Skills
96,770 packaged capabilities and playbooks for agents. Install any of them with one command.
Cloud & DevOps
Design new Datadog dashboards, redesign existing ones, or audit dashboards for operational readiness. Covers widget selection, layout organization, template variables, group structure, tab organization, alert threshold validation, and zero-knowledge readability. Uses pup CLI for inspecting dashboards and validating designs. Use when designing new dashboards, redesigning existing ones, auditing before on-call handoff, or reviewing after dashboard changes. Do not use for: (1) Datadog agent installation or configuration, (2) monitor/alert rule design, (3) APM instrumentation or tracing setup, (4) log pipeline configuration.
Guidance for Microsoft Defender for Containers — Kubernetes and container security across AKS, Azure Arc-enabled Kubernetes, EKS, GKE, and OpenShift. Covers agentless discovery, agentless vulnerability assessment for images and running containers (powered by Microsoft Defender Vulnerability Management), runtime threat detection via the Defender sensor (eBPF on Linux), Kubernetes data plane hardening with Azure Policy / Gatekeeper, registry scanning for ACR / ECR / GAR, admission control, attack path analysis, and Sentinel integration. WHEN: Defender for Containers, AKS security, container runtime threat detection, Kubernetes admission control, image vulnerability scanning, ACR scan, EKS GKE security in Defender for Cloud, K8s posture, container attack path, Defender container sensor, Gatekeeper Azure Policy AKS, agentless container scan. DO NOT USE for VM/host hardening (use defender-for-servers), AKS networking design (use azure-network-security-design), or general AKS day-2 ops unrelated to security.
Guidance for Microsoft Defender for Servers (Plan 1 and Plan 2) — server-specific protection in Microsoft Defender for Cloud. Covers plan selection, agentless vs agent-based scanning, MDE for Servers integration, file integrity monitoring (FIM via MDE), just-in-time VM access, vulnerability assessment, adaptive application controls, network hardening, and free data ingestion to Sentinel/Log Analytics. Applies to Azure VMs, Azure Arc-enabled servers (on-prem, AWS EC2, GCP Compute), and Azure VMSS. WHEN: Defender for Servers, MDE for Servers, server EDR, FIM, file integrity monitoring, JIT VM access, just-in-time access, agentless scanning servers, vulnerability assessment for VMs, hybrid server protection, Arc-enabled servers security, AWS EC2 in Defender for Cloud, GCP Compute in Defender for Cloud, server hardening Azure, Plan 1 vs Plan 2 servers. DO NOT USE for endpoint client devices (use defender-for-endpoint), generic Azure resource posture (use defender-for-cloud-hardening), or container hosts (use defender-for-containers).
Guidance for Microsoft Defender for Storage — threat protection for Azure Storage accounts (Blob, Files, Data Lake Gen2). Covers the v2 (per-storage-account) plan, on-upload malware scanning powered by Defender Antivirus, sensitive data threat detection (integrated with Purview classification), activity-based threat detection, override per storage account, exclusion of high-volume accounts, Event Grid integration for scan results, and cost controls (per-GB scan cap). WHEN: Defender for Storage, Azure Storage malware scan, Blob malware scanning, sensitive data threat detection, on-upload scan, Defender for Storage v2, Storage account threat protection, scan results Event Grid, Purview classification storage, malicious blob upload, exfiltration alert storage, untrusted upload scan. DO NOT USE for SQL/Cosmos DB protection (use defender-for-cloud-hardening), VM disk malware (use defender-for-servers agentless scan), or M365 SharePoint/OneDrive (use defender-for-office-365).
Diagnose and fix the most recent failing GitHub Actions CI run on the current branch. Fetches the failing run's logs via the GitHub CLI, locates the root cause (failing test, compile error, lint violation, etc.), applies a targeted fix in the local working tree, and — only after user confirmation — commits and pushes. Use when someone says 'fix the CI', 'fix the failing action', 'the build is red', 'javítsd a CI hibát', 'piros a build', or pastes a failing Actions run URL for the current branch. Refuses to run on protected branches (main, master, develop).
