القائمة
Adds a new application to NixOS or Home Manager configuration. Researches the package, determines the appropriate installation layer, implements it, and validates.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Drafts fact-based technical articles for hayao's outlets — Zenn (@hayao), Qiita (@Hayao0819), the personal blog (hayao0819.com) — matching his structural register without faking his personality. Use when writing, drafting, or rewriting a 技術記事 / blog post / Zenn / Qiita article in hayao's name about a technical topic. The LLM writes facts only: it does NOT manufacture his jokes, 毒舌, 自虐, casual throwaway closers, or first-person anecdotes — performing his personality is fabrication and he finds it offensive. Encodes the factual baseline of his writing (genre-driven 敬体/常体, direct openings, plain content-label headings, inline-code density, primary-source links) in a bundled reference.md, and composes with the natural-writing skill. Self-contained — does not depend on machine-local memory. Do NOT use for: non-hayao docs, pure code, commit messages, or chat replies.
Rewrites prose so it reads as if a human wrote it — stripping out LLM tells in both English and Japanese. Use whenever producing user-visible writing of any kind: documentation, README, markdown, blog posts, commit messages, PR descriptions, GitHub Issues, code-review comments, code comments and docstrings, replies in issue threads, professional or casual emails, Slack/Discord/chat messages, release notes, design docs, academic-style writeups and 論文. Use it even when the user did not ask for "natural" prose — any drafted text leaving Claude that a human will read should pass through this checklist first. Triggers include: any request to "write", "draft", "compose", "summarize", "explain", "describe", "review", "comment", "reply", or 「書いて」「文章作って」「まとめて」「メール作って」「返信して」「PR/Issueの説明書いて」. Do NOT use for: pure code generation with no prose, raw data transformations, or terse tool output.
Security audit of memory-safety vulnerabilities in C/C++ (userland/systems, not kernel), with confidence-gated reporting to keep false positives low. Taint-traces untrusted input (argv, env, files, network, stdin) to memory sinks (copy length, array index, allocation size, format string) and reports only when input is attacker-controlled AND reaches the sink AND bounds aren't enforced. Covers buffer overflow, use-after-free, double-free, OOB read, integer overflow into undersized alloc, format string, the dangerous-function table, hardening flags to verify, and the ASan/UBSan/MSan/fuzzing toolchain. Covers userland/systems C and the SGX enclave/host (ECALL/OCALL) pointer boundary. Use when reviewing C/C++ for memory-corruption bugs. Kernel code → auditing-kernel.
Security audit of Linux kernel code and out-of-tree modules/drivers, with confidence-gated reporting to keep false positives low. Traces attacker input from userspace entry points (syscalls, ioctl, sysfs/proc/debugfs writes, netlink, char-dev, mmap) — and, for confidential-computing guests, from the untrusted host — to memory/refcount/locking/infoleak sinks. Covers UAF via refcount imbalance, the copy_to/from_user boundary, double-fetch TOCTOU, missing capability checks, integer-overflow allocations, ioctl handler review, and the TDX/SEV-SNP/SGX threat model. Use when reviewing kernel C, a driver/ LKM, an ioctl handler, or enclave/attestation code for vulnerabilities.
Security audit of web applications — backend implementation and authentication/ authorization flows — with confidence-gated reporting to keep false positives low. Traces attacker-controlled request input (params, body, headers, cookies, path) to sinks, distinguishing server-controlled from attacker-controlled, and reports HIGH only. Leads with broken access control / IDOR (OWASP #1), then injection (and where GORM/sqlc/React are already safe), XSS, SSRF, CSRF, auth (password storage, sessions, reset), and tokens (JWT alg confusion, OAuth/OIDC PKCE). Framework-aware for Go/Gin/GORM/sqlc and Next.js Server Actions. Use when reviewing a web backend, API, route handler, Server Action, or auth flow.
Idiomatic, version-current Go review and authoring for an experienced engineer. Covers deliberate error wrapping (errors.Is/As/Join, AsType), structured concurrency (errgroup, context, the loopvar fix), modern stdlib that replaced old patterns (slices/maps/cmp, log/slog, min/max/clear, range-over-func iterators), table-driven and synctest testing, API design the linter can't check, and Gin/GORM/cobra backend patterns. Use when writing, reviewing, or refactoring Go — .go files, go.mod, goroutines, errors.Is/As, a Go backend or CLI — or before committing Go. Flags outdated pre-1.22 idioms (loopvar v:=v shadows, tools.go, hand-rolled helpers).
| name | add-app |
| description | Adds a new application to NixOS or Home Manager configuration. Researches the package, determines the appropriate installation layer, implements it, and validates. |
| when_to_use | When the user asks to install, add, or set up a new application or package in their Nix configuration. |
| argument-hint | <app-name> |
| allowed-tools | WebSearch, WebFetch(domain:mynixos.com), WebFetch(domain:discourse.nixos.org), WebFetch(domain:nixos.wiki), WebFetch(domain:github.com), Bash(nix search:*), Bash(nix flake check:*), Read, Edit, Write, Glob, Grep |
| Category | Examples | Target |
|---|---|---|
| NixOS system-level | docker daemon, nvidia, bootloader | modules/nixos/<name>/default.nix |
| GUI desktop apps | Chrome, VS Code, Discord | nixos/XPS9350/configuration.nix → users.users.hayao.packages |
| Cross-platform CLI | ripgrep, jq, nodejs | modules/home-manager/pkgs/global.nix |
| Linux-only CLI | dconf2nix | modules/home-manager/pkgs/linux.nix |
| Configured apps | git (with config), zsh (with plugins) | modules/home-manager/<name>/default.nix |
New modules are auto-imported via readDir — no need to edit default.nix index files.
modules/home-manager/<name>/default.nix or modules/nixos/<name>/default.nixnix flake check --extra-experimental-features 'nix-command flakes pipe-operators'