Use when receiving code review feedback, before implementing suggestions, especially if feedback seems unclear or technically questionable - requires technical rigor and verification, not performative agreement or blind implementation.
Use when reverse engineering a binary, firmware image, executable, or hardware device — disassembly, decompilation, unpacking, dynamic instrumentation, or protocol recovery. Triggers on Ghidra, radare2, rizin, binwalk, Frida, YARA, dropping an unknown file to analyze, extracting firmware, USB/HID/I2C/DDC device…
Use when reviewing or understanding code changes at the entity level — functions, classes, methods — instead of line-by-line. Covers entity-aware diffs (working tree, staged, commit ranges), impact/blast-radius analysis ('what breaks if I change X', which tests to run), entity blame ('who last touched this function')…
Use when interacting with shellbox.dev — creating, managing, or connecting to ephemeral Linux microVMs over SSH. Covers box lifecycle (stock + OCI-backed), keepalive/wakeup/cron modes, custom domains, public IPv6 + mosh, billing/funds/refunds, multi-device SSH key management, file transfer (scp/sftp), and IDE remote…
Use when operating, deploying, or debugging the self-hosted garnix CI (a fork of garnix-io/garnix-ci running on the erdtree NixOS host) - deploying config/backend changes, managing agenix secrets, the Authentik entitlement access gate, binary caches, building repos with garnix.yaml, private flake inputs, or diagnosing…
Use when starting feature work that needs isolation from current workspace or before executing implementation plans - creates isolated git worktrees with smart directory selection and safety verification.
Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions always.
Use when the user asks for an OpenSCAD 3D model, parametric design, or wants to iterate on .scad files with parameter-driven revisions and multi-view PNG previews.
Use when the user asks about a video — pasted URL (YouTube, Vimeo, TikTok, X, Loom, etc.) or local file path (.mp4/.mov/.mkv/.webm). Downloads the video, extracts frames, pulls a timestamped transcript so you can answer about visual + spoken content.
Use when reverse engineering a web or network protocol — protobuf or gRPC messages, a HAR capture, an undocumented HTTP or JSON API, a WebSocket stream, or a TLS-fingerprinted endpoint. Triggers on decoding protobuf wire format (protoscope, protoc --decoderaw), grpcurl or grpcui, curl-impersonate for bot-protected…
Use when reverse engineering a Windows target — a PE file (.exe, .dll, .sys), a .NET assembly, a driver, Windows malware, or an x86/x64 Windows binary. Triggers on PE header or import inspection, packer/protector detection, decompiling .NET to C#, extracting obfuscated strings, Windows memory-dump forensics, unpacking…
Use when running long-lived or persistent terminal processes — dev servers, builds, remote SSH/container shells that must survive disconnects or outlive the task — or when the user mentions zmx, session persistence, attach/detach, or asks to run or inspect something in a named session.
Use when starting any conversation - establishes how to find and use skills, requiring Skill tool invocation before ANY response including clarifying questions.
★not rated 2 6d agoA30 tokens
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: