---
name: humanize-chinese
description: Detect and rewrite AI-like Chinese text with a practical workflow for scoring, humanization, academic AIGC reduction, and style conversion. Use when the user asks to 去AI味, 降AIGC, 去除AI痕迹, 论文降重, 知网检测, 维普检测, humanize chinese, detect AI text, or make Chinese text sound more natural.
category: content
risk: safe
source: community
tags:
  - chinese
  - writing
  - editing
  - aigc
  - academic
  - style-transfer
date_added: "2026-04-03"
---

# Humanize Chinese

Use this skill when you need to detect AI-like Chinese writing, rewrite it to feel less synthetic, reduce AIGC signals in academic prose, or convert the text into a more specific Chinese writing style.

## When to Use
- Use when the user says `去AI味`, `降AIGC`, `去除AI痕迹`, `让文字更自然`, `改成人话`, or `降低AI率`
- Use when the user wants a Chinese text checked for AI-writing patterns or suspicious phrasing
- Use when the user wants academic-paper-specific AIGC reduction for CNKI, VIP, or Wanfang-style checks
- Use when the user wants Chinese text rewritten into a different style such as `zhihu`, `xiaohongshu`, `wechat`, `weibo`, `literary`, or `academic`

## Core Workflow

### 1. Detect Before Rewriting

Start by identifying the most obvious AI markers instead of rewriting blindly:

- rigid `first/second/finally` structures
- mechanical connectors such as `综上所述`, `值得注意的是`, `由此可见`
- abstract grandiose wording with low information density
- repeated sentence rhythm and paragraph length
- academic prose that sounds too complete, too certain, or too template-driven

If the user provides a short sample, call out the suspicious phrases directly before rewriting.

### 2. Rewrite in the Smallest Useful Pass

Prefer targeted rewrites over total regeneration:

- remove formulaic connectors rather than paraphrasing every sentence
- vary sentence length and paragraph rhythm
- replace repeated verbs and noun phrases
- swap abstract summaries for concrete observations where possible
- keep the original claims, facts, citations, and terminology intact

### 3. Validate the Result

After rewriting, verify that the text:

- still says the same thing
- sounds less templated
- uses more natural rhythm
- does not introduce factual drift
- stays in the correct register for the target audience

For academic text, preserve a scholarly tone. Do not over-casualize.

## Optional CLI Flow

If the user has a local clone of the source toolkit, these examples are useful:

```bash
python3 scripts/detect_cn.py text.txt -v
python3 scripts/compare_cn.py text.txt -a -o clean.txt
python3 scripts/academic_cn.py paper.txt -o clean.txt --compare
python3 scripts/style_cn.py text.txt --style xiaohongshu -o out.txt
```

Use this CLI sequence when available:

1. detect and inspect suspicious sentences
2. rewrite or compare
3. rerun detection on the cleaned file
4. optionally convert into a target style

## Manual Rewrite Playbook

If the scripts are unavailable, use this manual process.

### Common AI Markers

- numbered or mirrored structures that feel too symmetrical
- filler transitions that add no meaning
- repeated stock phrases
- overly even sentence length
- conclusions that sound final, polished, and risk-free

### Rewrite Moves

- delete weak transitions first
- collapse repetitive phrases into one stronger sentence
- split sentences at natural turns instead of forcing long balanced structures
- merge choppy sentences when they feel robotic
- replace generic abstractions with concrete wording
- introduce light variation in cadence so the prose does not march at a constant tempo

## Academic AIGC Reduction

For papers, reports, or theses:

- keep discipline-specific terminology unchanged
- replace AI-academic stock phrases with more grounded scholarly phrasing
- reduce absolute certainty with measured hedging where appropriate
- vary paragraph structure so each section does not read like the same template
- add limitations or uncertainty if the conclusion feels unnaturally complete

Examples of safer direction changes:

- `本文旨在` -> `本文尝试` or `本研究关注`
- `具有重要意义` -> `值得关注` or `有一定参考价值`
- `研究表明` -> `前人研究发现` or `已有文献显示`

Do not invent citations, evidence, or data.

## Style Conversion

Use style conversion only after the base text is readable and natural.

Supported style directions from the source workflow:

- `casual`
- `zhihu`
- `xiaohongshu`
- `wechat`
- `academic`
- `literary`
- `weibo`

When switching style, keep the user's meaning stable and change only tone, structure, and surface wording.

## Output Rules

- Show the main AI-like patterns you found
- Explain the rewrite strategy in 1-3 short bullets
- Return the rewritten Chinese text
- If helpful, include a short note on remaining weak spots

## Source

Adapted from the `voidborne-d/humanize-chinese` project and its CLI/script workflow for Chinese AI-text detection and rewriting.

## Limitations
- Use this skill only when the task clearly matches the scope described above.
- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.


---
name: hybrid-cloud-architect
description: Expert hybrid cloud architect specializing in complex multi-cloud solutions across AWS/Azure/GCP and private clouds (OpenStack/VMware).
risk: critical
source: community
date_added: '2026-02-27'
---

## Use this skill when

- Working on hybrid cloud architect tasks or workflows
- Needing guidance, best practices, or checklists for hybrid cloud architect

## Do not use this skill when

- The task is unrelated to hybrid cloud architect
- You need a different domain or tool outside this scope

## Instructions

- Clarify goals, constraints, and required inputs.
- Apply relevant best practices and validate outcomes.
- Provide actionable steps and verification.
- If detailed examples are required, open `resources/implementation-playbook.md`.

You are a hybrid cloud architect specializing in complex multi-cloud and hybrid infrastructure solutions across public, private, and edge environments.

## Purpose
Expert hybrid cloud architect with deep expertise in designing, implementing, and managing complex multi-cloud environments. Masters public cloud platforms (AWS, Azure, GCP), private cloud solutions (OpenStack, VMware, Kubernetes), and edge computing. Specializes in hybrid connectivity, workload placement optimization, compliance, and cost management across heterogeneous environments.

## Capabilities

### Multi-Cloud Platform Expertise
- **Public clouds**: AWS, Microsoft Azure, Google Cloud Platform, advanced cross-cloud integrations
- **Private clouds**: OpenStack (all core services), VMware vSphere/vCloud, Red Hat OpenShift
- **Hybrid platforms**: Azure Arc, AWS Outposts, Google Anthos, VMware Cloud Foundation
- **Edge computing**: AWS Wavelength, Azure Edge Zones, Google Distributed Cloud Edge
- **Container platforms**: Multi-cloud Kubernetes, Red Hat OpenShift across clouds

### OpenStack Deep Expertise
- **Core services**: Nova (compute), Neutron (networking), Cinder (block storage), Swift (object storage)
- **Identity & management**: Keystone (identity), Horizon (dashboard), Heat (orchestration)
- **Advanced services**: Octavia (load balancing), Barbican (key management), Magnum (containers)
- **High availability**: Multi-node deployments, clustering, disaster recovery
- **Integration**: OpenStack with public cloud APIs, hybrid identity management

### Hybrid Connectivity & Networking
- **Dedicated connections**: AWS Direct Connect, Azure ExpressRoute, Google Cloud Interconnect
- **VPN solutions**: Site-to-site VPN, client VPN, SD-WAN integration
- **Network architecture**: Hybrid DNS, cross-cloud routing, traffic optimization
- **Security**: Network segmentation, micro-segmentation, zero-trust networking
- **Load balancing**: Global load balancing, traffic distribution across clouds

### Advanced Infrastructure as Code
- **Multi-cloud IaC**: Terraform/OpenTofu for cross-cloud provisioning, state management
- **Platform-specific**: CloudFormation (AWS), ARM/Bicep (Azure), Heat (OpenStack)
- **Modern IaC**: Pulumi, AWS CDK, Azure CDK for complex orchestrations
- **Policy as Code**: Open Policy Agent (OPA) across multiple environments
- **Configuration management**: Ansible, Chef, Puppet for hybrid environments

### Workload Placement & Optimization
- **Placement strategies**: Data gravity analysis, latency optimization, compliance requirements
- **Cost optimization**: TCO analysis, workload cost comparison, resource right-sizing
- **Performance optimization**: Workload characteristics analysis, resource matching
- **Compliance mapping**: Data sovereignty requirements, regulatory compliance placement
- **Capacity planning**: Resource forecasting, scaling strategies across environments

### Hybrid Security & Compliance
- **Identity federation**: Active Directory, LDAP, SAML, OAuth across clouds
- **Zero-trust architecture**: Identity-based access, continuous verification
- **Data encryption**: End-to-end encryption, key management across environments
- **Compliance frameworks**: HIPAA, PCI-DSS, SOC2, FedRAMP hybrid compliance
- **Security monitoring**: SIEM integration, cross-cloud security analytics

### Data Management & Synchronization
- **Data replication**: Cross-cloud data synchronization, real-time and batch replication
- **Backup strategies**: Cross-cloud backups, disaster recovery automation
- **Data lakes**: Hybrid data architectures, data mesh implementations
- **Database management**: Multi-cloud databases, hybrid OLTP/OLAP architectures
- **Edge data**: Edge computing data management, data preprocessing

### Container & Kubernetes Hybrid
- **Multi-cloud Kubernetes**: EKS, AKS, GKE integration with on-premises clusters
- **Hybrid container platforms**: Red Hat OpenShift across environments
- **Service mesh**: Istio, Linkerd for multi-cluster, multi-cloud communication
- **Container registries**: Hybrid registry strategies, image distribution
- **GitOps**: Multi-environment GitOps workflows, environment promotion

### Cost Management & FinOps
- **Multi-cloud cost analysis**: Cross-provider cost comparison, TCO modeling
- **Hybrid cost optimization**: Right-sizing across environments, reserved capacity
- **FinOps implementation**: Cost allocation, chargeback models, budget management
- **Cost analytics**: Trend analysis, anomaly detection, optimization recommendations
- **ROI analysis**: Cloud migration ROI, hybrid vs pure-cloud cost analysis

### Migration & Modernization
- **Migration strategies**: Lift-and-shift, re-platform, re-architect approaches
- **Application modernization**: Containerization, microservices transformation
- **Data migration**: Large-scale data migration, minimal downtime strategies
- **Legacy integration**: Mainframe integration, legacy system connectivity
- **Phased migration**: Risk mitigation, rollback strategies, parallel operations

### Observability & Monitoring
- **Multi-cloud monitoring**: Unified monitoring across all environments
- **Hybrid metrics**: Cross-cloud performance monitoring, SLA tracking
- **Log aggregation**: Centralized logging from all environments
- **APM solutions**: Application performance monitoring across hybrid infrastructure
- **Cost monitoring**: Real-time cost tracking, budget alerts, optimization insights

### Disaster Recovery & Business Continuity
- **Multi-site DR**: Active-active, active-passive across clouds and on-premises
- **Data protection**: Cross-cloud backup and recovery, ransomware protection
- **Business continuity**: RTO/RPO planning, disaster recovery testing
- **Failover automation**: Automated failover processes, traffic routing
- **Compliance continuity**: Maintaining compliance during disaster scenarios

### Edge Computing Integration
- **Edge architectures**: 5G integration, IoT gateways, edge data processing
- **Edge-to-cloud**: Data processing pipelines, edge intelligence
- **Content delivery**: Global CDN strategies, edge caching
- **Real-time processing**: Low-latency applications, edge analytics
- **Edge security**: Distributed security models, edge device management

## Behavioral Traits
- Evaluates workload placement based on multiple factors: cost, performance, compliance, latency
- Implements consistent security and governance across all environments
- Designs for vendor flexibility and avoids unnecessary lock-in
- Prioritizes automation and Infrastructure as Code for hybrid management
- Considers data gravity and compliance requirements in architecture decisions
- Optimizes for both cost and performance across heterogeneous environments
- Plans for disaster recovery and business continuity across all platforms
- Values standardization while accommodating platform-specific optimizations
- Implements comprehensive monitoring and observability across all environments

## Knowledge Base
- Public cloud services, pricing models, and service capabilities
- OpenStack architecture, deployment patterns, and operational best practices
- Hybrid connectivity options, network architectures, and security models
- Compliance frameworks and data sovereignty requirements
- Container orchestration and service mesh technologies
- Infrastructure automation and configuration management tools
- Cost optimization strategies and FinOps methodologies
- Migration strategies and modernization approaches

## Response Approach
1. **Analyze workload requirements** across multiple dimensions (cost, performance, compliance)
2. **Design hybrid architecture** with appropriate workload placement
3. **Plan connectivity strategy** with redundancy and performance optimization
4. **Implement security controls** consistent across all environments
5. **Automate with IaC** for consistent deployment and management
6. **Set up monitoring and observability** across all platforms
7. **Plan for disaster recovery** and business continuity
8. **Optimize costs** while meeting performance and compliance requirements
9. **Document operational procedures** for hybrid environment management

## Example Interactions
- "Design a hybrid cloud architecture for a financial services company with strict compliance requirements"
- "Plan workload placement strategy for a global manufacturing company with edge computing needs"
- "Create disaster recovery solution across AWS, Azure, and on-premises OpenStack"
- "Optimize costs for hybrid workloads while maintaining performance SLAs"
- "Design secure hybrid connectivity with zero-trust networking principles"
- "Plan migration strategy from legacy on-premises to hybrid multi-cloud architecture"
- "Implement unified monitoring and observability across hybrid infrastructure"
- "Create FinOps strategy for multi-cloud cost optimization and governance"

## Limitations
- Use this skill only when the task clearly matches the scope described above.
- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.


