alibaba

使用 agent-sec-cli 扫描 prompt 文本中的注入攻击和越狱尝试，返回结构化 JSON 扫描结果。当用户提到 prompt 安全、prompt 注入检测、越狱检测、提示词攻击检测，或者需要判断一段文本是否包含恶意 prompt 注入时，都应使用此技能。即使用户没有明确说"扫描"，只要涉及评估 prompt 文本的安全性，也应触发此技能。

Use this skill when the user asks about ANOLISA, Alibaba Cloud Linux 4 Agentic Edition, cosh, Copilot Shell, AgentSecCore, AgentSight, Tokenless, ws-ckpt, OS Skills, or any component of ANOLISA. This includes questions about usage, configuration, commands,…

只读查询 agent-sec-cli 已落盘的历史安全事件记录，并据此生成会话级安全复盘。仅当用户显式要求查看或审计已发生的安全事件、安全告警、安全审计记录，或要求按 session/run/trace/时间/类别筛选与统计已有安全事件，或要求复盘某次会话的安全判定时使用。不用于扫描新内容：检查代码安全性用 code-scanner，检测 prompt 注入用 prompt-scanner，审查 Skill 安全状态用 skill-ledger。不要因为对话中出现“安全”“工具调用”等字样、或为了主动自查而触发。

Skill 安全状态查看、风险暴露审查、用户决策、快速扫描认证与可选深度扫描。支持用户主动查看或扫描单个/全部 Skill；当用户要求 agent 安装 Skill 且安装成功后，必须自动对最终本地目录执行快速扫描认证。

Help users configure, mount, and unmount a skillfs FUSE virtual filesystem on their local machine (e.g. for openclaw). Covers analyzing existing skill usage to suggest view configuration, generating skillfs-views.toml, mounting, and graceful unmount. Use this…

内核参数自动调优。分析系统配置，输出调优建议并可一键应用，支持自动回滚。使用场景：系统性能优化、安全加固、内核参数诊断。

Use when troubleshooting Linux server performance or stability issues — CPU saturation, high load, scheduling delay, memory pressure, OOM events, high RSS, page cache / shared memory growth, memory cgroup residue, Java heap issues, disk IO saturation or…

Install and configure OpenClaw non-interactively with Alibaba Cloud Model Studio. Use when the user asks to install OpenClaw, configure Aliyun Bailian/Model Studio/DashScope credentials, choose pay-as-you-go, Coding Plan, or Token Plan billing, set Base…

Create, run, diagnose, and iteratively improve Agent Skill evaluations (evals) with the skill-up CLI / 使用 skill-up CLI 创建、运行、诊断并持续改进 Agent Skill 评测. Use when the user asks to evaluate, test, regress, verify, fix, improve, iterate, or evolve a Skill; add or…

Quickly produces accurate calculation results when a user needs arithmetic, unit conversion, or mathematical formula solving. Triggered when users say things like "help me calculate", "compute", "how much is", etc.

SDD-RIPER workflow executor with phase gating

Per-case mocked MCP override smoke skill used by skill-up e2e tests.

帮助用户进行代码审查，识别常见代码问题并给出修改建议。

帮助用户管理待办事项，支持添加、删除、标记完成、列出任务等操作。

MCP mocked marker smoke skill used by skill-up e2e tests.

Analyzes code files and reports statistics including line counts, file counts by extension, and total size. Use this skill whenever the user wants to understand the composition of a codebase - asking about "how many lines of code", "what file types exist",…

在进行 Code Review 时，使用这个技能对 LoongCollector 变更进行安全导向、架构一致性优先的深度代码评审。

按 Conventional Commits 规范编写提交信息。在创建 git commit 时使用。

编译 LoongCollector C++ 与 Go 组件。涉及构建、单元测试或镜像时使用。

Design document writing conventions. Use when writing or reviewing technical design documents.

