Browse reusable Agent Skills, each with a clear purpose and practical guidance.
Audits security and supply-chain risk between two git refs with Codex cross-validation. 预发布安全审计（含 Codex 交叉验证）。Use when performing pre-release security audits, supply-chain reviews, or comparing two git refs for security regressions. Triggers on “预发布审计”, “security audit”, “release audit”, “安全预审”.
Monitor OneKey PR checks and review threads, fix failures, address comments, and continue until the PR is ready.
This skill should be used at the start of any computationally intensive scientific task to detect and report available system resources (CPU cores, GPUs, memory, disk space). It creates a JSON file with resource information and strategic recommendations that inform computational approach decisions such as whether to use parallel processing (joblib, multiprocessing), out-of-core computing (Dask, Zarr), GPU acceleration (PyTorch, JAX), or memory-efficient strategies. Use this skill before running analyses, training models, processing large datasets, or any task where resource constraints matter.
Treat manuscripts as software: version control, reproducible builds, figure pipelines, CI, and structured repo layout. Helps teams avoid 'final_v7' chaos and ensures submission-ready artifacts.
Use when diagnosing stale or orphaned Node.js processes launched by VCO, auditing ownership/liveness, or safely simulating cleanup without touching external Node workloads.
Dedicated security-audit route for OWASP-style risks, secret leaks, auth flaws, injection, unsafe input handling, SSRF/XSS, and sensitive-data exposure. Use instead of code-reviewer when the prompt explicitly asks for security, vulnerability, threat, auth, or OWASP review.
Load when a PR touches `http_api.py` auth middleware (`check_authorization_serverless` / `check_authorization`), `get_serverless_usage_check_async`, api-key→workspace resolution (`get_roboflow_workspace`), assume-identity (`_add_assume_identity_headers`, `x-assume-identity-*`), the unauthenticated-route allowlist, api-key redaction (`api_key_safe_raise_for_status`, `deduct_api_key`), usage api-key hashing, or new `*_SECRET`/`*_TOKEN`/`API_KEY` env vars in `env.py`.
不可逆事故发生后的应急响应：情绪急救 → 止损 → 补偿性劳动 → 教训沉淀。 Use when: 犯了不可挽回的错误、造成了人类伙伴的情绪波动、需要危机处理。 Not for: 可撤销的小失误、日常 bug fix（用 debugging）、预防性确认（用 shared-rules 铁律）。 Output: 情绪修复 + 止损行动 + 教训沉淀（lessons-learned / shared-rules）。
Reference and procedures for helping users understand APM, detect their installation state, answer questions from live docs, and handle migration from older versions.
Analyze a threat-intel blog post or report against Stratus Red Team coverage. Extract cloud TTPs, classify each as Covered / Partial / Open issue / Not covered, produce a markdown coverage report, and suggest GitHub issue drafts for the gaps. Use when the user pastes a threat-intel URL (Microsoft, Mandiant, CrowdStrike, Unit 42, etc.) and asks for a coverage report, gap analysis, TTP extraction, or "what does Stratus cover from this report". Also use when given a local report file (.md, .txt, .pdf) or pasted text.