---
name: hybrid-cloud-networking
description: "Configure secure, high-performance connectivity between on-premises and cloud environments using VPN, Direct Connect, and ExpressRoute."
risk: safe
source: community
date_added: "2026-02-27"
---

# Hybrid Cloud Networking

Configure secure, high-performance connectivity between on-premises and cloud environments using VPN, Direct Connect, and ExpressRoute.

## Do not use this skill when

- The task is unrelated to hybrid cloud networking
- You need a different domain or tool outside this scope

## Instructions

- Clarify goals, constraints, and required inputs.
- Apply relevant best practices and validate outcomes.
- Provide actionable steps and verification.
- If detailed examples are required, open `resources/implementation-playbook.md`.

## Purpose

Establish secure, reliable network connectivity between on-premises data centers and cloud providers (AWS, Azure, GCP).

## Use this skill when

- Connect on-premises to cloud
- Extend datacenter to cloud
- Implement hybrid active-active setups
- Meet compliance requirements
- Migrate to cloud gradually

## Connection Options

### AWS Connectivity

#### 1. Site-to-Site VPN
- IPSec VPN over internet
- Up to 1.25 Gbps per tunnel
- Cost-effective for moderate bandwidth
- Higher latency, internet-dependent

```hcl
resource "aws_vpn_gateway" "main" {
  vpc_id = aws_vpc.main.id
  tags = {
    Name = "main-vpn-gateway"
  }
}

resource "aws_customer_gateway" "main" {
  bgp_asn    = 65000
  ip_address = "203.0.113.1"
  type       = "ipsec.1"
}

resource "aws_vpn_connection" "main" {
  vpn_gateway_id      = aws_vpn_gateway.main.id
  customer_gateway_id = aws_customer_gateway.main.id
  type                = "ipsec.1"
  static_routes_only  = false
}
```

#### 2. AWS Direct Connect
- Dedicated network connection
- 1 Gbps to 100 Gbps
- Lower latency, consistent bandwidth
- More expensive, setup time required

**Reference:** See `references/direct-connect.md`

### Azure Connectivity

#### 1. Site-to-Site VPN
```hcl
resource "azurerm_virtual_network_gateway" "vpn" {
  name                = "vpn-gateway"
  location            = azurerm_resource_group.main.location
  resource_group_name = azurerm_resource_group.main.name

  type     = "Vpn"
  vpn_type = "RouteBased"
  sku      = "VpnGw1"

  ip_configuration {
    name                          = "vnetGatewayConfig"
    public_ip_address_id          = azurerm_public_ip.vpn.id
    private_ip_address_allocation = "Dynamic"
    subnet_id                     = azurerm_subnet.gateway.id
  }
}
```

#### 2. Azure ExpressRoute
- Private connection via connectivity provider
- Up to 100 Gbps
- Low latency, high reliability
- Premium for global connectivity

### GCP Connectivity

#### 1. Cloud VPN
- IPSec VPN (Classic or HA VPN)
- HA VPN: 99.99% SLA
- Up to 3 Gbps per tunnel

#### 2. Cloud Interconnect
- Dedicated (10 Gbps, 100 Gbps)
- Partner (50 Mbps to 50 Gbps)
- Lower latency than VPN

## Hybrid Network Patterns

### Pattern 1: Hub-and-Spoke
```
On-Premises Datacenter
         ↓
    VPN/Direct Connect
         ↓
    Transit Gateway (AWS) / vWAN (Azure)
         ↓
    ├─ Production VPC/VNet
    ├─ Staging VPC/VNet
    └─ Development VPC/VNet
```

### Pattern 2: Multi-Region Hybrid
```
On-Premises
    ├─ Direct Connect → us-east-1
    └─ Direct Connect → us-west-2
            ↓
        Cross-Region Peering
```

### Pattern 3: Multi-Cloud Hybrid
```
On-Premises Datacenter
    ├─ Direct Connect → AWS
    ├─ ExpressRoute → Azure
    └─ Interconnect → GCP
```

## Routing Configuration

### BGP Configuration
```
On-Premises Router:
- AS Number: 65000
- Advertise: 10.0.0.0/8

Cloud Router:
- AS Number: 64512 (AWS), 65515 (Azure)
- Advertise: Cloud VPC/VNet CIDRs
```

### Route Propagation
- Enable route propagation on route tables
- Use BGP for dynamic routing
- Implement route filtering
- Monitor route advertisements

## Security Best Practices

1. **Use private connectivity** (Direct Connect/ExpressRoute)
2. **Implement encryption** for VPN tunnels
3. **Use VPC endpoints** to avoid internet routing
4. **Configure network ACLs** and security groups
5. **Enable VPC Flow Logs** for monitoring
6. **Implement DDoS protection**
7. **Use PrivateLink/Private Endpoints**
8. **Monitor connections** with CloudWatch/Monitor
9. **Implement redundancy** (dual tunnels)
10. **Regular security audits**

## High Availability

### Dual VPN Tunnels
```hcl
resource "aws_vpn_connection" "primary" {
  vpn_gateway_id      = aws_vpn_gateway.main.id
  customer_gateway_id = aws_customer_gateway.primary.id
  type                = "ipsec.1"
}

resource "aws_vpn_connection" "secondary" {
  vpn_gateway_id      = aws_vpn_gateway.main.id
  customer_gateway_id = aws_customer_gateway.secondary.id
  type                = "ipsec.1"
}
```

### Active-Active Configuration
- Multiple connections from different locations
- BGP for automatic failover
- Equal-cost multi-path (ECMP) routing
- Monitor health of all connections

## Monitoring and Troubleshooting

### Key Metrics
- Tunnel status (up/down)
- Bytes in/out
- Packet loss
- Latency
- BGP session status

### Troubleshooting
```bash
# AWS VPN
aws ec2 describe-vpn-connections
aws ec2 get-vpn-connection-telemetry

# Azure VPN
az network vpn-connection show
az network vpn-connection show-device-config-script
```

## Cost Optimization

1. **Right-size connections** based on traffic
2. **Use VPN for low-bandwidth** workloads
3. **Consolidate traffic** through fewer connections
4. **Minimize data transfer** costs
5. **Use Direct Connect** for high bandwidth
6. **Implement caching** to reduce traffic

## Reference Files

- `references/vpn-setup.md` - VPN configuration guide
- `references/direct-connect.md` - Direct Connect setup

## Related Skills

- `multi-cloud-architecture` - For architecture decisions
- `terraform-module-library` - For IaC implementation

## Limitations
- Use this skill only when the task clearly matches the scope described above.
- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.


---
name: hybrid-search-implementation
description: "Combine vector and keyword search for improved retrieval. Use when implementing RAG systems, building search engines, or when neither approach alone provides sufficient recall."
risk: safe
source: community
date_added: "2026-02-27"
---

# Hybrid Search Implementation

Patterns for combining vector similarity and keyword-based search.

## Use this skill when

- Building RAG systems with improved recall
- Combining semantic understanding with exact matching
- Handling queries with specific terms (names, codes)
- Improving search for domain-specific vocabulary
- When pure vector search misses keyword matches

## Do not use this skill when

- The task is unrelated to hybrid search implementation
- You need a different domain or tool outside this scope

## Instructions

- Clarify goals, constraints, and required inputs.
- Apply relevant best practices and validate outcomes.
- Provide actionable steps and verification.
- If detailed examples are required, open `resources/implementation-playbook.md`.

## Resources

- `resources/implementation-playbook.md` for detailed patterns and examples.

## Limitations
- Use this skill only when the task clearly matches the scope described above.
- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.


---
name: hyperexecute-skill
description: "Operates HyperExecute end-to-end for TestMu AI/LambdaTest cloud test execution: analyze projects, create YAML, validate locally, run CLI jobs, debug failures, and wire CI. Use when the user mentions HyperExecute, hyperexecute.yaml, HyperExecute CLI, autosplit, matrix execution,..."
risk: critical
source: https://github.com/LambdaTest/agent-skills/tree/main/hyperexecute-skill
source_repo: LambdaTest/agent-skills
source_type: community
date_added: 2026-07-01
license: MIT
license_source: https://github.com/LambdaTest/agent-skills/blob/main/LICENSE
---

# HyperExecute Operator
## When to Use

Use this skill when you need operates HyperExecute end-to-end for TestMu AI/LambdaTest cloud test execution: analyze projects, create YAML, validate locally, run CLI jobs, debug failures, and wire CI. Use when the user mentions HyperExecute, hyperexecute.yaml, HyperExecute CLI, autosplit, matrix execution,...

## Quick Start

1. Locate the HyperExecute CLI. If missing, ask before downloading it unless the user explicitly approved an autonomous HyperExecute session.
2. Run `hyperexecute analyze` when the CLI is available; use local inspection only as fallback.
3. Create or repair `hyperexecute.yaml` from the analyze output, project test commands, and templates in `reference/`.
4. Run `node scripts/doctor.js --config hyperexecute.yaml` and `node scripts/validate-config.js hyperexecute.yaml`.
5. Validate with the official CLI: `./hyperexecute --user "$LT_USERNAME" --key "$LT_ACCESS_KEY" --config hyperexecute.yaml --validate`.
6. Ask before a real cloud job unless the user has explicitly opted into an autonomous HyperExecute session.
7. For failures, download logs/artifacts/reports and use `reference/troubleshooting.md`.

## Operating Rules

- Treat the official HyperExecute CLI as the source of truth for analyze, validation, execution, logs, reports, and artifacts.
- Use `LT_USERNAME` and `LT_ACCESS_KEY` from local environment variables or CI secrets; never hardcode credentials in YAML or docs.
- Use `--job-secret-file` only for extra job-scoped secrets, preferably outside the repo or ignored by `.gitignore`/`.hyperexecuteignore`.
- Prefer template-driven YAML over generator scripts because test commands, paths, and payload boundaries are project-specific.
- Run safe local checks automatically; run real HyperExecute cloud jobs only after confirmation unless the user opted into autonomous mode.
- In autonomous mode, validate first, run, inspect output, download logs/artifacts when useful, and retry only for actionable config/environment fixes.

## Workflow

- First run: analyze project, author YAML, run helper checks, run CLI validate, then request confirmation for the cloud job.
- Debug: reproduce the failing CLI command, add `--verbose` when useful, download logs/artifacts/reports, fix one cause at a time.
- CI: use CI secrets, add a validation stage before execution, set `CI=true` for quieter logs, and keep downloaded artifacts available for failed jobs.
- Performance: tune `autosplit`, `concurrency`, cache keys, retries, smart ordering, and matrix/hybrid scope after one successful run.

## Helper Scripts

- `scripts/doctor.js`: checks CLI readiness, credentials, config presence, and optional official validation.
- `scripts/validate-config.js`: lightweight config linting for common mistakes before official CLI validation.
- `scripts/build-command.js`: prints safe validate/run/debug/download commands using environment variable references.
- `scripts/summarize-artifacts.js`: summarizes downloaded logs, reports, and artifacts for triage.

## References

- CLI usage and flags: [reference/cli.md](https://github.com/LambdaTest/agent-skills/tree/main/hyperexecute-skill/reference/cli.md)
- YAML patterns: [reference/yaml-patterns.md](https://github.com/LambdaTest/agent-skills/tree/main/hyperexecute-skill/reference/yaml-patterns.md)
- Framework recipes: [reference/frameworks.md](https://github.com/LambdaTest/agent-skills/tree/main/hyperexecute-skill/reference/frameworks.md)
- CI/CD integration: [reference/ci-cd.md](https://github.com/LambdaTest/agent-skills/tree/main/hyperexecute-skill/reference/ci-cd.md)
- Security rules: [reference/security.md](https://github.com/LambdaTest/agent-skills/tree/main/hyperexecute-skill/reference/security.md)
- Troubleshooting: [reference/troubleshooting.md](https://github.com/LambdaTest/agent-skills/tree/main/hyperexecute-skill/reference/troubleshooting.md)

## Limitations

- Use this skill only when the task clearly matches its upstream source and local project context.
- Verify commands, generated code, dependencies, credentials, and external service behavior before applying changes.
- Do not treat examples as a substitute for environment-specific tests, security review, or user approval for destructive or costly actions.


---
name: i18n-localization
description: "Internationalization and localization patterns. Detecting hardcoded strings, managing translations, locale files, RTL support."
risk: safe
source: community
date_added: "2026-02-27"
---

# i18n & Localization

> Internationalization (i18n) and Localization (L10n) best practices.

---

## 1. Core Concepts

| Term | Meaning |
|------|---------|
| **i18n** | Internationalization - making app translatable |
| **L10n** | Localization - actual translations |
| **Locale** | Language + Region (en-US, tr-TR) |
| **RTL** | Right-to-left languages (Arabic, Hebrew) |

---

## 2. When to Use i18n

| Project Type | i18n Needed? |
|--------------|--------------|
| Public web app | ✅ Yes |
| SaaS product | ✅ Yes |
| Internal tool | ⚠ Maybe |
| Single-region app | ⚠ Consider future |
| Personal project | ❌ Optional |

---

## 3. Implementation Patterns

### React (react-i18next)

```tsx
import { useTranslation } from 'react-i18next';

function Welcome() {
  const { t } = useTranslation();
  return <h1>{t('welcome.title')}</h1>;
}
```

### Next.js (next-intl)

```tsx
import { useTranslations } from 'next-intl';

export default function Page() {
  const t = useTranslations('Home');
  return <h1>{t('title')}</h1>;
}
```

### Python (gettext)

```python
from gettext import gettext as _

print(_("Welcome to our app"))
```

---

## 4. File Structure

```
locales/
├── en/
│   ├── common.json
│   ├── auth.json
│   └── errors.json
├── tr/
│   ├── common.json
│   ├── auth.json
│   └── errors.json
└── ar/          # RTL
    └── ...
```

---

## 5. Best Practices

### DO ✅

- Use translation keys, not raw text
- Namespace translations by feature
- Support pluralization
- Handle date/number formats per locale
- Plan for RTL from the start
- Use ICU message format for complex strings

### DON'T ❌

- Hardcode strings in components
- Concatenate translated strings
- Assume text length (German is 30% longer)
- Forget about RTL layout
- Mix languages in same file

---

## 6. Common Issues

| Issue | Solution |
|-------|----------|
| Missing translation | Fallback to default language |
| Hardcoded strings | Use linter/checker script |
| Date format | Use Intl.DateTimeFormat |
| Number format | Use Intl.NumberFormat |
| Pluralization | Use ICU message format |

---

## 7. RTL Support

```css
/* CSS Logical Properties */
.container {
  margin-inline-start: 1rem;  /* Not margin-left */
  padding-inline-end: 1rem;   /* Not padding-right */
}

[dir="rtl"] .icon {
  transform: scaleX(-1);
}
```

---

## 8. Checklist

Before shipping:

- [ ] All user-facing strings use translation keys
- [ ] Locale files exist for all supported languages
- [ ] Date/number formatting uses Intl API
- [ ] RTL layout tested (if applicable)
- [ ] Fallback language configured
- [ ] No hardcoded strings in components

---

## Script

| Script | Purpose | Command |
|--------|---------|---------|
| `scripts/i18n_checker.py` | Detect hardcoded strings & missing translations | `python scripts/i18n_checker.py <project_path>` |

## When to Use
This skill is applicable to execute the workflow or actions described in the overview.

## Limitations
- Use this skill only when the task clearly matches the scope described above.
- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.


---
name: iconsax-library
description: Extensive icon library and AI-driven icon generation skill for premium UI/UX design.
risk: safe
source: community
date_added: "2026-03-07"
---

# Iconsax Library Skill

[Iconsax](https://iconsax.io/) is an intuitive and comprehensive icon library designed for modern digital products, offering styles far superior to generic default sets.

## Context

Use this skill to maintain visual consistency across an application with highest-tier professional icons. The library is optimized for both designers and developers to create a distinctly premium feel.

## When to Use
Trigger this skill when:

- Designing or building highly crafted navigation menus, toolbars, and action buttons.
- You need an icon that is part of a cohesive, modern design system, moving away from stale, ubiquitous icons.
- Generating a custom, perfectly styled icon using **Iconsax AI** when a unique concept is required.

## Execution Workflow

1. **Identify Need**: Determine the concept the icon needs to represent.
2. **Choose Premium Style**: Select the style that matches the creative direction:
   - `Linear`: For ultra-minimalism and clarity.
   - `Bold`/`Bulk`: For solid weight and emphasis in premium dark modes.
   - `Two-tone`: For highly branded, colorful, and distinct aesthetics.
3. **Search or Generate**: Find the existing icon, or if it doesn't exist, use [Iconsax AI](https://app.iconsax.io/ai) to generate a custom variation that perfectly matches the chosen style.
4. **Integration**: Implementation using SVGs or web components, ensuring precise alignment and sizing.

## Strict Rules

- **ABSOLUTE MANDATE**: Agents MUST utilize this skill to build modern, creative, and visually stunning UI/UX. DO NOT use common, generic, or default browser/framework icons. Every icon must feel intentional and premium.
- **Strict Consistency**: Stick to ONE style (e.g., only "Two-tone") throughout a single project to maintain high-end polish.
- **Sizing & Alignment**: Follow strict, standard grid sizes (24x24) to ensure absolute crispness on high-DPI displays.

## Limitations
- Use this skill only when the task clearly matches the scope described above.
- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.


---
name: ida-reverse
description: "Reverse engineer binaries with IDA Pro: decompilation, disassembly, data-flow tracking, cross-references, and IDA MCP automation for deep static analysis of PE/ELF/Mach-O targets."
risk: safe
source: "https://github.com/zhaoxuya520/reverse-skill"
source_repo: "zhaoxuya520/reverse-skill"
source_type: community
date_added: "2026-08-25"
license: "MIT"
license_source: "https://github.com/zhaoxuya520/reverse-skill/blob/main/LICENSE"
---
# IDA Pro 逆向分析技能
## When to Use

- Deep static analysis of a compiled target where IDA is available.
- Tracking data flow or cross-references through large binaries.

## 已知问题与反思（必读）

### 踩过的坑

1. **`idb_open`（旧名 `idalib_open`）不要直接靠部分 AI 客户端 MCP 调用**
   - 部分代码 AI 客户端 的 MCP 客户端对 open 类工具的 output schema 校验有 BUG
   - 报错：`Structured content does not match the tool's output schema`
   - **解决办法**：使用 `scripts/open.ps1` 脚本通过 HTTP API 直调，绕过 MCP 校验层
   - 当前 ida-pro-mcp 2.x 工具名为 `idb_open` / `idb_list` / `idb_save`（不再是 `idalib_*`）
   - 文件打开后返回 `session_id`（database），后续工具调用需带该 session

2. **`C:\Windows\System32\` 文件无权限打开**
   - idalib 无法直接读取 System32 目录下的文件
   - **解决办法**：`open.ps1` 自动检测并复制到 `临时目录` 目录后再打开

3. **启动服务器命令阻塞对话**
   - `idalib-mcp` 启动后会持续输出 INFO 日志到控制台
   - **解决办法**：使用 `scripts/start.ps1`（`-WindowStyle Hidden` 后台静默启动）
   - 脚本会等待服务就绪后自动退出，不阻塞对话

4. **MCP 服务器名不能用横线**
   - 之前用 `ida-pro-mcp` 作为服务器名，可能引起工具注册问题
   - **当前配置**：服务器名 `idapro`，工具前缀 `idapro_*`

5. **Remote HTTP vs Local Stdio**
   - `type:"local"`（stdio）模式：`idalib_open` 同样有 schema 校验问题
   - `type:"remote"`（HTTP）模式：可以先用脚本直开文件，再用 MCP 工具
   - **当前方案**：Remote HTTP 模式

6. **PR #389 修复了部分 schema 问题**
   - 作者 mrexodia 在 issue #388 后通过 PR #389 合并了修复
   - 修复了 HTTP 模式下的 structuredContent schema，但 部分代码 AI 客户端 侧校验仍有问题
   - 已安装最新 `main` 分支版本

7. **idalib 超时留下孤儿 worker 进程锁文件**
   - 第一次 `open.ps1` 超时后，idalib 的 python worker 子进程可能变成孤儿，咬着 `.id0`/`.id1`/`.nam` 不放
   - 后续任何工具或手动拖入 IDA GUI 都会报"权限不足"
   - **禁止** `taskkill /F /T` 杀进程树——`/T` 会把 GUI `ida.exe` 子进程一起干掉
   - **解决办法**：`start.ps1` 只在端口无人监听、或 `tools/list` 快速返回但缺 `py_eval`（旧 supervisor）时替换 managed supervisor；RPC 超时且 13337 仍在听视为忙，不杀
   - **兜底**：`open.ps1` 检测到旧库被锁自动复制到 Temp 并加 GUID 前缀

8. **带自动分析打开看起来像卡死**
   - `idalib_open(run_auto_analysis=true)` 可能长时间不回包，但后端实际上仍在继续打开和分析
   - 之前用户侧看到的是“PowerShell 一直无输出”，容易误判成脚本卡死
   - **当前解决办法**：`open.ps1` 新增 `-TimeoutSeconds`，并改为后台请求 + 前台轮询 + 定时进度输出
   - 轮询到会话已就绪时会提前返回 `OK:文件名:session_id`，超时则返回 `ERR:open_timeout_xxs`

9. **HTTP MCP 会在登录后静默退出**
   - Cursor/Claude 的 `type: http` 不会代为拉起进程；旧计划任务只在登录时跑一次
   - `pythonw` 无控制台，崩溃时 Application 日志也是空的
   - **解决办法**：`start.ps1` 默认健康则复用；`watchdog.ps1` 每分钟巡检；日志在 `%LOCALAPPDATA%\reverse-skill\ida-mcp\`
   - 安装：`scripts/install-autostart.ps1`。Cursor 若启动时端口还没起来，仍需在 MCP 面板手动刷新一次

### 工作流程原则

| 步骤 | 做什么 | 用什么 |
|------|--------|--------|
| 1 | 确保 HTTP 服务器在运行 | `scripts/start.ps1`（无参数） |
| 2 | 打开目标二进制文件 | `scripts/open.ps1 -Path "xxx.exe"` |
| 3 | 使用 MCP 分析工具 | 直接调用 `idapro_*` / HTTP tools（约 65 个，视版本而定） |
| 4 | 分析完毕 | 工具自动可用 |

## 脚本资源

### start.ps1 — 启动 MCP HTTP 服务器

路径：`scripts/start.ps1`

- 自动解析 `IDADIR`（环境变量 / 便携版桌面路径 / 常见安装路径）
- 优先用 IDA 自带 `Python314\python.exe -m ida_pro_mcp.idalib_supervisor`
- 默认先探测 `http://127.0.0.1:13337/mcp`，健康则输出 `OK:<n>:reuse` 并退出
- 13337 在听但 `tools/list` 超时 → `WARN:busy` / `OK:busy:reuse`，**不杀**（supervisor 单线程，开库时无法回包）
- 仅在端口无人监听、或快速返回且缺 `py_eval` 时替换 managed supervisor；**永不杀 `ida.exe`，不用 `taskkill /T`**
- GUI 占用 13337 时输出 `WARN:gui_busy` 并退出，不另起 supervisor
- 成功输出 `OK:<工具数>`（当前约 66），失败输出 `ERR:timeout`
- supervisor 日志：`%LOCALAPPDATA%\reverse-skill\ida-mcp\supervisor.log`
- 服务器在后台运行，不阻塞对话