LoongCollector E2E Testing Framework Development Guide. Use this rule when you need to understand E2E testing framework architecture, develop new test behavior functions, or extend testing capabilities. Contains detailed BDD testing framework usage, test…

E2E Testing Standards Guide. Use this rule when you need to write or execute E2E tests, including test naming conventions, test workflows, and test behavior templates. This rule should be used for end-to-end integration testing scenarios to ensure test…

LoongCollector E2E 测试全流程指南：设计、编写、运行和调试。当需要编写新 E2E 测试、运行现有测试、或排查 E2E 测试失败时使用此 skill。

Whenever diagrams or mermaid is mentioned

GreptimeDB provider for obz. Covers PromQL metric query, labels, label-values, and series commands via GreptimeDB's Prometheus-compatible API. Use this skill when the user mentions "GreptimeDB", "Greptime", "obz metric -p greptimedb", or needs to query…

Multi-backend observability CLI for querying metrics, logs, and traces across 12 backends. This skill should be used when the user runs obz commands, constructs metric/log/trace queries, configures providers, parses obz JSON output, or troubleshoots obz…

Datadog provider for obz. Supports metrics (Datadog Query Language), logs (Datadog Log Query), and traces. Requires api-key and app-key configured under auth in config.yaml. Does not support metric labels, label-values, or series commands. This skill should…

Elasticsearch provider for obz. Supports log search and trace operations using Elasticsearch Query DSL (Lucene-based). Requires --index flag. This skill should be used when the user mentions "Elasticsearch", "obz -p es", or needs to search logs or traces from…

Jaeger provider for obz. Covers trace search, trace retrieval by ID, and extension commands for service and operation discovery. This skill should be used when the user mentions "Jaeger", "obz trace -p jg", or needs to search distributed traces from a Jaeger…

Grafana Loki provider for obz. Covers log search using LogQL, a label-based query language for log aggregation. This skill should be used when the user mentions "Loki", "Grafana Loki", "LogQL", "obz log search -p loki", or needs to search logs from a Loki…

Grafana Mimir provider for obz. Covers all 6 metric commands using standard PromQL. Mimir is a horizontally-scalable Prometheus-compatible TSDB. This skill should be used when the user mentions "Mimir", "Grafana Mimir", "obz metric -p mimir", or needs to…

OpenSearch provider for obz. Supports log search and trace operations using Lucene-based query syntax. Requires --index flag. This skill should be used when the user mentions "OpenSearch", "obz -p os", or needs to search logs or traces from an OpenSearch…

MNN Metal 后端 op/kernel 开发与优化入口。索引四份 sub-doc：kernel 开发规范与优化知识库（命名/写法/GEMV/GEMM/attention）、算子融合全链路（导出图→converter→Metal 单 dispatch）、运行时调度（fence/content-cache/H2D/replay）、构建测试基线、env 开关注册表。根据当前任务选择性阅读对应 sub-doc。

Run MNN tests / benchmarks on host or real devices. Covers two parallel tracks — (1) the regression / CI suite (static checks, host-side tests, on-device Android arm64 matrix via ./test.sh + test_stages.json) and (2) one-command iOS real-device LLM…

MNN Vulkan 后端 kernel/算子性能优化与新特性集成。覆盖 benchmark 基线、kernel 优化迭代、集成验证全流程，以及 GLSL .comp + makeshader 双轨、conv1x1/attention dispatcher 多路径（coopMat/subgroup/nosubgroup）、cooperative matrix、packed weight 设计、pipeline cache、CPU 侧调度瓶颈、Adreno/Mali/Apple 多 vendor 真机验证等参考知识。

MNN Hexagon/HVX/HMX DSP 后端（`source/backend/hexagon`）的优化、重构、构建与回归验证。覆盖设备实测的相位分解、测量纪律、v79/v81 双架构差异、常见瓶颈模式、已否证方向与 cDSP crash 诊断。

为 MNN 框架添加新的 LLM 模型支持。支持从 HuggingFace/ModelScope 下载模型，分析架构，添加映射，Hook 对齐测试，导出 MNN 模型。采用 TDD 模式，分 6 步执行，每步有独立测试标准。

MNN 各类正确性/回归 bug 的排查方法论集合。按 bug 分类组织：当前覆盖 (1) 内存别名/生命周期错误（buffer aliasing、arena reuse、`MemChunk` / tensor buffer 生命周期）、(2) 量化误差/导出侧权重损坏（低 bit 打包、导出分块、PyTorch MPS/CUDA 大张量静默错误）、(3) 持久化缓存误信（weight-mmap sync 标记自我污染、陈旧/跨模型缓存复用）、(4) 数值精度/fp16 表示能力不足（长序列复读、position…

