Skills
96,981 packaged capabilities and playbooks for agents. Install any of them with one command.
Cloud & DevOps
Production logging patterns for observability and incident debugging. Structured JSON logging, correlation IDs, context propagation, log levels, and performance. Use when implementing logging, adding observability, or debugging production systems. Triggers on logging setup, logger configuration, observability, distributed tracing, or incident response workflows.
Turborepo monorepo build system guidance. Triggers on: turbo.json, task pipelines, dependsOn, caching, remote cache, the "turbo" CLI, --filter, --affected, CI optimization, environment variables, internal packages, monorepo structure/best practices, and boundaries. Use when user: configures tasks/workflows/pipelines, creates packages, sets up monorepo, shares code between apps, runs changed/affected packages, debugs cache, or has apps/packages directories.
Guide for implementing Turborepo - a high-performance build system for JavaScript and TypeScript monorepos. Use when setting up monorepos, optimizing build performance, implementing task pipelines, configuring caching strategies, or orchestrating tasks across multiple packages.
Use when the user provides a UCloud site space connection Key starting with `site_` (format `site_<sandbox-id>_<code>`) and asks to connect, verify, or operate on the site space. Applies to validating the connection Key and deriving the sandbox ID via ucloud-sandbox-cli on Linux, macOS, or Windows; recognizing the legacy `site_<sandbox-id>` format and guiding the user to the 星图 site space page to re-obtain the connection statement; verifying site connections; recognizing access-code protection; executing commands; browsing and managing files; uploading or downloading code; reading site environment variables; and generating, building, deploying, and troubleshooting a website service running on port 80; while respecting the single-sandbox permission boundary and masking requirements for sensitive information such as the site connection Key and site access code.
Monitor and control an Unraid server via the Unraid Management Agent's MCP server (125 tools, 5 resources, 6 diagnostic prompts) and REST API. Use when: connecting an AI client (Claude, ChatGPT, Cursor, Copilot, Gemini CLI) to Unraid; checking system, array, disk, Docker, VM, GPU, UPS, ZFS, or network status; starting/stopping containers, VMs, the array, or parity checks; diagnosing disk health, performance, or array state; managing alerts, health checks, fan/CPU/tuning, or updates; or choosing between MCP, REST, and WebSocket. Corrects: inventing Unraid tool names or REST paths; running destructive actions (stop array, reboot, delete snapshot) without confirm=true; polling REST in a loop instead of using WebSocket/MCP; dumping full lists instead of search_/get_ tools; and assuming auth the agent lacks by default.
Create and manage Volcengine cloud resources using the Volcengine CLI (`ve` command). Supports all Volcengine services including ECS, VPC, CLB, RDS, Redis, and more. Trigger this skill whenever the user asks to create, query, modify, or delete cloud resources on Volcengine, mentions the `ve` command, says "volcengine CLI", or describes infrastructure tasks such as "create an ECS instance", "set up a VPC", "list security groups", "allocate an EIP". Also trigger when the user encounters errors from `ve` commands and needs troubleshooting help.
Ship Faster end-to-end workflow for small web apps (default: Next.js 16.1.1): idea/prototype → foundation gate → design-system.md → lightweight guardrails + docs → feature iteration → optional Supabase + Stripe → optional GitHub + Vercel deploy → optional AI-era SEO (sitemap/robots/llms.txt). Resumable, artifact-first under runs/ship-faster/ (or OpenSpec changes/). Trigger: ship/launch/deploy/production-ready MVP.
Use when reasoning about how Apple delivers and serves its experiences — the observable web delivery/infra (multi-CDN, mzstatic image-transform URLs, image formats, HLS adaptive video, caching, HTTP/2-3) and the reverse-engineered, INFERRED server-side architecture (CloudKit, APNs, StoreKit, Sign in with Apple, Private Cloud Compute, iCloud sync). Part of the apple-design family. Keywords: apple cdn, akamai, mzstatic, image transform url, srcset picture, HLS m3u8, http3 quic, cache-control immutable, content-hash fingerprint, frame-sequence delivery, createImageBitmap, KTX texture, video scrub, cloudkit, APNs push, StoreKit, sign in with apple, private cloud compute, icloud sync, conflict resolution, backend, infrastructure, reverse-engineered, inferred architecture.