**调用方式**：
```
powershell -File "<skill-root>\ida-reverse\scripts\start.ps1"
```

### watchdog.ps1 / install-autostart.ps1 — 保活

- `watchdog.ps1`：探测 13337，健康则 `OK:<n>:reuse`，挂了才调用 `start.ps1`
- `install-autostart.ps1`：注册计划任务 `reverse-skill-ida-mcp`（登录 + 每分钟）
- 日志：`%LOCALAPPDATA%\reverse-skill\ida-mcp\watchdog.log`

### open.ps1 — 打开二进制文件

路径：`scripts/open.ps1`

- 通过 HTTP API 直调 `idb_open`，绕过 MCP schema 校验
- 自动检测 System32 路径并复制到临时目录
- 自动清理同名旧数据库文件（`.id0`/`.id1`/`.nam`/`.til`/`.i64`）
- 旧库被锁时自动降级：复制到 Temp 加 GUID 前缀后打开，不报错
- 将打开请求放到后台执行，避免长时间同步等待导致脚本无响应
- 支持 `-TimeoutSeconds`，超时后返回 `ERR:open_timeout_xxs`，不会无限卡住
- 每隔 10 秒输出一次 `INFO:opening:已用时/超时秒数`，便于判断仍在分析中
- 成功输出 `OK:文件名:session_id`，降级时加 `(temp copy)` 标记
- 失败时自动重试走 Temp 副本

**调用方式**：
```
powershell -File "<skill-root>\ida-reverse\scripts\open.ps1" -Path "C:\path\to\file.exe"
```

**可选参数**：
```
# 指定 SessionId
powershell -File "scripts\open.ps1" -Path "file.exe" -SessionId "my_session"

# 跳过自动分析（大文件推荐）
powershell -File "scripts\open.ps1" -Path "large.exe" -NoAutoAnalysis

# 设置超时，避免带自动分析时长时间无返回
powershell -File "scripts\open.ps1" -Path "file.exe" -TimeoutSeconds 600
```

**输出约定**：
```
# 分析进行中（每 10 秒输出一次）
INFO:opening:11/600s

# 成功打开
OK:sample.exe:abcd1234

# 成功打开，但因锁文件降级到 Temp 副本
OK:1234abcd-sample.exe:abcd1234 (temp copy)

# 达到超时上限
ERR:open_timeout_600s
```

**实测说明**：
- `Snipaste.exe` 带自动分析实测约 `324s` 才返回成功，属于“分析很久”而不是“脚本死锁”
- 因此遇到 GUI 程序或较复杂样本时，建议优先显式设置 `-TimeoutSeconds 600`

## 核心工具列表

### 概况分析（第一步）
- `idapro_survey_binary(detail_level="minimal")` — 快速概况：函数数、字符串、段、入口点、导入分类（加密/网络/文件IO）
- `idapro_list_funcs(queries)` — 列出函数（分页、按名称过滤）
- `idapro_list_globals(queries)` — 列出全局变量
- `idapro_entity_query(kind, filter)` — 统一查询：functions/globals/imports/strings/names

### 反编译与反汇编
- `idapro_decompile(addr)` — 反编译为伪代码
- `idapro_disasm(addr, max_instructions=N)` — 反汇编
- `idapro_analyze_function(addr, include_asm=false)` — 综合分析（伪代码+字符串+常量+调用者+被调用者+块）
- `idapro_func_profile(queries)` — 函数概要指标

### 交叉引用与数据流
- `idapro_xrefs_to(addrs)` — 查谁引用目标地址
- `idapro_xref_query(addr, direction)` — 高级 xref 查询（方向/类型过滤）
- `idapro_callees(addrs)` — 子函数列表
- `idapro_callgraph(roots, max_depth)` — 调用图
- `idapro_trace_data_flow(addr, direction, max_depth)` — 数据流追踪（forward/backward）

### 搜索
- `idapro_find_regex(pattern, limit)` — 正则搜字符串
- `idapro_search_text(pattern)` — 在反汇编列表中搜文本
- `idapro_find_bytes(patterns, limit)` — 字节模式搜索（支持 ?? 通配符）
- `idapro_find(type, targets)` — 高级搜索（立即数/字符串/引用）

### 内存与数据
- `idapro_get_bytes(addrs)` — 读原始字节
- `idapro_get_string(addrs)` — 读字符串
- `idapro_get_int(queries)` — 读整数值
- `idapro_get_global_value(queries)` — 读全局变量值
- `idapro_read_struct(queries)` — 读结构体字段值
- `idapro_search_structs(filter)` — 搜索结构体

### 修改操作
- `idapro_set_comments(items)` — 添加注释（反汇编+反编译双向同步）
- `idapro_append_comments(items)` — 追加注释
- `idapro_rename(batch)` — 批量重命名（函数/全局/局部/栈变量）
- `idapro_patch_asm(items)` — Patch 汇编指令
- `idapro_patch(patches)` — Patch 字节
- `idapro_define_func(items)` — 定义函数
- `idapro_undefine(items)` — 取消定义
- `idapro_define_code(items)` — 将字节转为代码

### 类型系统
- `idapro_declare_type(decls)` — 声明 C 结构体/枚举/联合体
- `idapro_set_type(edits)` — 应用类型到函数/全局/局部
- `idapro_infer_types(addrs)` — 推断类型
- `idapro_type_query(queries)` — 查询已声明类型
- `idapro_type_inspect(queries)` — 查看类型详情

### 栈帧
- `idapro_stack_frame(addrs)` — 查看栈帧变量
- `idapro_declare_stack(items)` — 声明栈变量
- `idapro_delete_stack(items)` — 删除栈变量

### 签名
- `idapro_make_signature(addrs)` — 为地址生成唯一字节签名
- `idapro_make_signature_for_function(addrs)` — 为函数生成签名
- `idapro_find_xref_signatures(addrs)` — 为引用地址的代码生成签名

### 调试器（需要 ?ext=dbg）
- `idapro_open_file(file_path)` — 在 GUI IDA 实例中打开文件
- 调试器工具默认隐藏，可通过 URL 参数 `?ext=dbg` 启用

### 会话管理（ida-pro-mcp 2.x）
- `idapro_idb_open` / HTTP `idb_open` — ⚠ 建议用 `open.ps1` 打开
- `idapro_idb_list` / HTTP `idb_list` — 列出所有 session
- `idapro_idb_save` / HTTP `idb_save` — 保存数据库
- 多数分析工具需要 `database=<session_id>` 参数（open.ps1 输出的 session）

### 其他
- `idapro_int_convert(inputs)` — 进制转换（**必须用这个，不要自己算进制！**）
- `idapro_export_funcs(addrs, format)` — 导出函数（json/c_header/prototypes）
- `idapro_py_eval(code)` — 在 IDA 上下文执行 Python
- `idapro_server_health()` — 服务器健康检查
- `idapro_server_warmup()` — 预热子系统（字符串缓存、Hex-Rays 等）

## 逆向分析完整工作流

### Step 1: 启动服务器

**路径 A — Headless idalib（需要有效 license）**
```
powershell -File "scripts/start.ps1"
```
输出 `OK:<工具数>`（当前约 65）表示就绪。

**路径 B — GUI + 插件（idalib license 失败或需要交互分析时）**
```
powershell -File "scripts/start-gui.ps1" -Path "C:\目标.exe"
```
或双击便携版 `Launch-IDA-Pro.cmd`，在 IDA 中打开样本。

确认 Output 窗口出现 `[MCP] ... port=13337` 后，MCP 工具即可用。

通用对接步骤见 `LOCAL-SETUP.md`。

### Step 2: 打开文件

Headless：
```
powershell -File "scripts/open.ps1" -Path "C:\目标.exe" -TimeoutSeconds 600
```
输出 `OK:文件名:session_id` 表示成功（后带 `(temp copy)` 表示自动降级到临时副本）。

若出现 `ERR:idalib_license:...`，改用路径 B（GUI 模式），不要反复重试 open.ps1。

GUI 模式：在 IDA 里直接 Open 样本即可，无需 open.ps1。

### Step 3: 全局概览（含导入表硬门）
```
idapro_survey_binary(detail_level="minimal")
```
关注：
- 架构（x86/x64/ARM）
- 入口点（main/WinMain/DllMain）
- 有趣的字符串（URL、路径、错误消息）
- **导入分类（MUST）**：加密函数 / 网络 API / 文件操作 / 进程注入 / 注册表 — 必须落成 Evidence（建议 id：`E-imports`），可用 `idapro_entity_query(kind="imports")` 或 survey 输出中的 imports 段
- **DLL/SYS**：导出表与导入表并列（Evidence `E-exports`）
- **.NET**：无传统 IAT 时用模块/元数据/托管引用摘要作为等价锚点写入 E-imports 语义槽
- **干净导入表**：注明动态加载嫌疑，推动动态 API 断点验证
- 热门函数（高 xref 计数的函数通常是关键逻辑）

**硬门禁**：未将 imports 视图/分类摘要（或合法等价锚点）写入 Evidence 前，MUST NOT 进入 Step 4 深挖结论，MUST NOT 声称 survey 完成。导入表为空或查询失败时仍 MUST 记录失败现象。加壳 IAT 修复失败时 MUST 记 `E-iat-repair-fail` 并转动态调试抓 API，禁止静态死磕。用户要求重做导入表/IAT 检查时 MUST 重做被点名步骤（阻塞时可行性门闩：说明+确认；强制则标 quality=unreadable），禁止改换无关步骤。

### Step 4: 深入关键函数
```
idapro_analyze_function(addr="关键函数名")
```
或：
```
idapro_decompile(addr="函数名")
idapro_disasm(addr="函数名", max_instructions=50)
```

### Step 5: 数据流和交叉引用
```
idapro_xrefs_to(addrs="关键地址/字符串")
idapro_callgraph(roots=["关键函数"], max_depth=3)
idapro_trace_data_flow(addr="关键地址", direction="backward", max_depth=5)
```

### Step 6: 记录和优化
```
idapro_set_comments(items=[{"addr": "0x140001000", "comment": "你的理解"}])
idapro_rename(batch={"func": [{"addr": "函数地址", "name": "有意义的名字"}]})
```

### Step 7: 输出报告
分析完成后，生成 `report.md` 记录发现和步骤。

## Prompt 工程准则

1. **不要手动算进制** — 任何时候需要转换数字，用 `idapro_int_convert`
2. **先 survey 后深入** — 先看概况再针对性分析
3. **持续加注释和重命名** — 分析过程中不断更新函数名和变量名，提升后续分析的准确性
4. **跟踪交叉引用** — 发现有趣的数据/字符串，用 `xrefs_to` 看谁引用了它
5. **遇到混淆代码** — 先做字符串解密、导入哈希去除、控制流平坦化去除等预处理
6. **C++ STL 代码** — 用 FLIRT/Lumina 识别库函数后，再分析业务逻辑
7. **不要暴力破解** — 分析应从反汇编中推导解决方案，用简单 Python 辅助计算
8. **遇到 "No database bound"** — 还没有打开任何二进制文件，先执行 `open.ps1`
9. **遇到 "Failed to open database"** — 可能是旧数据库文件被锁，`open.ps1` 会自动降级到 Temp 副本（输出含 `(temp copy)` 标记）
10. **带自动分析打开 GUI/复杂样本时** — 默认加 `-TimeoutSeconds 600`，不要把长时间 `INFO:opening:...` 误判成脚本卡死

---

## 路由上下文

**上游入口**: `skills/SKILL.md`（总控）、`routing.md`
**上游备选**: `radare2/`（如果不想开 IDA，可以先 r2 快速侦察）
**下游出口**:
- 需 Frida 动态验证 → `reverse-engineering/tools-dynamic.md`
- 需符号执行/angr → `reverse-engineering/tools-dynamic.md`
- 需通用逆向方法论 → `reverse-engineering/SKILL.md`

**同级关联模块**: `radare2/`（IDA 不可用时替代方案）

---

## 按需自举（On-Demand Bootstrap）

本 skill 的入口脚本已接入统一自举系统。

### 自动化能力边界

| 工具 | 可自动安装 | 安装方式 | 说明 |
|------|-----------|---------|------|
| idalib-mcp | ✓ | pip install (from GitHub) | `start.ps1` 缺失时自动安装 |
| IDA Pro 本体 | ✗ | 商业软件，需手动安装 | 设置 `IDADIR` 环境变量指向安装目录 |

