Hunt for DNS-based persistence mechanisms including DNS hijacking, dangling CNAME records, wildcard DNS abuse,
Detect DNS tunneling and data exfiltration by analyzing Zeek dns.log for high-entropy subdomain queries, excessive
Detect domain fronting C2 traffic by analyzing SNI vs HTTP Host header mismatches in proxy logs and TLS certificate
Detect WMI-based lateral movement by analyzing Windows Event ID 4688 process creation and Sysmon Event ID 1 for
Hunt for adversary abuse of legitimate cloud services for C2, data staging, and exfiltration including abuse
Proactively hunt for adversary abuse of legitimate system binaries (LOLBins) to execute malicious payloads while
Hunt for adversary abuse of Living Off the Land Binaries (LOLBins) by analyzing endpoint process creation logs
Systematically hunt for adversary persistence mechanisms across Windows endpoints including registry, services,
Hunt for adversary persistence through Windows Management Instrumentation event subscriptions by monitoring WMI
Detect process injection techniques (T1055) including CreateRemoteThread, process hollowing, and DLL injection
Hunt for registry-based persistence mechanisms including Run keys, Winlogon modifications, IFEO injection, and
Detect MITRE ATT&CK T1547.001 registry Run key persistence by analyzing Sysmon Event ID 13 logs and registry
Hunt for adversary persistence via Windows Scheduled Tasks by analyzing task creation events, suspicious task
Detect T1547.001 startup folder persistence by monitoring Windows startup directories for suspicious file creation,
Hunt for supply chain compromise indicators including trojanized software updates, compromised dependencies,
Hunt for adversary persistence and execution via Windows scheduled tasks by analyzing task creation events, suspicious
Hunt for MITRE ATT&CK T1098 account manipulation including shadow admin creation, SID history injection, group
Hunt for unusual network connections by analyzing outbound traffic patterns, rare destinations, non-standard
Detect suspicious Windows service installations (MITRE ATT&CK T1543.003) by parsing System event logs for Event
【版权：青岛火一五信息科技有限公司 账号：huo15】火一五文档技能（别名）。文档模板生成工具。用于生成公司正式文档（合同、报价单、功能说明书、发货单、PDA 单据、会议纪要等），包含公司信息、字体规范、页面设置等模板规则/PDF 文档时。**生成 Word 默认使用此技能**。触发场景：(1) 生成合同或报价单 (2) 创建 Word 文档模板 (3)…
Session retrospective with AI-KPT framework. Reviews AI autonomous actions, detects omissions via counterfactual reasoning, persists learnings.
Interacts with sourcehut issue trackers using the hut CLI. Use when asked to create, read, update, triage, or comment on tickets for a sourcehut-hosted project.
Print the orchestrator's intended approach for an item, slice, or milestone — files it would touch, files it would create, tests it would add, assumptions it's making, known…
Per-item design exploration before /hv-plan — Socratic discovery, 2-3 approaches with tradeoffs, sectioned design with per-section approval, writes .hv/designs/.md, hands off…
Capture bugs, features, and tasks into TODO.md without executing them. Classifies each item, assigns priority/size, mints zero-padded IDs ([B01], [F01], [T01]).
Change hv-skills configuration interactively — pick which settings to edit from a checklist showing current values, then choose new values from the same options used at init.
Capture or refine a domain term in .hv/CONTEXT.md — the project's canonical glossary. Use on "save X as Y", "let's call this X", "by Y I mean…", "add X to context", or to refine…
Systematic root-cause investigation for a bug — reads the TODO entry + detail file, consults KNOWLEDGE.md, reproduces, hypothesizes, verifies, fixes with one atomic commit, and…
Capture a hard-boundary decision into .hv/DECISIONS.md — manually confirmed, never auto-invoked. Decisions differ from learnings in KNOWLEDGE.md by being active commitments with…
Scaffold and maintain a public-facing user guide under / (default docs/) — aimed at consumers, not contributors.
Capture one item and immediately implement it — combines /hv-capture and /hv-work, skipping the /hv-next review.
Initialize the .hv/ folder structure with TODO.md, KNOWLEDGE.md, counters.json, config.json, status.json, and CLI helpers.
Pull open GitHub/GitLab issues into .hv/BACKLOG.md — list candidates from the upstream repo(s), capture selected ones with GH/GL cross-references, label them in-progress upstream…
Extract durable session learnings (gotchas, conventions, constraints) into .hv/KNOWLEDGE.md grouped by topic, and update the CLAUDE.md topic index.
