knowlet

Automated code review that checks code quality, Clean Architecture compliance, DDD patterns, coding standards, and spec traceability.

從規格目錄的 acceptance.yaml 生成/維護 BDD/ezSpec 測試。使用類似 Gherkin 語法，AI 自動產生 step definition（開發人員不需要手寫），驗收測試規格即為 Executable Specification。

在單元測試通過後觸發。透過引入人工錯誤（Mutants）來「測試你的測試」，確保測試案例具有足夠的錯誤偵測能力，建立對驗證機制的信任（Trust the Verification）。

驗證規格檔案的完整性與一致性，確保所有必要的規格元素都已定義且符合標準格式。

Replace with description of the skill and when Claude should use it.

協調多個 AI 模型（ChatGPT、Gemini、Codex、QWEN、Claude）進行三角驗證，確保「Specification == Program == Test」一致性。過濾假警報後輸出報告，大幅減少人工介入時間。

處理跨 Frame 的複雜業務流程，協調多個 Sub-agent (command/query/reactor) 完成 Saga/Choreography 模式的分散式交易。當需求涉及多個狀態變更、事件反應與查詢的組合時使用。

當接收到新需求或 Event Storming 產出後觸發。分析問題類別（CBF/IDF/RIF），生成完整的規格目錄結構。實現「需求與實作分離」、「規格即文檔、文檔即規格」。

Use this skill when analyzing stripped, packed, or statically linked Go malware or suspicious Go binaries and the goal is to recover build metadata, separate user logic from runtime noise, map packages and goroutine behavior, extract high-signal evidence, and produce defensible capability and next-step assessments. Use when the workflow should combine fast CLI triage (file, sha256, binwalk, strings, go version -m) with concrete `ida-pro-mcp` steps (`decompile`, `xrefs_to`, `find_regex`, `export_funcs`) or AI-assisted structured survey before deep reversing. Trigger on Go malware behavior reconstruction, goroutine-heavy samples, dispatcher or C2 handler hunting, or when symbol recovery is already done and analyst focus shifts to capabilities.

Use this skill when stripped, packed, or poorly labeled Go binaries need function names, package paths, build metadata, source layout clues, types, or interfaces recovered from build info, pclntab, moduledata, typelinks, or tool-specific metadata before deeper malware analysis. Use when triaging with binwalk/strings/go version -m/GoReSym/redress, when IDA or Ghidra shows too few strings versus strings(1), or when preparing concrete `ida-pro-mcp` rename and xref workflows for pclntab-anchored recovery.

Use this skill whenever an `ida-pro-mcp` server is connected and you need to drive IDA Pro efficiently for reverse engineering — structured "survey this binary" first passes, progressive deepening from big-picture to dispatcher-level detail, ready-to-paste `py_eval` helpers for `.rodata` string recovery, panic-path extraction, and pclntab discovery, and disciplined rules for when to `decompile`, `xrefs_to`, `find_regex`, `rename`, and `set_type`. Trigger on any task involving IDA MCP, IDA Pro workflows, stripped binary analysis when the disassembler is connected, or when an analyst asks Claude to "look at this IDB", "survey this binary", "find the dispatcher", or "recover symbols" with an IDA backend available. Complements `reverse-malware-triage`, `reverse-rust-malware`, `reverse-golang-symbol-recovery`, and `reverse-golang-malware`.

Use this skill to perform fast malware or suspicious binary triage, extract high-signal evidence, summarize capabilities, identify likely next pivots, and produce analyst-ready outputs.

Use this skill when analyzing stripped or static-linked Rust malware or suspicious Rust ELF binaries. Focus on string recovery, panic-path reconstruction, module-tree building, command-dispatch discovery, and protocol recovery.

Use this skill when reverse-engineering, sandbox, or threat-intel work has already reconstructed a malware or botnet control plane and the goal is to turn that evidence into ranked disruption, containment, sinkhole, monitoring, and coordination options without overstating what is actually feasible.

Use this skill when reverse-engineering, sandbox, or threat-intel evidence exposes build paths, usernames, typo fingerprints, version windows, cloud relays, wallets, contracts, peer infrastructure, or other operator traces and the goal is to pivot from malware artifacts to a defensible developer or operator attribution model with prioritized investigative actions.

Use this skill to reconstruct command flow, transport assumptions, message boundaries, field candidates, and encode/decode behavior from reverse-engineering evidence.

Full TDD with Codex-native routing: write failing tests first, verify RED, implement locally for small changes, and use Codex subagents for larger parallelizable work when delegation is allowed. Finish with a review pass before delivery. Use when the user asks for /tdd-execute-codex, TDD execute, test-driven implementation, or a larger TDD change that benefits from explicit delegation.