为 MNN 框架新增算子。包含 Schema 定义、形状计算、几何计算、后端实现、单元测试的完整 TDD 流程。分 5 步执行，每步有独立测试标准。

MNN QNN（高通 HTP/NPU）后端的问题定位、修复与算子适配。覆盖运行时报错（1002/6000/1003/6004）、模型转换/算子校验失败、推理结果异常、精度不达标、以及性能问题;并指导为 QNN 新增/适配算子。核心方法:用 MNN2QNNModel --dump_intermediate_outputs 一次性导出 QNN 全部中间张量,与 CPU(fwd=0) 基线逐张量对比,直接定位首个出错算子(旧的 testMNNFromOnnx.py 截断二分已降为回退手段);区分“真…

Format, create, and update concise XQUIC pull request bodies and review-state transitions. Use when asked to prepare or edit an alibaba/xquic PR body, create a draft PR from an already-pushed branch, update a PR after code changes pushed a new head, or move a…

Safely stage, commit, and push XQUIC changes after scoped Git checks. Use when asked to stage, commit, push, publish a branch to a fork, or verify that only intended files will be sent to a remote.

Classify XQUIC GitHub issues with an evidence-backed L1-L4 resolution-complexity label while keeping validity, priority, severity, and disposition separate and skipping uniquely labeled issues unless the user explicitly forces a recheck. Use when triaging one…

Prepare and run XQUIC local compilation. Use when asked to compile, build, configure, or diagnose the local build environment for XQUIC, especially across macOS/Linux. Detect intent and platform, then delegate actual compilation to scripts/validate.sh instead…

Address actionable GitHub pull request review comments for xquic. Use when asked to handle PR review feedback, requested changes, unresolved inline threads, or reviewer comments while preserving unrelated edits.

Debug and fix failing GitHub PR checks for xquic. Use when a PR, branch, or commit has failed CI, GitHub Actions, build checks, test checks, or requested validation failures that should be diagnosed from logs before editing.

Review XQUIC harness structure for bloat, duplicated facts, trigger overlap, reference drift, and missing hard checks. Use when changing AGENTS.md, harness specs, pipelines, skills, setup scripts, validation routing, or when asked to audit harness design.

Enforce XQUIC test coverage and local validation gates. Use when code, build, or test changes need verification; before commit or pull request; or when asked to build, test, validate, or verify XQUIC. Requires paired happy-path and abnormal-path unit tests,…

Archive a completed change in the experimental workflow. Use when the user wants to finalize and archive a change after implementation is complete.

Archive multiple completed changes at once. Use when archiving several parallel changes.

Continue working on an OpenSpec change by creating the next artifact. Use when the user wants to progress their change, create the next artifact, or continue their workflow.

Enter explore mode - a thinking partner for exploring ideas, investigating problems, and clarifying requirements. Use when the user wants to think through something before or during a change.

Fast-forward through OpenSpec artifact creation. Use when the user wants to quickly create all artifacts needed for implementation without stepping through each one individually.

Start a new OpenSpec change using the experimental artifact workflow. Use when the user wants to create a new feature, fix, or modification with a structured step-by-step approach.

Guided onboarding for OpenSpec - walk through a complete workflow cycle with narration and real codebase work.

Sync delta specs from a change to main specs. Use when the user wants to update main specs with changes from a delta spec, without archiving the change.

Analyze indexed codebases via graph database (neug) and vector index (zvec). Covers call graphs, dependencies, dead code, hotspots, module coupling, architecture reports, semantic search, impact analysis, bug root cause from GitHub issues, class diagrams…

Submit a new issue to the project.

Submit a new Pull Request to the project.

Analyze new commits and generate related test cases.

Execute the implementation planning workflow using the plan template to generate design artifacts.

Create or update the feature specification from a natural language feature description.

Generate an actionable, dependency-ordered tasks.md for the feature based on available design artifacts.

Cerate or Update a GitHub Issue for each Module in the task document.

Runs .continue/checks locally against the current diff, simulating a PR review before pushing.

Deploys React/Vite applications to Alibaba Cloud ESA Pages. Use when the user needs to deploy frontend applications, manage deployments, configure custom domains, or troubleshoot deployment issues on ESA (Edge Security Acceleration) platform.

