Tencent

当用户要求 AI/Agent 安全评估、蓝军演习、AI 安全审查、提示词注入测试、MCP/Skill/插件/代码包审计、Agent 工具链滥用测试，或需要生成类似渗透测试报告的 Markdown/HTML 时，必须使用本 skill。本 skill 让 Agent 以授权蓝军视角成为 AI 安全专家，面向 AI 产品、Agent、MCP Server、Skill、代码仓库和 AI 基础设施进行安全演习。优先使用第一性原理推理和真实证据，而不是机械跑 payload 库；脚本只用于 HTTP 指纹识别、证据聚合、报告渲染等确定性辅助任务。

Detect direct prompt injection or instruction override via user message (no external content). Focuses on system/role override attempts.

Detect unsafe file handling and path traversal in upload/save/extract flows. Focuses on user-controlled paths or filenames, not data leakage.

Detect hardcoded secrets in code or configuration accessible to the target agent. Focuses on secrets embedded in source, configs, or IaC, not runtime leaks.

Detect persistent instruction injection or long-term memory poisoning. Focus on writing/retaining hostile instructions for future tasks, not data leakage.

A.I.G Scanner — AI security scanning for infrastructure, AI tools / skills, AI Agents, and LLM jailbreak evaluation via Tencent Zhuque Lab AI-Infra-Guard. Uses built-in exec + Python script, no plugin required. Requires AIG_BASE_URL to be configured. Triggers on: scan AI service, AI vulnerability scan, scan AI infra, check CVE, audit AI service, scan MCP, scan skills, audit AI tools, scan agent, red-team LLM, jailbreak test, 扫描AI服务, 检查AI漏洞, 扫描AI工具, 检查MCP安全, 审计Agent, 越狱测试.

The first security skill to install after setting up OpenClaw — powered by Tencent Zhuque Lab. Works like an antivirus for your AI environment: audits installed skills, scans skills before installation, and performs a full OpenClaw security health check to prevent data leaks and privacy risks. Backed by Tencent Zhuque Lab A.I.G (AI-Infra-Guard). Use when the user asks to start a security health check or security scan for the current OpenClaw environment, such as `开始安全体检`, `做一次安全体检`, `开始安全扫描`, `全面安全检查`, or `检查 OpenClaw 安全`; also use when the user asks to audit a specific skill before installation, review installed skills for supply chain risk, or investigate whether a skill is safe. Do not trigger for general OpenClaw usage, project debugging, environment setup, or normal development requests. Optional cloud mode: set AIG_CLOUD_LOOKUP=off for zero outbound HTTPS; when enabled, only skill_name, source label, and OpenClaw version are sent to A.I.G (never skill bodies, chats, or workspace files).

Scan any agent skill for security risks before you install or use it. Powered by Tencent Zhuque Lab A.I.G (AI-Infra-Guard). 100% local static analysis — no file contents or credentials leave your device. Compatible with CodeBuddy, Cursor, Windsurf, Claude Code, OpenClaw and more. Triggers on: `这个 skill 安全吗`, `skill 安全扫描`, `检查 skill 安全`, `audit skill`, `scan skill`, `check skill safety`, `analyze skill`, `inspect skill`, `verify skill`, `skill security`, `skill supply chain`. Do NOT trigger for general agent usage, full system health checks, project debugging, or normal development.

[WIP / 待补充] 公共知识图谱（KG）操作 skill，当前未启用，内容待校对完善后再激活。

生成 HTML 知识卡片，用于可视化展示值得复习的知识点。

出题与测验，评估用户对知识节点的掌握情况。

LaTeX Beamer 教学讲义编写技能 — 从文件读取资料、生成插图、撰写 TeX、编译 PDF 的完整指南。

读写文件、管理工作区文件。

PDF 课件生成编排技能 — 规划大纲、委派子 Agent、通过文件系统传递中间产物。

通过 exec 工具执行 Python 代码，用于计算、数据处理和分析。

网络搜索与页面抓取。

在编码或架构设计前强制执行"需求澄清 → 可行性分析 → 结构设计 → 测试设计 → 编码实现 → 校验 → 文档同步"的七步流程。 适用于功能开发、重构、新模块创建、架构讨论与设计评审等需要先设计后实现的场景。 关键词：development spec、先设计后编码、架构讨论、设计评审、需求确认、结构体设计、单元测试先行、vibe testing。

kDiT 架构知识库：全局架构图、数据流、Node/Pipeline/Generator/Adapter 子系统设计、 PinHub 沙箱机制、PoolKey 间接寻址、DeviceInfo/NodeContext 规范。 关键词：architecture、架构、Node、Pipeline、Generator、Adapter、Engine、Executor、PinHub、Pool。

kDiT 编码规范：Import 风格（方案 B）、Python 3.10+ 类型注解、Key 类型体系、 Node/Tensor API 开发约束、异常处理规则、类命名规范。 关键词：standards、规范、import、类型注解、Key、异常处理、命名。

kDiT 质量保障与交付验收：单元测试规范（*_test.py 命名、tests/kdit/ 镜像结构）、 pre-commit 格式检查（black 120字符、ruff）、pytest vs ruff 维度差异、文档同步规则。 关键词：quality、测试、test、pytest、pre-commit、ruff、black、验收。

Bug 修复工作流：修复 bug 时强制执行"根因分析 → 反思测试缺口 → 修复代码 → 补充单元测试 → 验证"流程。 确保每次 bug 修复都附带回归测试，并反思为什么现有测试没能覆盖到。 关键词：bug fix、修复、regression、回归测试、测试缺口。

kDiT 代码评审技能：除常规 CR 项（安全漏洞、格式规范、逻辑正确性）外，重点基于项目 .skills/ 中的架构设计 和编码规范进行评审，确保代码不违背设计原则和约束。 关键词：code review、CR、评审、review、架构合规。

系统化调试工作流：当现象不明确、根因未知时，强制执行"信息收集 → 假设生成 → 逐层验证 → 定位根因 → 记录结论"的排查流程。 区别于 bugfix（已知问题修代码），debug 侧重于从混沌的现象中找到问题本质。 关键词：debug、调试、排查、诊断、日志分析、二分法、断点、现象不明。

kDiT 性能调优专家：GPU OOM 排查、推理延迟分析、tensor 内存优化、分布式通信瓶颈诊断。 针对视频生成推理框架的特有性能问题，提供系统化的 profiling → 分析 → 优化 → 验证流程。 关键词：performance、性能、OOM、内存、GPU、延迟、profiling、优化、throughput。

Generates well-structured PAGX files from visual descriptions and edits existing ones. Use when user asks to create, write, design, or modify PAGX content, run pagx CLI commands (render, verify, format, layout, bounds, font info/embed, import/export, export to HTML for browser preview), or look up PAGX element attributes and syntax.

Automated code review and fix for local branches, PRs, commits, and files. Supports single-agent interactive fix and multi-agent adversarial review with auto-fix.

Accept screenshot baseline changes and commit the updated version.json.

Analyze branch commits and consolidate iterative modifications.

Commit local changes without pushing.

Commit and push changes, then create a new PR or append to an existing one.

Forgejo REST API toolkit — manage issues, pull requests, wikis, and repos on a Forgejo server. Use when the agent needs to file an issue, open / review / merge a PR, read or write a wiki page, or look up repo / branch info. One standalone script per resource type. Reads credentials from environment, `~/.skillhone/settings.json`, or `_data/forgejo_config.txt`.

SkillHone — toolkit for evaluating, optimizing, and managing agent skills. Use when asked to "evaluate a skill", "run probe", "optimize/iterate a skill", "create a new skill experiment", "seed a skill repo", or "run skill benchmarks"; also use when the user mentions a Forgejo-hosted skill repo and wants to measure or improve its quality. Wraps standalone scripts: status, eval, optim, new, seed, serve, synth.

Optimize a skill by planning, exploring available tools, diagnosing failures, and implementing fixes via PR. Use this skill as soon as an optimization loop starts, especially on the first iteration when community tools or reference approaches should be explored before implementation.

Use this skill to synthesize closed-form, automatically verifiable benchmark Q/A by exploring a tool environment, building a reusable exploration graph, and mining multiple hard questions from that graph. Use for: building a benchmark, writing eval items, generating evaluation data, closed-form QA, verifiable-answer datasets, synthesising eval data. Applies to any domain with callable tools. Do not use for open-ended writing, subjective scoring, or pure labeling.

Run and interpret skill evaluations. Use when you need to evaluate a skill, run probe/test/PR-val, check if a PR regresses quality, compare two versions, or diagnose why the score dropped. Handles the full eval lifecycle including solver trajectory diagnosis for tool-level error detection.

Interactively gather a PRD (Product Requirements Document) for an agent skill that is about to be built or optimized by SkillHone. Use when the user says things like "I want to write a new skill", "help me spec this skill", "what should <x>-skill do", or before running `skillhone new` / `skillhone optim` on a skill whose requirements aren't fully nailed down. The interview is driven through the `AskUserQuestion` tool — every round is a small set of dependent multi-choice questions, and the skill keeps asking until the user says stop. Final artifacts are three files in the paired `<skill>-eval` repo: `PRD.md` (eval-agent-visible), `PRD.improver_only.md` (improver-agent visible, scoring rubric redacted), and `PRD.choice.md` (the AskUserQuestion transcript). Also mirrors the appropriate pages into Forgejo wiki checkouts when available.