Maintain the project map of subsystems under .hv/map/. Modes — first-run (scaffold), after-work (update touched subsystems), consolidate (merge stale/duplicate entries).
Review the backlog, reconcile active work against git state, archive old completions, show sorted tables with relationship clusters, suggest the next item, and route to /hv-work.
Write an implementation plan as a first-class artifact before execution — keyed by milestone and slice or item (M01-S01.md, M01-B07.md).
Cut a release — bump version (major/minor/patch), generate categorized release notes from commits since the last tag, prepend a section to CHANGELOG.md, create an annotated git…
Reorient after a context clear or a fresh session — shows active work streams reconciled against git, recent commits per stream, backlog counts, and routes to /hv-work, /hv-ship,…
Remove a captured backlog item and clean up its dependencies — strips the TODO entry, removes Related cross-references, deletes the detail file…
Bundle completed work on a feature branch into a PR (or direct merge) — extracts commits, resolved item IDs with titles, optionally runs /hv-review, and calls hv-pr or hv-merge.
Compact project-state overview — backlog counts, active work, recent completions, knowledge topics. Read-only and fast.
Guided rollback of the last /hv-work cycle on the base branch — resets the merge commit, restores TODO entries to their type sections, refuses on cycles with post-merge commits…
Check for a newer hv-skills release on GitHub and tell the user how to update — detects install type (plugin, stow, repo clone), compares plugin.json version against the latest…
Orchestrator-driven parallel implementation — plans tasks, dispatches worker subagents, verifies, commits atomically per task.
한화(Hanwha) 브랜드 톤으로 UI를 만들 때 DESIGN.md + tokens.css + 한화체 3w + 한화고딕 5w + IBM Plex 웹폰트 + Tailwind 프리셋 + 공식 트리서클 로고(PNG) + token-audit 스크립트를 한 번에 프로젝트에 배포해 AI 세션 간 룩앤필을 고정하는 스킬.
HWP 파일을 PDF로 변환하여 이미지/도형/표 포함 100% 읽기 가능하게 만드는 스킬. HWP 파일 분석, 한글 문서 변환, 정부과제 서류 읽기 시 자동 트리거.
HWP/HWPX 문서(.hwp, .hwpx) 생성·변환·읽기·편집 통합 스킬. 'HWP 변환', 'hwp를 hwpx로', '한글 문서', 'hwpx', 'HWPX', '한글파일', '.hwpx 만들어줘', '보고서', '공문', '기안문', '한글로 작성', '회의록', '제안서', '이미지 포함 문서' 등의 키워드 시…
Harness Workflow — 需求到交付的全自动流水线框架。当用户说 /hx、hx doc、hx plan、hx run、hx go 等触发词时使用。支持需求获取、计划生成、任务执行、质量检查、MR 创建的完整工作流。
Adaptive routing strategies for distributed systems with multi-channel communication
Detects hybrid agent anti-pattern where agents perform execution work directly instead of delegating to skills
Expert hybrid cloud architect specializing in complex multi-cloud solutions across AWS/Azure/GCP and private clouds (OpenStack/VMware).
Configure secure, high-performance connectivity between on-premises and cloud environments using VPN, Direct Connect, and ExpressRoute.
Windows and Linux cross-platform configuration synchronizer. Use when updating terminal settings, VSCode keybindings, or Winget scripts to ensure a seamless experience across OSs.
Use when creating, updating, or querying a local Hybrid RAG database from PRISMA JSON metadata or PDF documents in a folder.
Combine vector and keyword search for improved retrieval. Use when implementing RAG systems, building search engines, or when neither approach alone provides sufficient r — from…
Combine vector and keyword search for improved retrieval. Use when implementing RAG systems, building search engines, or when neither approach alone provides sufficient r — from…
Combine vector and keyword search for improved retrieval. Use when implementing RAG systems, building search engines, or when neither approach alone provides sufficient r — from…
Reciprocal Rank Fusion for merging full-text and vector search results in this project. Convex native searchIndex + vectorIndex integration with admin-toggleable hybrid search.
Use when a task should run through Hydra's Lead-driven workflow for multi-agent orchestration, or when an existing workflow must be inspected or cleaned up.