Skills
96,770 packaged capabilities and playbooks for agents. Install any of them with one command.
Cloud & DevOps
Coordinate local, Git remote, and SSH/HPC/RunAI research projects. Use for server state, sync safety, job submission, interactive sessions, logs, artifact lookup, context recovery, raw SSH commands, remote shell one-liners, SSH quoting issues, remote-cmd, remote-bash, or avoiding local shell expansion of remote variables.
Lists, generates, and removes RHDH test entries and Hive ClusterPools in the openshift/release Prow ci-operator configuration. Covers OCP `e2e-ocp-vX-Y-helm-nightly` entries, `cluster_claim.version`, the `rhdh-cluster-pool` Hive pools, and AKS/EKS/GKE entries with `MAPT_KUBERNETES_VERSION`. Use for "add an OCP test entry", "which OCP versions are we testing", "list the cluster pools", "what AKS/EKS/GKE version is configured", or an OCP coverage-gap analysis.
RouterOS /app YAML format for container applications (7.21+ builtin app, 7.22+ custom YAML creation). Use when: writing or validating RouterOS /app YAML files, working with MikroTik container apps, building docker-compose-like definitions for RouterOS, creating /app store schemas, debugging /app validation errors, or when the user mentions /app, tikapp, or RouterOS container YAML.
MikroTik RouterOS CHR (Cloud Hosted Router) with QEMU. Use when: running RouterOS in QEMU, booting CHR images, debugging CHR boot failures, setting up VirtIO devices for RouterOS, choosing between SeaBIOS and UEFI boot, configuring QEMU port forwarding for RouterOS REST API, setting up inter-VM socket networking or host-side L2 capture of guest broadcasts (e.g. MNDP), or selecting QEMU acceleration (KVM/HVF/TCG).
Set up Sentry releases and deploy tracking — tag events with a version and environment, create the release in CI with its commits, and wire up suspect commits and code mappings, so Sentry can show which release introduced an issue, which commit is responsible, and release health. Use when asked to set up releases, track deploys, see what changed, or when issues show an unknown release or no suspect commit.
Tencent Cloud penetration testing methodology. Use when the target uses Tencent Cloud services, when cos.*.myqcloud.com assets are discovered, when Tencent Cloud SecretId/SecretKey is obtained, when the metadata at metadata.tencentyun.com is reachable from inside a CVM instance, or when a security assessment of Tencent Cloud services such as CAM/CVM/COS/TencentDB/TKE/SCF is required. Covers CAM privilege escalation, CVM takeover, COS object storage exploitation, TencentDB database attacks, TKE container clusters, SCF cloud functions, CLB load balancing, CLS log service, and KMS key management
Generate complete, runnable Volcengine SDK code and provide SDK configuration guidance. Supports Go, Python, PHP, Java, and Node.js. Trigger this skill whenever the user wants to call a Volcengine API, generate Volcengine SDK code, or describes a cloud operation on Volcengine (e.g., "list ECS instances", "create a VPC on Volcengine", "query Volcengine billing with Python"). Also trigger when the user asks about Volcengine SDK configuration and best practices — including retry, timeout, authentication (AK/SK, STS, AssumeRole), proxy, connection pooling, SSL, debug mode, and error handling (e.g., "how to configure retry for Volcengine Go SDK", "volcengine python sdk proxy setup"). Trigger when the user mentions Volcengine service names such as ECS, VPC, CDN, CLB, RDS, Redis, Kafka, billing, IAM, DNS with code generation or SDK usage intent. When the user only needs API specification queries (parameters, error codes, response structures), hand off to the volcengine-api skill. When the user needs CLI-based operations, hand off to the volcengine-cli skill. Supports both Chinese and English prompts.
Walrus CLI client for storing, reading, and managing blobs from the command line. Use when the user needs to run walrus store, walrus read, walrus blob-status, walrus extend, walrus delete, walrus share, or any other walrus CLI command. Also use for CLI installation, configuration (client_config.yaml), JSON mode for scripting, gas budgets, wallet configuration, and logging. For blob lifecycle management details, see `walrus-blob-lifecycle`. For quilts, see `walrus-quilts`.
Walrus quilts for batching many small blobs into a single storage unit. Use when the user needs to store multiple files as a quilt, retrieve individual blobs by QuiltPatchId or identifier, list patches in a quilt, or use quilt HTTP endpoints. Also use when optimizing storage costs for many small blobs. Covers both CLI (store-quilt, read-quilt, list-patches-in-quilt) and HTTP API quilt operations. For regular single-blob storage, see `walrus-cli` or `walrus-http-api`.