This skill should be used when users need to manage GitOps deployments via ArgoCD CLI. It covers application sync, rollback, status checking, refresh, and deployment history. Integrates with Kargo for progressive delivery. Triggers on requests mentioning ArgoCD, GitOps, application sync, deployment status, or rollback operations.
Use when an AWS account's IAM API is blocked by an MFA-required policy — `sts:GetCallerIdentity` works but `iam:*` is rejected with `InvalidClientTokenId` — or when FIDO2 passkey MFA can't be used from the CLI. Trigger it from symptoms like "access denied", "token expired", or "only IAM operations fail" related to aws-vault / aws-cli / MFA / passkey (even if the user doesn't name aws-vault explicitly).
Detect and manage the network drives (TOS bucket mounts) mounted under the workspace /root/.openclaw/workspace/. Use this skill when you need to save files to persistent storage, check mounted TOS buckets, or list available workspace network drives.
Cloud metadata exploitation. Use when the cloud instance metadata service is reachable via SSRF or a shell you already have. Covers metadata endpoints for AWS/Azure/GCP/Alibaba Cloud/Tencent Cloud, IAM/CAM credential extraction, IMDSv2 bypass, and the full attack chain from metadata to cloud service enumeration. Use this skill in any SSRF scenario, or whenever 169.254.169.254 or 100.100.100.200 is reachable from the internal network
Connect Workers to PostgreSQL/MySQL with Hyperdrive's global pooling and caching. Use when: connecting to existing databases, setting up connection pools, using node-postgres/mysql2, integrating Drizzle/Prisma, or troubleshooting pool acquisition failures, TLS errors, nodejs_compat missing, or eval() disallowed.
Store and transform images with Cloudflare Images API and transformations. Use when: uploading images, implementing direct creator uploads, creating variants, generating signed URLs, optimizing formats (WebP/AVIF), transforming via Workers, or debugging CORS, multipart, or error codes 9401-9413.
Build Model Context Protocol (MCP) servers on Cloudflare Workers - the only platform with official remote MCP support. TypeScript-based with OAuth, Durable Objects, and WebSocket hibernation. Use when: deploying remote MCP servers, implementing OAuth (GitHub/Google), using dual transports (SSE/HTTP), or troubleshooting URL path mismatches, McpAgent exports, OAuth redirects, CORS issues.
CloudNative-PG (CNPG) PostgreSQL database management for the Kubernetes homelab. Covers shared platform cluster, dedicated per-app clusters, credential provisioning, cross-namespace replication via kubernetes-replicator, and monitoring. Use when: (1) Adding a new database for an application, (2) Creating a dedicated CNPG cluster, (3) Setting up database credentials and cross-namespace replication, (4) Debugging database connectivity or CNPG cluster health, (5) Adding PostgreSQL extensions for specialized workloads. Triggers: "database", "postgresql", "postgres", "cnpg", "cloudnative-pg", "pooler", "pgbouncer", "database credentials", "db password", "managed roles", "Database CRD", "database cluster", "shared database", "dedicated database", "cnpg cluster"
Build, test, deploy, and certify commercetools Connect applications — service/API-extension, event/subscription, job, and Connect-hosted Merchant Center custom apps and views — in TypeScript/JavaScript (Java supported). Covers the connect.yaml contract, least-privilege scopes, lifecycle scripts, sync-vs-async idempotency and ack, testing, and deployment. For a named vendor or domain integration see commercetools-integrations; not for the hosted Checkout widget (see commercetools-checkout). Use when building, deploying, certifying, or debugging a Connect connector.
Databricks AI Runtime, the `databricks air` CLI commands for submitting and managing GPU training workloads on Databricks serverless compute. Use for: writing and submitting `databricks air` workload YAML, passing hyperparameters and secrets, checking run status, listing/cancelling runs, streaming a run's logs and watching its progress, custom Docker image setup, and environment configuration
Use when planning deployments, build commands, environment checks, CI/CD, release steps, smoke tests, rollback, and monitoring. Dry-run first; do not deploy to production, change secrets, or mutate live services without explicit approval.