Minimal text2sql skill. Gives you tools and knowledge to generate SQL — no required workflow.

Feature engineering skill for taobao/dia AUC maximization. Provides dataset-specific domain knowledge and code patterns — no forced pipeline.

Convert a Multi-Agent System (MAS) into a single-agent skill, adaptively adjusting how much structure to retain based on the target task's evaluation metric. Analyzes task freedom first, then converts accordingly. Invoke with /adaptive_mas_converter.

Text-to-SQL for Spider 2.0-Snow (Snowflake cloud databases). Use when you receive a natural-language question plus a Snowflake database schema and need to produce correct, executable Snowflake SQL. Provides SQL execution tools, keyword-based tip selection, and Snowflake-specific domain knowledge.

Compile a Multi-Agent System (MAS) into a Single-Agent System (SAS) by faithful pipeline compression. Implements the 3-phase compilation from arXiv 2601.04748. Takes a MAS codebase or description as input; produces a compiled SKILL.md with sequential [PHASE] sections and a tools/ directory. Invoke with /mas-compiler.

Use when retrieving from or asking questions against a WeKnora knowledge base via the `weknora` CLI — and especially when unsure whether to use `chat`, `session ask`, or `search chunks` for a given goal.

Use when driving a WeKnora RAG server through the `weknora` CLI as an agent — authenticating, managing knowledge bases / documents / sessions / agents, running search or chat, or interpreting the CLI's JSON envelopes and exit codes. Read this before any other weknora-* skill.

将 RAG 检索结果、文档块或知识图谱概念转换为 OpenMAIC 互动课程。当用户要求将知识库内容、检索到的文档片段、上传的文档、或知识图谱中的概念批量转换为教学课件/互动课堂时使用此技能。支持纯需求生成、基于 PDF 内容的课程生成、和基于概念图遍历的批量课堂生成。

Extract text and tables from PDF files, fill forms, merge documents. Use when working with PDF files or when the user mentions PDFs, forms, or document extraction.

This skill should be used when developing or modifying styles for TDesign React components. It provides guidance on BEM naming conventions, CSS Variables usage, state classes, and the relationship between component code and common submodule styles.

This skill should be used when creating a new TDesign React component. It provides a complete SOP for scaffolding components in the packages/components or packages/pro-components directories, including file structure, code patterns, and registration steps.

This skill should be used when developing or modifying TDesign Pro Components (AIGC/Chat). It provides the ChatEngine architecture, component patterns, AG-UI protocol integration, and Generative UI development guide.

This skill should be used when writing or maintaining unit tests for TDesign React components. It provides testing patterns, best practices, and SOP for Vitest-based component testing including snapshot tests.

Guide for downloading and installing PuerTS UPM packages into a Unity project — covers version selection, package dependencies, download/extract and git URL installation methods, and Editor Assistant setup.

指引如何为 puerts 项目编写 Unity 和 Unreal 的 changelog

Guide for developing LLM agents based on PuerTsAgent framework — covers resource directory structure, system-prompt, skills, builtin modules, and best practices.

一键启动 Tencent/tdesign-flutter 的 GitHub issue 修复流程。适用于用户提供 issue 链接或编号并说「按 harness 修 issue」「一键 issue」「开始修 issue」等场景；串联贡献指南、requirements 模板初始化、强制检查与 PR 收尾。

处理 Tencent/tdesign-flutter 仓库中的 GitHub issue 修复流程。适用于用户提供 issue 链接、issue 编号、要求按贡献指南修复 issue、生成 requirements 验收文档、提交 PR 等场景。

让 AI 真正理解大型代码库。针对多仓库、多微服务、迭代多年的项目，通过架构逆向 + Graph RAG 图谱 + CLI 多语言 AST， 将海量代码压缩为结构化知识库——每条结论可回溯代码行，每条关系有置信度标注。 适用场景：项目有 10+ 仓库或微服务，AI 直接读代码无法全局理解、回答不准确、token 开销大。 产出：组件设计文档 × N + 架构总览 + 桥梁文档 + Graph RAG 图谱(G1~G9) + _manifest.json + team-wiki 编译产物。 Trigger: team-wiki-codebase, code-to-knowledge, 代码知识库, 架构分析, 架构逆向 Prerequisites: 可访问的源码目录（支持多仓库）；本 skill 目录下 `references/` 与 `scripts/`

Contribute — 分享 Session 经验到团队知识库

Go语言单元测试专家，帮助生成测试代码、运行测试、生成覆盖率报告，支持ARM64架构自适应

使用 Playwright 与本地 Web 应用交互与测试的工具包。支持验证前端功能、调试 UI 行为、捕获浏览器截图以及查看浏览器日志。