Tencent

当用户要求 AI/Agent 安全评估、蓝军演习、AI 安全审查、提示词注入测试、MCP/Skill/插件/代码包审计、Agent 工具链滥用测试，或需要生成类似渗透测试报告的 Markdown/HTML 时，必须使用本 skill。本 skill 让 Agent 以授权蓝军视角成为 AI 安全专家，面向 AI 产品、Agent、MCP Server、Skill、代码仓库和 AI 基础设施进行安全演习。优先使用第一性原理推理和真实证据，而不是机械跑 payload 库；脚本只用于 HTTP…

Detect agentic supply-chain risks: compromised dependencies, malicious plugins/tools/models, and untrusted update sources.

Detect error propagation, chain failures, and single-point breakdowns that cascade across agent workflows.

Detect social engineering, deceptive responses, false assurances, or prompts that induce unsafe user actions.

Detect data leakage, missing boundaries, or privilege mismatch in inter-agent communication.

Detect command injection, eval/exec usage, remote execution, or arbitrary code loading.

OWASP Top 10 for Agentic Applications 2026 (ASI) classification framework. Use for mapping security findings to standardized risk categories.

Detect privilege escalation and unauthorized access via dialogue. Use when the agent has roles, admin functions, or multi-user data.

[WIP / 待补充] 公共知识图谱（KG）操作 skill，当前未启用，内容待校对完善后再激活。

生成 HTML 知识卡片，用于可视化展示值得复习的知识点。

出题与测验，评估用户对知识节点的掌握情况。

LaTeX Beamer 教学讲义编写技能 — 从文件读取资料、生成插图、撰写 TeX、编译 PDF 的完整指南。

读写文件、管理工作区文件。

PDF 课件生成编排技能 — 规划大纲、委派子 Agent、通过文件系统传递中间产物。

通过 exec 工具执行 Python 代码，用于计算、数据处理和分析。

网络搜索与页面抓取。

You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.

通用知识沉淀能力 - 提供从项目交付过程中提炼可复用经验、教训和模式的标准化方法论，包括信息收集、精简提炼、结构化输出。不绑定任何特定工作流或存储方式。当用户说"帮我做知识沉淀"、"总结一下这次需求的经验"、"记录一下踩坑"、"沉淀一下这次的技术决策"、"做个复盘"时使用本技能。

通用技术方案撰写技能。根据需求输入（需求分析报告或口头描述）自动生成结构完整的技术方案 Markdown 文档。当用户说"帮我写技术方案"、"出一个技术设计文档"、"写一份 design doc"、"给这个需求出方案"时使用本技能。

Use when you have a spec or requirements for a multi-step task, before touching code

在 Codex 中运行 devflow。用户提到 devflow、start/resume/status/abort devflow、多 agent 工作流，或要求“按 Codex devflow 跑”时使用。

通用知识沉淀能力。用于从 devflow 或其他交付过程的需求、设计、实现、审查、测试产物中提炼可复用经验、技术决策、踩坑记录和流程改进。

Use during devflow TASK-01 requirement clarification before design or implementation. Explores user intent, requirements, constraints, and success criteria.

You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.

在编码或架构设计前强制执行"需求澄清 → 可行性分析 → 结构设计 → 测试设计 → 编码实现 → 校验 → 文档同步"的七步流程。 适用于功能开发、重构、新模块创建、架构讨论与设计评审等需要先设计后实现的场景。 关键词：development spec、先设计后编码、架构讨论、设计评审、需求确认、结构体设计、单元测试先行、vibe testing。

kDiT 架构知识库：全局架构图、数据流、Node/Pipeline/Generator/Adapter 子系统设计、 PinHub 沙箱机制、PoolKey 间接寻址、DeviceInfo/NodeContext 规范。 关键词：architecture、架构、Node、Pipeline、Generator、Adapter、Engine、Executor、PinHub、Pool。

kDiT 编码规范：Import 风格（方案 B）、Python 3.10+ 类型注解、Key 类型体系、 Node/Tensor API 开发约束、异常处理规则、类命名规范。 关键词：standards、规范、import、类型注解、Key、异常处理、命名。

kDiT 质量保障与交付验收：单元测试规范（*_test.py 命名、tests/kdit/ 镜像结构）、 pre-commit 格式检查（black 120字符、ruff）、pytest vs ruff 维度差异、文档同步规则。 关键词：quality、测试、test、pytest、pre-commit、ruff、black、验收。

Bug 修复工作流：修复 bug 时强制执行"根因分析 → 反思测试缺口 → 修复代码 → 补充单元测试 → 验证"流程。 确保每次 bug 修复都附带回归测试，并反思为什么现有测试没能覆盖到。 关键词：bug fix、修复、regression、回归测试、测试缺口。

kDiT 代码评审技能：除常规 CR 项（安全漏洞、格式规范、逻辑正确性）外，重点基于项目 .skills/ 中的架构设计 和编码规范进行评审，确保代码不违背设计原则和约束。 关键词：code review、CR、评审、review、架构合规。

系统化调试工作流：当现象不明确、根因未知时，强制执行"信息收集 → 假设生成 → 逐层验证 → 定位根因 → 记录结论"的排查流程。 区别于 bugfix（已知问题修代码），debug 侧重于从混沌的现象中找到问题本质。 关键词：debug、调试、排查、诊断、日志分析、二分法、断点、现象不明。

kDiT 性能调优专家：GPU OOM 排查、推理延迟分析、tensor 内存优化、分布式通信瓶颈诊断。 针对视频生成推理框架的特有性能问题，提供系统化的 profiling → 分析 → 优化 → 验证流程。 关键词：performance、性能、OOM、内存、GPU、延迟、profiling、优化、throughput。

Converts an HTML file/URL or a described visual (poster, card, banner, social post) to a PAGX file, and edits existing PAGX files. Use when the user asks to create a PAGX from a visual description, convert HTML to PAGX, modify/update an existing PAGX, run…

Automated code review and fix for local branches, PRs, commits, and files. Supports single-agent interactive fix and multi-agent adversarial review with auto-fix.

