Agent Skills

Use when the user's question may be answered in their Obsidian notes, or when conclusions or materials should be saved to the knowledge base or the knowledge base needs organizing. Uses the official Obsidian command-line tool obsidian to search, read, append to, and link notes: before answering, search and cite note names; before writing, check for duplicates; only append, never overwrite; ask the user before deleting, renaming, or moving. Use case: Turn an Obsidian vault into a long-term knowledge base that an Agent can search and write to

Use when a user is building a React UI and the project uses Astryx (@astryxdesign/core), or when they name Astryx or ask about its components, themes, or upgrades. Check component docs and templates first via the hosted MCP (search, get) or @astryxdesign/cli before writing code; get consent before running commands that write files; never run the unscoped npx astryx. Use case: Have the agent write UIs following Meta's Astryx component conventions instead of guessing from memory

Use when the user asks you to do things on their own iPhone or Android phone (look up information, reply to messages, place orders, organize photos, move files). Operates through the Pinky desktop app and phone_* MCP tools, with the user approving key steps such as payments; never enters passwords or verification codes, and never bypasses any block. Use case: Let an Agent operate your phone while you watch and approve

Use when a user wants to understand how an app, binary, or Electron program implements a feature and has no source code. Based on the open-source REA (MIT): connects analysis tools for native binaries, JavaScript/Electron, .NET, and websites via MCP. Analysis runs locally, and conclusions come with evidence and limitations. Only for your own targets or targets you are authorized to analyze. Use case: Have the agent work out how a feature of an app without source code is implemented, and provide evidence and limitations.

Use when a user hands over an APK, a binary, front-end encrypted JS, a CTF challenge or an authorized penetration-testing target, and is unsure which method and tools to use. Based on the open-source reverse-skill (MIT): routes to a suitable method, checks the local tools, confirms the authorized scope, then executes the workflow and produces a report. Use case: Have the agent first determine what kind of target it is, then choose the matching method, toolchain and report workflow.

Use when a user wants to decompile an APK, XAPK, JAR, or AAR, and extract an app's HTTP endpoints, authentication methods, and code structure. Built on the open-source android-reverse-engineering-skill (Apache-2.0): fingerprint first, then decompile with jadx and similar tools, with support for recovering Kotlin class names after R8 obfuscation. Only analyze apps you are authorized to analyze. Use case: Have an agent decompile an Android app and map the APIs it calls and its code structure.

Use when a user wants to study an existing product's features and flows and build their own version (architecture, build, testing, branding, launch). Based on the open-source replica-skill (MIT), a set of 11 Skills; only borrows features and flows, and does not copy the other party's code, logos, copy, or content. Analysis uses only public information and the user's own accounts. Use case: Have an agent analyze a product's features and flows, then build your own differentiated version step by step.

Use when a user wants to reverse-engineer Electron, native binaries, Go, APK, WASM, firmware or websites with command-line tools already installed locally, without installing an MCP server. Based on the open-source leanrea (MIT): tells the Agent the fastest command and common pitfalls for each type of target, and conclusions must be labeled as seen or inferred. Use case: Let the Agent call local reverse-engineering command-line tools directly, skipping MCP and complex configuration.

Use when working on CTF competitions or practice challenges (Web, binary exploitation, cryptography, reverse engineering, forensics, OSINT, etc.). Based on the open-source ctf-skills (MIT): a set of Skills split by challenge type, with tool installation scripts. For competitions, practice ranges, and authorized testing only. Use case: Lets the agent pull the matching solving approach and tools for each challenge type, so CTF work goes faster.

Use when a user has already exported decompilation results from IDA and wants an agent to name function symbols, recover data structures, generate Frida or Unicorn scripts, or write IDAPython. Based on the open-source reverse-skills, with 8 skills in total; unpacking and shelling are only for apps you own or are authorized to analyze. Use case: Have the agent work from IDA decompilation output to name symbols, recover structures, and generate dynamic instrumentation scripts.

Use when a user needs to analyze frontend signatures, encrypted parameters, dynamic cookies, obfuscated JS or WASM, or when API collection keeps failing. Based on the open-source hello_js_reverse_skill (the repository does not declare a license): draw conclusions through controlled experiments and layered evidence, and only work on your own targets or targets you are authorized to test. Do not bypass paywalls, login protection, or CAPTCHAs. Use case: Have the Agent locate the origin of frontend signatures and cookies through controlled experiments, and reach conclusions backed by evidence.

