Skills
96,770 packaged capabilities and playbooks for agents. Install any of them with one command.
Cloud & DevOps
Use when the user needs to deploy, configure, upgrade, or troubleshoot Twingate Connectors on any platform. Activate for: Docker connector, Linux connector, systemd connector, ECS connector, Azure Container Instances, GCE, Helm chart connector, connector tokens, connector HA, connector health, connector metrics, connector logging, connector upgrades, DEAD_NO_RELAYS, DEAD_NO_HEARTBEAT, or connector placement questions. Also activate for connector deployment tooling and unofficial platform support: Raspberry Pi, Ubiquiti/UniFi (UDM Pro, UDM SE, UXG) gateways, Unraid, Home Assistant, Steam Deck / Decky Loader, Hyper-V, Chocolatey packaging, custom or hardened connector containers, GitHub Codespaces, Coder workspaces, render.com, Spacelift CI runners, connector log shipping to S3, connector fleet autoscaling, Grafana connector dashboards, PagerDuty connector alerting, or Docker container auto-updating for connector hosts.
Use when the user deploys Twingate in Kubernetes, uses the Twingate Helm chart or operator, manages TwingateResource or TwingateRemoteNetwork CRDs, routes traffic from cluster pods outward through Twingate, gates kubectl access via Twingate, or integrates Twingate into a GitOps workflow. Also trigger when an existing K8s stack needs connector deployment, token secret management, or declarative Twingate resource definitions. Also trigger for Helm chart `values.yaml` fields, operator CRD kinds (`TwingateConnector`, `TwingateResource`, `TwingateResourceAccess`, `TwingateGroup`, `TwingateGateway`, `TwingateCertificateAuthority`), kubeconfig sync automation, or running the Twingate headless client as a Kubernetes sidecar container.
Use when the user writes, debugs, or reviews Twingate Pulumi code in any language (TypeScript, Python, Go, C#/.NET). Activate on mentions of Pulumi, pulumi-twingate, @pulumi/twingate, or pulumi_twingate, or when an existing Pulumi stack needs to add Twingate resources. Also trigger when the user is migrating from Terraform to Pulumi for Twingate, or building a multi-language Pulumi stack that needs Twingate provisioning. Also trigger for local-plugin build/install errors (`pulumi plugin install`, 404 on `pulumi up`/`pulumi preview`, `+dirty`/alpha version strings), or requests for SE reference quick-start Pulumi scripts per cloud.
Use when the user writes, debugs, or reviews Twingate Terraform configuration. Activate for any .tf file that touches Twingate resources, the Twingate Terraform provider, IaC provisioning of Remote Networks, Connectors, Resources, Groups, or Service Accounts, provider version questions, and terraform apply errors involving Twingate. Also trigger when existing AWS, Azure, GCP, or Kubernetes Terraform stacks need to add Twingate. Also trigger for provider source/schema questions (`internal/provider/`), `group_ids` / `access` block migration errors, provider release version and changelog questions, or requests for SE reference quick-start Terraform modules per cloud.
Use when scaling a dedicated Kubernetes cluster (Linode LKE or AWS EKS) on Zeabur — listing node pools, changing node counts, or adding/removing node pools. Use when user says "scale my cluster", "add nodes", "remove nodes", "resize node pool", "加節點", "擴容", "縮容". Do NOT use for renting new servers (use zeabur-server-rent) or for single-VM dedicated servers (they have no node pools).
This skill should be used when managing ZFS pools in a homelab environment with multiple devices. It handles pool health monitoring, snapshot management with Sanoid/Syncoid, automated replication between devices, dataset property optimization, scrub scheduling, and error recovery. Use when the user asks to "check ZFS pool health", "setup ZFS replication", "configure ZFS snapshots", "optimize ZFS performance", "troubleshoot ZFS issues", "schedule ZFS scrubs", "check pool capacity", "setup Sanoid", or mentions ZFS-related tasks. CRITICAL: This skill enforces MANDATORY double confirmation for ALL destructive operations.
