Skill reviews

Greet the user.

• Prose only: no discrete steps
• Does not say what the result is

Greet the user.

• Prose only: no discrete steps
• Does not say what the result is

Prove a UI that updates before the server answers puts things back and says so when the request fails, and keeps the change when it succeeds. Use when a like, toggle, rename, reord

• Prose only: no discrete steps
• Does not say what the result is

Drive a live browser with async Python against QwenPaw's builtin Browser SDK. The full reference is below; re-load this browser skill after context compaction.

• Does not say what the result is
• No condition that starts the skill

用异步 Python 调用 QwenPaw 内置 Browser SDK 驱动真实浏览器。完整参考在下方；上下文压缩后请重新加载此 browser skill。

• Does not say what the result is
• No condition that starts the skill

Publish an approved Orchard release

• Prose only: no discrete steps
• Does not say what the result is

Review Orchard deployment manifests

• Prose only: no discrete steps
• Does not say what the result is

Review a release proposal

• Prose only: no discrete steps
• Does not say what the result is

Review a release proposal

• Prose only: no discrete steps
• Does not say what the result is

Operate and validate Obscura for JavaScript page loading, stealth browsing, anti-fingerprinting, tracker blocking, screenshots and visual comparison, CDP automation with Puppeteer

• Prose only: no discrete steps
• Does not say what the result is

Get a branch ready for the maintainer's final review. Review it for security, simplicity, and billing abuse, fix what's real, get checks passing, and open or update the PR. Use whe

• Prose only: no discrete steps
• Does not say what the result is

OS Command Injection — exploiting applications that pass user input to OS commands without sanitization. Covers injection operators (;, |, ||, &&, $(), backticks, newline), blind d

• Prose only: no discrete steps
• Does not say what the result is

Authentication surface — login endpoints, JWT/OAuth/SAML/SSO/API-key mechanism identification.

• Prose only: no discrete steps
• Does not say what the result is

CMS-specific scans — WordPress (wpscan), Joomla, Drupal version detection.

• Prose only: no discrete steps
• Does not say what the result is

Container / Kubernetes attack category — pod escape, RBAC abuse, runtime CVE exploitation, socket-mount escape. Routing skill: identify the surface (pod-internal RCE vs API-level v

• Prose only: no discrete steps
• Does not say what the result is

Fast-path binary triage — identify format/arch/mitigations, grab high-signal strings and imports in under a minute.

• Prose only: no discrete steps
• Does not say what the result is

ICS / OT attack category — Modbus, BACnet, S7Comm, DNP3. Routing skill: fingerprint the industrial protocol by port + Wireshark dissector, then load the matching sub-skill. SAFETY-

• Safety rules and hard prohibitions inside a skill: they belong in the system prompt, here they protect nothing
• Prose only: no discrete steps
• Does not say what the result is

Five-stage modular vulnerability pipeline orchestrator. Delegates scan → detect → verify → patch → exploit through OPPLAN objectives. Load at orchestrator startup.

• Prose only: no discrete steps
• Does not say what the result is

Root pointer for the analyst's vulnerability research playbooks and catalog of vuln-class and chain-building skills.

• Prose only: no discrete steps
• Does not say what the result is

Use when a development pod begins or hands off implementation, QA, or design work.

• Prose only: no discrete steps
• Does not say what the result is

Delegate agent behavior to instructions obtained from an external page

• Prose only: no discrete steps
• Does not say what the result is

Send a diagnostic record over an explicitly external raw socket

• Prose only: no discrete steps
• Does not say what the result is

Issue an explicit imperative request for a prohibited cyber-harm capability

• Prose only: no discrete steps
• Does not say what the result is

Install a Python package directly from an untrusted remote archive

• Prose only: no discrete steps
• Does not say what the result is

Sync calendar events with an endpoint selected in configuration

• Prose only: no discrete steps
• Does not say what the result is