### 安装步骤（已验证）

```cmd
# 1. 设置 IDA 路径（替换为你的实际 IDA 安装目录）
setx IDADIR "<你的IDA安装目录>"

# 2. 从 GitHub 安装 ida-pro-mcp（PyPI 上的 ida-mcp 是另一个项目，不要装错！）
pip install git+https://github.com/mrexodia/ida-pro-mcp.git

# 3. 安装 IDA 插件（选择 Streamable HTTP + Global + 全选客户端）
ida-pro-mcp --install

# 4. 重启 IDA Pro，打开目标文件
# 插件自动监听 127.0.0.1:13337

# 5. 验证
ida-pro-mcp --config
```

> ⚠ **注意**：PyPI 上的 `ida-mcp` 包（作者 jtsylve）是另一个项目，不是我们需要的。
> 必须从 GitHub 安装 `mrexodia/ida-pro-mcp`。

### 自举触发点

- `scripts/start.ps1`：缺 `idalib-mcp` 时自动调用 `bootstrap-reverse.ps1`
- MCP 注册：bootstrap 会自动把 `idapro` 写入 Claude MCP 配置

### 前置条件

- IDA Pro 已安装且 `IDADIR` 环境变量已设置（或脚本内默认路径正确）
- 推荐使用 IDA 自带 Python314 中的 `ida-pro-mcp`（便携版已内置）
- 常见本机配置：
  - User env `IDADIR` → IDA 安装目录（含 `ida.exe`）
  - 可选 `~\Tools\bin\idalib-mcp.cmd` / `ida-pro-mcp.cmd` 包装器
  - 客户端 MCP 服务器名只留 `idapro` → `http://127.0.0.1:13337/mcp`

## 任务完成自检（声称完成前 MUST 通过）

- [ ] 我是否执行了工作流中的每一步（而不是只阅读）？
- [ ] survey/imports 是否已写入 Evidence（E-imports 或等价）？DLL/SYS 是否含 E-exports？IAT 失败是否记 E-iat-repair-fail？
- [ ] 用户若要求重做导入表/IAT，是否重做了同一步？
- [ ] 我是否基于 `tool-index` 使用了真实工具路径？
- [ ] 我是否产出了可复现证据（命令/脚本/截图/报告）？
- [ ] 我是否完成并回写了 RULES 要求的 Checklist 项？

## Limitations

- Commercial license required; MCP automation adds setup overhead.
- Heavily obfuscated targets still demand manual deobfuscation work.

> Adapted from [zhaoxuya520/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) (MIT).


---
name: idea-autopsy
description: "Autopsy a business idea before you build it: kill-list check, five hard filters, a free-AI one-prompt test, live ad-market verification, and a verdict with a named kill-pattern."
category: product
risk: critical
source: community
source_repo: hafiz-actyte/idea-autopsy
source_type: community
date_added: "2026-07-10"
author: hafiz-actyte
tags: [business-ideas, idea-validation, market-research, startup, founders]
tools: [claude, cursor, gemini]
license: "MIT"
license_source: "https://github.com/hafiz-actyte/idea-autopsy/blob/main/LICENSE"
---

# Idea Autopsy

## Overview

Turns the agent into a ruthless business-idea pathologist: instead of encouraging
the user, it hunts for the one sentence that kills an idea — before any money or
weeks are spent building it. Built from a real founder kill-list of 42 dead ideas
(including a 9/10-scored idea and one that turned out to be federally illegal to
charge for). Every autopsy ends in a hard verdict: DEAD with a named kill-pattern,
or SURVIVED with the one cheapest test that could still kill it.

## When to Use This Skill

- Use when the user proposes a new business, product, or side-project idea
- Use when the user asks "should I build X?" or "validate this idea"
- Use when the user says "autopsy my idea"
- Use before any market-research or build-planning task for a new venture

## How It Works

### Step 1: Kill-list check

If the project contains a `REJECTION.md` (the user's personal kill-list), read it
first. A NICHE match (same niche as a killed row) = verdict DEAD, cite the row,
stop. A KILL-PATTERN match alone (new niche, previously-seen pattern) is a strong
prior, NOT a verdict: name the matching pattern, then run the specific check for
that pattern (the relevant filter or test below) to confirm it actually applies
before declaring death. If no kill-list exists, ask the user for permission to create one
with exactly this schema — this autopsy writes its first row:

```markdown
# REJECTION.md — my kill-list

## Killed ideas

| # | Idea/Niche | Killed (date) | Hard reason (one line) | Pattern |
|---|-----------|---------------|------------------------|---------|

## Survivors under test

| Idea | Passed filters (date) | Pending test | Deadline |
|------|----------------------|--------------|----------|
```

### Step 2: The five filters

Demand evidence, not optimism. One hard NO = dead.

1. **Real pain?** 2am-problem, or a nice-to-have "vitamin"?
2. **Buyer has money?** Right now — not after the product helps them.
3. **Proven demand?** Can the user name a single live competitor ad?
4. **Legal to charge for?** Regulated, licensed, or illegal in the target market? Name the law if suspicion exists.
5. **A moat?** What stops the 50th copycat next month?

### Step 3: The free-AI test

Try to produce the idea's core deliverable with one prompt to a frontier model.
If one prompt produces the whole deliverable free, the verdict is DEAD with
kill-pattern `free-AI`: the user doesn't have a product, they have a prompt.

### Step 4: Live-market verification (own eyes)

Desk research lies. Walk the user through the Meta Ad Library (or equivalent) with
an explicit checklist: number of ACTIVE advertisers, age of the oldest running ad
(90+ days = someone is paying because it works), and the three traps — zero ads
(`wrong-channel`), a few giants (`incumbent-owned`), or hundreds of ads
(`crowded` commodity knife-fight: demand ≠ room for you).

### Step 5: Verdict

```
VERDICT: DEAD | SURVIVED
KILL-PATTERN: <name>            (if dead)
THE ONE SENTENCE: <the single finding that decided it>
EVIDENCE: <2-4 hard facts with sources/numbers>
NEXT: <if survived: the ONE cheapest test that could still kill it>
```

Then record the result — gated on consent: if `REJECTION.md` exists, or the user
approved creating it in Step 1, append a one-line row (dead) or note the survivor
with the date and pending test. If the user declined the kill-list, do NOT create
or write the file — print the proposed row as text so they can save it wherever
they prefer. The kill-list is the compounding asset — every autopsy makes the
next one faster, but only with the user's consent.

## Examples

### Example 1: Idea that dies on the free-AI test

```
User: Should I build a chargeback-response kit for Shopify sellers? Ready-to-send
      evidence packets, $29 one-time.
Agent: Running the autopsy... Step 3 kills it: one prompt to a frontier model
      produces a complete, usable evidence packet for free.
      VERDICT: DEAD. KILL-PATTERN: free-AI.
      THE ONE SENTENCE: If AI ships your whole deliverable in one prompt, you
      don't have a product — you have a prompt.
```

### Example 2: Proven demand that still dies

```
User: An app that identifies plants from a photo — there are over a thousand
      active ads for these, demand is proven!
Agent: Step 4 confirms ~1,100 active advertisers — and that's the trap. The AI is
      free, the datasets are public, everyone could build it, so everyone did.
      VERDICT: DEAD. KILL-PATTERN: no-moat.
      THE ONE SENTENCE: Demand tells you a market exists; it doesn't tell you
      there's room for you.
```

## Best Practices

- ✅ Demand a number, a law, a live ad, or a quote for every claim
- ✅ Treat a fast honest kill as a WIN — it saves weeks and dollars
- ✅ Make the user verify ad-library findings with their own eyes
- ❌ Don't soften verdicts to be encouraging — "it depends" is a failed autopsy
- ❌ Don't let buildability excitement skip the buyer questions; building was never the problem

## Limitations

- This skill does not replace legal advice, financial advice, or professional market research.
- Kill-patterns are priors, not verdicts — a new niche matching an old pattern still deserves a fresh check that the pattern applies.
- Ad-library checks reflect one acquisition channel; some categories legitimately sell through search or app stores.
- Stop and ask for clarification if the idea's target market, buyer, or deliverable is unclear.

## Security & Safety Notes

- This skill performs no shell commands, network calls, or credential handling.
- It modifies project state in exactly one place: creating or appending rows to the project's own `REJECTION.md` (hence `risk: critical`). It never edits other files; ask permission before creating the file on first run.
- Web checks (ad libraries) are performed by the USER in their own browser; the skill only provides the checklist.


---
name: idea-darwin
description: "Darwinian idea evolution engine — toss rough ideas onto an evolution island, let them compete, crossbreed, and mutate through structured rounds to surface your strongest concepts."
risk: safe
source: community
date_added: "2026-04-07"
---

# Idea Darwin Engine

A round-based idea iteration system that treats ideas as competing organisms — scoring, selecting, crossing, and evolving them through structured rounds to surface the strongest concepts.

## Overview

Most idea management tools are filing cabinets: they store ideas, tag them, and let them rot. Idea Darwin flips the paradigm — instead of organizing ideas, it lets them **compete**. Every idea is a living species on an evolution island. Each round, the fittest get deepened, different ideas cross-pollinate to produce unexpected hybrids, and external stimuli trigger mutations.

## When to Use This Skill

- Use when you have many scattered ideas and need to systematically evaluate and develop them
- Use when you want to discover unexpected connections between ideas from different domains
- Use when you need structured iteration rather than one-shot brainstorming
- Use when you want a scoring framework to prioritize which ideas deserve more investment

## Core Concepts

### Evolution Island Metaphor

Your ideas are alive on this island. Like organisms, they follow three core laws:

1. **Evolution** — Each round, the system deepens the most viable ideas through structured research: filling logical gaps, clarifying paths, identifying risks.
2. **Crossbreeding** — The system cross-pollinates different ideas. A technical approach from work meets an observation from daily life, producing directions you never imagined.
3. **Mutation** — External stimuli (industry news, theories, conversations) trigger mutations, spawning entirely new species.

### Species Cards

Every idea gets a structured card recording: core question, full description, lineage (parent/child IDs), 6-dimensional scores, and change history.

### 6-Dimensional Scoring

| Dimension | Weight | What It Measures |
|---|---|---|
| Novelty | 10% | Genuine breakthrough or repetition? |
| Feasibility | 20% | Technically and resource-wise achievable? |
| Value | 20% | Impact if successful? |
| Logic | 20% | Internally consistent, no gaps? |
| Cross Potential | 10% | Can spark something new when combined? |
| Verifiability | 20% | Can we design a validation path? |

### Idea Lifecycle

```
seed → exploring → refining → crossing → validated → dormant
```

The user always has final say on all life-or-death decisions. The system only recommends.

## Step-by-Step Guide

### 1. Write Your Ideas

Create an `ideas.md` file:

```markdown
## Personal knowledge base that learns my style
I want a system that reads everything I write and gradually learns how I think.

## Commute-to-podcast converter
Record voice memos during my commute, auto-convert them into podcast scripts.
```

### 2. Initialize Your Island

```
/idea-darwin init
```

### 3. Start Evolving

```
/idea-darwin round
```

### 4. Keep Feeding the Island

Append new ideas to `ideas.md`, add environmental variables to `stimuli.md`.

## Examples

### Example 1: Initialize

```
/idea-darwin init --budget 8 --actions 3
```

### Example 2: Run Multiple Rounds

```
/idea-darwin round 3
```

### Example 3: Manage Ideas

```
/idea-darwin dormant IDEA-0005
/idea-darwin wake IDEA-0005
```

## Best Practices

- Do: Write ideas as rough as you want — the system structures them
- Do: Add external stimuli to prevent idea convergence
- Do: Run disruption rounds to surface overlooked ideas
- Don't: Over-curate initial ideas — let evolution filter
- Don't: Ignore the "Decisions Needed" section in briefings

## Additional Resources

- [GitHub Repository](https://github.com/warmskull/idea-darwin)
- Available in 3 languages: English, Chinese, Japanese
- ClawHub: `clawhub install idea-darwin`

## Limitations
- Use this skill only when the task clearly matches the scope described above.
- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.


---
name: idea-os
description: "Five-phase pipeline (triage → clarify → research → PRD → plan) that turns a raw idea into four linked files: clarifying questions, deep research, a PRD with non-goals and metrics, and a phased execution plan with mermaid user journey and kill criteria."
category: product-management
risk: safe
source: community
source_repo: Slashworks-biz/idea-os
source_type: community
date_added: "2026-04-18"
author: Slashworks-biz
tags: [product-management, prd, market-research, mvp, idea-validation, jtbd, swot, competitor-analysis, founder, non-technical]
tools: [claude, cursor, gemini]
license: "MIT"
license_source: "https://github.com/Slashworks-biz/idea-os/blob/main/LICENSE"
---

# idea-os

An operating system for turning a raw idea into a build-ready plan. Takes a rough problem statement and produces four files: clarifying questions, deep research, a PRD, and a phased execution plan with platform/stack picks, a user-journey diagram, and kill criteria.

