Skills
97,222 packaged capabilities and playbooks for agents. Install any of them with one command.
Agent workflows
Use the RunAPI CLI for one-off artifacts and results, or RunAPI's standard x402 REST flow for wallet-funded Task calls without an API key. Use when an agent needs to discover models or prices, create a paid Task, poll its result, or run a supported CLI service. Use an SDK for app or production integration.
Assess and harden LLM applications and agentic systems against prompt injection, tool misuse, excessive agency, memory poisoning, RAG data leakage, and model supply-chain risk, mapped to the OWASP Top 10 for LLM and Agentic Applications. Use when reviewing an AI feature, agent, MCP server, or RAG pipeline for security, or when threat modeling an autonomous system.
Use this skill when creating new Claude Code skills from scratch, editing existing skills to improve their descriptions or structure, or converting Claude Code sub-agents to skills. This includes designing skill workflows, writing SKILL.md files, organizing supporting files with intention-revealing names, and leveraging CLI tools and Node.js scripting.
Improve skills and workflows by analyzing run artifacts and execution logs (events.jsonl/state.json) under runs/ (or OpenSpec changes/). Use when you want to iterate on skills based on real runs: find failure modes, bottlenecks, unclear prompts, missing I/O contracts, and propose concrete edits.
Audit an Agent Skill (or a repo/plugin of skills) for safety before installing or trusting it. Use whenever the user wants to vet, review, audit, or check whether a skill, plugin, or its scripts are safe, asks "is this skill safe to install", pastes a skill repo/URL to evaluate, or is about to install a third-party skill from GitHub, npx skills, or a plugin marketplace. Runs static analysis only (never executes the target) and reports network egress, process execution, secret access, dynamic code, filesystem writes, obfuscation, npm install-time scripts, MCP server declarations, symlinks leaving the skill tree, shipped binaries, recorded agent transcripts carrying opaque reasoning blocks, and prompt-injection instructions hidden in SKILL.md, tiered by whether the code runs automatically, on invocation, or on demand.
Validates all CI skills in this repo. Checks Agent Skills spec compliance, gh-aw workflow compilation, permission correctness, and structural conventions. Use when CI skills have been added or modified and you want to verify they compile and conform before committing.
Search, find, discover, install, remove, update, review, deduplicate, list, move, optimise, and iterate on skills for AI coding agents. Use when user asks "find a skill for X", "install skill", "remove skill", "update skills", "list skills", "deduplicate skills", "why are two skills shown", "choose the canonical skill", "check for skill conflicts", "review skill quality", "move skill", "check for updates", "optimise skill", "audit skill edits", "trigger test skill", or "transfer skill across agents". Includes duplicate-free installation preflight and SkillOpt-style training loops. Do not use for creating skills from scratch (use /skill-creator instead).
Social Media Manager role skill. Orchestrates the full SMB social media workflow across three layers — Foundation (brand setup + calendar), Content Creation (captions, platform-specialist posts, visuals), and Distribution (scheduling via Blotato + performance review). Coordinates all 9 component skills as a sequential, human-reviewed pipeline. Run this skill instead of invoking component skills individually.
Generate probability-weighted alternative options that challenge default thinking. Forces unconventional alternatives and exposes hidden assumptions behind the "obvious" choice. For decision-point analysis, NOT full design exploration. Triggers on "대안", "alternatives", "옵션 뽑아", "options", "어떤 방법이", "아이디어", "다른 방법", "선택지".
Unified team skill for roadmap-driven development workflow. Coordinator discusses roadmap with user, then dispatches phased execution pipeline (plan -> execute -> verify). All roles invoke this skill with --role arg. Triggers on "team roadmap-dev".
Replaces the agent's reflex of piping a command straight through `tail -n N` or `head -n N` with `tee` to a file inside a `mktemp -d` directory followed by the same `tail` / `head`. The truncated view stays the same; the full output stays recoverable. Skipped for outputs expected to be very long.
Work with Ticks issue tracker and AI agent runner. Use when managing tasks or issues with tk commands, running AI agents on epics, breaking down requirements into ticks, or working in a repo with a .tick directory. Triggers on phrases like create ticks, tk, run ticks, epic, close the task, plan this, break this down.