Deploying, updating, and serving decentralized static websites on Walrus Sites. Use when the user needs to deploy a frontend to Walrus Sites, run a local portal for testnet or mainnet, use the site-builder CLI, configure ws-resources.json (routing, headers, metadata), set up custom domains (SuiNS, DNS), automate deploys with GitHub Actions CI/CD, debug site-builder errors, or manage site object lifecycle (update, destroy, extend blobs). Also use when the user asks about site-builder, walrus-sites, portal setup, or hosting a dApp on Walrus. For blob storage without the Sites framework (raw upload/download), see `walrus-cli` or `walrus-http-api`.
Walrus storage pricing, cost estimation, and the dual-token (WAL + SUI) cost model. Use when the user asks how much storage costs, how to estimate costs for a dataset, what the per-blob metadata overhead is, how epochs relate to pricing, how to use the cost calculator or walrus info, or why small blobs are expensive. Also use when the user asks about WAL vs SUI fees, write fees, storage fund deposits, dry-run cost checks, or cost optimization strategies (quilts, storage reuse).
Create and deploy single-page static websites to GitHub Pages with autonomous workflow. Use when building portfolio sites, CV pages, landing pages, or any static web project that needs GitHub Pages deployment. Handles complete workflow from project initialization to live deployment with GitHub Actions automation.
Sets up GitHub Actions CI/CD workflows for WordPress plugins — coding standards (WPCS/PHPCS), PHP/JS/CSS linting, PHPUnit testing, static analysis (PHPStan), Composer security scanning, WordPress Playground PR previews, and automated deployment to WordPress.org. ALWAYS use this skill when a user wants to create, add, set up, or configure GitHub Actions, CI/CD, automated checks, or deployment workflows for a WordPress plugin — even if they don't use the exact phrase "GitHub Actions". This includes any request to: add automated coding standards or PHPCS/WPCS checks to a WP plugin repo; set up linting (PHP, JS, CSS) for a WordPress plugin; configure PHPUnit testing in CI for a plugin; auto-deploy a plugin to WordPress.org from GitHub; add Playground previews to pull requests; add security scanning or static analysis to a plugin pipeline; or generally "add CI", "add automated checks", "set up workflows", or "automate" anything related to a WordPress plugin's GitHub repository. Also trigger when someone mentions wanting to stop doing manual SVN deploys, wants quality gates on PRs, or is setting up a new WordPress plugin repo and wants best practices for automation. If the user is inside a WordPress plugin repository and mentions anything about automated testing, code quality, deployment, or GitHub workflows, use this skill.
Use when handling BK-CI YAML pipeline import/export, bidirectional YAML and Model conversion, PAC, template references, and YAML validation. Prefer this when the user mentions YAML pipelines, PAC, templating, comment preservation, expression parsing, or conversion debugging.
Deploy and manage apps on 9pm.ai with the public 9pm CLI. Use when a user asks to deploy an app, inspect app compatibility for 9pm.ai, create a hosted app, configure app access, use managed storage, set environment variables or secrets, regenerate deployment commands, or delete a 9pm.ai app.
Alchemy IaC framework for TypeScript. Use when the user mentions Alchemy, wants to set up infrastructure, deploy Cloudflare Workers, configure databases, KV, R2, queues, use bindings and secrets, set up dev mode, use framework adapters (Vite, Astro, React Router, SvelteKit, Nuxt, TanStack Start), create custom resources, or work with any Alchemy provider.
PAI-DLC job diagnostics and health inspection. Queuing-stuck root cause analysis, failed-job localization, cluster health checks. Companion to the `alibabacloud-pai-dlc-job` skill (read-only — no writes). Triggers: "diagnose", "diagnose job", "job stuck", "why queuing", "queue stuck", "stuck in queue", "job failed", "failure reason", "healthcheck", "health check", "inspect job", "inspection".
Use this skill when the user needs hardware-level management, testing, or diagnostics for Huawei Ascend NPUs. Typical scenarios: checking an NPU card's status, temperature, and utilization; testing memory bandwidth (h2d/d2h/d2d/p2p); running compute/power benchmarks (TFLOPS, TOPS); diagnosing NPU hardware faults or performing health checks; stress testing NPU cards (aicore, memory); resetting or recovering stuck or abnormal NPU cards. Typical user questions (trigger even if ascend-dmi is not mentioned): "help me test this server's compute and bandwidth", "check the NPU temperature and utilization on 192.168.1.50", "run an fp16 compute test and see the TFLOPS", "is the d2d bandwidth up to spec", "card 3 seems to have a problem, help me diagnose it", "the NPU is stuck, reset it", "stress test all 8 cards", "run a power test, edp mode". Use this skill whenever the user wants to measure, diagnose, or manage Ascend NPU hardware directly — including checking server NPU performance (compute/bandwidth/power), diagnosing hardware faults, or resetting NPU cards. Trigger even when the user only mentions "server" + "compute/bandwidth/NPU status" without saying "ascend-dmi". Do NOT use for: writing NPU code, installing frameworks, debugging training issues, or Docker configuration.
