Skills
96,981 packaged capabilities and playbooks for agents. Install any of them with one command.
Cloud & DevOps
Better environment variable management for agents and humans with full type safety, CLI-based remote environment synchronization, and environment validation. Use when setting up typed config schemas, validating env variables, or managing remote env vars across Vercel, Netlify, Railway, Cloudflare, and Fly.io with better-env.
Infrastructure operations for Cloudflare: Workers, KV, R2, D1, Hyperdrive, observability, builds, audit logs. Triggers: worker/KV/R2/D1/logs/build/deploy/audit. Three permission tiers: Diagnose (read-only), Change (write requires confirmation), Super Admin (isolated environment). Write operations follow read-first, confirm, execute, verify pattern. MCP is optional — works with Wrangler CLI/Dashboard too.
Complete knowledge domain for Cloudflare R2 - S3-compatible object storage on Cloudflare's edge network. Use when: creating R2 buckets, uploading files to R2, downloading objects, configuring R2 bindings, setting up CORS, generating presigned URLs, multipart uploads, storing images/assets, managing object metadata, or encountering "R2_ERROR", CORS errors, presigned URL failures, multipart upload issues, or storage quota errors. Keywords: r2, r2 storage, cloudflare r2, r2 bucket, r2 upload, r2 download, r2 binding, object storage, s3 compatible, r2 cors, presigned urls, multipart upload, r2 api, r2 workers, file upload, asset storage, R2_ERROR, R2Bucket, r2 metadata, custom metadata, http metadata, content-type, cache-control, aws4fetch, s3 client, bulk delete, r2 list, storage class
Build and deploy the Goldsky Compose bitcoin-oracle example under the user's own account — a cron task that fetches BTC/USD from CoinGecko and writes `(timestamp, price)` as `bytes32` values to an on-chain `PriceOracle` contract via a Compose-managed wallet, appending each price to a durable collection. Triggers on: 'build a bitcoin price oracle', 'BTC/USD oracle onchain', 'push a price feed onchain', 'cron price oracle', 'set up / deploy the bitcoin-oracle example', 'compose price oracle'. Recommends the shared fully-unpermissioned oracle on Base Sepolia so there's nothing to deploy. Scaffolds the example from goldsky-io/documentation-examples, walks CLI install, contract choice (reuse shared / deploy own), wiring, optional GitHub publish, and a log-tailing smoke test. For a custom/novel Compose app that isn't this oracle, use /compose. For debugging an already-deployed app, use /compose-doctor. For manifest/CLI/API field lookups, use /compose-reference.
Run all infrastructure standards checks and configure compliance across a project. Use when performing a comprehensive infrastructure audit, setting up a new project against all standards, batch-fixing compliance issues with --fix, or validating CI/CD compliance. Natural triggers: "check all standards", "audit project compliance", "configure everything", "run all configure checks".
Check and configure container infrastructure (builds, registry, scanning, devcontainer). Use when auditing container infrastructure compliance, checking multi-stage builds and non-root users, setting up container build workflows with GHCR and multi-platform support, or adding Trivy/Grype scanning to CI pipelines. Natural triggers: "configure container build", "add container scanning", "set up GHCR workflow".
Analyse Datadog observability data including metrics, logs, monitors, incidents, SLOs, APM traces, RUM, security signals, and more. Use when asked to investigate infrastructure health, query metrics, search logs, check monitors, diagnose errors, or analyse any Datadog data.
Deploys Palo Alto Networks Prisma Access for SASE-based zero trust network access, configuring GlobalProtect agents, ZTNA Connectors, security policy enforcement, and Strata Cloud Manager integration for unified management. Use when implementing enterprise-grade SASE with integrated ZTNA/SWG/CASB/FWaaS, replacing both VPN and branch firewalls with cloud-delivered security, or integrating ZTNA with an existing Palo Alto NGFW estate.
Docker containerization. Covers Dockerfile, images, and best practices. Use for containerizing applications. USE WHEN: user mentions "dockerfile", "docker build", "docker run", "containerize", "docker image", "multi-stage build", asks about "how to dockerize", "container security", "docker optimization", "image size", "docker layers" DO NOT USE FOR: docker-compose multi-service setups - use `docker-compose` skill instead, Kubernetes orchestration - use `kubernetes` skill instead
Set up automatic build + deploy of a Dockerized repo to a self-hosted Dokploy instance using GitHub Actions, GitHub Container Registry (GHCR), and the Dokploy MCP. Use when the user wants to auto-deploy a repo to Dokploy, set up CI/CD targeting Dokploy, ship a container to their own Dokploy server, configure a new app on Dokploy from an existing repo, or wire GitHub Actions to push an image and trigger a Dokploy redeploy — even if they don't mention "GHCR" or "GitHub Actions" explicitly. Triggers on phrasings like "deploy this to dokploy", "set up dokploy for this repo", "auto-build and deploy on my server", "ship this app to my dokploy", "I want CI/CD to my self-hosted Dokploy".
Use when evaluating projects for production or enterprise readiness, implementing supply chain security (SLSA, cosign, SBOMs, pnpm), hardening CI/CD pipelines, establishing quality gates (TYPO3: CI matrix PHP 8.2-8.5 x TYPO3 12.4/13.4/14.3 LTS), pursuing OpenSSF Best Practices Badge (Passing/Silver/Gold) or OSPS Baseline levels, reviewing code quality, writing ADRs, or configuring Git hooks and CI pipelines.
Persist flaker's DuckDB storage across GitHub Actions runs and feed it from multiple sources (vitest reports, custom adapter reports, etc.). Use when wiring `@mizchi/flaker` into a new repo's CI, adding a new ingest source to an existing flaker setup, or debugging why `flaker apply` / `flaker run --gate ...` "lost its history" between runs. Encodes the cache key shape, fetch-depth requirements, `--changed` derivation, and the import-step placement that internal flaker users converged on.
Operate the joelclaw gateway daemon — the always-on pi session that receives events, notifications, and messages. Use the joelclaw CLI for ALL gateway operations. Use when: "restart gateway", "gateway status", "is gateway healthy", "push to gateway", "gateway not responding", "telegram not working", "messages not going through", "gateway stuck", "gateway debug", "check gateway", "drain queue", "test gateway", "stream events", or any task involving the gateway daemon.
Proactively harden a cloud account or organization before an incident — prioritizing IAM and identity risk over checkbox findings, closing the exposures that become attack paths (public storage, over-broad roles, missing audit logging, unencrypted data), reading CSPM output critically, and enforcing guardrails at the org level. Use when reviewing a cloud environment's security posture, triaging a Prowler/ScoutSuite/Security Hub report, deciding which misconfigurations actually matter, or setting preventive controls across AWS, Azure, or GCP.
Interactive setup guide for using Infisical as a secret management tool in your projects. Helps users integrate Infisical into local development (CLI), Docker containers (build-time and runtime secret injection), CI/CD pipelines (GitHub Actions, GitLab CI), Kubernetes (Operator + CRDs), and application code (all 9 SDKs: Node.js, Python, Go, Java, .NET, Ruby, PHP, Rust, C++). Also walks through choosing and configuring any of the 13 machine identity auth methods (Universal, Token, Kubernetes, GCP, AliCloud, AWS, Azure, TLS Cert, OCI, OIDC, JWT, LDAP, SPIFFE). Use this skill whenever someone asks about: using Infisical, injecting secrets, infisical run, infisical init, connecting their app to Infisical, Docker secrets, Kubernetes secrets operator, machine identity setup, SDK initialization, CI/CD secret injection, or 'how do I get my secrets into my app'. Not for the Kubernetes Operator CRDs (infisical-kubernetes-operator), rendering secrets to files (infisical-agent), pushing secrets outward (infisical-secret-syncs), or human SSO login (infisical-sso).
Plan safe website migrations when existing URLs, redirects, sitemap, robots, schema, canonical pages, metadata, analytics, webmaster tools, or launch monitoring may change. Use after existing-site analysis or rebuild decisions; never apply production redirects, DNS, deploy, or webmaster mutations without explicit approval.
This skill should be used when the user asks to deploy, scale, or cost-optimize ML workloads on cloud platforms. PROACTIVELY activate for: (1) AWS SageMaker Studio, Training, Processing, Pipelines, Endpoints, Model Monitor, Feature Store, Clarify, Ground Truth, EC2 GPUs, EKS, Lambda, Inferentia, Trainium, (2) GCP Vertex AI Training, Pipelines, Endpoints, Feature Store, Model Monitoring, AutoML, Matching Engine, TPU, GKE, Cloud Run, (3) Azure ML workspaces, pipelines, managed endpoints, AutoML, Responsible ML, AKS/ACI, (4) Databricks, Modal, Replicate, RunPod, Lambda Labs, Anyscale. Provides: cloud ML architecture, autoscaling, hardware, security, and cost guidance.
Download and convert AI models using the Model Download microservice. Use this skill whenever a user wants to download a model from HuggingFace, Ollama, Ultralytics, Geti, or Pipeline Zoo; convert a model to OpenVINO IR format for OVMS; download healthcare AI models (3D Pose, rPPG, AI-ECG) via the HLS plugin; set up the model download service; submit a download or conversion job via the REST API or the MCP server; connect an MCP client (Claude Desktop, Copilot) to model-download; or asks, “How do I get model X working with OVMS?” Also trigger on phrases like “download model,” “download weights,” “convert to int4,” “OVMS-ready model,” “prepare model for inference,” and “model-download MCP server.”
NetBox server administration: configuration, authentication backends (local/LDAP/SAML/OIDC), object permissions, API tokens, performance tuning, backups, upgrades, and housekeeping. Use when managing a NetBox instance rather than consuming its API.
Patterns for ingesting data into NetBox using the Diode SDK (Python and Go). Use when building network discovery, bulk import, or automated data population integrations that write data to NetBox via gRPC. Covers SDK setup, entity construction, batch ingestion, chunking, reconciler behavior, error handling, and when to use Diode vs the REST API.
Methodology for migrating data into NetBox from spreadsheets, legacy IPAM/DCIM systems, CMDBs, and unstructured sources. Use when planning or executing a data migration — covers assessment, cleaning, dependency ordering, import strategy selection, validation, and post-migration verification with Discovery and Assurance.
Review and audit NetBox integration code for correctness, performance, and reliability. Use when reviewing scripts or applications that interact with NetBox APIs, checking for pagination bugs, authentication issues, performance anti-patterns, error handling gaps, and SDK misuse.
Operate, configure, and debug a running OpenClaw installation from a host machine (locally or over SSH). Covers the whole runtime surface **except** building agent personalities/workspaces — channels, gateway, daemon/service, config (`openclaw.json`), models + auth, cron, hooks, plugins, sandbox, sessions, security audit, doctor, reset, uninstall. This skill MUST be invoked on any mention of `openclaw` CLI commands, `~/.openclaw`, `openclaw.json`, "restart gateway", "add a channel", "check why my bot isn't responding", "openclaw doctor", "channels status", "ssh into the OpenClaw box", and similar — also whenever a host has `~/.openclaw/openclaw.json` and OpenClaw work is implied even if not named. MUST hand off to **openclaw-agent-builder** for any work that creates or edits an agent's workspace files (SOUL.md / AGENTS.md / IDENTITY.md / USER.md / RAG knowledge / `agents.list[]` entries / `bindings[]`).
RabbitMQ message broker with AMQP protocol. Covers exchanges, queues, bindings, and messaging patterns. Use for reliable message delivery and complex routing scenarios. USE WHEN: user mentions "rabbitmq", "amqp", "exchanges", "routing patterns", "topic exchange", "fanout", asks about "message routing", "work queues", "request/reply", "flexible routing" DO NOT USE FOR: high-throughput streaming - use `kafka` or `pulsar`; cloud-native - use `nats`; AWS-native - use `sqs`; JMS required - use `activemq`; simple pub/sub - use `redis-pubsub`
Manages the rhdh-plugin-export-overlays repository and Extensions Catalog: onboard plugins, update upstream versions, repair export or publish failures, inspect workspace health, triage the overlay PR backlog by label, staleness and merge readiness, and trigger /publish. Use for source.json, plugins-list.yaml, backstage.json, catalog metadata, overlay CI, plugin import, overlay PRs, or testing exact PR artifacts before merge. For code-level review of a pull request, use /rhdh-pr-review. To promote an rhdh-plugins release through overlays into rhdh-plugin-catalog, use /rhdh-plugin-midstream-propagate.
Installs and configures gcx: contexts, authentication, connection to Grafana Cloud or on-premise Grafana, env var overrides for CI/CD, default datasources. Use for first-time setup, or when gcx fails with auth or connection errors (401, 403, connection refused, missing namespace).
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.