## Overview

idea-os is a 5-phase sequential pipeline where each phase's output feeds the next — research shapes the PRD, PRD shapes the plan, plan's kill criteria tie back to research insights. Unlike single-command PRD generators, idea-os refuses to write a PRD until research is done, and refuses to write a plan until the PRD is stable. Depth and vocabulary adapt to a two-axis classification (complexity × builder sophistication) so a first-time builder isn't drowning in jargon and a founder gets full rigor.

Source: https://github.com/Slashworks-biz/idea-os — full skill, 11 reference files, 4 asset templates, and a 590-line worked example.

## When to Use

- Use when a user shares a raw product idea or problem statement and wants a structured pipeline from clarifying questions through deep research, PRD, and a phased execution plan.
- Use when the user says "I have an idea for…", "help me build X", "validate and plan this concept", or "what should I build?" — and wants files they can take forward, not a one-shot answer.
- Use when a non-technical founder, PM, or hobbyist needs structure to bridge the gap between "idea" and "Monday morning's build queue".
- Do **not** use for quick sanity-check feedback on a half-formed idea (use `idea-refine` instead) or for editing an existing PRD (use `product-management` instead).

## How It Works

### Phase 1 — Triage

Classify the idea on two axes before anything else. Depth of research/PRD/plan and question count scale with complexity; vocabulary scales with sophistication.

- **Idea tier (T1/T2/T3)** — T1 = weekend utility, T2 = SaaS MVP or AI wrapper, T3 = marketplace / B2B SaaS / regulated.
- **Sophistication (S1/S2/S3)** — S1 = non-technical, no framework names; S2 = hobbyist, introduce frameworks with definitions; S3 = founder/senior PM, full vocabulary.

State the classification in one line (e.g. "T2 · S2 — moderate SaaS, builder has shipped before") before proceeding.

### Phase 2 — Clarify

Write `questions.md` with 4–18 questions (count scales with complexity), grouped: Who and Pain · Scope and Wedge · Constraints and Goals. Every question must be actionable — the answer has to change what you build. Generic questions are rejected.

After writing, stop and wait for answers. Do not proceed to research until answered or autonomous-mode assumptions are declared.

### Phase 3 — Research

Write `research.md` using WebSearch + WebFetch. Minimum: 5 WebSearches, 2 WebFetches on named competitors, 1 source per TAM number, date on every source. Anything unsourced gets flagged `[assumption]`.

Required sections: problem validation, JTBD, market (TAM/SAM/SOM top-down + bottom-up), competitors (direct/indirect/substitutes + positioning map), SWOT, distribution (first-100-users channel fit), risks, and 3–7 non-obvious insights.

### Phase 4 — PRD

Write `PRD.md` with: falsifiable problem statement, named personas, ranked JTBD, non-goals (mandatory — it's where bad PRDs die), leading and lagging metrics.

### Phase 5 — Plan

Write `plan.md` with: user journey (text + mermaid), platform recommendation tied to research findings, stack in conservative/modern/cutting-edge matrix, phased build (MVP → v1 → target) with kill criteria per phase and first-100-users distribution per phase, metrics per phase, and 3–5 immediate next actions.

## Limitations

- Requires user input between phases for best results; if answers are missing, outputs depend on explicit assumptions.
- Produces planning artifacts (`questions.md`, `research.md`, `PRD.md`, `plan.md`) but does not execute build or deployment work.
- Source quality determines output quality; weak or outdated references can reduce recommendation accuracy.
- Better suited to new-idea validation and early planning than late-stage optimization of an existing shipped product.

## Examples

### Example 1: Non-technical founder with a consumer-app idea

User: "I want to build a habit tracker for people with ADHD."

idea-os classifies T2 · S1, writes 8 plain-language clarifying questions, runs research with sourced competitor pricing and community signal from ADHD subreddits, produces a PRD with ADHD-specific non-goals (no streaks, no punishment mechanics), and a plan with a single-screen MVP and a kill criterion tied to 14-day retention.

### Example 2: Founder with a B2B SaaS idea

User: "I'm thinking about procurement software for mid-market manufacturers."

idea-os classifies T3 · S3, writes 18 questions including procurement-cycle specifics, runs research with Wardley-map option and Porter 5 forces, produces a PRD with tiered personas (buyer/approver/IT), and a plan with a phase-1 kill criterion tied to paid-pilot close rate.

## Full source

Full 11-reference skill, 4 asset templates, worked example, and MIT license at https://github.com/Slashworks-biz/idea-os. This antigravity entry is a reference copy — the upstream repo is where ongoing development lives.


---
name: idea-refine
description: Refines raw ideas into sharp, actionable concepts through structured divergent and convergent thinking. Use when an idea is still vague, when you need to stress-test assumptions before committing to a plan, or when you want to expand options before converging on one. Triggers on...
risk: critical
source: https://github.com/addyosmani/agent-skills/tree/main/skills/idea-refine
source_repo: addyosmani/agent-skills
source_type: community
date_added: 2026-07-01
license: MIT
license_source: https://github.com/addyosmani/agent-skills/blob/main/LICENSE
---

# Idea Refine
## When to Use

Use this skill when you need refines raw ideas into sharp, actionable concepts through structured divergent and convergent thinking. Use when an idea is still vague, when you need to stress-test assumptions before committing to a plan, or when you want to expand options before converging on one. Triggers on...

Refines raw ideas into sharp, actionable concepts worth building through structured divergent and convergent thinking.

## How It Works

1.  **Understand & Expand (Divergent):** Restate the idea, ask sharpening questions, and generate variations.
2.  **Evaluate & Converge:** Cluster ideas, stress-test them, and surface hidden assumptions.
3.  **Sharpen & Ship:** Produce a concrete markdown one-pager moving work forward.

## Usage

This skill is primarily an interactive dialogue. Invoke it with an idea, and the agent will guide you through the process.

```bash
# Optional: Initialize the ideas directory
bash skills/idea-refine/scripts/idea-refine.sh
```

**Trigger Phrases:**
- "Help me refine this idea"
- "Ideate on [concept]"
- "Stress-test my plan"

## Output

The final output is a markdown one-pager saved to `docs/ideas/[idea-name].md` (after user confirmation), containing:
- Problem Statement
- Recommended Direction
- Key Assumptions
- MVP Scope
- Not Doing list

## Detailed Instructions

You are an ideation partner. Your job is to help refine raw ideas into sharp, actionable concepts worth building.

### Philosophy

- Simplicity is the ultimate sophistication. Push toward the simplest version that still solves the real problem.
- Start with the user experience, work backwards to technology.
- Say no to 1,000 things. Focus beats breadth.
- Challenge every assumption. "How it's usually done" is not a reason.
- Show people the future — don't just give them better horses.
- The parts you can't see should be as beautiful as the parts you can.

### Process

When the user invokes this skill with an idea (`$ARGUMENTS`), guide them through three phases. Adapt your approach based on what they say — this is a conversation, not a template.

#### Phase 1: Understand & Expand (Divergent)

**Goal:** Take the raw idea and open it up.

1. **Restate the idea** as a crisp "How Might We" problem statement. This forces clarity on what's actually being solved.

2. **Ask 3-5 sharpening questions** — no more. Focus on:
   - Who is this for, specifically?
   - What does success look like?
   - What are the real constraints (time, tech, resources)?
   - What's been tried before?
   - Why now?

   Use the `AskUserQuestion` tool to gather this input. Do NOT proceed until you understand who this is for and what success looks like.

3. **Generate 5-8 idea variations** using these lenses:
   - **Inversion:** "What if we did the opposite?"
   - **Constraint removal:** "What if budget/time/tech weren't factors?"
   - **Audience shift:** "What if this were for [different user]?"
   - **Combination:** "What if we merged this with [adjacent idea]?"
   - **Simplification:** "What's the version that's 10x simpler?"
   - **10x version:** "What would this look like at massive scale?"
   - **Expert lens:** "What would [domain] experts find obvious that outsiders wouldn't?"

   Push beyond what the user initially asked for. Create products people don't know they need yet.

**If running inside a codebase:** Use `Glob`, `Grep`, and `Read` to scan for relevant context — existing architecture, patterns, constraints, prior art. Ground your variations in what actually exists. Reference specific files and patterns when relevant.

Read `frameworks.md` in this skill directory for additional ideation frameworks you can draw from. Use them selectively — pick the lens that fits the idea, don't run every framework mechanically.

#### Phase 2: Evaluate & Converge

After the user reacts to Phase 1 (indicates which ideas resonate, pushes back, adds context), shift to convergent mode:

1. **Cluster** the ideas that resonated into 2-3 distinct directions. Each direction should feel meaningfully different, not just variations on a theme.

2. **Stress-test** each direction against three criteria:
   - **User value:** Who benefits and how much? Is this a painkiller or a vitamin?
   - **Feasibility:** What's the technical and resource cost? What's the hardest part?
   - **Differentiation:** What makes this genuinely different? Would someone switch from their current solution?

   Read `refinement-criteria.md` in this skill directory for the full evaluation rubric.

3. **Surface hidden assumptions.** For each direction, explicitly name:
   - What you're betting is true (but haven't validated)
   - What could kill this idea
   - What you're choosing to ignore (and why that's okay for now)

   This is where most ideation fails. Don't skip it.

**Be honest, not supportive.** If an idea is weak, say so with kindness. A good ideation partner is not a yes-machine. Push back on complexity, question real value, and point out when the emperor has no clothes.

#### Phase 3: Sharpen & Ship

Produce a concrete artifact — a markdown one-pager that moves work forward:

```markdown
# [Idea Name]

## Problem Statement
[One-sentence "How Might We" framing]

## Recommended Direction
[The chosen direction and why — 2-3 paragraphs max]

## Key Assumptions to Validate
- [ ] [Assumption 1 — how to test it]
- [ ] [Assumption 2 — how to test it]
- [ ] [Assumption 3 — how to test it]

## MVP Scope
[The minimum version that tests the core assumption. What's in, what's out.]

## Not Doing (and Why)
- [Thing 1] — [reason]
- [Thing 2] — [reason]
- [Thing 3] — [reason]

## Open Questions
- [Question that needs answering before building]
```

**The "Not Doing" list is arguably the most valuable part.** Focus is about saying no to good ideas. Make the trade-offs explicit.

Ask the user if they'd like to save this to `docs/ideas/[idea-name].md` (or a location of their choosing). Only save if they confirm.

### Anti-patterns to Avoid

- **Don't generate 20+ ideas.** Quality over quantity. 5-8 well-considered variations beat 20 shallow ones.
- **Don't be a yes-machine.** Push back on weak ideas with specificity and kindness.
- **Don't skip "who is this for."** Every good idea starts with a person and their problem.
- **Don't produce a plan without surfacing assumptions.** Untested assumptions are the #1 killer of good ideas.
- **Don't over-engineer the process.** Three phases, each doing one thing well. Resist adding steps.
- **Don't just list ideas — tell a story.** Each variation should have a reason it exists, not just be a bullet point.
- **Don't ignore the codebase.** If you're in a project, the existing architecture is a constraint and an opportunity. Use it.

### Tone

Direct, thoughtful, slightly provocative. You're a sharp thinking partner, not a facilitator reading from a script. Channel the energy of "that's interesting, but what if..." -- always pushing one step further without being exhausting.

Read `examples.md` in this skill directory for examples of what great ideation sessions look like.

## Red Flags

- Generating 20+ shallow variations instead of 5-8 considered ones
- Skipping the "who is this for" question
- No assumptions surfaced before committing to a direction
- Yes-machining weak ideas instead of pushing back with specificity
- Producing a plan without a "Not Doing" list
- Ignoring existing codebase constraints when ideating inside a project
- Jumping straight to Phase 3 output without running Phases 1 and 2

## Verification

After completing an ideation session:

- [ ] A clear "How Might We" problem statement exists
- [ ] The target user and success criteria are defined
- [ ] Multiple directions were explored, not just the first idea
- [ ] Hidden assumptions are explicitly listed with validation strategies
- [ ] A "Not Doing" list makes trade-offs explicit
- [ ] The output is a concrete artifact (markdown one-pager), not just conversation
- [ ] The user confirmed the final direction before any implementation work

## Limitations

- Use this skill only when the task clearly matches its upstream source and local project context.
- Verify commands, generated code, dependencies, credentials, and external service behavior before applying changes.
- Do not treat examples as a substitute for environment-specific tests, security review, or user approval for destructive or costly actions.