Alibaba Cloud WAF Bot Management automated configuration assistant. Automatically completes bot protection policy evaluation, configuration, verification, and tuning via OpenAPI/CLI. Supports scenarios such as LLM API protection, retail promotion anti-scalper, general anti-crawling, and academic research platforms. Triggers when the user mentions Bot management, crawler protection, anti-crawling, WAF Bot, BOT2.0, LLM API abuse prevention, retail anti-scalper, promotion protection, SMS bombing, script attacks, or automated traffic protection.
End-to-end pipeline for releasing an iOS / watchOS app to TestFlight and the App Store. Use when the user wants to publish, ship, or release an iOS/watchOS app, get a build onto TestFlight, archive and upload via xcodebuild, deploy a CloudKit schema to Production, set App Privacy or export compliance, mint a Distribution certificate, or work through App Store Connect / Apple Developer portal steps. Triggers on 'continue publishing', 'ship the app to TestFlight', 'release the iOS app', 'upload a build', 'deploy CloudKit to production', 'App Privacy labels', 'distribution signing', or any cryptic Apple upload error (cloud signing, 90057 missing CFBundleShortVersionString, 90474 orientation). macOS and Xcode only.
Interactively guides the documentation of arc42 Section 7 (Deployment View). Asks about infrastructure, environments, and software-to-hardware mapping before generating C4 PlantUML deployment diagrams and environment comparison tables. Iterates until the user is satisfied.
Design Azure cloud architectures from requirements and generate High-Level Design (HLD) documentation with service selection, patterns, cost estimates, and WAF alignment. Use this when asked to design or architect Azure solutions.
ECS blue/green deployment patterns. Recommends ALB-native weighted target groups as the simpler default; covers CodeDeploy as a reference for teams that already use it or need pipeline-integrated rollback. Use when choosing or debugging ECS blue/green infrastructure.
Buildkite CI/CD integration. Use when the user needs to check build status, trigger builds, read build logs, debug failures, manage pipelines, or any Buildkite workflow. Triggers include "buildkite", "build", "pipeline", "CI", "deploy", "build log", "build failed".
Configures cloud storage retention policies across AWS S3, Azure Blob Storage, and Google Cloud Storage. Covers lifecycle rules, object lock, legal hold, immutability policies, cross-region replication retention alignment, and compliance mode configuration. Activate for cloud retention, S3 lifecycle, Azure retention, GCP retention policy queries.
Manage Cloudflare DNS records and zones from the terminal with the cf CLI (coollabsio/cloudflare-cli). Full DNS CRUD, zone listing, filtered queries, proxied record toggling, and JSON output for scripting. Use when: managing DNS records via CLI, listing Cloudflare zones, creating/updating/deleting DNS records, automating Cloudflare DNS workflows, or troubleshooting zone-scoped token permission errors, “cf: command not found,” and config file issues
Complete knowledge domain for Cloudflare Workers KV - global, low-latency key-value storage on Cloudflare's edge network. Use when: creating KV namespaces, storing configuration data, caching API responses, managing user preferences, implementing TTL expiration, handling KV metadata, or encountering "KV_ERROR", "429 too many requests", "kv rate limit", cacheTtl errors, or eventual consistency issues. Keywords: kv storage, cloudflare kv, workers kv, kv namespace, kv bindings, kv cache, kv ttl, kv metadata, kv list, kv pagination, cache optimization, edge caching, KV_ERROR, 429 too many requests, kv rate limit, eventually consistent, wrangler kv, kv operations, key value storage
Write a safe, zero-downtime database migration plan for a schema change. Use when asked to plan a database migration, design a zero-downtime schema change, document an expand/contract migration, produce a rollback procedure for a database change, or coordinate a database schema update with a deployment. Produces a structured migration plan covering migration objectives, backward compatibility analysis, expand/contract phase breakdown, exact SQL, rollback steps per phase, data validation queries, and a deployment runbook.
