Catalog
Every x402, MPP, MCP, and skill listing we've indexed, normalized, and enriched.
onboarding
Onboard a project to LaunchDarkly: kickoff roadmap, resumable log, explore repo, MCP, companion flag skills, nested SDK install (detect/plan/apply), first flag. Use when adding LaunchDarkly, setting up or integrating feature flags in a project, SDK integration, or 'onboard me'.
coff0xc-vulnerability-lifecycle
Use when / 当用户请求: 全面漏洞研究、CVE/补丁分析、漏洞管理、风险优先级、报告、授权验证和修复跟踪工作流。触发：CVE、漏洞原理、补丁对比、advisory、CVSS、EPSS、KEV、PoC 验证、漏洞报告、bug bounty、pentest report、修复跟踪、上游修了安全问题、受不受影响、先修哪儿、跟进闭环、security patch。 Covered source aliases / 来源别名: bug-bounty, pentest-report, red-team-poc, vuln-research, vulnera
coff0xc-ui-doc-output
Use when / 当用户请求 UI、frontend、dashboard/admin/SaaS screen、component/design system、responsive/mobile、accessibility/ARIA/contrast、empty/loading/error/hover/focus/keyboard states、browser smoke/screenshot/console cleanliness、anti-AI visual polish、technical/executive report narrative、t
coff0xc-software-engineering
Use when / 当用户请求: dev, autonomous development, build end-to-end, full-stack feature, one-shot implementation, repo repair, monorepo repair, failing tests, CI failing tests, bugfix, code bug, refactor, scripts, local Git summary, CI failure triage, test reproduction, fast inner lo
coff0xc-skill-router
Coff0xc lightweight skill router and autonomous multi-skill composer. Use only when the user asks the AI to decide which coff0xc skills to use, chain skills, build a task/workflow graph, orchestrate vibe coding, handle cross-domain/multi-domain work, or recover from an uncertain/
coff0xc-secure-code-appsec
Use when / 当用户请求: 全面代码安全审计、Web/API/GraphQL/OAuth/浏览器/SPA/LLM 安全、后门检测和授权应用安全验证工作流。触发：代码审计、危险函数、source/sink、污点分析、Web 安全、API 安全、GraphQL、OAuth、CSP、CORS、Cookie、Prompt 注入、越权、权限越权、权限模型、SSRF、XSS、SQLi、后门、Webshell、绕过登录、看到别人数据、代码入口、数据流、access control、permission model、authorization bypass、se
coff0xc-research-drawio-diagram
Use when / 当用户请求: 科研算法架构图、论文方法图、论文级模型结构图、模型结构图、实验流程图、draw.io、diagrams.net、.drawio 可编辑文件、算法 pipeline、method figure、architecture figure、paper figure、model diagram、model structure、research workflow、arXiv、official GitHub、科研绘图、论文配图、神经网络结构、Transformer/CNN/GNN/diffusion/RAG/agent 架构图。Re
coff0xc-purple-deception
Use when / 当用户请求: 全面紫队演练、ATT&CK 映射、控制验证、检测能力评估、蜜罐/欺骗防御和安全运营改进工作流。触发：purple team、ATT&CK、红蓝对抗、control validation、detection coverage、emulation plan、honeypot、deception、decoy、canary、检测有效性、蓝队发现攻击行为、覆盖指标、改进闭环、防守能力验证。 Covered source aliases / 来源别名: honeypot, purple-team. Capability domai
coff0xc-office-doc-tools
Use when / 当用户请求: 正式 Office 和文件型交付物能力，覆盖 PowerPoint/PPT/PPTX/slides/deck、Word/DOCX/document/redline/comment、PDF/read/create/review/render、Excel/XLSX/CSV/spreadsheet/workbook/chart/formula。适合创建、编辑、检查、转换、批注、渲染验证和导出可交付文件。可交付：可编辑 PPTX、DOCX、PDF、XLSX/CSV、图表、批注/修订、公式检查、渲染截图/预览 QA、文件路径和验
coff0xc-network-protocol-security
Use when / 当用户请求: 全面网络协议、TLS/DNS/TCP/UDP/QUIC/HTTP、无线/RF/蓝牙、协议日志分析、通信安全和形式化协议建模工作流。触发：network protocol、TLS、DNS、HTTP/2、HTTP/3、QUIC、TCP、UDP、WiFi、Bluetooth、BLE、RF、packet、pcap、Wireshark、协议分析、安全通信、ProVerif、Mermaid protocol、抓包、握手、解析异常、加密协商、异常字段、通信流程。 Covered source aliases / 来源别名: netw
coff0xc-identity-zero-trust
Use when / 当用户请求: 全面身份安全、零信任、AD/Kerberos、IAM、权限、凭证风险、横向移动防御和访问控制审查工作流。触发：IAM、identity、identity paths、SSO、MFA、AD、Active Directory、Kerberos、BloodHound、权限、凭证、服务账号、提权、横向移动、Zero Trust、PAM、账号权限混乱、谁能访问什么、特权账号收敛、登录策略、access governance。 Covered source aliases / 来源别名: ad-pentest, credentia
coff0xc-detection-response
