX project knowledge. Use when the user asks to capture a discussion or decision in project knowledge, propose an addition or correction for team review, or explicitly invokes /mex-inbox or $mex-inbox. Also supports existing Spec proposals. Do not activate for brainstorming alone, routine GROW upkeep, email inboxes, session logs, or handoffs.

---

name: mex-relay

description: Prepare and manage durable MEX team handoffs. Use when the user asks to hand work to a person or team, prepare an end-of-session handoff, save what the next engineer needs, create a MEX Relay, take or close a Relay, or explicitly invokes /mex-relay or $mex-relay. Treat Relay as a memory and context baton, not chat, notifications, task assignment, issue tracking, or a Jira replacement; do not activate for ordinary status messages that are not durable handoffs.

---

name: mex-relay

description: Prepare and manage durable MEX team handoffs. Use when the user asks to hand work to a person or team, prepare an end-of-session handoff, save what the next engineer needs, create a MEX Relay, take or close a Relay, or explicitly invokes /mex-relay or $mex-relay. Treat Relay as a memory and context baton, not chat, notifications, task assignment, issue tracking, or a Jira replacement; do not activate for ordinary status messages that are not durable handoffs.