Skills
97,222 packaged capabilities and playbooks for agents. Install any of them with one command.
Cloud & DevOps
Generate SAP BTP (Business Technology Platform) solution architecture diagrams as native draw.io (.drawio) files following the official SAP BTP Solution Diagram guidelines (Fiori Horizon design system) and open them via a configured draw.io MCP server. USE WHEN: user asks to create/draw/design/sketch a BTP diagram, BTP architecture, BTP landscape, BTP solution diagram, BTP reference architecture, SAP Business Technology Platform diagram, or wants to visualize SAP BTP services (CAP, Build, Integration Suite, SAC, AI Core, HANA Cloud, Cloud Foundry, Kyma, Workzone, etc.) and their interdependencies in draw.io / drawio / diagrams.net. DO NOT USE FOR: non-BTP architecture diagrams, generic flowcharts, sequence/UML diagrams, or diagrams that should remain in Mermaid/PlantUML.
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for AI-agent, prompt-injection, MCP or toolchain, cloud, container, CI/CD, and supply-chain challenges. Use when the user asks to analyze prompt-to-tool flows, retrieval poisoning, mounted secrets, deployment drift, runtime-vs-manifest mismatches, registry provenance, or CI-produced artifacts under sandbox assumptions. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for cloud metadata services, instance identity, workload identity, link-local credential paths, role assumption, and metadata-to-privilege trust edges. Use when the user asks to inspect metadata-service access, instance credentials, pod or workload identity, link-local token paths, SSRF-to-metadata escalation, or explain how metadata-derived credentials turn into accepted cloud or control-plane privilege. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for reverse proxies, Host headers, forwarded headers, vhost routing, websocket upgrades, path-prefix rewriting, base-URL derivation, and multi-node route resolution. Use when the user asks which host or container serves a route, why a public-looking domain still belongs to the sandbox, how headers or proxies change behavior, or how a route resolves across proxy, container, and worker boundaries. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for SSRF reachability, internal route probing, metadata-service access, credential pivoting, and token-to-accepted-privilege chains. Use when the user asks to trace SSRF sources, internal hosts, metadata endpoints, link-local tokens, service-account credentials, or explain how a server-side fetch edge turns into accepted access. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
Internal downstream skill for ctf-sandbox-orchestrator. CTF-sandbox workflow for CI/CD, registry, dependency drift, artifact provenance, image build, release pipeline, and runtime consumer challenges. Use when the user asks to trace dependency drift, registry pulls, malicious packages, build or release tampering, CI execution, artifact signing, or which shipped artifact the runtime actually consumes. Use only after `$ctf-sandbox-orchestrator` has already established sandbox assumptions and routed here.
Guidance for Microsoft Defender for APIs — a Defender for Cloud plan that discovers, prioritizes by risk, and protects APIs published in Azure API Management against threats and abuse. Covers onboarding, security findings, and threat detection. WHEN: Defender for APIs, API threat protection, secure APIs in API Management, API security posture, detect API abuse, onboard APIs to Defender, API attack detection, sensitive data exposure in APIs.
Deploy applications to DigitalOcean App Platform via GitHub Actions with proper environment management and secrets handling. Use when setting up CI/CD pipelines, configuring staging/production environments, managing deployment secrets, or creating GitHub Actions workflows.
Comprehensive guide for deploying Docker Compose stacks on Dokploy (self-hosted VPS deployment platform). Use this skill whenever the user mentions Dokploy, deploying Docker Compose to a VPS, deploying applications with docker-compose.yml on a self-hosted server, or when troubleshooting Docker Compose stacks running on Dokploy. Covers both Compose (stack) and Application (Git) deployment types, volume strategies, networking, environment variables, init containers, healthchecks, domains with Traefik, and troubleshooting common errors like EAI_AGAIN, permission denied, unhealthy containers, and JWT/config issues. Also applies when deploying any multi-service Docker Compose stack to Dokploy.
Edge computing with Cloudflare Workers, Deno Deploy, Bun, Vercel Edge Functions, AWS Lambda@Edge, and edge databases (Turso, D1, DynamoDB Global Tables). Use when building low-latency edge applications, edge-side rendering, or globally distributed compute.
Use when optimizing OCI costs, investigating unexpected bills, planning budgets, or identifying waste. Covers hidden cost traps (boot volumes, reserved IPs, egress), Universal Credits gotchas, shape migration savings, free tier maximization, and cost allocation challenges.
Diagnose performance issues on Amazon SageMaker HyperPod clusters — uneven NCCL bandwidth across nodes and poor filesystem throughput. Read-only. Surfaces host-side signals (Xid, ECC, NVLink, EFA reachability, FSx saturation) and routes to the appropriate sibling skill (hyperpod-node-debugger, hyperpod-nccl, hyperpod-version-checker, hyperpod-issue-report) for any remediation. Triggers on uneven NCCL across nodes, straggler node, FSx slow, checkpoint slow, dataloader slow, filesystem bottleneck, FSx throughput, cross-AZ latency, topology mismatch.
Operate the joelclaw Kubernetes cluster — Talos Linux on Colima (Mac Mini). Deploy services, check health, debug pods, recover from restarts, add ports, manage Helm releases, inspect logs, fix networking. Triggers on: 'kubectl', 'pods', 'deploy to k8s', 'cluster health', 'restart pod', 'helm install', 'talosctl', 'colima', 'nodeport', 'flannel', 'port mapping', 'k8s down', 'cluster not working', 'add a port', 'PVC', 'storage', any k8s/Talos/Colima infrastructure task. Also triggers on service-specific deploy: 'deploy redis', 'redeploy inngest', 'livekit helm', 'pds not responding'.
