awesome-skills

Perform auditable research with executable mode budgets, mandatory source-content verification, typed web and repository evidence, confidence assessment, honest degradation, and one fixed nine-section report. Use for web research, claim verification, technical comparisons, trend analysis, pure codebase research, and hybrid codebase-plus-web investigations that need traceable conclusions rather than search-result summaries.

Use when creating or refactoring GitHub Actions CI workflows for Go repositories. Covers repository-shape detection, Make-driven delegation with formal fallbacks, Go setup, caching, tool pinning, permissions, reusable workflows, and quality gate design.

Create evidence-backed pull requests to the GitHub main branch with strict preflight, quality, and security gates. Use when users ask to create/submit/open/update a PR to main (including private repos), decide draft vs ready state, and provide reviewer-ready context for team review.

Canonical skill for Go Makefiles. Create/refactor root Makefiles for Go repositories with standardized build/test/lint/run targets, self-documenting help output, predictable artifacts, and maintainable target naming.

Safely create a git commit by validating repository state, staging intended changes, scanning for secrets/conflicts, generating a Conventional Commits message (repository convention first, else an English Angular default) from the staged diff, and committing without amend.

Performance load testing specialist for writing k6/vegeta/wrk scripts, defining SLOs, modeling scenarios (spike/soak/stress/breakpoint), analyzing results, and identifying bottlenecks. ALWAYS use when writing load test scripts, reviewing test results, designing test scenarios, setting performance SLOs, or diagnosing latency and throughput issues at the service level. Complements go-benchmark (micro-level function profiling) with macro-level end-to-end service testing. Use proactively for any pre-release performance validation, capacity planning, or production incident investigation involving latency/throughput.

Write, review, and improve technical documents (技术文档, 设计文档, 操作手册, 故障报告, API文档). Use when users ask to write/draft/review/improve a technical document, create an RFC/ADR, write a runbook or operation guide, produce API docs, or create any structured technical writing deliverable. Audience-aware, evidence-based, with quality gates and anti-staleness enforcement. Supports concept docs, task docs, reference docs, troubleshooting docs, and design docs (RFC/ADR).

Generate or refactor project README.md files using repository evidence. Use when the user asks to create/rewrite/standardize README, improve documentation structure, or produce maintainable README templates for different project types (service/library/CLI/monorepo).

Exploitability-first standalone security review of code changes, diffs, PRs, or services. Use when asked for a security review, security audit, vulnerability assessment, or pre-merge security check (安全审查/安全评审/漏洞排查) — covers auth, input, secrets, API, data, concurrency, container, third-party, and dependency risk across Go, Node.js/TypeScript, Java, and Python, with mandatory evidence, false-positive suppression, scope-based depth (Lite/Standard/Deep), and CWE/OWASP-mapped machine-readable output. NOT for general-purpose Go code review — use go-review-lead for that (it dispatches go-security-review as its security dimension); this skill is the deeper security-only process with mandatory gates and audit-grade output.

Orchestrate a comprehensive US-stock investment analysis by classifying sector archetype, fetching SEC filings, dispatching six vertical equity-research skills (business model, earnings quality, balance sheet, management, industry & competition, peer comparison) as parallel agents, then synthesizing a buy/hold/sell verdict with Bull/Base/Bear target-price ranges using sector-aware thresholds and calibrated probability assignment. Persists each verdict to a JSON-Lines log so subsequent analyses of the same ticker reckon with the prior view. Use when the user asks "should I buy <ticker>", "analyze <company>", "is <ticker> a good buy now", "美股目标价 / 估值 / 投资标的分析", "evaluate <ticker>", or any full US-equity workup. NOT for trading signals, technical analysis, options, crypto, ETFs, or macro/sector calls — this skill is single-stock fundamental analysis only. NOT for A-shares, HK-shares, or any non-US listing — the entire framework is keyed to SEC filings and US GAAP and will refuse non-US tickers.

Review a US-listed company's industry position and competitive moat for an equity-research workup. Covers Porter Five Forces scan, market-share trend (absolute and relative to industry growth), TAM size and trajectory, unit economics where disclosed (LTV/CAC, unit gross margin), moat classification (network / brand / scale-cost / switching-cost / patent / regulatory / proprietary-data), substitute threats, new-entrant threats, pricing-power evidence, supplier/channel concentration risk, and regulatory exposure. Trigger when analyzing competitive position at L6 of the seven-layer X-ray framework. Dispatched by stock-analysis-lead; at Lite depth runs in Lite-Industry mode (moat type + share trend only, no full Porter scan).