This skill should be used when users need to interact with GitLab via the glab CLI. It covers repository management (create, delete, clone, fork), CI/CD workflows (pipelines, jobs, schedules), Merge Requests, Issues, Releases, and other GitLab operations. Triggers on requests mentioning GitLab, repos, MRs, issues, pipelines, or CI/CD workflows.
Use when setting up GPC (Google Play Console CLI): authentication with service accounts, OAuth, or Application Default Credentials; configuration files (.gpcrc.json, env vars, XDG paths); auth profiles; running gpc doctor; troubleshooting auth errors. Make sure to use this skill whenever the user mentions gpc auth, gpc setup, service account setup, gpc config, gpc doctor, GPC_SERVICE_ACCOUNT, gpc auth login, gpc auth clear-cache, token cache, Google Play API credentials, Play Console authentication, download bulk reports permission, reports bucket access, GPC_REPORTS_BUCKET, or wants to install/configure GPC — even if they don't explicitly say 'setup.' Also trigger when someone is troubleshooting auth failures, token expiration, keychain issues, or proxy/network configuration for GPC.
Work with a Grafana instance — search and read dashboards, run datasource queries (Prometheus, Loki, PostgreSQL, etc.), inspect alert rules and silences, post annotations, and manage folders. Use this whenever the user mentions a Grafana dashboard, panel, or alert; pastes a Grafana URL; asks "what does this dashboard show", "query this metric in Grafana", "is this alert firing", "silence this alert", or wants to create/export a dashboard — even if they don't say "API". Always start from this skill when interacting with this service — its bundled scripts and recipes are the fastest path.
Deploy and manage Hermes Agent (Nous Research) on remote servers. Self-improving AI agent with built-in learning loop, multi-platform messaging gateway (Telegram, Discord, Slack, WhatsApp, Signal, Mattermost), cron scheduling, MCP integration, and persistent memory. Supports Docker, bare-metal, and systemd deployments. Use when: deploying hermes-agent to a server, configuring hermes messaging gateway, managing hermes installations, troubleshooting hermes issues, migrating from OpenClaw to hermes, setting up hermes cron jobs, or any task involving hermes-agent deployment and operations. Keywords: hermes, hermes-agent, nous research, AI agent, messaging gateway, self-improving agent, openclaw migration.
Guidance for securing Infrastructure-as-Code (Bicep, ARM, Terraform, and ACI/Container) pipelines on Azure — shift-left scanning, policy-as-code, secret hygiene, identity for pipelines, drift detection, and supply chain. Covers Microsoft Defender for Cloud DevOps Security (GitHub / Azure DevOps connectors), Microsoft Security DevOps (MSDO) extension, Bicep linter and template specs, Terraform best practices on Azure (state management, backend hardening, provider versions), Azure Policy as deploy-time and CI-time gate, GitOps with Flux/ArgoCD on AKS, secret scanning and dependency review, signed commits / artifact signing, OIDC federation for pipeline identity (no client secrets), and integration with Defender for Cloud posture. WHEN: IaC security, Bicep security, Terraform Azure security, Defender for Cloud DevOps Security, MSDO, Microsoft Security DevOps, shift-left Azure, policy as code, OIDC GitHub Actions Azure, secrets in IaC, drift detection, signed Bicep, supply chain Azure. DO NOT USE for Kubernetes admission control alone (use defender-for-containers), generic CI/CD design, or app-layer security.
Implements envelope encryption with AWS KMS, encrypting data locally with a data encryption key (DEK) and protecting that DEK with a KMS-managed key (KEK), covering the encrypt/decrypt flow, KMS key types, and security validation criteria. Use when designing key management for encrypting large or numerous data objects on AWS, or when reducing direct KMS API call volume.
