Skills
96,770 packaged capabilities and playbooks for agents. Install any of them with one command.
Cloud & DevOps
Covers integrating Vercel Blob object storage (@vercel/blob) into Next.js and other Vercel apps: server-side uploads with put, client-side uploads via presigned client upload tokens, listing, downloading and deleting blobs, streaming and multipart uploads for large files, public versus private access, content-type and caching settings, and automatic CDN delivery. Use when adding file, image, PDF or video uploads to a Next.js app, handling user-generated content such as avatars and attachments, building file management features, migrating from Cloudflare R2 to Vercel Blob, or hitting errors like BLOB_READ_WRITE_TOKEN is not defined, file size limit exceeded, client upload token failures, filename collisions, upload timeouts, or blobs that fail to delete.
Walrus publisher and aggregator REST API for storing and reading blobs over HTTP. Use when the user needs to store or read Walrus blobs using HTTP PUT/GET requests, integrate Walrus from any programming language, configure storage options (epochs, deletable, permanent, send_object_to), or parse store/read API responses. Also use when troubleshooting HTTP API errors or CDN caching issues after upload. For quilt HTTP endpoints, see the `walrus-quilts` skill. For CLI usage, see `walrus-cli`.
High-level overview of Walrus: what it is, how it works, and which tool to use. Use when the user is new to Walrus, asks "what is Walrus", "how does Walrus work", "what is a blob", or needs to choose between CLI, HTTP API, TypeScript SDK, and Move integration. Also use when explaining Walrus architecture, comparing Walrus to AWS S3 or IPFS, explaining the publisher/aggregator/upload relay distinction, or clarifying blob ID vs Sui object ID. This is the entry-point skill for Walrus newcomers.
Walrus TypeScript SDK (@mysten/walrus) for storing and reading blobs programmatically. Use when writing TypeScript/JavaScript code that interacts with Walrus for blob storage, reading, or lifecycle management: the WalrusFile API (getFiles, writeFiles), the raw readBlob/writeBlob API, the writeFilesFlow/writeBlobFlow step-by-step flows for browser wallets and crash-recoverable uploads, upload relays and tips, WASM loading in Vite or Next.js, and verifying a blob before depending on it. For CLI usage, see the `walrus-cli` skill. For HTTP API, see the `walrus-http-api` skill.
Sets up and drives TencentDB Agent Memory (MemoryCore, MemoryHub, MemoryProxy, MemoryPanel) for agent teams. Use when the user mentions “memory hub”, “team memory”, “chat memory”, “skill library”, “wiki”, or “codegraph”, or asks to install, configure, or troubleshoot the memory-tencentdb plugin, onboard a new agent, or deploy standalone (Docker Compose, panel UI, team review).
Alibaba Cloud penetration testing methodology. Use when the target uses Alibaba Cloud services, when you find oss-*.aliyuncs.com assets, when you obtain an Alibaba Cloud AccessKey (starting with LTAI), when the 100.100.100.200 metadata endpoint is reachable from inside an ECS instance, or when you need to assess the security of Alibaba Cloud services such as RAM / ECS / OSS / RDS / ACK / FC. Covers RAM privilege escalation, ECS takeover, OSS bucket exploitation, RDS database attacks, ACK container clusters, FC function compute, SLB load balancing, Log Service, and KMS key management
AWS IAM / Resource Policy analysis methodology. Use when the target involves AWS cloud services and policy files such as IAM policies, resource policies, Lambda code, or CloudFormation templates are provided. Covers identification of dangerous IAM policy patterns, analysis of resource policy principals, Condition key bypass patterns, and derivation of service trust relationship graphs. Use this skill when you find AWS policy files (json/yaml), *.amazonaws.com endpoints, or IAM ARNs
Specialized methodology for AWS IAM privilege escalation. Use when you already have AWS credentials and need to escalate privileges, when the current IAM user/role has limited permissions and you need lateral or vertical escalation, or when you need to analyze IAM policies to find escalation paths. Covers privilege escalation techniques for 46 AWS services, including PassRole abuse, chained AssumeRole escalation, Lambda/EC2/ECS compute service escalation, and exploitation of implicit permissions via NotAction