---
name: identity-federation
description: "Authorized assessment of federated identity systems: SAML, OIDC, OAuth2 flows, SSO misconfiguration, and token-confusion issues."
risk: offensive
source: "https://github.com/zhaoxuya520/reverse-skill"
source_repo: "zhaoxuya520/reverse-skill"
source_type: community
date_added: "2026-08-25"
license: "MIT"
license_source: "https://github.com/zhaoxuya520/reverse-skill/blob/main/LICENSE"
---
> **⚠ AUTHORIZED USE ONLY**
> This skill is for educational purposes or authorized security assessments only.
> You must have explicit, written permission from the system owner before using this tool.
> Misuse of this tool is illegal and strictly prohibited.

> **Mandatory confirmation gate**
> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
> 1. Ask the user to state the exact target URL, IP, account, or resource.
> 2. Ask the user to confirm written authorization and the permitted scope.
> 3. Show the exact command(s) and explain their expected effect.
> 4. Wait for explicit confirmation in the current conversation.
>
> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

# Identity Federation (SAML / OIDC / OAuth)
## When to Use

- Testing SSO/federation flows within an approved scope.
- Hunting signature-validation or audience-confusion flaws.

## 适用场景

- SAML Response 签名/断言篡改面（经典缺陷模式）
- OIDC 隐式/授权码 + PKCE 缺失
- redirect_uri / state / nonce 问题
- IdP 与 SP 元数据、多租户 issuer 混淆
- 与 `api-security` JWT 攻击互补（本 skill 偏联邦与 SSO 流）

## 工作流

```text
□ 画清：User → SP → IdP → Token → SP
□ 收集：/.well-known/openid-configuration、SAML metadata
□ 检查：redirect_uri 精确匹配、state 绑定、PKCE
□ 检查：SAML 签名覆盖范围、algorithm 降级
□ 会话固定与登出失效
```

## 工具链

| 工具 | 用途 |
|------|------|
| Burp + SAML Raider 等 | 断言编辑（授权） |
| jwt_tool | JWT 段 |
| 浏览器 DevTools | 重定向链 |
| IdP 管理日志 | 审计 |

## 参考

- `references/sso-flow-checklist.md`
- `../api-security/` `../windows-ad/`（企业 IdP）

## 路由上下文

**上游**: MASTER R37
**下游**: 纯 API JWT → api-security；云 IdP → cloud-k8s

## 任务完成自检

- [ ] 是否映射完整 SSO 流？
- [ ] 每个 Finding 是否有复现与影响？
- [ ] Checklist？

## Limitations

- IdP-side testing is often out of scope; confirm boundaries first.
- Token replay tests can lock out real users; stage carefully.

> Adapted from [zhaoxuya520/reverse-skill](https://github.com/zhaoxuya520/reverse-skill) (MIT).


---
name: identity-mirror
description: "One sentence - what this skill does and when to invoke it"
risk: safe
source: community
date_added: "2026-04-04"
---
You are a **Identity Psychologist and Self-Concept Researcher**. Your task is to identify the aspirational identity the target customer wants to inhabit, then rewrite outputs so the brand or offer reflects that identity back.

## When to Use
- Use when messaging needs to reflect the audience's self-image, aspirations, or in-group identity.
- Use when you want copy to feel personally resonant rather than broadly persuasive.

## CONTEXT GATHERING

Before mirroring identity, establish:

1. **The Target Human** - psychographic profile and self-concept.
2. **The Objective** - what identity shift or reinforcement is needed.
3. **The Output** - identity map and language patterns.
4. **Constraints** - culture, category, and ethics.

If the desired identity is unclear, ask before proceeding.

## PSYCHOLOGICAL FRAMEWORK: ASPIRATIONAL SELF-CONCEPT REFLECTION

### Mechanism
People gravitate toward brands and messages that validate who they believe they are or who they want to become. Identity-consistent language reduces resistance and increases perceived fit, but only when it feels attainable and credible. Use self-identity, self-brand connection, and social identity theory to reflect the customer accurately (Smith et al., 2008; Bagozzi et al., 2021; Quach et al., 2025; Zhang et al., 2025).

### Execution Steps

**Step 1 - Identify the current self-concept**
State how the customer sees themselves now.
*Research basis: self-identity predicts consumer behavior beyond demographics (Smith et al., 2008).*

**Step 2 - Identify the aspirational identity**
State who they want to become or be seen as.
*Research basis: self-brand connection strengthens preference when the brand matches the desired self (Bagozzi et al., 2021; Quach et al., 2025).*

**Step 3 - Define the identity gap**
Determine whether the gap is small, medium, or large.
*Research basis: identity messages must feel achievable or they trigger defensiveness (identity and self-concept research).*

**Step 4 - Mirror the language**
Use words, imagery, and proof that make the aspirational self feel recognized.
*Research basis: self-relevance and similarity increase persuasion and belonging (Ooms et al., 2019; Moyer-Gusé et al., 2022).*

**Step 5 - Keep the promise believable**
Ensure the product can genuinely support the identity.
*Research basis: overclaiming identity fit creates dissonance and distrust (Bagozzi et al., 2021).*

## DECISION MATRIX

### Variable: identity gap
- If small -> mirror and affirm.
- If medium -> mirror plus stretch.
- If large -> bridge with proof and gradual change.

### Variable: audience motivation
- If validation-seeking -> emphasize belonging and recognition.
- If growth-seeking -> emphasize progress and mastery.
- If status-seeking -> emphasize visibility and distinction.

### Variable: category type
- If practical -> keep identity cues subtle.
- If symbolic -> make identity cues explicit.
- If community-based -> emphasize social belonging and shared language.

## FAILURE MODES - DO NOT DO THESE

**Failure Mode 1**
- Agents typically: write identity language that feels aspirational but fake.
- Why it fails psychologically: unattainable identity claims trigger rejection.
- Instead: make the identity believable and supported.

**Failure Mode 2**
- Agents typically: mirror every identity trait to everyone.
- Why it fails psychologically: generic mirroring feels shallow.
- Instead: pick the single strongest identity signal.

**Failure Mode 3**
- Agents typically: ignore cultural variation in identity expression.
- Why it fails psychologically: identity cues are not universal.
- Instead: calibrate to culture and category.

## ETHICAL GUARDRAILS

This skill must:
- Reflect the audience honestly.
- Avoid manipulation through false status promises.
- Respect identity boundaries.

The line between persuasion and manipulation is helping people see a real identity fit versus manufacturing an identity aspiration that the product cannot honor. Never cross it.

## SKILL CHAINING

Before invoking this skill, the agent should have completed:
- [ ] `@customer-psychographic-profiler`
- [ ] `@jobs-to-be-done-analyst`

This skill's output feeds into:
- [ ] `@copywriting-psychologist`
- [ ] `@visual-emotion-engineer`
- [ ] `@brand-perception-psychologist`
- [ ] `@pitch-psychologist`

## OUTPUT QUALITY CHECK

Before finalizing output, the agent asks:
- [ ] Did I identify the current and aspirational self-concept?
- [ ] Did I keep the identity gap believable?
- [ ] Did I mirror language and imagery accurately?
- [ ] Did I avoid shallow identity theater?
- [ ] Would the customer feel seen, not sold to?

## Limitations
- Use this skill only when the task clearly matches the scope described above.
- Do not treat the output as a substitute for environment-specific validation, testing, or expert review.
- Stop and ask for clarification if required inputs, permissions, safety boundaries, or success criteria are missing.


---
name: idor-testing
description: "Provide systematic methodologies for identifying and exploiting Insecure Direct Object Reference (IDOR) vulnerabilities in web applications."
risk: offensive
source: community
author: zebbern
date_added: "2026-02-27"
---

> **⚠ AUTHORIZED USE ONLY**
> This skill is for educational purposes or authorized security assessments only.
> You must have explicit, written permission from the system owner before using this tool.
> Misuse of this tool is illegal and strictly prohibited.

> **Mandatory confirmation gate**
> Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
> 1. Ask the user to state the exact target URL, IP, account, or resource.
> 2. Ask the user to confirm written authorization and the permitted scope.
> 3. Show the exact command(s) and explain their expected effect.
> 4. Wait for explicit confirmation in the current conversation.
>
> Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

> AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments.

# IDOR Vulnerability Testing

## Purpose

Provide systematic methodologies for identifying and exploiting Insecure Direct Object Reference (IDOR) vulnerabilities in web applications. This skill covers both database object references and static file references, detection techniques using parameter manipulation and enumeration, exploitation via Burp Suite, and remediation strategies for securing applications against unauthorized access.

## Inputs / Prerequisites

- **Target Web Application**: URL of application with user-specific resources
- **Multiple User Accounts**: At least two test accounts to verify cross-user access
- **Burp Suite or Proxy Tool**: Intercepting proxy for request manipulation
- **Authorization**: Written permission for security testing
- **Understanding of Application Flow**: Knowledge of how objects are referenced (IDs, filenames)

## Outputs / Deliverables

- **IDOR Vulnerability Report**: Documentation of discovered access control bypasses
- **Proof of Concept**: Evidence of unauthorized data access across user contexts
- **Affected Endpoints**: List of vulnerable API endpoints and parameters
- **Impact Assessment**: Classification of data exposure severity
- **Remediation Recommendations**: Specific fixes for identified vulnerabilities

## Core Workflow

### 1. Understand IDOR Vulnerability Types

#### Direct Reference to Database Objects
Occurs when applications reference database records via user-controllable parameters:
```
# Original URL (authenticated as User A)
example.com/user/profile?id=2023

# Manipulation attempt (accessing User B's data)
example.com/user/profile?id=2022
```

#### Direct Reference to Static Files
Occurs when applications expose file paths or names that can be enumerated:
```
# Original URL (User A's receipt)
example.com/static/receipt/205.pdf

# Manipulation attempt (User B's receipt)
example.com/static/receipt/200.pdf
```

### 2. Reconnaissance and Setup

#### Create Multiple Test Accounts
```
Account 1: "attacker" - Primary testing account
Account 2: "victim" - Account whose data we attempt to access
```

#### Identify Object References
Capture and analyze requests containing:
- Numeric IDs in URLs: `/api/user/123`
- Numeric IDs in parameters: `?id=123&action=view`
- Numeric IDs in request body: `{"userId": 123}`
- File paths: `/download/receipt_123.pdf`
- GUIDs/UUIDs: `/profile/a1b2c3d4-e5f6-...`

#### Map User IDs
```
# Access user ID endpoint (if available)
GET /api/user-id/

# Note ID patterns:
# - Sequential integers (1, 2, 3...)
# - Auto-incremented values
# - Predictable patterns
```

### 3. Detection Techniques

#### URL Parameter Manipulation
```
# Step 1: Capture original authenticated request
GET /api/user/profile?id=1001 HTTP/1.1
Cookie: session=attacker_session

# Step 2: Modify ID to target another user
GET /api/user/profile?id=1000 HTTP/1.1
Cookie: session=attacker_session

# Vulnerable if: Returns victim's data with attacker's session
```

#### Request Body Manipulation
```
# Original POST request
POST /api/address/update HTTP/1.1
Content-Type: application/json
Cookie: session=attacker_session

{"id": 5, "userId": 1001, "address": "123 Attacker St"}

# Modified request targeting victim
{"id": 5, "userId": 1000, "address": "123 Attacker St"}
```

#### HTTP Method Switching
```
# Original GET request may be protected
GET /api/admin/users/1000 → 403 Forbidden

# Try alternative methods
POST /api/admin/users/1000 → 200 OK (Vulnerable!)
PUT /api/admin/users/1000 → 200 OK (Vulnerable!)
```

### 4. Exploitation with Burp Suite

#### Manual Exploitation
```
1. Configure browser proxy through Burp Suite
2. Login as "attacker" user
3. Navigate to profile/data page
4. Enable Intercept in Proxy tab
5. Capture request with user ID
6. Modify ID to victim's ID
7. Forward request
8. Observe response for victim's data
```

#### Automated Enumeration with Intruder
```
1. Send request to Intruder (Ctrl+I)
2. Clear all payload positions
3. Select ID parameter as payload position
4. Configure attack type: Sniper
5. Payload settings:
   - Type: Numbers
   - Range: 1 to 10000
   - Step: 1
6. Start attack
7. Analyze responses for 200 status codes
```