Review a US-listed company's balance sheet health for an equity-research workup. Covers net-debt/EBITDA leverage, current ratio, cash runway, goodwill concentration and impairment history, DSO trend, inventory days, off-balance-sheet items (operating leases, contingent liabilities), and pension underfunding. Trigger when analyzing financial-statement risk at L4 of the seven-layer X-ray framework, or when assessing whether the company can survive a downturn. Dispatched by stock-analysis-lead.

Review a US-listed company's business model and revenue structure for an equity-research workup. Covers product/service mix, customer concentration, geographic exposure, industry position, revenue-growth decomposition (organic vs acquired vs price vs volume), and information-tier discipline (which numbers are facts vs management narrative). Trigger when analyzing a single US ticker's business fundamentals, when reading 10-K Item 1 "Business" and Item 1A "Risk Factors", or when the orchestrator stock-analysis-lead dispatches business review. Dispatched by stock-analysis-lead or invoked directly for business-focused analysis.

Review a US-listed company's earnings quality, cash-flow integrity, and operating leverage for an equity-research workup. Covers operating cash flow vs net income drift, free cash flow trajectory, capex character (maintenance vs expansion), equity issuance / shareholder-return yield, revenue-quality signals (receivables vs revenue growth, channel stuffing), gross-margin level and trend, operating leverage, and three-cost-rate hygiene (S&M, R&D, G&A). SaaS-specific: ARR/NRR/GRR/CAC payback/Magic Number. Trigger when analyzing financial statements at L1+L2+L3 of the seven-layer X-ray framework. Dispatched by stock-analysis-lead.

Monitoring and alerting design reviewer for production backend services. ALWAYS use when writing Prometheus alerting rules, designing Grafana dashboards, defining SLI/SLO, configuring alert routing (PagerDuty/OpsGenie/Slack), or reviewing existing monitoring setups. Covers SLI/SLO definition, alert rule quality (sensitivity/specificity tradeoff), burn-rate alerting, alert fatigue prevention, dashboard design principles, label cardinality management, and on-call routing configuration. Use even for "just add an alert" — a poorly designed alert either pages at 3AM for non-issues (alert fatigue) or stays silent during real outages (false confidence).

Incident post-mortem specialist for writing blameless post-mortems, extracting timelines from logs/events, conducting root cause analysis (5-Why, fishbone), classifying severity, and generating tracked action items. ALWAYS use when writing a post-mortem, reviewing an incident, extracting a timeline, performing root cause analysis, or converting incident data into organizational knowledge. Complements systematic-debugging (finds the cause) with structured documentation that prevents recurrence.

Go performance benchmarking and pprof profiling specialist. ALWAYS use when writing benchmark functions (testing.B), generating or reading pprof profiles, interpreting flame graphs, finding memory allocation hotspots, comparing implementations with benchstat, or measuring ns/op / B/op / allocs/op. In Go code contexts, also trigger when the user says "it's slow", "too many allocations", "find the bottleneck", or "profile this Go code".

Generate Go fuzz tests (Go 1.18+ testing.F) for specified code when users ask for fuzzing/模糊测试/fuzz test generation, parser robustness, round-trip, or differential fuzzing. Always run an applicability gate first; if the target is not suitable, explain concrete reasons and stop without writing fuzz test code.

Generate and run yt-dlp download commands with probe-driven format selection, safe output naming, retry defaults, and structured execution reports. Use when users want to download videos, extract audio, fetch playlists, grab subtitles, handle authenticated/age-gated content, or download live streams. Covers single videos, playlists, audio extraction, subtitle-inclusive downloads, format-ID / resolution-capped downloads, SponsorBlock integration, live streams, and browser-cookie authentication.

Orchestrate a comprehensive Go code review by triaging code changes, dispatching vertical review skills (security, concurrency, error, logic, performance, quality, test, observability) as parallel agents, then consolidating results into a unified report. Use for full Go PR review or comprehensive code review. Replaces the monolithic go-code-reviewer with focused parallel analysis.

Review a US-listed company's management quality and capital-allocation track record for an equity-research workup. Covers 5-year capital-allocation history (buybacks vs dividends vs M&A vs capex vs debt), buyback timing, M&A return-on-investment, guidance-vs-actuals track record, comp-structure alignment, insider ownership and trading activity, earnings-call communication style, and strategic-thesis stability. Trigger when analyzing the human-judgment layer (L5 of the seven-layer X-ray) — the most under-rated and longest-impact dimension. Dispatched by stock-analysis-lead.