Deploy a web app to Cloudflare Workers through GitHub Actions: write the wrangler config and a deploy workflow that creates D1/KV/R2, applies D1 migrations, syncs Worker secrets from GitHub, and deploys on every merge; guide the secrets and steps the user owns in DEPLOYMENT.md; re-run or roll back. Use when deploying a web app to Cloudflare, setting up Cloudflare deploys in GitHub Actions, adding Worker secrets, attaching a custom domain, adding Cloudflare resources for an app, or preparing a monorepo package for Cloudflare
Validate that a Dynamo deployment's NIXL/UCX/NCCL interconnect is ready for disaggregated serving over RDMA/NVLink. Use after recipe-runner brings a deployment up (especially disagg/multi-node) to confirm the KV transport is correct; use troubleshoot for diagnosing already-failed pods.
Runs Fastly Compute WASM binaries locally and serves as the authoritative reference for Compute platform internals. The fastlike source code is highly readable and covers the host ABI, caching and purging APIs, KV/config/secret store interfaces, rate limiting with counters and penalty boxes, ACL lookups, the full request lifecycle, backend fetch semantics, and a built-in per-request profiler with hostcall spans, backend waterfalls, native CPU samples, and optional deep metrics (body bytes, cache outcomes, header summaries, wasm heap curve). Use when working with Compute runtime internals or host calls, understanding how edge data stores behave at runtime, profiling local Compute apps, or testing WASM binaries locally. Prefer this skill over Viceroy for any non-Rust Compute work — its source code is easier to understand as a Fastly Compute API reference.
Enable or disable a GrowthBook feature flag in a specific environment. Use when the user says "turn on flag X in production", "disable this flag in staging", "kill switch flag X", "turn this off everywhere", "enable the flag", "flip it off in prod", or "I need to disable this flag now". This is the environment-level kill switch — it controls whether the flag is evaluated at all in an environment, independent of its rules. Changes are review-gated and go through the standard draft → publish flow. For adding or editing targeting rules within an environment, use flag-targeting. For toggling a rule on or off without affecting the environment, use flag-rules.
(Experimental) Runs an end-to-end observability rollout for an application on Grafana Cloud via gcx: instrumentation, SLOs, alerts, synthetic checks, k6, IRM, dashboards, cost, GitOps. Use to set up monitoring for a service from scratch. For LLM apps use agento11y-instrument.
GitHub Actions workflow patterns for React Native iOS simulator and Android emulator cloud builds with downloadable artifacts. Use when setting up CI build pipelines or downloading GitHub Actions artifacts via gh CLI and GitHub API.
Automates GitHub repository setup: 12 production-tested GitHub Actions workflow templates (React/Vite, Node matrix testing, Python, Cloudflare Workers deploy, basic CI), 4 YAML issue and pull request templates, Dependabot config, CodeQL security scanning, branch protection, and CODEOWNERS. Prevents 18 documented errors in workflow YAML syntax and indentation, action version pinning, runner versions, issue template structure, Dependabot PR limits, and CodeQL permissions such as security-events: write. Use when bootstrapping a new repo, adding CI/CD pipelines, creating issue or PR templates, enabling Dependabot or CodeQL scanning, deploying to Cloudflare Workers from GitHub Actions, or fixing GitHub Actions workflow YAML syntax errors.