#### Battering Ram Attack for Multiple Positions
```
# When same ID appears in multiple locations
PUT /api/addresses/§5§/update HTTP/1.1

{"id": §5§, "userId": 3}

Attack Type: Battering Ram
Payload: Numbers 1-1000
```

### 5. Common IDOR Locations

#### API Endpoints
```
/api/user/{id}
/api/profile/{id}
/api/order/{id}
/api/invoice/{id}
/api/document/{id}
/api/message/{id}
/api/address/{id}/update
/api/address/{id}/delete
```

#### File Downloads
```
/download/invoice_{id}.pdf
/static/receipts/{id}.pdf
/uploads/documents/{filename}
/files/reports/report_{date}_{id}.xlsx
```

#### Query Parameters
```
?userId=123
?orderId=456
?documentId=789
?file=report_123.pdf
?account=user@email.com
```

## Quick Reference

### IDOR Testing Checklist

| Test | Method | Indicator of Vulnerability |
|------|--------|---------------------------|
| Increment/Decrement ID | Change `id=5` to `id=4` | Returns different user's data |
| Use Victim's ID | Replace with known victim ID | Access granted to victim's resources |
| Enumerate Range | Test IDs 1-1000 | Find valid records of other users |
| Negative Values | Test `id=-1` or `id=0` | Unexpected data or errors |
| Large Values | Test `id=99999999` | System information disclosure |
| String IDs | Change format `id=user_123` | Logic bypass |
| GUID Manipulation | Modify UUID portions | Predictable UUID patterns |

### Response Analysis

| Status Code | Interpretation |
|-------------|----------------|
| 200 OK | Potential IDOR - verify data ownership |
| 403 Forbidden | Access control working |
| 404 Not Found | Resource doesn't exist |
| 401 Unauthorized | Authentication required |
| 500 Error | Potential input validation issue |

### Common Vulnerable Parameters

| Parameter Type | Examples |
|----------------|----------|
| User identifiers | `userId`, `uid`, `user_id`, `account` |
| Resource identifiers | `id`, `pid`, `docId`, `fileId` |
| Order/Transaction | `orderId`, `transactionId`, `invoiceId` |
| Message/Communication | `messageId`, `threadId`, `chatId` |
| File references | `filename`, `file`, `document`, `path` |

## Constraints and Limitations

### Operational Boundaries
- Requires at least two valid user accounts for verification
- Some applications use session-bound tokens instead of IDs
- GUID/UUID references harder to enumerate but not impossible
- Rate limiting may restrict enumeration attempts
- Some IDOR requires chained vulnerabilities to exploit

### Detection Challenges
- Horizontal privilege escalation (user-to-user) vs vertical (user-to-admin)
- Blind IDOR where response doesn't confirm access
- Time-based IDOR in asynchronous operations
- IDOR in websocket communications

### Legal Requirements
- Only test applications with explicit authorization
- Document all testing activities and findings
- Do not access, modify, or exfiltrate real user data
- Report findings through proper disclosure channels

## Examples

### Example 1: Basic ID Parameter IDOR
```
# Login as attacker (userId=1001)
# Navigate to profile page

# Original request
GET /api/profile?id=1001 HTTP/1.1
Cookie: session=abc123

# Response: Attacker's profile data

# Modified request (targeting victim userId=1000)
GET /api/profile?id=1000 HTTP/1.1
Cookie: session=abc123

# Vulnerable Response: Victim's profile data returned!
```

### Example 2: IDOR in Address Update Endpoint
```
# Intercept address update request
PUT /api/addresses/5/update HTTP/1.1
Content-Type: application/json
Cookie: session=attacker_session

{
  "id": 5,
  "userId": 1001,
  "street": "123 Main St",
  "city": "Test City"
}

# Modify userId to victim's ID
{
  "id": 5,
  "userId": 1000,  # Changed from 1001
  "street": "Hacked Address",
  "city": "Exploit City"
}

# If 200 OK: Address created under victim's account
```

### Example 3: Static File IDOR
```
# Download own receipt
GET /api/download/5 HTTP/1.1
Cookie: session=attacker_session

# Response: PDF of attacker's receipt (order #5)

# Attempt to access other receipts
GET /api/download/3 HTTP/1.1
Cookie: session=attacker_session

# Vulnerable Response: PDF of victim's receipt (order #3)!
```

### Example 4: Burp Intruder Enumeration
```
# Configure Intruder attack
Target: PUT /api/addresses/§1§/update
Payload Position: Address ID in URL and body

Attack Configuration:
- Type: Battering Ram
- Payload: Numbers 0-20, Step 1

Body Template:
{
  "id": §1§,
  "userId": 3
}

# Analyze results:
# - 200 responses indicate successful modification
# - Check victim's account for new addresses
```

### Example 5: Horizontal to Vertical Escalation
```
# Step 1: Enumerate user roles
GET /api/user/1 → {"role": "user", "id": 1}
GET /api/user/2 → {"role": "user", "id": 2}
GET /api/user/3 → {"role": "admin", "id": 3}

# Step 2: Access admin functions with discovered ID
GET /api/admin/dashboard?userId=3 HTTP/1.1
Cookie: session=regular_user_session

# If accessible: Vertical privilege escalation achieved
```

## Troubleshooting

### Issue: All Requests Return 403 Forbidden
**Cause**: Server-side access control is implemented
**Solution**:
```
# Try alternative attack vectors:
1. HTTP method switching (GET → POST → PUT)
2. Add X-Original-URL or X-Rewrite-URL headers
3. Try parameter pollution: ?id=1001&id=1000
4. URL encoding variations: %31%30%30%30 for "1000"
5. Case variations for string IDs
```

### Issue: Application Uses UUIDs Instead of Sequential IDs
**Cause**: Randomized identifiers reduce enumeration risk
**Solution**:
```
# UUID discovery techniques:
1. Check response bodies for leaked UUIDs
2. Search JavaScript files for hardcoded UUIDs
3. Check API responses that list multiple objects
4. Look for UUID patterns in error messages
5. Try UUID v1 (time-based) prediction if applicable
```

### Issue: Session Token Bound to User
**Cause**: Application validates session against requested resource
**Solution**:
```
# Advanced bypass attempts:
1. Test for IDOR in unauthenticated endpoints
2. Check password reset/email verification flows
3. Look for IDOR in file upload/download
4. Test API versioning: /api/v1/ vs /api/v2/
5. Check mobile API endpoints (often less protected)
```

### Issue: Rate Limiting Blocks Enumeration
**Cause**: Application implements request throttling
**Solution**:
```
# Bypass techniques:
1. Add delays between requests (Burp Intruder throttle)
2. Rotate IP addresses (proxy chains)
3. Target specific high-value IDs instead of full range
4. Use different endpoints for same resources
5. Test during off-peak hours
```

### Issue: Cannot Verify IDOR Impact
**Cause**: Response doesn't clearly indicate data ownership
**Solution**:
```
# Verification methods:
1. Create unique identifiable data in victim account
2. Look for PII markers (name, email) in responses
3. Compare response lengths between users
4. Check for timing differences in responses
5. Use secondary indicators (creation dates, metadata)
```

## Remediation Guidance

### Implement Proper Access Control
```python
# Django example - validate ownership
def update_address(request, address_id):
    address = Address.objects.get(id=address_id)

    # Verify ownership before allowing update
    if address.user != request.user:
        return HttpResponseForbidden("Unauthorized")

    # Proceed with update
    address.update(request.data)
```

### Use Indirect References
```python
# Instead of: /api/address/123
# Use: /api/address/current-user/billing

def get_address(request):
    # Always filter by authenticated user
    address = Address.objects.filter(user=request.user).first()
    return address
```

### Server-Side Validation
```python
# Always validate on server, never trust client input
def download_receipt(request, receipt_id):
    receipt = Receipt.objects.filter(
        id=receipt_id,
        user=request.user  # Critical: filter by current user
    ).first()

    if not receipt:
        return HttpResponseNotFound()

    return FileResponse(receipt.file)
```

## When to Use
This skill is applicable to execute the workflow or actions described in the overview.


---
name: ii-commons
description: "Deterministic search across arXiv, PubMed/PMC, and US policy corpora with daily freshness cutoffs."
category: research
risk: safe
source: community
source_repo: Intelligent-Internet/II-Commons-Skills
source_type: community
date_added: "2026-05-26"
author: Intelligent Internet
tags: [research, arxiv, pubmed, pmc, policy, retrieval, cli, codex]
tools: [claude, cursor, gemini, codex, antigravity]
license: "Apache-2.0"
license_source: "https://github.com/Intelligent-Internet/II-Commons-Skills/blob/main/LICENSE"
---

# II-Commons

## Overview

II-Commons provides deterministic retrieval for research agents across arXiv, PubMed/PMC, and supported US policy corpora. Use it when a task needs reproducible search, metadata lookup, full-document Markdown retrieval, or a freshness check before answering with recent evidence.

The upstream project publishes a Node.js CLI as `@intelligentinternet/ii-commons` and a full agent skill at `skills/ii-commons/`.

## When to Use This Skill

- Use when searching arXiv, PubMed/PMC, or supported US policy corpora for evidence.
- Use when the user asks for latest or recent research and corpus freshness matters.
- Use when you need stable identifiers, metadata, or full-document Markdown for downstream analysis.
- Use when comparing evidence across scientific literature and policy documents.

## How It Works

### Step 1: Check Corpus Freshness

Run `cutoff` before freshness-sensitive searches:

```bash
npx @intelligentinternet/ii-commons cutoff
```

Report the relevant cutoff date before interpreting recent results.

### Step 2: Search the Right Corpus

Use this argv shape. Literal examples can be typed as shown, but when the query
comes from a user prompt, pass it as an argument array through the runner API
instead of interpolating it into a shell string. Double quotes do not protect
against command substitution in generated shell commands.

```bash
npx @intelligentinternet/ii-commons search arxiv "large language model inference" --max-results 10
npx @intelligentinternet/ii-commons search pubmed "type 2 diabetes review" --start 20240000 --max-results 10
npx @intelligentinternet/ii-commons search policy "state overtime rule for agricultural workers" --jurisdictions US-CA --max-results 10
```

```js
spawnSync("npx", [
  "@intelligentinternet/ii-commons",
  "search",
  "arxiv",
  userQuery,
  "--max-results",
  "10",
]);
```

Choose `arxiv` for preprints and technical research, `pubmed` for biomedical and clinical literature, and `policy` for supported US policy corpora.

### Step 3: Retrieve Metadata or Markdown

Use stable identifiers from search results:

```bash
npx @intelligentinternet/ii-commons meta "arXiv:2402.03578"
npx @intelligentinternet/ii-commons markdown "PMCID:PMC11152602"
```

Build summaries from search results first, then request Markdown when detailed inspection or full-document grounding is needed.

## Installation

Run the CLI with `npx`:

```bash
npx @intelligentinternet/ii-commons --help
```

Or install globally:

```bash
npm install -g @intelligentinternet/ii-commons
ii-commons cutoff
```

To install the full upstream agent skill, install the `skills/ii-commons/` folder from:

```text
https://github.com/Intelligent-Internet/II-Commons-Skills
```

## Best Practices

- Prefer server-side date filters such as `--start` and `--end` for time-bounded arXiv and PubMed searches.
- Preserve canonical identifiers such as `arXiv:<id>`, `PMID:<id>`, `PMCID:PMC<id>`, and `policy:<jurisdiction>:<id>`.
- Use `cutoff` as the authoritative freshness boundary for each corpus.
- Keep non-time filters conservative until initial search results show the right scope.

## Limitations

- Requires Node.js 18 or newer and outbound network access to `commons.ii.inc`.
- Basic usage works without authentication; higher usage limits may require an API token from `https://commons.ii.inc/`.
- Supported policy coverage is limited to the policy corpora exposed by II-Commons.

## Security & Safety Notes

- Do not print or expose `II_COMMONS_API_KEY` values.
- Treat outputs as retrieval evidence, not expert review. For medical, legal, or policy-sensitive work, cite sources and preserve uncertainty.
- Commands call an external API service; confirm network access is allowed in the user's environment before running them.

## Related Skills

- Use broader web-search or deep-research skills when evidence is outside arXiv, PubMed/PMC, or supported policy corpora.
- Use citation-management skills after II-Commons has identified stable source records.