菜单
Use when a secret may have been committed or is about to be. Covers high-signal detection patterns and the correct remediation order — rotate the credential first, then remove it from code and history. Always redact when reporting.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use when designing memory or persistent context for an agent — deciding what to persist vs. recompute, how to retrieve only what's relevant, and how to summarize/compact history to fit the context window. Use when an agent forgets, bloats its context, or repeats work.
Interactive installer for Rosetta. Guides users through selecting and installing skills and language-specific rules at user-level or project-level, verifies paths, and optionally optimizes installed files.
Instinct-based learning system that observes sessions via hooks, creates atomic instincts with confidence scoring, and evolves them into skills, commands, and agents.
Use when building or reviewing an evaluation for an LLM feature — assembling a representative test set, choosing pass criteria (exact match, programmatic checks, rubric, or LLM-as-judge), and catching regressions. Use when asking "how do I know this prompt or model change is better?"
Use when writing or reviewing a prompt for an LLM — making it specific, structured, and testable (clear task, role/context, examples, an explicit output contract, decomposition, room to reason) and avoiding the anti-patterns that make prompts brittle. Provider-agnostic.
Pattern for progressively refining context retrieval to solve the subagent context problem.
| name | secret-remediation |
| description | Use when a secret may have been committed or is about to be. Covers high-signal detection patterns and the correct remediation order — rotate the credential first, then remove it from code and history. Always redact when reporting. |
A committed secret should be treated as compromised the moment it lands, even in a private repo. The clock starts at commit time, not at discovery.
AKIA…/ASIA…), GCP/Azure key blobs.ghp_…, github_pat_…), Slack (xox…), Stripe (sk_live_…),
npm, PyPI tokens.-----BEGIN … PRIVATE KEY----- block.scheme://user:password@host/db with embedded credentials.*secret*, *token*,
*password*, *api*key*, especially in .env, config, or CI files.Filter false positives: placeholders (example, changeme, xxxx), test fixtures, and
documented sample values.
git filter-repo
or BFG) and force-push, then have collaborators re-clone. Rotation (step 1) matters more
than a clean history — a rotated secret in old history is harmless..gitignore, add a pre-commit secret scan, and
document where the real value lives.AKIA****), never the full value — the report
itself can leak.