Use when debugging GPC errors, failures, or unexpected behavior. Make sure to use this skill whenever the user mentions gpc error, gpc failing, exit code, AUTH_FAILED, API_FORBIDDEN, NETWORK_ERROR, CONFIG_MISSING, EDIT_CONFLICT, upload failed, permission denied, timeout, rate limit, gpc doctor failing, unexpected exit code, command not working, GPC crash, debug GPC, verbose output, --json error, threshold breach, REPORT_ACCESS_DENIED, REPORT_BUCKET_NOT_FOUND, reports bucket access, bulk reports permission denied, API_DECLARATION_REQUIRED, App content declaration, foreground service declaration, API_ALREADY_EXISTS, API_ENDPOINT_RETIRED, ORDER_REVIEW_REFUND_INVALID, PLUGIN_PERMISSIONS_REQUIRED, PLUGIN_IDENTITY_MISMATCH, CONFIRMATION_REQUIRED, IMAGE_SYNC_DIR_UNREADABLE, THRESHOLD_NO_DATA, THRESHOLD_INVALID, TRAIN_GATE_NO_DATA, API_METRIC_GAMES_ONLY, INVALID_PACKAGE_NAME — even if they don't explicitly say 'troubleshoot.' Also trigger when someone encounters any GPC error they don't understand, when gpc doctor reports issues, when CI pipelines fail with GPC commands, or when they need to interpret exit codes. For auth-specific setup issues, see gpc-setup. For CI-specific issues, see gpc-ci-integration.
Hunt CI/CD pipeline vulnerabilities — GitHub Actions workflow injection (pull_request_target Pwnrequest + ${{ }}-into-shell), self-hosted runner poisoning, OIDC trust-policy abuse, Jenkins script-console RCE and CVE-2024-23897 file read, GitLab CI runner-token registration, Terraform state file leakage, artifact/log secret leakage, pipeline env-var disclosure. Use when target has a public GitHub/GitLab org, exposed CI dashboards (Jenkins/TeamCity/Drone/Argo), or build artifacts/images are reachable
Hunt cloud / infrastructure misconfigurations. AWS: public S3 buckets (s3:GetObject anonymous), permissive bucket policies (PutObjectAcl public-write), exposed CloudFront origin, public Lambda function URL, public RDS snapshot, IAM credentials in JS bundles, AWS metadata accessible via SSRF. GCP: public GCS buckets, exposed Cloud Run services, leaked service account JSON. Azure: public blob containers, exposed Function App. (Kubernetes/Docker exposure is owned by hunt-k8s; CI/CD pipeline attacks by hunt-cicd; post-credential IAM escalation by cloud-iam-deep.) Detection: targeted dorking, certificate transparency, JS bundle secret extraction, port scan for known service ports. Validate: actual data read / write / RCE. Use when hunting cloud-native storage and compute misconfig (S3/GCS/Blob, IMDS-via-SSRF, serverless, public managed services).
Hunt Kubernetes & Docker — API anonymous access, kubelet 10250 exec (SPDY/WebSocket, NOT plain POST) and the simpler /run primitive, etcd 2379 unauth, dashboard skip-login, RBAC misconfig, secret/SA-token abuse, docker.sock host escape, runc/container-escape (Leaky Vessels CVE-2024-21626), API-server-mediated nodes/proxy RCE, EphemeralContainers node-shell, bound/projected SA-token audience+expiry abuse, admission-controller bypass, Helm/Tiller remnants. Use when target runs containerized infra, exposes K8s ports (6443/10250/10255/2379/8443), or cloud metadata reveals K8s service accounts.
Implements GCP Binary Authorization end to end, including creating KMS-backed attestors, Container Analysis notes, deploy-time policies, and signing image attestations, so that only trusted, verified images deploy to GKE and Cloud Run. Use when enforcing container supply-chain integrity or deploy-time attestation checks on GCP.
Operate Konnect AI Gateway request flow, provider/model routing, AI Proxy behavior, prompt/response controls, and LLM analytics. Use when the issue is inside AI Gateway, not generic prompt engineering, provider SDK debugging, or non-AI Gateway rollout.