Guidance for Azure AI Content Safety — programmatic content moderation for text, images, multimodal, and generative AI guardrails. Covers Content Safety categories (hate, violence, sexual, self-harm) with severity levels, Prompt Shields for jailbreak and indirect prompt injection detection, groundedness detection (hallucination check vs grounding sources), protected material detection (text and code), custom categories, blocklists, Content Safety Studio for tuning, integration with Azure OpenAI as input/output filters (built-in plus custom), latency/cost trade-offs, agent guardrails, and deployment patterns (sidecar in app, integrated with Azure OpenAI). WHEN: Azure AI Content Safety, prompt shields, jailbreak detection, indirect prompt injection, groundedness check, protected material detection, content moderation, generative AI guardrails, harmful content categories, custom blocklist AI, agent guardrail. DO NOT USE for AI workload threat detection / SOC alerts (use defender-for-cloud-ai), end-user AI usage governance (use purview-ai-hub), or general AI app design unrelated to safety.
Guidance for secure remote VM management in Azure using Azure Bastion combined with Defender for Cloud just-in-time (JIT) VM access. Covers Bastion SKU selection (Developer / Basic / Standard / Premium), IP-based and shareable-link connections, native client (RDP/SSH from local machine via az CLI), session recording (Premium), private-only deployment, JIT request workflow and policy, RBAC for connect operations, integration with Conditional Access (via Bastion + Entra login on the VM), Azure Policy enforcement to require Bastion + JIT and prohibit public IP on VMs, and migration off VPN/jump-box patterns. WHEN: Azure Bastion design, Bastion SKU comparison, JIT VM access, just-in-time access Azure, Bastion shareable link, native client Bastion, session recording Bastion, eliminate public IP on VMs, replace jump host with Bastion, secure RDP SSH Azure, Bastion Premium recording. DO NOT USE for hybrid/SD-WAN VPN design, GSA Private Access (use entra-global-secure-access), or cluster-only K8s access.
Guidance for Azure Confidential Computing — protecting data in use through hardware-based Trusted Execution Environments (TEEs). Covers Confidential VMs (AMD SEV-SNP, Intel TDX), Confidential containers on AKS (Kata + AMD SEV-SNP), confidential GPU VMs (NVIDIA H100 with TDX), Azure Key Vault Managed HSM and Premium with secure-key-release for confidential workloads, attestation (Microsoft Azure Attestation service), confidential ledger, scenarios (multi-party data sharing, regulated workload isolation, AI training on sensitive data), key-release policies tying secrets to attested TEE state, and decision criteria vs CMK/Customer Key. WHEN: Azure Confidential Computing, AMD SEV-SNP, Intel TDX, confidential VM, confidential AKS container, confidential GPU H100, Azure Attestation, secure key release, multi-party computation, confidential AI, encrypted memory Azure, hardware enclave Azure. DO NOT USE for general data-at-rest CMK (use azure-key-vault), application encryption SDK only, or non-Azure TEE design.
Guidance for Azure DDoS Protection — Network Protection (per-VNet) and IP Protection (per public IP) tiers built on the same always-on Microsoft platform. Covers tier selection vs free Basic infrastructure protection, scope (VNet vs single IP), traffic profiling and mitigation policy auto-tuning, attack analytics and metrics, attack alerts to Sentinel, DDoS Rapid Response engagement, integration with Azure WAF and Front Door, cost-protection guarantee, mitigation reports for compliance, and per-region capacity planning. WHEN: Azure DDoS Protection, DDoS Network Protection, DDoS IP Protection, layer 3/4 DDoS, attack analytics Azure, DDoS rapid response, cost protection DDoS, DDoS metrics, mitigation report, simulate DDoS Azure. DO NOT USE for layer 7 / app-layer attack mitigation alone (use azure-waf), Azure Firewall design (use azure-firewall), or hybrid network DDoS via on-prem appliances.
