Agent skills for Windsurf (legacy)

Use when writing, editing, or translating blog posts in a Hugo site - creates posts with valid front matter, keeps multilingual…

Learn a Hugo blog author's writing style from their existing posts and write a new post on a given topic that reads exactly like them…

Reviews a GitHub pull request like a thoughtful human reviewer and writes the feedback to a markdown file.

Use whenever writing, drafting, continuing, or revising fiction — short stories, novel chapters, scripts, or any narrative creative…

Human-readable control flow patterns for refactoring complex conditionals.

Use when deciding which humrel-* sub-skill to invoke next, or when sequencing manuscript work from topic through rebuttal for a Human…

Use when targeting Human Resource Management (HRM, Wiley) or deciding whether a strategic HRM / employment-relationship manuscript fits…

Design boundaries between human sovereignty and machine agency.

Write prose that sounds authentically human rather than AI-generated.

Use when writing or editing a Slack message, email, pull request body, GitHub issue, Reddit post, agenda, or doc.

Use when the user says 'humanize', 'clean up writing', 'make it sound natural', or wants text to not sound AI-generated.

Remove signs of AI-generated writing from text.

Remove signs of AI-generated writing from academic medical papers.

Remove signs of AI-generated writing from text to make it sound more natural and human-written.

Interacts with live Hunk diff review sessions via CLI.

Hunt CAPTCHA Bypass — 6 distinct patterns: (1) CAPTCHA field simply omitted from the request (server-side validation absent), (2) CAPTCHA…

Hunt Clickjacking — missing X-Frame-Options / CSP frame-ancestors lets an attacker embed the target page in an invisible iframe and trick…

Hunt CORS Misconfiguration — origin-reflection with credentials, null-origin trust, subdomain-regex bypass (unanchored vs unescaped-dot vs…

Finds root cause before applying fixes for errors, crashes, regressions, failing tests, broken behavior, and screenshot-reported defects.

Hunt client-side DOM vulnerabilities — DOM Clobbering (overwrite JS globals via HTML injection), PostMessage hijacking (missing origin…

Hunt HTTP request smuggling (CL.TE, TE.CL, H2.CL, H2.TE).