Overall methodology for penetration testing AWS cloud environments. Use when the target uses AWS cloud services, when you find AWS-related assets (S3 buckets / EC2 instances / Lambda functions / CloudFront distributions), when you obtain AWS credentials (AK/SK/Session Token/IAM Role), or when you need to assess the security of an AWS environment. Provides a full attack decision tree from unauthenticated enumeration to privilege escalation, post-exploitation, and persistence, guiding you to specialized skills for deeper dives. Covers the attack surface of 47+ AWS services
AWS post-exploitation and persistence specialization. Use after obtaining high AWS privileges (Admin/PowerUser) or permissions on specific services when you need to exfiltrate data, move laterally to other accounts/regions, establish persistent backdoors, or clean up attack traces. Covers S3/RDS/DynamoDB/EBS data exfiltration, cross-account AssumeRole lateral movement, Lambda/IAM/EventBridge persistence backdoors, and CloudTrail/GuardDuty evasion techniques
Azure AD / Entra ID attack methodology. Use when the target uses Microsoft 365/Azure cloud environments, when you discover Azure AD authentication flows, or when you obtain Azure credentials. Covers initial access (password spray / phishing), token theft, Service Principal abuse, conditional access bypass, and cross-tenant attacks
Guidance for the security-side use of Azure Monitor and Log Analytics — designing the workspace strategy that feeds Microsoft Sentinel and Defender for Cloud, choosing analytics vs basic vs auxiliary log tiers, retention and archive, table-level transformations to drop noise pre-ingestion, Data Collection Rules (DCRs) and Azure Monitor Agent (AMA), workspace topology (single vs regional vs sovereign), commitment tiers and cost control, customer-managed keys for the workspace, RBAC including table-level RBAC, integration with Sentinel (workspace requirements), and decommissioning legacy MMA. WHEN: Log Analytics workspace design, Azure Monitor security data, Sentinel workspace, log tier basic auxiliary, AMA Azure Monitor Agent, DCR data collection rule, drop columns ingestion transform, log retention archive, workspace CMK, table-level RBAC, log ingestion cost control. DO NOT USE for Sentinel detection authoring (use sentinel-detection-engineering), App Insights instrumentation (use appinsights-instrumentation), or non-security observability.
Reference for Cloudflare Browser Rendering, headless Chrome on Workers via @cloudflare/puppeteer and @cloudflare/playwright. Covers the browser binding, puppeteer.launch, puppeteer.connect and puppeteer.sessions, page.goto, page.screenshot, page.pdf, page.evaluate, browser.close and disconnect, session reuse with keep_alive, incognito contexts, batch scraping and crawling, and pricing and concurrency limits. Use when taking screenshots, generating PDFs from URLs or HTML, scraping or crawling sites, automating or testing web apps from a Worker, extracting page content for AI, or troubleshooting browser timeouts, concurrency limits, memory exceeded errors, XPath selectors not supported, or Cannot read properties of undefined (reading fetch).
Reference for Cloudflare Workers AI, running AI models on serverless GPUs through the env.AI.run() binding. Covers the AI binding in wrangler.jsonc, model selection (@cf/meta/llama, Flux and Stable Diffusion image generation, BGE embeddings, vision models), streaming responses, AI Gateway caching, RAG with Vectorize, Vercel AI SDK integration and OpenAI-compatible endpoints, plus rate limits, neuron pricing and a production checklist. Use when implementing AI inference in a Cloudflare Worker, generating text or images at the edge, configuring Workers AI bindings, adding AI streaming, wiring up AI Gateway, building embeddings or RAG on Workers, or debugging AI_ERROR, rate limit errors, model not found, model unavailable, token limit exceeded, neurons exceeded, quota exceeded or streaming failures.