Independently benchmark a US-listed target equity against 2-4 closest peers on a fixed 12-item ratio panel — growth rates, profitability, capital intensity, balance sheet leverage, capital returns, and valuation multiples. Provides cross-validation for moat and market-share claims made by the business and industry reviewers. Trigger when running a Standard-or-deeper stock-analysis-lead workup; supplies the independent quantitative comparison that single-name analysis cannot. Dispatched by stock-analysis-lead.

Senior-SRE log analysis specialist. Use when investigating incidents from logs, triaging error spikes, extracting timelines, correlating distributed traces, or separating signal from noise across plain-text, JSON (slog/zap), syslog, journald, container, and Kubernetes logs. ALWAYS use when the user asks to "analyze logs", "find the error", "what went wrong", "investigate this outage", "correlate request_id/trace_id", "look at the log file", or hands over log dumps / aggregator queries / kubectl logs output. Hands off to incident-postmortem when a blameless post-mortem document is requested.

Compress chaotic information into a leader-ready structure before output. ALWAYS use when the user is preparing to brief a senior leader, present a technical proposal, write a one-pager, or otherwise turn scattered facts and feelings into Frame → Crux → Nodes → Tilt + Reasoning that fits in 3–5 minutes of reading. Trigger phrases include "向领导汇报", "做技术方案 presentation", "整理思路", "report up", "brief the boss", "summarize for leadership", "executive briefing", "one-pager". NOT for writing the final polished document (use tech-doc-writer), NOT for decomposing tasks into implementation steps (use writing-plans), NOT for incident root-cause analysis (use incident-postmortem), NOT for aggregating research with citations (use deep-research).

REST API contract designer and reviewer. ALWAYS use when designing new endpoints, reviewing existing API contracts, planning API versioning, or standardizing error models. Covers resource modeling (URL/naming), HTTP method semantics, status code selection, error model consistency, pagination/filtering/sorting, idempotency keys, concurrency control (ETag/If-Match), object-level authorization (IDOR prevention), rate limiting, backward compatibility assessment, and OpenAPI-ready output. Use even for "just add an endpoint" — inconsistent APIs compound into integration nightmares that are extremely expensive to fix after clients depend on them.

Go dependency audit specialist for CVE scanning (govulncheck), license compliance, outdated dependency detection, upgrade impact analysis, and supply chain security. ALWAYS use when auditing go.mod dependencies, running govulncheck, checking license compatibility, planning dependency upgrades, or investigating supply chain risks in Go projects. Complements security-review (code-level) with module-level supply chain analysis.

Kafka event-driven architecture designer and reviewer. ALWAYS use when designing, reviewing, or troubleshooting Kafka-based event systems — topic design, partition strategy, consumer group configuration, event schema definition (Avro/Protobuf/JSON), idempotent consumers, dead letter queues, exactly-once semantics, Schema Registry compatibility, backpressure handling, and consumer lag monitoring. Use even for "just publish an event" — Kafka's partition-ordered-not-globally-ordered semantics, at-least-once default delivery, and consumer rebalance storms are the source of most production event-driven bugs.

MongoDB schema migration safety reviewer and migration script generator. ALWAYS use when writing, reviewing, or planning MongoDB schema changes — field additions/removals, index builds, schema validator changes, document type migrations, shard key modifications, or any bulk update touching production collections. Covers index build lock behavior (foreground vs rolling builds), additive schema evolution, _id-range batched updates, write concern tuning during migration, reshardCollection (5.0+), collMod validator changes, and rollback planning. Use even for "just add a field" — MongoDB's schema-less nature makes silent type inconsistencies and missing-field bugs harder to detect than RDBMS constraint violations.

MySQL schema migration safety reviewer and DDL generator. ALWAYS use when writing, reviewing, or planning MySQL schema changes — ALTER TABLE, CREATE/DROP INDEX, column type changes, charset conversions, data backfills, or any DDL touching production tables. Covers online DDL algorithm selection (INSTANT/INPLACE/COPY), lock-safety analysis, large-table migration with gh-ost/pt-osc, phased rollout design, replication-safe DDL, backward compatibility, and rollback planning. Use even for "simple" ADD COLUMN — MySQL DDL locking behavior is version- and operation-dependent, and mistakes cause production outages.

