The library

api-crud-generator · When you need a complete, tested REST API with auth and docs from a single prompt.

pinion-chain-intel · When you need lightweight on-chain queries at $0.01 per call via micropayments.

worktree · When you need isolated branches without stashing or checking out locally.

api-crud-generator · When you need a complete, tested REST API with auth and docs from a single prompt.

fix-lint · When you have lint errors and want automatic fixes before manual intervention.

micro-pipeline · When building any multi-step output (docs, code, reports) and you need quality gates.

create-pr · When you need to create a PR with automatic base branch detection.

what-would-cc-do · When unsure what Claude Code skill to invoke next.

offensive-shellcode · When you need robust, testable shellcode with immediate verification.

aso-appstore-listing-skill · When optimizing app listings for higher search ranking and conversion.

review-pr · When you need multi-angle code review (correctness, efficiency, style) with inline comments.

openalex · When you need comprehensive academic metadata with proper citation tracking beyond simple Google Scholar.

backmerge · When releasing a hotfix and need to synchronize prod-test-main in proper order.

offensive-windows-mitigations · When auditing Windows binary defenses or preparing Week 8 exploit bypass techniques.

arxiv-digest · When tracking robotics research trends daily with automated Zotero library sync.

offensive-iot · When assessing smart-home or ICS device security via hardware and firmware analysis.

content-writer · When deriving SEO article topics from real GEO data rather than guessed keywords.

offensive-mobile · When auditing mobile app security including deep-links WebView APIs and exported IPC.

zod · When needing runtime type checking tied to static types in form data or API payloads.

codex-cli-runtime · When delegating complex code repairs to Codex from within Claude Code subagents.

offensive-osint-methodology · When teaching or systematizing OSINT workflows to avoid ad-hoc recon drift.

skill-eval · When vetting skills for inclusion in agent harnesses or production use.

codex-result-handling · When consuming Codex outputs in automated Claude Code workflows.

offensive-osint · When starting reconnaissance on a target with only name or domain known.

SKILL · When onboarding a new skill into a framework or verifying structure.

gpt-5-4-prompting · When crafting prompts for Codex subagents or other LLM-heavy workflows.

offensive-fast-checking · When needing a quick vulnerability surface scan before in-depth testing.

SKILL · When setting up skill-based agents in a framework or CI environment.

sast-analysis · When auditing source code in CI/CD or pre-release security review.

offensive-reporting · When translating raw pentest data into boardroom-ready security reports.

ts-library · When releasing TypeScript utility libraries to npm with strong type guarantees.

sast-businesslogic · Finding exploitable gaps in payment, workflow, and authorization logic that scanners miss

offensive-business-logic · Finding high-value logic chains in fintech/marketplace apps where scanners miss compound flows

reddit-growth · Organic growth in niche communities where bot-detection is high and authenticity matters

cm-tdd · Catching regressions and hidden edge cases that manual testing cannot verify

sast-fileupload · Finding RCE paths through file upload that extension blocklists and static analysis miss

offensive-deserialization · Achieving RCE on Java/.NET/PHP/Python apps that deserialize untrusted objects without allowlists

limbic · Quick emotional state snapshot without introspection when you need gut-check interpretation

sast-graphql · Finding query string injection that reaches GraphQL parsers (not resolver SQL injection)

offensive-file-upload · Finding RCE or XSS through file upload when MIME validation or extension checks are sole defense

poke-agents-mcp · Headless orchestration of local agent runs without UI when scripting multi-agent workflows

sast-hardcodedsecrets · Finding exposed API keys, credentials, and tokens that code review and linters miss

offensive-graphql · Bypassing GraphQL authorization when individual resolvers don't check permissions uniformly

sast-idor · Finding authorization gaps where IDs are trusted directly without ownership verification

offensive-idor · Accessing other users' data when IDs are sequential or predictable and authorization is missing

apple-app-review-skills · Reducing App Store submission failures by catching common violations before review

sast-jwt · Finding JWT signature bypass, algorithm confusion, and key exposure in token handling

offensive-open-redirect · Chaining open redirect with phishing or SSRF when URL parameters trust user input

cm-start · Setting up codymaster scaffolding for new projects without manual config

sast-missingauth · Finding unprotected endpoints that forgot authentication decorators or checks