Deploy, start, and update the Alibaba Cloud Observability MCP Server (阿里云可观测 MCP Server). Use this skill whenever the user mentions deploying, installing, starting, updating, or configuring the observability MCP server, Alibaba Cloud SLS/CMS MCP tools, or wants to connect Alibaba Cloud monitoring to their AI coding agent. Also trigger when the user says things like 'set up MCP server', 'install observability tools', 'deploy aliyun MCP', 'configure SLS MCP', or 'update MCP server tools'.
Type-safe Drizzle ORM patterns for Cloudflare D1 databases: schema definition, migration management with Drizzle Kit and drizzle.config.ts, relations and relational queries, joins, prepared statements, the D1 batch API for transaction-like work, and Workers/Wrangler integration. Documents 12 known pitfalls including D1 transaction errors (SQL BEGIN is unsupported), foreign key constraint failures during migrations, module import errors under Wrangler, missing D1 bindings, migration apply failures, schema TypeScript inference errors, prepared statement caching, rollback patterns, TypeScript strict mode errors, remote versus local database confusion, and mixing wrangler.toml with wrangler.jsonc. Use when building a D1 schema, writing type-safe queries, running or repairing Drizzle migrations, or hitting D1_ERROR, BEGIN TRANSACTION, d1 binding, or schema inference errors.
Deploy Electric via Docker, Docker Compose, or Electric Cloud. Covers DATABASE_URL (direct connection, not pooler), ELECTRIC_SECRET (required since v1.x), ELECTRIC_INSECURE for dev, wal_level=logical, max_replication_slots, ELECTRIC_STORAGE_DIR persistence, ELECTRIC_POOLED_DATABASE_URL for pooled queries, IPv6 with ELECTRIC_DATABASE_USE_IPV6, Kubernetes readiness probes (200 vs 202), replication slot cleanup, and Postgres v14+ requirements. Load when deploying Electric or configuring Postgres for logical replication.
Overall methodology for penetration testing GCP cloud environments. Use when the target uses Google Cloud Platform, when GCP-related assets are discovered (GCS Bucket/Compute Engine/Cloud Functions/GKE), when GCP credentials are obtained (Service Account Key/OAuth Token/Metadata Token), or when a security assessment of a GCP environment is required. Provides a full decision tree from unauthenticated enumeration to privilege escalation, post-exploitation, and GCP-to-Workspace traversal. Covers the attack surface of 37+ GCP services
Interface with Gitea instances via the tea CLI. Manage repositories, issues, pull requests, releases, labels, milestones, CI/CD actions, webhooks, organizations, wiki pages, SSH keys, comments, and notifications. Use when user mentions "Gitea", "tea CLI", or asks to create/list/edit/close issues, create/review/merge pull requests, manage repos, create releases, view CI/CD workflow runs, manage webhooks, track time, or perform any code hosting task on a Gitea server. Do NOT use for GitHub (use gh CLI) or GitLab.
GitHub Actions workflow review, scaffolding, and security hardening. Use when user says 'review my workflow', 'check my actions', 'scaffold a workflow', 'is my CI correct', 'pin actions', 'OIDC to AWS', or when working in .github/workflows/*.yml files.
Use when writing BK-CI Go Agent code, such as Agent API calls, task processing, concurrency patterns, error handling, logging, and host-side tool development. Prefer this when the user is writing Go build-agent-side code rather than backend Kotlin services.
Configure and use GoReleaser for release automation with `.goreleaser.yaml`, `goreleaser build`, and `goreleaser release`. Use this skill when creating or editing GoReleaser config, setting up GitHub Actions release pipelines, building cross-platform binaries, publishing to Homebrew, Scoop, AUR, nFPM, Docker, or other package targets, generating changelogs, or automating release artifacts for Go, Rust, Zig, TypeScript, or Python projects.
