Skills

安全代码审计深度专业技能 v3.0：攻击面驱动的审计优先级方法论（入口点→数据流→敏感操作）、多语言漏洞模式识别（Java/Python/Go/Node.js/PHP/C#）、数据流与污点分析、认证授权审计、业务逻辑审计、供应链代码审计（依赖投毒/后门植入/恶意包）、反混淆与对抗审计、AI…

安全自动化顶级专业技能：DevSecOps全流程集成、CI/CD安全管道、SAST/DAST/SCA/容器/IaC自动化扫描编排、安全工具链集成实战、攻防双视角自动化（红队打点/蓝队检测响应）、SOAR深度编排、Agentic AI安全自动化（LLM…

Apache Shiro安全框架深度利用专业技能v3.0：rememberMe Cookie AES-CBC/CBC-GCM双模式深挖、密钥爆破方法论升级(Padding Oracle深度解密原理/工具选型/并行加速)、Gadget链版本兼容矩阵、Shiro-550/721、认证绕过全系列(CVE-2020-1957…

Spring Framework漏洞深度利用专业技能：全年代CVE时间线（2016-2026）、Spring Boot Actuator深度利用与heapdump凭据链、SpEL注入全家族、Spring4Shell数据绑定RCE、Spring…

漏洞评估高级专业技能：CVSS 3.1/4.0评分体系深度与滥用案例、EPSS/KEV/VPT漏洞优先级技术融合、攻击面管理与扫描器深度配置(Nessus/OpenVAS/Nuclei自动化与误报治理)、漏洞验证与真实可利用性分析、供应链SBOM与云容器漏洞评估专项、AI大模型辅助漏洞研判与报告生成、从发现到闭环的漏…

Designer's eye plan review — interactive, like CEO and Eng review.

Interact with Azure DevOps repositories, pull requests, and APIs using the AZURE_DEVOPS_TOKEN environment variable.

Bitbucket Data Center (self-hosted Bitbucket Server) specifics — authenticate with BITBUCKET_DATA_CENTER_TOKEN, use the REST API 1.0, PROJECT/repo_slug…

Install and configure Swift programming language on Debian Linux for server-side development.

Deploy and manage applications on Vercel, including preview deployments and deployment protection.

Monitor RSS and Atom feeds for new posts from blogs, news sites, and podcasts using Python feedparser

Pipeline for ML/AI research papers — lit review to LaTeX submission

Structured pipeline for writing ML and AI research papers — from literature review to LaTeX submission

Generate images via Stable Diffusion (HuggingFace Diffusers, local/API)

Generate images using Stable Diffusion via HuggingFace Diffusers library locally or via API

Post, read, and search X (Twitter) content using x-cli or the X API v2

Post PR review comments using the GitHub API with inline comments, suggestions, and priority labels.

Use Sokosumi with API-key auth, direct agent hires, coworker tasks, job monitoring, and result retrieval from non-interactive agent environments.

Build a tight, red-capable feedback loop before diagnosing failures, then minimize, test ranked hypotheses, and lock the fix with a regression test.

Generate and send a digest on a configurable topic, optionally pulling RSS/Atom feeds as an input source alongside web + X signal

Search and curate X/Twitter behind one selector - keyword, topic roundup, a single or tracked-account digest, an X list, or the AI-agent buzz preset -…

Curated trending across GitHub repos and the Hugging Face Hub (models, datasets, spaces) - filtered, clustered, and labeled by momentum with a one-line…

Execution-gap audit - cross-references the startup idea backlog against shipped skills, prototypes, and cross-repo PRs, surfacing the top 3 ideas to build…

One-shot Base-token investigation - runs any subset of six onchain-security checks (rug-scan, contract-audit, deployer-trace, holder-concentration, honeypot…