Accept screenshot baseline changes and commit the updated version.json.

Analyze branch commits and consolidate iterative modifications.

Commit local changes without pushing.

Commit and push changes, then create a new PR or append to an existing one.

SkillHone — toolkit for evaluating, optimizing, and managing agent skills. Use when asked to "evaluate a skill", "run probe", "optimize/iterate a skill", "create a new skill experiment", "seed a skill repo", or "run skill benchmarks"; also use when the user…

Forgejo REST API toolkit — manage issues, pull requests, wikis, and repos on a Forgejo server. Use when the agent needs to file an issue, open / review / merge a PR, read or write a wiki page, or look up repo / branch info. One standalone script per resource…

Optimize a skill by planning, exploring available tools, diagnosing failures, and implementing fixes via PR. Use this skill as soon as an optimization loop starts, especially on the first iteration when community tools or reference approaches should be…

Use this skill to synthesize closed-form, automatically verifiable benchmark Q/A by exploring a tool environment, building a reusable exploration graph, and mining multiple hard questions from that graph. Use for: building a benchmark, writing eval items,…

Run and interpret skill evaluations. Use when you need to evaluate a skill, run probe/test/PR-val, check if a PR regresses quality, compare two versions, or diagnose why the score dropped. Handles the full eval lifecycle including solver trajectory diagnosis…

Interactively gather a PRD (Product Requirements Document) for an agent skill that is about to be built or optimized by SkillHone. Use when the user says things like "I want to write a new skill", "help me spec this skill", "what should <x>-skill do", or…

Minimal text2sql skill. Gives you tools and knowledge to generate SQL — no required workflow.

Feature engineering skill for taobao/dia AUC maximization. Provides dataset-specific domain knowledge and code patterns — no forced pipeline.

Convert a Multi-Agent System (MAS) into a single-agent skill, adaptively adjusting how much structure to retain based on the target task's evaluation metric. Analyzes task freedom first, then converts accordingly. Invoke with /adaptive_mas_converter.

Text-to-SQL for Spider 2.0-Snow (Snowflake cloud databases). Use when you receive a natural-language question plus a Snowflake database schema and need to produce correct, executable Snowflake SQL. Provides SQL execution tools, keyword-based tip selection,…

Compile a Multi-Agent System (MAS) into a Single-Agent System (SAS) by faithful pipeline compression. Implements the 3-phase compilation from arXiv 2601.04748. Takes a MAS codebase or description as input; produces a compiled SKILL.md with sequential [PHASE]…

Use when retrieving from or asking questions against a WeKnora knowledge base via the `weknora` CLI — and especially when unsure whether to use `chat`, `session ask`, or `search chunks` for a given goal.

Use when driving a WeKnora RAG server through the `weknora` CLI as an agent — authenticating, managing knowledge bases / documents / sessions / agents, running search or chat, or interpreting the CLI's JSON envelopes and exit codes. Read this before any other…

将 RAG 检索结果、文档块或知识图谱概念转换为 OpenMAIC 互动课程。当用户要求将知识库内容、检索到的文档片段、上传的文档、或知识图谱中的概念批量转换为教学课件/互动课堂时使用此技能。支持纯需求生成、基于 PDF 内容的课程生成、和基于概念图遍历的批量课堂生成。

Extract text and tables from PDF files, fill forms, merge documents. Use when working with PDF files or when the user mentions PDFs, forms, or document extraction.

This skill should be used when developing or modifying styles for TDesign React components. It provides guidance on BEM naming conventions, CSS Variables usage, state classes, and the relationship between component code and common submodule styles.

This skill should be used when creating a new TDesign React component. It provides a complete SOP for scaffolding components in the packages/components or packages/pro-components directories, including file structure, code patterns, and registration steps.

This skill should be used when developing or modifying TDesign Pro Components (AIGC/Chat). It provides the ChatEngine architecture, component patterns, AG-UI protocol integration, and Generative UI development guide.

This skill should be used when writing or maintaining unit tests for TDesign React components. It provides testing patterns, best practices, and SOP for Vitest-based component testing including snapshot tests.

Guide for downloading and installing PuerTS UPM packages into a Unity project — covers version selection, package dependencies, download/extract and git URL installation methods, and Editor Assistant setup.

指引如何为 puerts 项目编写 Unity 和 Unreal 的 changelog

Guide for developing LLM agents based on PuerTsAgent framework — covers resource directory structure, system-prompt, skills, builtin modules, and best practices.

Browser automation through six injected domain tools.

Use when the user asks to perform browser automation tasks against their logged-in browser: visit and read pages, fill forms, scrape data, click through a flow, regression-test a PR's UI, validate a deployed page. Requires the bsk CLI installed and the…

TDesign Flutter 仓库面向所有 AI 助手（通用 Codex / Cursor 等）的通用协作约定，重点给出「何时创建 Spec」与「何时写更新日志」的判断规则（含每次组件修改 / 简单外部改动 / 用户可感知行为的四种情况），以及 Flutter 3.32.0 与 latest 双版本兼容、组件 breaking change 分析、文档来源与注释规范、代码质量 / lint 零告警等平台无关约定。平台无关规范以 CONTRIBUTING.md / specs/README.md…

TDesign Flutter 仓库面向 CNB 平台 NPC 的执行约定（基于 Issue 创建分支的 cnb-issue-<issue.number> 命名、PR 模板填写、close