Build stateless MCP servers with TypeScript on Cloudflare Workers using @modelcontextprotocol/sdk. Provides patterns for tools, resources, prompts, and authentication (API keys, OAuth, Zero Trust). Use when exposing APIs to LLMs, integrating Cloudflare services (D1, KV, R2, Vectorize), or troubleshooting export syntax errors, unclosed transport leaks, or CORS misconfigurations.
Create or update repo-native project instructions for AI agents, such as AGENTS.md or CLAUDE.md. Use when initializing an AI-native repository protocol, documenting project overview, tech stack, repository structure, build/run/test commands, durable working rules, progressive disclosure, workflow artifact routing, organization skill routing, or converting repeated coding-session habits into durable agent instructions.
Plan and coordinate approved multi-task work from prose, issues, repository evidence, or an explicitly selected Project by grouping selected issues into coherent PRs, delegating implementation in reusable task worktrees, and delivering verified draft PRs with required native stacks for dependent PRs. Never merges.
Autonomous quality meta-skill / "quality brain" (also invocable as /ultracode and /quality-orchestrator aliases). Proactively orchestrates a rigorous, multi-phase quality workflow on any medium/high complexity implementation, review, fix, research, design, audit, or work involving judgment, unknown scope, risk, multiple findings, or non-trivial trade-offs — without the user having to ask. It self-assesses complexity, prefers direct deterministic oracles first, chooses phases (Understand/Design/Review/Research/etc.), composes the right patterns (work-refute with lenses, work-judge, work-exhaust, work-sweep, work-gaps, work-tournament, work-check, work-review), applies all execution mechanics (structured output + retry, worktree isolation, null-handling, concurrency/budget caps, journaling/resume, no silent caps, log/phase via todos), and drives the workflow visibly. The agent is expected to decide on its own at checkpoints (after significant edits, before marking complex todos done, at phase boundaries, when findings accumulate, or when the task language implies "make sure it's solid / thorough / find all issues"). Broad auto-trigger phrases: complex work, implementation, review the changes, audit, design decision, ensure quality, make it robust, thorough review, find all edge cases, etc. The agent can also call the focused skills directly when it identifies the specific need.
Check your work with a verification sub-agent that runs direct oracles first (build/test/typecheck/lint/run-the-app), re-reads the changed code, and returns a schema-validated PASS/FAIL verdict — not prose to grep. Spawns one verifier for small diffs, or parallel lenses (BARRIER) for larger or security/auth/data-boundary changes, then fixes issues and re-verifies under a SEEN ledger until it passes. Use when asked to "check work", "verify changes", "self-verify", "/work-check", "/check", "/verify", or "/self-verify".
Add resources to OpenViking, aka. ov. Use when an agent needs to add files, URLs, or external knowledge during interactions. Trigger this tool when 1. sees keyword "ovr"; 2. is explicitly requested adding files or knowledge; 3. identifies valuable resources worth importing
Compile an agent-optimized changelog by cross-referencing git history with plans and documentation. Use when asked to "update changelog", "compile history", "document project evolution", or proactively after major milestones, architectural changes, or when stale/deprecated information is detected that could confuse coding agents.
Creating, refining, splitting, consolidating, renaming, auditing, or designing adoption evaluations for agent skills—portable content boundaries and agentskills.io authoring. Triggers on `SKILL.md`, frontmatter, `description`, “where does this rule belong,” “split this skill,” “recast this skill as a capability,” “audit skill portability,” and “compare skill revisions.” Skill management owns installation and active loading; project policy and host guidance own gates and execution; QA practices judge evidence sufficiency only within their scope. Covers capability framing, judgment versus mechanism, conditional references, structural validators, and task/treatment/scorer/opportunity contracts.
Capture learnings from the current session into the project-rules file (AGENTS.md, CLAUDE.md, or local override) so future sessions benefit. Use when the user says "revise the rules", "update AGENTS.md / CLAUDE.md with what we just learned", "save this to project memory", "remember this for next time", or at the end of a productive session when valuable context has emerged that is not yet documented. This complements agents-md-improver — improver audits, while this one captures.