Use when / 当用户请求: 全面 SOC、安全运营、检测工程、威胁狩猎、威胁情报、邮件安全、恶意软件分析、取证和应急响应工作流。触发：SIEM、Sigma、YARA、Sigma/YARA、IOC、日志、告警、EDR、IR、forensics、malware、phishing、timeline、detection response、incident response、incident、威胁情报、狩猎、误报、安全告警太吵、安全告警、检测响应、事故响应、检测逻辑、降误报、验证样本、alert tuning。 Covered source aliases
coff0xc-compliance-architecture
Use when / 当用户请求: 全面安全架构、威胁建模、合规审计、数据安全、DLP、隐私、安全基线和成熟度评估工作流。触发：安全架构、STRIDE、威胁建模、等保、PCI-DSS、GDPR、ISO27001、SOC2、CIS、NIST、数据分类、脱敏、DLP、隐私、基线、控制矩阵、安全评审、风险模型、控制项、审计证据、控制证据、audit log、risk register、control evidence、release evidence、executive report、compliance report、上线前评审、审计日志、高管报告、风险报告
coff0xc-cloud-devsecops
Use when / 当用户请求: 全面云安全、容器/Kubernetes、Serverless、DevSecOps、供应链、CI/CD 和密钥管理工作流。触发：AWS、Azure、GCP、IAM、S3/Blob/GCS、Docker、K8s、Kubernetes、镜像、Serverless、CI/CD、SAST、DAST、SCA、SBOM、supply chain、supply-chain、secret scanning、IaC、Terraform、GitHub Actions、发版流水线、集群配置、镜像权限、依赖来源、配置暴露、pipeline ri
coff0xc-blockchain-security
Use when / 当用户请求: 全面区块链、智能合约、DeFi、Web3、跨链、代币和多链安全审计工作流。触发：Solidity、EVM、Solana、Cosmos、Substrate、Cairo/StarkNet、TON、Algorand、DeFi、AMM、oracle、bridge、token、NFT、智能合约审计、Foundry、Hardhat、Slither、链上资金逻辑、价格来源、资产流转、合约权限、测试覆盖。 Covered source aliases / 来源别名: blockchain-security. Capability do
coff0xc-binary-mobile-iot
Use when / 当用户请求: 全面二进制/逆向/内核/移动/IoT/ICS/CTF/密码学安全分析工作流。触发：reverse engineering、PWN、kernel、APK、IPA、Frida、firmware、UART、JTAG、SPI、SCADA、PLC、Modbus、BLE、RF、CTF、crypto review、constant-time、设备包、可执行文件、通信固件、静态分析、动态调试、接口枚举。 Covered source aliases / 来源别名: binary-exploit, crypto-security, ct
coff0xc-authorized-assessment
Use when / 当用户请求: 全面授权安全评估、攻击面梳理、红队计划防御化、演练边界、控制有效性验证和报告工作流。触发：recon、fingerprint、attack chain、full pentest、red team、adversary、adversary emulation、C2、evasion、phishing simulation、post-exploitation、data exfiltration、CDN/WAF、proxy、social engineering、ROE、书面授权、完整入侵链、防护发现、边界和步骤、防御验证、对手模
coff0xc-api-data-platform
Use when / 当用户请求: 全面 API、数据库、数据平台、CLI、SDK 和接口契约工程工作流。触发：REST、GraphQL、OpenAPI、SQL、Postgres、PostgreSQL、数据库、schema、migration、数据迁移、CLI、SDK、分页、认证、错误码、JSON 输出、数据模型、ETL、数据质量、后端接口、请求响应、鉴权、版本兼容、存储结构、外部客户接口、usage ledger、ledger、filter builder、impact analysis、影响面分析。 Covered source aliases /
coff0xc-ai-agent-rag
Use when / 当用户请求: 全面 AI Agent、RAG、Prompt、LLM 应用、多模型协作、评测、观测和成本控制工作流。触发：Agent、RAG、embedding、向量数据库、Prompt、LangChain、AutoGen、工具调用、多模型编排、代码审计协作、视觉分析、评测、缓存、记忆、失败恢复、查资料助手、调用工具、答错追踪、可落地 AI 助手、AI workflow。 Covered source aliases / 来源别名: ai-agent-dev, ai-orchestrator, deep-thinking. Capab
creating-claude-md
Use when the user wants to create a new CLAUDE.md from scratch for a repository, bootstrap project memory for a new repo, set up a repo for Claude Code for the first time, or completely rewrite an existing CLAUDE.md deemed unsalvageable. Produces a lean, high-signal file under 80
hypothesis-validator
Use for decision-grade startup hypothesis validation: kill/refine ideas, identify ICP, jobs, demand, money signals, wedges, and GTM paths via the bundled Russian research prompt.
ttm-request-skill
File a GitHub issue requesting a new takeToMarket skill. Auto-uses gh CLI if installed and authed; otherwise opens a pre-filled GitHub issue URL in your browser.
ttm-playwright-setup
Walk through installing Playwright MCP server + Chrome extension bridge. Enables competitor-scan fallback, LinkedIn/Twitter author scraping, and landing/pSEO visual + performance gates. Run once per machine.
ttm-linkedin-post
Generate a LinkedIn post in your voice. First run interviews you for 2-5 author profiles to mimic, scrapes their recent posts via Playwright MCP, and builds .taketomarket/PLAYBOOKS/linkedin-base.md. Subsequent runs use that base + post history + news web search to draft posts. Fi