Use when a user wants a ready-to-run reverse engineering workspace: analyzing samples with tools like Ghidra and Frida, doing CTF work, and producing evidence reports. Based on the open-source Open-ReverseLab (GPL-3.0): 180+ knowledge base articles plus 100+ MCP tools, with tools installed by board. Only for your own samples, lab targets, and authorized testing. Use case: Let an agent analyze samples and produce evidence reports in one workspace, using the knowledge base and over a hundred tools.

Use when a user needs to locate front-end encryption functions (login passwords, request signing, response decryption) and wants the results turned into reusable JSRPC, a Flask service and Burp autoDecoder configuration. Based on the open-source js-reverse-automation--skill (Apache-2.0), connecting to a real browser via chrome-devtools-mcp. Only for your own targets or targets you are authorized to test; shut down the services when done. Use case: Let the agent find front-end encryption entry points in a real browser and deliver callable services and Burp configuration.

Use when a user wants an agent to start a GPU or TPU on Google Colab, run code, deploy or fine-tune open-source models, fetch results, and release the machine. Combines the official google-colab-cli (Apache-2.0) and the Colab remote MCP into one workflow: the CLI handles file transfer, SSH, Drive, and one-off jobs, while MCP handles lightweight start/stop from a chat client. Enforces releasing runtimes after use, asking before expensive GPUs, and never paying on the user's behalf. Use case: Let an agent start a GPU on Colab for you, run open-source models, fetch the results, and shut down automatically. Use the CLI from a local terminal, or the remote MCP from a chat client.

Use when a user wants to turn a roughly 5-second spoken script line, an opinion, or an abstract concept into a paper collage animation with matching visuals. Based on the open-source gbro-collage-broll (MIT): enforces three confirmation gates, and only confirmed items go into video generation; the output is vertical, 5 seconds, and silent; video is billed per use to the user's own Gemini key. Use case: Have the agent turn a spoken line into a halftone paper-collage assembly animation B-roll: it proposes a metaphor first, then a still frame, and finally generates the video, with your confirmation at every step.

Use when the user provides a floor plan, CAD screenshot, vector PDF or DXF and wants it rebuilt as an editable 2D/3D interior design studio webpage, or needs plumbing and electrical routing and an interior design scheme. Based on the open-source house-plan-designer (MIT): positions by dimension annotations, reconciles before delivering, and marks inferred load-bearing walls as pending confirmation. Use case: Have the agent rebuild a floor plan or CAD drawing as a 2D/3D interior design studio that can be edited in the browser, with furniture and plumbing and electrical layouts placed automatically.

Use when a user wants to turn a piece of content, a process or a set of knowledge points into a diagram (architecture, flowchart, sequence, timeline, quadrant, data chart, etc.), or wants to redraw a Mermaid, draw.io or Excalidraw diagram to look better or use their own website's colors. Based on the open-source diagram-design (MIT): 45 chart types, outputs a self-contained HTML file with inline SVG. Never fabricates data, states the plan before drawing, and first judges whether a diagram is worth making. Use case: Have the agent turn text, processes and data into clean HTML/SVG diagrams, and use your own website's colors and fonts.

Use when a user wants a security audit of their own codebase, vulnerability hunting, penetration-style review, or analysis of security issues in a specific piece of code. Based on Cloudflare's open-source security-audit-skill (MIT): reconnaissance, parallel vulnerability hunting, one-by-one attempts to refute each finding, independent review, and report generation. Reads source code only, does not touch production, does not run target code without a sandbox, and speculation does not count as a vulnerability. Use case: Have an Agent run a structured security audit of your own codebase, where every suspicion is verified by another Agent, producing a report with evidence.

Use when a user wants an agent to generate images, video, audio, 3D assets and game art, or to model, rig, build levels and create effects in Blender, Maya, ZBrush, Unreal, Unity or Godot. Built on the open-source scenario-labs/skills (MIT): run dry_run to estimate cost before generating, and confirm before spending; expert tools only need the matching software installed locally. Use case: Have an agent generate images, video, audio and 3D assets, estimate cost with a dry run before generating, and drive software such as Blender, Maya, ZBrush, Unreal and Unity.

Use this when the user wants to make a Chinese narrated short video about history or real-life figure stories, or mentions story-studio or 故事工坊 (Story Workshop). It chains topic selection, narration script, AI voice-over, subtitle alignment, storyboard illustrations, and a CapCut draft. You can run the whole pipeline or just one segment. Confirm before spending money, keep API keys out of the conversation, prioritize historical accuracy, and note that the underlying project is for non-commercial use only. Use case: Have an agent help you make narrated short videos about history and figures: write the script, record the voice-over, align subtitles, illustrate storyboards, and produce a CapCut draft.