Traffic hijacking and sensitive information theft in Kubernetes sidecar containers. Use when a target Pod has an Istio/Envoy/Linkerd sidecar, when the challenge mentions an 'invisible bystander' or 'shared network', or when you need to sniff traffic from inside a Pod. Covers tcpdump packet capture, plaintext traffic capture from sidecars, and exploitation of shared network namespaces. Use this skill whenever you find signs of a sidecar or multiple co-existing containers in a K8s Pod
Kubernetes Admission Webhook abuse and policy engine exploitation. Use when the cluster has Kyverno/OPA Gatekeeper/custom webhooks, when DNS scanning reveals kyverno-svc or gatekeeper services, or when you need to extract injected secrets from a Mutating Webhook. Core technique: forging AdmissionReview requests. Use this skill for any scenario in K8s where a webhook service or policy engine is found
Kubernetes cluster DNS service discovery and reconnaissance with k8spider. Use when you need to enumerate Services in a K8s cluster with low privileges, probe DNS services, scan network ranges for PTR/SRV records, or attempt AXFR zone transfers. k8spider needs only DNS access to discover all services in a cluster, with no API Server permissions required. Use this skill for scenarios involving K8s service discovery, DNS reconnaissance, cluster information gathering, PTR scanning, or SRV enumeration. Trigger it also when the user mentions k8spider, K8s DNS enumeration, cluster service scanning, or DNS zone transfer
This skill should be used when the user asks to "create bash scripts", "automate Linux tasks", "monitor system resources", "backup files", "manage users", or "write production shell scripts". It provides ready-to-use shell script templates for system administration
Add OpenTelemetry tracing to MATLAB code. Use when the user asks to "add tracing", "instrument with spans", "add OpenTelemetry", "trace my code", "add observability" (when about tracing), or mentions "spans", "distributed tracing", or "OTel tracing" in the context of MATLAB functions. Covers span creation, parent-child context propagation, error handling, attributes, events, and semantic conventions
How to query OpenTelemetry metrics datasets in Honeycomb correctly. Metrics datasets follow different rules from trace/event datasets — many operations (bare COUNT, RATE_SUM, RATE_AVG, RATE_MAX, CONCURRENCY) are forbidden, temporal aggregation is automatic, and each metric has its own attributes. Use this skill when querying a metrics dataset (gauges, counters, histograms, sums), asking about temporal aggregation (RATE, INCREASE, SUMMARIZE, LAST), finding the metrics dataset or discovering metric names and attributes, debugging unexpected metrics query results, or querying infrastructure metrics like CPU, memory, disk I/O, or network stats. Do NOT use for instrumenting metrics (use otel-instrumentation), querying event datasets with "metrics" in their name, or conceptual questions (use observability-fundamentals).
OpenTelemetry Collector deployment, configuration, and troubleshooting for Coralogix users. Use when writing or debugging collector configs — the `coralogix` exporter (`domain:` vs `endpoint:`, `${env:CORALOGIX_PRIVATE_KEY}` bracket syntax, `coralogix/resource_catalog` variant), the universal processor chain, agent → cluster-collector → gateway topology, spanmetrics/tail_sampling/k8sattributes placement, component stability checks, data-safety/redaction routing including `url_sanitizer`, `sanitize_span_name`, `allow_all_keys`, and before/after validation for broad sanitizer over-sanitization, spanmetrics cardinality protection, and Coralogix-specific presets. Covers the `otel-integration` Helm chart (EKS/GKE/AKS/OpenShift, GKE Autopilot Warden, EKS Fargate), ECS EC2 daemonset, ECS Fargate sidecar, Linux/Windows/macOS standalone, Docker, and the universal installer. Not for OTTL authoring (use the `opentelemetry-ottl` skill) or OpAMP supervisor/Fleet Manager internals beyond the config-precedence callout.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.