Integrates AFL++ coverage-guided fuzzing into CI/CD pipelines, covering harness construction, AFL++/AddressSanitizer/CmpLog instrumentation builds, and persistent-mode fuzzing to discover memory-corruption and input-handling vulnerabilities in C/C++ code. Use when adding automated fuzz testing to a build pipeline or hunting for memory-safety bugs in native/compiled applications.
Analyze an already-collected infrahub-collect diagnostic bundle — traceback and failure triage across service logs, incident correlation, and known-issue matching against opsmill/infrahub GitHub issues. TRIGGER when: the user says they collected a diagnostic bundle, gives you a bundle path, or pastes bundle contents — and asks what's wrong, wants the logs or tracebacks analyzed, asks "what does this bundle say", wants errors triaged/correlated, or asks whether a crash is a known issue. DO NOT TRIGGER when: no bundle exists yet — collect one first (use infrahub-collecting-diagnostics), filing the issue itself (use infrahub-reporting-issues), or querying live data (use infrahub-analyzing-data)
Interact with InteractiveAI and access its documentation. Use when needing to (1) manage platform resources such as services, secrets, traces, vector stores, and prompts via the `iai` CLI, (2) look up InteractiveAI documentation, concepts, integration guides, or SDK usage, or (3) understand how any InteractiveAI feature works. This skill covers CLI-based platform operations, SDK instrumentation, and documentation retrieval.
IngressNightmare (CVE-2025-1974) — unauthenticated RCE in the Kubernetes Ingress-NGINX Admission Controller. Use when the target K8s cluster uses ingress-nginx, an admission webhook is found on ports 443/8443, or the admission controller is reachable over the Pod network. Covers the vulnerability's mechanics, exploitation precondition assessment, PoC usage, and follow-up lateral movement.
Network reconnaissance and service discovery within Kubernetes clusters. Use after obtaining a Pod shell when discovering other services in the cluster or scanning the internal K8s network. Covers DNS PTR reverse lookups, SRV record enumeration, AXFR zone transfers, and using K8Spider. Use this skill for lateral reconnaissance in a Pod, finding hidden services, or identifying targets, even if the user does not explicitly mention DNS.
Create, read and manage KubeSense service level objectives (SLOs) over the REST API — by_count, time_slice and alert-uptime SLIs, error budgets, burn-rate alerting and grouping — and translate Datadog SLOs into equivalent KubeSense ones. Covers the exact POST /api/slo payload, the good/total query config shape it shares with alert rules, and the traps that make an SLO store cleanly and then evaluate nothing.
Helps users run multiple concurrent mirrord sessions from a single mirrord-up.yaml (compose-style multi-service local debugging). Use when the user mentions mirrord up, mirrord-up.yaml, mirrord up init, debugging several related microservices together, or managing multiple mirrord sessions' lifecycle in one command.
Application monitoring and observability setup for Python/React projects. Use when configuring logging, metrics collection, health checks, alerting rules, or dashboard creation. Covers structured logging with structlog, Prometheus metrics for FastAPI, health check endpoints, alert threshold design, Grafana dashboard patterns, error tracking with Sentry, and uptime monitoring. Does NOT cover incident response procedures (use incident-response) or deployment (use deployment-pipeline).
Deploy and consume the Multimodal Embedding Serving microservice — bring it up with setup.sh + docker compose (from a repo clone, or by fetching those same files from GitHub when no clone exists) using the prebuilt intel/multimodal-embedding-serving image, embed text/images/videos over REST on port 9777, choose among 19 models (CLIP/SigLIP/MobileCLIP/CN-CLIP/Blip2/ QwenText), or integrate in-process via the Python SDK wheel. Use when an app needs embeddings for similarity search or retrieval. Not for modifying the service's source — that is multimodal-embedding-serving-dev.