A methodology for lateral movement from Azure Cloud to on-premises AD. Use after obtaining Azure/Entra ID privileges when access to an on-premises Active Directory environment is needed, when the target uses a hybrid identity architecture such as Azure AD Connect/Cloud Sync/PTA/Federation, or when PRT/Certificate/Cookie credentials are needed for Cloud-to-OnPrem lateral movement. Covers 14 lateral techniques: Pass the PRT/Certificate/Cookie, Cloud Kerberos Trust, Connect Sync/Cloud Sync credential extraction, PTA Agent backdoor, Federation Token forgery, Seamless SSO silver ticket, Exchange Hybrid impersonation, Arc GPO deployment script injection, and on-premises cloud credential extraction.
Comprehensive expertise for Azure Static Web Apps including architecture, configuration, API integration with Azure Functions, authentication, routing, deployment, and CI/CD. Use when building, configuring, deploying, or troubleshooting Azure Static Web Apps projects with frameworks like React, Angular, Vue, Blazor, or vanilla JavaScript.
Guidance for Azure Web Application Firewall — deployed on Azure Front Door (global, edge-tier) or Azure Application Gateway (regional, integrated with backend pools). Covers WAF policy design with managed rule sets (Microsoft Default Rule Set, Bot Manager, OWASP CRS), custom rules (rate limit, geo-block, IP allow/deny), exclusion design (the long-tail tuning task that decides whether WAF stays in Prevention), JSON challenge / CAPTCHA, log analytics integration, false-positive triage workflow, integration with Defender for Cloud and Sentinel, regional vs global trade-off, and migration from third-party WAF. WHEN: Azure WAF, Front Door WAF, Application Gateway WAF, OWASP CRS Azure, bot manager Azure, WAF custom rules, WAF rate limiting, WAF false positives, WAF exclusions, WAF prevention vs detection, JSON challenge WAF, geo-block WAF. DO NOT USE for L3/L4 DDoS (use azure-ddos-protection), Azure Firewall design (use azure-firewall), or non-HTTP workloads.
Amazon Bedrock AgentCore deployment patterns for production AI agents. Covers starter toolkit, direct code deploy, container deploy, CI/CD pipelines, and infrastructure as code. Use when deploying agents to production, setting up CI/CD, or managing agent infrastructure.
Build and deploy applications on inference.sh. Use when getting started, understanding the platform, creating apps, configuring resources, or needing an overview of inference.sh app development. Supports both Python and Node.js. Triggers: inference.sh app, belt app, inf.yml, inference.py, inference.js, deploy app, app development, build app, create app, GPU app, VRAM, app resources, app secrets, app integrations, multi-function app
Deploy Chat Question-and-Answer Core with Docker Compose (OpenVINO CPU, OpenVINO GPU, or Ollama CPU), including env setup, profile selection, startup verification, health checks, and teardown. Use this skill when the user says "deploy chatqna core", "start chatqna container", "run compose", "openvino gpu deploy", or "ollama deploy".
Deploy Chat Question-and-Answer Core to Kubernetes using Helm (OpenVINO CPU, OpenVINO GPU, or Ollama), including values.yaml configuration, helm install/upgrade, deployment verification, uninstall, and translation from Docker Compose setup_env.sh variables into Helm override values. Use this skill when the user says "deploy chatqna core to kubernetes", "helm install chatqna-core", "configure values.yaml", "convert compose config to helm", or "translate setup_env.sh to chart values".
Covers Cloudflare Hyperdrive, which connects Cloudflare Workers to existing PostgreSQL and MySQL databases with global connection pooling and query caching: creating configs with wrangler hyperdrive create, wrangler.jsonc bindings, the required nodejs_compat flag, driver setup for node-postgres (pg), postgres.js and mysql2, Drizzle ORM and Prisma integration, local development, and caching and TLS options. Use when giving Workers access to RDS, Aurora, Neon or Supabase databases, setting up connection pooling or a hybrid architecture, or debugging errors such as Failed to acquire a connection from the pool, TLS not supported by the database, connection refused, missing nodejs_compat, or Code generation from strings disallowed.
Advisory-only Kafka tuning for Confluent Cloud or Confluent Platform by priority: latency, throughput, availability, or durability. Use when asked to size a planned topic or tune an existing cluster, topic, producer, or consumer for a quantified target such as lower p99 latency or no lost acknowledged writes. Inspects configuration read-only and recommends changes, trade-offs, and validation; the administrator applies them. Do NOT trigger for: WarpStream or Apache Kafka OSS-only clusters; Flink SQL or UDF authoring, tuning, or debugging (use confluent-cloud-flink-sql or flink-udf); Kafka Connect tuning; new Java/Python client implementation (use developing-kafka-java-client or developing-kafka-python-client); Kafka Streams/KStream/KTable development (use kafka-streams-programming); or CDC, Tableflow, or Iceberg pipelines (use confluent-cloud-cdc-tableflow).
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.