Generate production-ready Dockerfiles for any GitHub project. Supports monorepos, multi-stage builds, workspace detection, and iterative build-fix cycles. Use when the user asks to create, generate, write, fix, or improve a Dockerfile; containerize an application; mentions Docker build issues; needs a .dockerignore; or wants to package an app as a Docker image. Also triggers on “/dockerfile”.
Create a Dockerfile for the current project to deploy with haloy. Use when the user says "dockerize", "create a Dockerfile", "containerize my app", "make this deployable", or "prepare for haloy". This skill creates optimized, production-ready Dockerfiles without docker-compose. Not for multi-container setups requiring docker-compose, local development environments with multiple services, or Kubernetes manifests.
Use when comparing domain registrars, TLD costs, renewal risks, privacy, DNS features, transfer lock, and purchase steps. Advisory/dry-run only; do not buy domains or log into registrar accounts without explicit approval.
Fetches the DORA metrics Deployment Frequency and Lead Time for Changes, per project and per repo, from the provider's API (GitHub, GitLab, Bitbucket, or Azure DevOps — not local git). Use this skill whenever the user asks to run or update the DORA metrics, measure the deployment frequency or lead time of a project (e.g. "Example Project"), generate the biweekly metrics report, or asks how many deploys a project made or how long a change takes to reach production — regardless of which of the four providers the project's repos live on. Also trigger on phrases like: "run the DORA metrics", "metrics for Example Project", "deployment frequency for [project]", "lead time for [project]", "biweekly metrics report", "how many deploys did we do this sprint", "add a GitLab/Bitbucket/Azure DevOps project to the DORA metrics"
Sets up GitHub Actions CI/CD workflows for EmDash plugins — TypeScript type-checking, ESLint linting, Vitest testing, npm publishing, and automated releases. ALWAYS use this skill when a user wants to create, add, set up, or configure GitHub Actions, CI/CD, automated checks, or deployment workflows for an EmDash plugin — even if they don't use the exact phrase "GitHub Actions". This includes any request to: add automated type-checking or linting to an EmDash plugin repo; set up testing in CI for a plugin; auto-publish a plugin to npm from GitHub; add security scanning or dependency auditing to a plugin pipeline; or generally "add CI", "add automated checks", "set up workflows", or "automate" anything related to an EmDash plugin's GitHub repository. Also trigger when someone wants quality gates on PRs or is setting up a new EmDash plugin repo and wants best practices for automation. If the user is inside an EmDash plugin repository and mentions anything about automated testing, code quality, deployment, or GitHub workflows, use this skill.
Diagnose gateway failures by reading daemon logs, session transcripts, Redis state, and OTEL telemetry. Full Telegram path triage: daemon process → Redis channel → command queue → pi session → model API → Telegram delivery. Use when: 'gateway broken', 'telegram not working', 'why is gateway down', 'gateway not responding', 'check gateway logs', 'what happened to gateway', 'gateway diagnose', 'gateway errors', 'review gateway logs', 'fallback activated', 'gateway stuck', or any request to understand why the gateway failed. Distinct from the gateway skill (operations) — this skill is diagnostic.
Read and query GCP logs for Hyperlane agents using gcloud CLI. Use when investigating relayer, validator, or scraper logs, debugging message processing, or analyzing operational issues. Provides efficient filtering and context management strategies.
Comprehensive code security checks and server security audit skill. Use for: (1) Code vulnerability scanning - detect OWASP Top 10 vulnerabilities such as SQL injection, XSS, and SSRF, (2) Dependency security checks - identify outdated or vulnerable third-party libraries (e.g. React2Shell CVE-2025-55182, Next.js CVE-2025-66478), (3) Server configuration audit - check security configurations for SSH, firewalls, permissions, and more, (4) Sensitive information leak detection - detect hardcoded API keys, passwords, tokens, and more, (5) Container security scanning - audit Docker images and Kubernetes configurations, (6) CI/CD security checks. Trigger keywords: "安全检查", "漏洞扫描", "代码审计", "security audit", "vulnerability scan", "penetration test", "SAST", "DAST", "dependency check", "CVE 检测", etc.