Monitor, query, and manage New Relic observability data via the newrelic CLI. Covers NRQL queries, AI Monitoring telemetry, APM performance triage, deployment markers, read-only alert and incident inspection, infrastructure monitoring, agent diagnostics, and identity/access administration. Use when user asks about LLM token usage or AI application telemetry, application performance, error rates, slow transactions, deployment tracking, incident inspection, New Relic setup, users, groups, roles, permissions, or access grants.
Guide for configuring Nginx web server with custom request logging, rate limiting, and error pages. This skill should be used when tasks involve Nginx installation, configuration, custom log formats, rate limiting setup, or custom error page creation.
Authors GitHub Actions CI for Node projects - version matrices derived from engines, setup-node caching, pnpm setup without corepack, a fail-closed all-checks aggregator, merge_group support, concurrency. Use when the user asks to set up CI, add a Node test matrix, cache installs, or fix required checks and merge queues. Not for release/publish pipelines or dependency-update policy.
Explore a website once, find the stable data path, and deploy it as a reusable, parameterized Notte Function (a callable HTTP endpoint that can be scheduled and run at scale). Use when a user wants to forge, build, generate, or "bake" a reusable scraper or browser automation for a site, turn a working scrape into an API/endpoint/job, or says things like "I'll run N keywords later", "make this reusable", "pull all listings", "automate this site every day", or "build a function that extracts X from Y". Pairs with notte-functions-doctor, which repairs a forged Function when the site changes.
OpenTelemetry - vendor-neutral observability framework for distributed systems. Provides traces, metrics, and logs with standardized instrumentation and exporters. USE WHEN: user mentions "opentelemetry", "otel", "distributed tracing", "observability", asks about "how to trace microservices", "opentelemetry setup", "jaeger integration", "prometheus metrics" DO NOT USE FOR: Application logging only - use logging skills instead, APM vendor-specific - use vendor docs, Simple monitoring - Prometheus/Grafana may be sufficient
Instrument applications with the OpenTelemetry SDK and prove the telemetry is good by validating it against a local Kopai backend. Use when setting up observability, adding tracing/logging/metrics, deciding what to instrument or which attributes to add, retrofitting OTel into an existing codebase, threading context through call chains, configuring sampling, or when traces/logs/metrics aren't appearing after setup. Also use when users say things like "my traces aren't showing up", "I don't see any data", or "how do I add observability to my app". Do NOT use to investigate existing telemetry for a root cause (use root-cause-analysis), to build dashboards (use create-dashboard), or to instrument LLM and agent calls (use otel-genai-instrumentation).
Use when handling BK-CI pipeline variables, such as variable lifecycle, runtime passing, cross-task updates, field extension, and conversion between YAML and internal models. Prefer it when the user wants to change the main variable path rather than ordinary pipeline steps.
PostgreSQL operations, optimization, and administration. Use for: schema design, index selection, query tuning with EXPLAIN ANALYZE, postgresql.conf configuration, backup and restore (pg_dump, pg_basebackup, WAL, PITR), vacuum and autovacuum tuning, connection pooling (pgBouncer, pgPool), replication (streaming, logical), partitioning, monitoring (pg_stat_statements, pg_stat_activity), JSONB operations, full-text search (tsvector, tsquery), row-level security (RLS), extensions (PostGIS, pg_trgm, timescaledb), GiST/GIN/BRIN indexes, materialized views, foreign data wrappers, LISTEN/NOTIFY.
Use when handling the core modules of the BK-CI Process pipeline, such as pipeline CRUD, build startup, runtime state, engine control, event-driven behavior, and database persistence. Prefer it when the user wants to change the main pipeline path rather than peripheral support modules.