Kubernetes container orchestration. Covers deployments, services, and configuration. Use for container orchestration. USE WHEN: user mentions "kubernetes", "k8s", "kubectl", "deployment", "pod", "service", "ingress", "configmap", "secret", asks about "container orchestration", "scaling", "rolling updates", "helm", "production cluster", "namespace" DO NOT USE FOR: local development environments - use `docker-compose` skill instead, Dockerfile creation - use `docker` skill instead, CI/CD workflows - use `github-actions` skill instead
Analyze log files to troubleshoot errors, identify peak error periods, and produce error clustering, frequency statistics, and time distribution reports. Supports JSON, syslog, and Nginx formats with automatic detection. Use when a user uploads a .log file and asks to analyze errors, find patterns, debug issues, or get distribution stats.
PostgreSQL development for Python with full-text search (tsvector, tsquery, BM25 via pg_search), vector similarity (pgvector with HNSW/IVFFlat), JSONB and array indexing, and production deployment. Use when creating search features, storing AI embeddings, querying vector similarity, optimizing PostgreSQL indexes, or deploying to AWS RDS/Aurora, GCP Cloud SQL/AlloyDB, or Azure. Covers psycopg2, psycopg3, asyncpg, SQLAlchemy integration, Docker development setup, and index selection strategies. Triggers are Use "PostgreSQL search", "pgvector", "BM25 postgres", "JSONB index", "psycopg", "asyncpg", "PostgreSQL Docker", "AlloyDB vector". Does NOT cover - DBA administration (backup, replication, users), MySQL/MongoDB/Redis, schema design theory, stored procedures.
Guide for .NET MAUI apps consuming .NET Aspire-hosted backend services. Covers AppHost configuration, service discovery for mobile clients, HttpClient DI setup, Entra ID authentication with MSAL.NET for calling protected APIs, development workflow (Aspire dashboard + MAUI debugging), Blazor Hybrid considerations, and platform-specific networking for Android emulators and iOS simulators. USE FOR: "MAUI with Aspire", "Aspire service discovery", "AppHost MAUI", "Aspire backend", "MAUI Aspire networking", "mobile Aspire", "Aspire dashboard MAUI". DO NOT USE FOR: standalone REST API calls without Aspire (use maui-rest-api), authentication without Aspire (use maui-authentication), or Aspire-only projects without MAUI.
Fast path for a minimal CloudBase Web + database demo (minimal frontend/backend / minimal viable fullstack / Lovable-like BaaS). Defaults to @cloudbase/js-sdk client CRUD (NoSQL app.database / PG app.rdb), MCP-only schema, preview-first, and forbids cloud functions unless secrets, cron/background jobs, or logic that security rules/RLS cannot express. Use for building a demo, guestbook, Todo, Notes, Kanban, or when users say “with cloud functions + cloud database” but only need CRUD. NOT for production multi-service backends, CloudRun, WeChat Mini Programs, or tasks that truly need server secrets.
Deploy a production self-hosted n8n end-to-end to a fresh Linux VM over SSH, using Docker Compose behind a Caddy reverse proxy with automatic HTTPS. Use whenever the user wants to self-host, install, set up, provision, or deploy n8n on their own server/VPS/box (Hetzner, DigitalOcean, AWS EC2, bare metal, etc.) — in either single/regular mode or queue mode with workers — or to update, back up, restore, or harden such an instance. This is for SELF-HOSTED n8n (Docker), not n8n Cloud and not building workflows. The skill makes the agent ask single-vs-queue first, collect the domain/SSH/timezone inputs, generate fresh secrets on the box, and bring the stack up with TLS. Trigger on "deploy n8n", "self-host n8n", "install n8n on my server", "n8n docker compose", "n8n queue mode / workers / scaling", "n8n reverse proxy / SSL", "back up / update my n8n", or "we don't want to give every user the OAuth client secret" / "enable the Sign in with Google button" (credential overwrites).
Cuts and automates npm releases - Changesets, semantic-release or release-please, npm trusted publishing (OIDC) with provenance, the first-publish bootstrap, staged publishing, changelogs and tags. Use when the user asks to release, version, publish to npm, or remove tokens from publish workflows. Not for package exports/bundling artifacts or verifying dependency provenance.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.