Implement GitOps workflows with ArgoCD and Flux for automated, declarative Kubernetes deployments with continuous reconciliation. Use when implementing GitOps practices, automating Kubernetes deployments, or setting up declarative infrastructure management.
Build headless Shopify storefronts with Hydrogen and Oxygen. Use this skill for creating custom React-based storefronts, using Hydrogen components, deploying to Oxygen hosting, working with the Storefront API, and building high-performance e-commerce experiences. Also covers bringing your own stack with custom frameworks.
Hike Capital file publishing CLI: turn local HTML pages (including images on the page) into publicly accessible URLs (h.hikecapital.com)—the goal is a public link, not a chat attachment. Use this skill to upload to h.hikecapital.com whenever the user wants to publish, launch, host, upload, or send an .html file; asks for “a clickable link” or “send me a URL”; or wants to share a webpage link with LPs or investors. Also covers three management operations: ① re-upload and overwrite an updated file (“the link must not change,” “upload it again”; overwriting a file with the same name keeps the URL unchanged, so existing links remain valid); ② list or query files they have published; ③ delete published files. Call it as usual even if public sharing has not been confirmed—the skill’s own workflow handles confirmation before publishing. Boundary: use lark-drive to send a file as an attachment to a Feishu group or person; do not use this skill just to create or edit HTML without a request for a public link (but if the generated HTML is to be published publicly, use this skill for the publishing step).
DWS cluster high memory root cause diagnosis skill, based on KooCLI v3.2.0+ and DWS Autopilot MCP Server. Automatically collects memory metrics, analyzes root causes (customer-side / system-side), and outputs a standardized diagnosis report. Applicable to scenarios where DWS cluster memory usage is too high, memory alarms, and OOM. Trigger words: 内存高, 内存告警, 内存诊断, 内存使用率过高, 内存不足, OOM, 内存溢出, 动态内存使用率超阈值, high memory, memory alarm, memory diagnosis.
Manage Huawei Cloud SMN (Simple Message Notification) topics, subscriptions, message templates and message publishing, and manage DMS (Distributed Message Service) Kafka/RabbitMQ/RocketMQ instances and Kafka topics. 15 built-in actions cover query (list topics/subscriptions/message templates/DMS instances/Kafka topics), diagnosis (subscription confirmation status, DMS instance health & capacity), management (create topic, add subscription, create message template, publish message, create DMS instance) and destructive operations (delete SMN topic, confirm subscription, delete DMS instance). KooCLI has no DMS command; the three engine services are the only DMS entry points. Supports both AK/SK and local KooCLI profile authentication. Use this skill when the user wants to: (1) list or create SMN topics and subscriptions, (2) send or diagnose notifications, (3) inspect SMN subscription confirmation status, (4) list, create, or delete DMS Kafka/RabbitMQ/RocketMQ instances, (5) list Kafka topics, (6) analyze DMS instance health or capacity. Triggers include: "SMN", "SMN主题", "消息通知", "subscribe", "topic", "发布消息", "推送消息", "notification", "DMS", "Kafka", "RabbitMQ", "RocketMQ", "消息队列", "DMS实例", "Kafka实例", "RabbitMQ实例", "RocketMQ实例", "订阅", "消息模板", "MQS"
Deploys OPA Gatekeeper via Helm as a Kubernetes admission controller and writes ConstraintTemplates with Rego plus instantiated Constraints to validate, mutate, or deny resource requests at admission time. Use when enforcing custom policy-as-code at admission on Kubernetes v1.24+, blocking non-compliant workloads before scheduling, or expressing a rule that built-in controls cannot. Keywords: Gatekeeper, ConstraintTemplate, Constraint, Rego, admission webhook, audit, mutation. Do not use for the standard pod security profiles that Pod Security Admission already covers - use implementing-pod-security-admission-controller.
Use when a project needs launch/infrastructure coordination across domains, registrars, servers, DNS, deploy, SSL, webmaster tools, monitoring, and launch readiness. Dry-run first; do not purchase, provision, deploy, or mutate production without explicit approval.
Use before launch to audit SEO, schema, accessibility, performance, security, analytics, redirects, sitemap, robots, SSL, monitoring, rollback, and approval gates. Evidence-first; do not mark launch ready unless required checks ran or are explicitly skipped with rationale.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.