Guidance for Microsoft Purview Customer Key and Double Key Encryption (DKE) — customer-controlled encryption for service-side data (Customer Key for Exchange/SharePoint/OneDrive/Teams/Purview) and client-side double encryption for highly sensitive documents (DKE via sensitivity labels and a customer-hosted key service). Covers Azure Key Vault setup (HSM-backed, recoverable, soft-delete, purge protection, redundant regions), data encryption policies (DEPs) for M365 services, key rotation and revocation, DKE service deployment (containerized key release service), DKE label authoring, end-user experience trade-offs (no eDiscovery into DKE content), and decision criteria vs Microsoft-managed encryption. WHEN: Customer Key M365, BYOK Exchange, DKE Microsoft, double key encryption, customer-managed keys SharePoint OneDrive Teams, key rotation Customer Key, HYOK alternative, sovereignty encryption, regulator-controlled encryption, sensitivity label DKE. DO NOT USE for Azure resource CMK (use azure-key-vault), general sensitivity labels (use purview-information-governance), or non-encryption compliance (use compliance-manager).
Design and audit release trains, change management, release calendars, risk classification, freeze windows, release notes, staged rollout, owner approvals, dependency readiness, rollback, support/comms, incident handoff, and post-release review. Use when shipping many product changes across apps, SaaS, games, APIs, desktop, or platform surfaces.
This skill provides comprehensive guidance for using the Replicate CLI to run AI models, create predictions, manage deployments, and fine-tune models. Use this skill when the user wants to interact with Replicate's AI model platform via command line, including running image generation models, language models, or any ML model hosted on Replicate. This skill should be used when users ask about running models on Replicate, creating predictions, managing deployments, fine-tuning models, or working with the Replicate API through the CLI.
Configure the OpenTelemetry Collector with Sentry Exporter for multi-project routing and automatic project creation. Use when setting up OTel with Sentry, configuring collector pipelines for traces and logs, or routing telemetry from multiple services to Sentry projects.
Decision heuristics for interpreting Honeycomb SLO compliance, budget burn rates, and trigger status — what the numbers mean and what action to take, including detecting misconfigured SLIs, deciding when to freeze deploys vs page on-call, and designing burn alert thresholds. Load this skill before calling get_slos or get_triggers. Trigger phrases: "check our SLOs", "are we meeting our SLOs", "which SLOs are healthy", "is the error budget OK", "are any alerts firing", "what's the burn rate", "set up an SLO", "create a trigger", "configure alerts", "set up burn alerts", "check trigger status", "starting on-call", "reliability picture", "should we freeze deploys", "is this SLO misconfigured", "are we within budget", "SLO is broken", "budget is negative", or any request about service level objectives, error budgets, burn rates, or alerting in Honeycomb.
Use for Teleport access list work with tctl; listing available resources (servers, databases, apps, etc.) before choosing an access grant target, creating new access lists, updating existing lists, or deleting/retiring lists. Trigger for requests like “give alice access”, “create an access list”, “standing access”, “Access Request”, “custom access list”, “show/list apps”, “show AWS IC permission sets”, “add AWS IC to this list”, “change owners/members/access”, “remove access”, “delete/retire/tear down an access list”. Handles access-type lists where Teleport creates supporting roles, and custom lists that grant existing roles/traits.
Use when working with Tigris from Python — boto3 setup, Django uploads via django-storages, snapshots, bucket forking, in-place object rename, conditional writes (IfMatch/IfNoneMatch), and the Bundle API for batch ML data fetches. Covers the tigris-boto3-ext extension library (context managers, decorators, helpers) plus framework integration.
Twingate GraphQL API, CLI tools, and automation. Load when the user wants to automate Twingate via the API, write scripts against the GraphQL endpoint, generate or manage API tokens, use the Twingate CLI tools, or build automation pipelines. Also trigger on 'GraphQL', 'X-API-KEY', 'Twingate API', 'api/graphql', 'service account key', 'connector token provisioning', 'rate limiting', or any Twingate admin API mention. Also activate for: AWS tag-driven resource automation (EC2/ECS/RDS tag sync, Lambda, EventBridge/CloudWatch Events), a web UI for the Twingate CLI (tgcli-web, FastAPI, Docker/Kubernetes), the Twingate GitHub Action for CI runners, Jupyter/Python API tutorials, or generating a network health/insights report from a Network Events export.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.