Call the free Agnes text model API for chat completions, streaming answers, coding help, tool-calling experiments, and OpenAI-compatible text generation. Use when the user asks for 免费文本, 免费的文本模型, free text API, Agnes text, Agnes-2.0-Flash, free LLM calls, or wants to use a free chat/completion model through an Agent skill.
This skill should be used when the user asks to "ask Gemini", "get Gemini's opinion", "have Gemini review", "improve writing style", "make less AI-sounding", "get feedback on article", "review this draft", "Nano Banana", "Gemini API help", "Gemini models", or needs a second opinion on content, writing, code, or design. Supports text questions and up to 10 images.
Atom of Thoughts (AoT) reasoning - decompose complex problems into atomic units with confidence tracking and backtracking. For genuinely complex reasoning, not everyday questions. Triggers on: atomise, complex reasoning, decompose problem, structured thinking, verify hypothesis.
Audit Model Context Protocol servers for injection surfaces, excessive tool scope, authorization gaps, resource over-exposure, and transport weaknesses across stdio, SSE, and Streamable HTTP deployments. Use when reviewing an MCP server implementation, assessing tool definitions for injection or description manipulation risk, auditing the trust boundary between an AI agent and MCP tools, or reviewing MCP server deployment for authentication and authorization controls.
Sets up the toolchain for brand and design work (brand kit setup, install skills, higgsfield CLI). Checks prerequisites such as Node, Python, and Chrome, installs the unslop, grill-with-docs, web-design-guidelines, and seo-audit skills in the right place each, and connects the Higgsfield CLI for image generation. Use this skill as soon as someone wants to build a brand kit, develop a brand identity, generate AI images for their own brand, or rebuild this toolchain, even if installation is not explicitly mentioned.
Use this skill when the user needs to control the browser launch mode for browser_use. By default, browser_use launches the local Chrome/Chromium using managed CDP; `headed` controls whether the window is visible, and `private_mode` controls whether CDP is disabled in favor of Playwright.
Automate web browser interactions using natural language via CLI commands. Use when the user asks to browse websites, navigate web pages, extract data from websites, take screenshots, fill forms, click buttons, or interact with web applications. Supports remote Browserbase sessions with automatic CAPTCHA solving, anti-bot stealth mode, and residential proxies — ideal for scraping protected websites, bypassing bot detection, and interacting with JavaScript-heavy pages.
Build autonomous AI agents with Claude Agent SDK. Structured outputs (v0.1.45, Nov 2025) guarantee JSON schema validation, plugins system, hooks for event-driven workflows. Use when: building coding agents with validated JSON responses, SRE systems, security auditors, or troubleshooting CLI not found, structured output validation, session forking errors.
Comprehensive cost tracking and optimization for production Claude deployments. Covers Admin API usage tracking, efficiency measurement, ROI calculation, optimization patterns (caching, batching, model selection, context editing, effort parameter), and cost prediction. Use when tracking costs, optimizing token usage, measuring efficiency, calculating ROI, reducing production expenses, or implementing cost-effective Claude integrations.
Create Claude Code plugins, skills, commands, agents, hooks, MCP servers, and marketplace files. Use when building a plugin, packaging skills for sharing, creating a marketplace, converting standalone config to a plugin, or deciding between plugin vs skill vs MCP vs standalone.
Designs or reviews CLIs so coding agents can run them reliably: non-interactive flags, layered --help with examples, stdin/pipelines, fast actionable errors, idempotency, dry-run, and predictable structure. Use when building a CLI, adding commands, writing --help, or when the user mentions agents, terminals, or automation-friendly CLIs.
Use before any codebase search or exploration in a large or unfamiliar repository — finding where a feature/domain lives, locating a file, deciding which app/package owns some logic — before reaching for find/grep/Explore or a research subagent.
Analyzes project bounded contexts, extracts business rules and domain knowledge, writes ai-context/features/<context>.md files, and produces a teach-report.md with documentation coverage metrics. Trigger: /codebase-teach, teach codebase, extract domain knowledge, update feature docs.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.