Oracle Database schema migration safety reviewer and DDL generator. ALWAYS use when writing, reviewing, or planning Oracle schema changes — ALTER TABLE, CREATE/DROP INDEX, column type changes, constraint additions, partition DDL, or any DDL touching production tables. Covers DDL auto-commit implications, DDL_LOCK_TIMEOUT, DBMS_REDEFINITION for online table restructuring, ENABLE NOVALIDATE constraint patterns, global index impact from partition DDL, CTAS-based migration, ROWID-range batching, and Flashback recovery. Use even for "simple" ADD COLUMN — Oracle DDL issues implicit COMMIT before and after execution, making every DDL statement irreversible without manual rollback planning.

PostgreSQL schema migration safety reviewer and DDL generator. ALWAYS use when writing, reviewing, or planning PostgreSQL schema changes — ALTER TABLE, CREATE/DROP INDEX, column type changes, constraint additions, RLS policy changes, or any DDL touching production tables. Covers lock-level analysis, CREATE INDEX CONCURRENTLY, NOT VALID constraint patterns, transactional DDL rollback, pg_repack for table rewrites, phased rollout design, and backward compatibility. Use even for "simple" ADD COLUMN — PostgreSQL DDL lock behavior varies by operation and version, and AccessExclusiveLock on a hot table causes immediate outage.

Redis caching strategy designer and reviewer. ALWAYS use when designing, reviewing, or troubleshooting Redis caching layers — cache pattern selection (cache-aside, write-through, write-behind), TTL strategy, cache stampede/penetration/avalanche prevention, hot key handling, cache-DB consistency, distributed locking, key naming, and degradation design. Use even for "just add a cache" requests — cache invalidation is one of the two hard problems in computer science, and a naive implementation creates subtle consistency bugs that surface only under load.

Design, maintain, and execute reliable end-to-end tests for critical user journeys with Agent Browser as first choice for exploration and Playwright as the preferred code path for suites and CI. Use for E2E strategy, journey coverage, flaky test triage, artifact collection, CI gating, regression prevention, and browser automation tasks.

Review Go code with a defect-first approach using repository policy (constitution.md first, then AGENTS.md fallback). Use for code review, PR review, quality checks, risk analysis, and regression detection.

Review Go code for observability gaps: missing structured logging, broken trace context propagation, Prometheus cardinality explosions, span lifecycle errors, and sensitive fields in logs. Dispatched by go-review-lead as a vertical reviewer. Also trigger directly when the user says "review my logging", "check my tracing", "observability review", or "are my metrics correct".

Use when the user asks for unit tests (e.g, "单元测试", "unit test"), wants to add/fix Go tests, wants table-driven and subtest organization, or wants to enforce a minimum coverage gate (default 80% for logic packages). Prioritize bug discovery (especially boundary, mapping loss, and concurrency defects) over test volume. Do NOT use for benchmarks, fuzz tests, integration tests, E2E tests, load tests, or mock generation.

Create, maintain, and run gated Go integration tests for internal APIs and service-to-service clients (HTTP/gRPC). Use for endpoint verification, contract checks with real runtime config, opt-in execution, timeout/retry safety, and integration failure triage in Go services.

Review Go code for error handling correctness, nil safety, and failure-path integrity including ignored errors, missing wrapping, panic misuse, SQL/HTTP resource lifecycle, and transaction patterns. Trigger when code contains error returns, panic calls, sql.Rows, transactions, HTTP client/server code, or nil-sensitive pointer operations. Use for error-handling and correctness-focused review.

Review Go code for code quality, style, and modern Go practices including function length, nesting depth, naming, mutable globals, interface design, receiver consistency, modern Go idioms (slog, generics, typed atomics), and static analysis. Trigger when reviewing Go code structure, readability, or maintainability. Also runs golangci-lint for automated style checks.

Transcribe a specified local video or audio file into cleaned final `.txt`, `.pdf`, or `.docx` transcripts using speech recognition with Apple Silicon GPU acceleration and LLM-based proofreading. Use when the user wants text extracted from a local media file path such as `.mp4`, `.mov`, `.mkv`, `.webm`, `.mp3`, `.m4a`, or `.wav`, and the output language should follow the spoken language in the media automatically. Prefer this skill for local-file transcription workflows that should produce cleaned transcripts with natural paragraphs, LLM-corrected Chinese text, and simplified Chinese output for Chinese speech.