[project] OPC-Starter 测试驱动开发规范。管理和执行 Playwright E2E 测试、演示模式测试、单元测试的完整工作流。适用于新增功能时补充测试用例、运行认证/注册/演示测试、维护测试规划文档。当用户提到测试、E2E、Playwright、演示、用例、质量、补充测试时使用。

OPC-Starter 智能开发技能。AI 亲和的 React Boilerplate 项目开发规范，支持动态上下文感知、TDD 驱动开发、Agent Studio 扩展。适用于认证系统、组织架构、Agent 工具、数据同步等模块的迭代开发。

代码仓库 AI 亲和度审计工具，支持前端、后端、全栈等各类项目。此技能用于检查给定的代码仓库对 AI Coding 工具的友好程度，生成详细的分析报告和改进建议。当用户需要评估代码仓库是否适合 AI 辅助开发、希望提升仓库的 AI 可操作性、或准备引入 AI Coding 工具前进行仓库评估时，应使用此技能。支持 TypeScript/JavaScript、Go、Java/Kotlin、Python、Rust 等主流技术栈。融合 OpenAI Harness Engineering 方法论，评估 Outer…

OPC-Starter 智能开发技能。AI 亲和的 React Boilerplate 项目开发规范，支持动态上下文感知、TDD 驱动开发、Agent Studio 扩展。适用于认证系统、组织架构、Agent 工具、数据同步等模块的迭代开发。

IHS（IDE Harness Score）仓库健康评估技能。用于衡量 AI Coding IDE 驾驭能力下的代码仓技术债变化趋势，输出 IHS.md 评测报告（代码腐化、测试信号、文档对齐、变好/变坏结论）。

Create distinctive, production-grade frontend interfaces with high design quality using Mobile First strategy. Analyzes design systems from screenshots, generates Tailwind CSS + Shadcn UI configurations, and retrofits existing projects. Optimized for Claude…

Prerequisites and connection details for attaching to a live Python process with PyFlightProfiler. Read this skill first before using any other PyFlightProfiler command (watch, trace, stack, perf, etc.).

Inspect Python module global field or class static field value in a running Python process. Use this for safe, read-only inspection of global variables, configuration objects, or class-level state.

Translate a file path to its Python module name in a running Python process. Use this when you know a file path but need the module name for commands like watch, trace, or reload.

Hot-reload a Python function implementation from the latest file content without restarting the process. Use this to apply code fixes live after identifying a bug with watch/trace.

Inspect stack frames of a running Python process including thread stacks, native C-level frames, and async coroutine stacks. Use this to see what each thread is currently doing and diagnose hangs, deadlocks, or stuck async tasks.

Trace execution time of Python method invocations in a live process with call stack visualization. Use this to see a hierarchical call tree showing which sub-calls are slow and where time is spent within a function.

Inspect live Python class instances in a running process — find all instances of a class, examine their attributes/state, or invoke methods on them. Also supports forcing GC. Use this when you need to probe object-level runtime state beyond what…

Display input/output args, return object and cost time of a Python method invocation in a live process. Use this to observe function behavior at runtime — see what arguments go in, what comes back, and how long it takes. This is the most frequently used…

Sample skill fixture for classpath registry enhancement tests.

商品文案写作助手。根据商品信息生成吸引人的营销文案。当用户提到"写文案"、"商品描述"、"营销文案"时使用此技能。

选品分析助手。根据市场趋势和用户需求，分析并推荐适合的商品品类。当用户提到"选品"、"商品推荐"、"品类分析"时使用此技能。

Database schema and business logic for inventory tracking including products, warehouses, and stock levels.

Database schema and business logic for sales data analysis including customers, orders, and revenue.

Test skill for groupedTools. When executing this skill, use the record_result tool to record the result value.

Extract text, tables, and form data from PDF documents for analysis and processing. Use when user asks to extract, parse, or analyze PDF files.

Mine a per-kernel optimization trace — a git repository capturing successive versions of one kernel being optimized — into structured, gate-validated optimization-experience records for the GPU kernel wiki. Use when asked to distill an optimization run, a…

Quickly extract a typed GPU-Wiki query intent from prose. Never inspect or query a knowledge store.

Mine AI coding-agent session transcripts into structured, gate-validated GPU-kernel optimization records for the wiki. Use when asked to turn vibe-coding sessions, Codex rollout logs, or Claude Code project transcripts into wiki records; to summarise what a…

Learn the target framework from gpu-wiki and implement a baseline GPU kernel. Use this skill to understand compute semantics, determine the target platform and framework, search reference implementations, and produce a correct V0 baseline with performance…

Run the evidence loop of one long-horizon GPU kernel optimization episode. Use this skill to reconstruct the incumbent, profile and localize a bottleneck, research progressively, plan one coherent direction, implement and repair, validate development…

Generate a structured implementation plan from an evidence draft. Validate paths, obtain independent Codex and Qoder reviews, synthesize their advice against repository evidence, preserve the draft, and produce testable acceptance criteria and validation…