Reviews CI/CD pipeline configurations against SLSA v1.0 build levels and OWASP Top 10 CI/CD Security Risks. Auto-invoked when reviewing GitHub Actions workflows, GitLab CI configs, Jenkins pipelines, or when discussing supply chain security. Produces a pipeline security assessment with SLSA level determination and CICD-SEC risk findings.
Assess Splunk Search Head Cluster captaincy, elections and Raft state, member health, configuration and artifact replication, scheduler and search availability, KV Store health and recovery boundaries, deployer bundle phases, member drift, and rolling-change readiness without changing a deployment. Use for SHC captain/member instability, replication inconsistency, KV Store symptoms, deployer propagation failures, rolling readiness, and SHC-specific incident routing. Preserve Cloud, Enterprise, evidence-collection, platform, search, app, knowledge-object, upgrade, and indexer-cluster boundaries.
Deploy a frontend or any static site to the IC with the @dfinity/static-site recipe (the certified-assets canister). Covers icp.yaml recipe config, SPA routing with _redirects, custom headers/CSP with _headers, clean URLs, access protection for private apps, custom domains, and building against canister IDs. This is the recommended way to host frontends and static files on the IC. Also the entry point for the legacy @dfinity/asset-canister recipe and .ic-assets.json5 (see the legacy reference) and for migrating an existing asset canister to certified-assets. Use when hosting a frontend, deploying static files, an asset canister, or setting up SPA routing on the IC. Do NOT use for canister-level HTTP code patterns or custom domain DNS setup — use custom-domains for DNS.
Senior Cloud Architect specializing in AWS, Azure, and GCP multi-cloud strategies with expertise in cost optimization, infrastructure design, and enterprise cloud migration. Use when designing cloud architecture, planning migrations, optimizing cloud costs, or implementing multi-cloud strategies.
Provides comprehensive guidance for Tencent Cloud COS including bucket creation, object storage, access control, and COS management. Use when the user asks about Tencent Cloud COS, needs to store files in COS, configure COS buckets, or work with Tencent Cloud storage.
Performs a container and Kubernetes security review against the CIS Docker Benchmark v1.6.0, CIS Kubernetes Benchmark v1.9.0, and NIST SP 800-190. Auto-invoked when reviewing Dockerfiles, Kubernetes manifests, Helm charts, or container orchestration configurations. Evaluates image security, runtime hardening, RBAC, Pod Security Standards, network policies, and secrets management. Produces a prioritized findings report with remediation guidance.
Diagnose NCCL failures and adjacent training-pod failures on HyperPod GPU clusters (EKS or Slurm) — training hangs, AllReduce / collective-op timeouts, EFA or libfabric errors, rendezvous failures, EFA TCP fallback, /dev/shm or memlock issues, NCCL version mismatch across pods, container OOM / exit-137 / OOMKilled, GPU OOM (CUDA out of memory), CrashLoopBackOff / Pending pods, MASTER_ADDR DNS, NetworkPolicy blocking. Not for single-node hardware faults (→ hyperpod-node-debugger § G) or cluster-creation EFA / SSM failures (→ hyperpod-cluster-debugger § A / § F).
Diagnose and remediate per-node issues on a HyperPod cluster (EKS or Slurm) — a specific node is unhealthy, unresponsive, stuck, or needs replacing. Covers on-node EFA, GPU / accelerator hardware (XID, ECC, NVLink, row-remap, DCGM), Slurm node down/drained, disk and memory pressure, per-node lifecycle-script failures, SSM agent, container runtime, kernel panics, pod networking. Read-only. Not for cluster-wide provisioning (→ hyperpod-cluster-debugger), NCCL (→ hyperpod-nccl), or MFU (→ hyperpod-mfu-debugger).
Diagnostic-only skill for Slurm scheduler and node-daemon issues on Amazon SageMaker HyperPod Slurm clusters. Scope mirrors the HyperPod troubleshooting guide. Invoke when the user reports a Slurm node stuck in down/drain, "Node unexpectedly rebooted" after auto-repair, slurmd not running, jobs stuck PENDING with REASON=Resources while sinfo shows idle nodes, jobs stuck COMPLETING after node replacement, GRES/GPU counts wrong, scontrol ping failing, slurmctld unresponsive, an Action:Reboot/Replace request that did not trigger HyperPod auto-recovery, or auto-resume not restarting a job. Also triggers on "drain before reboot", "diagnose a Slurm node", "investigate stuck jobs."
Use when driving a Jenkins server's REST (Remote Access) API directly with curl (no SDK) — triggering a build, polling the queue item to a build, reading build status + console log, listing/inspecting jobs, job CRUD (createItem/copy/delete/enable/disable via config.xml), and build management (stop/delete). Jenkins is path-addressed REST authenticated with HTTP Basic username:API_TOKEN. A build trigger is ASYNC — it returns a queue item, not a build, so you poll queue/item/<id>/api/json to the executable. API-token auth is exempt from the CSRF crumb (Jenkins 2.96/2.107+); a crumb is only a 403 fallback. No official Jenkins OpenAPI exists, so the CORE path table is grounded on the official Remote Access docs (the bundled swaggy-jenkins spec is an unofficial cross-check). Consumes caller-injected credentials (base_url + username + a token resolved by variable name) — it does not provision or resolve them; the token value is read only by curl, never printed.
Framework-independent LLM serving benchmark skill for comparing SGLang, vLLM, TensorRT-LLM, TokenSpeed, or another serving framework. Use when a user wants to find the best deployment command for one model across multiple serving frameworks under the same workload, GPU budget, and latency SLA.
Manages Python library releases including semantic versioning, changelog maintenance (Keep a Changelog format), release automation with GitHub Actions, and deprecation workflows. Use when planning releases, writing changelogs, automating release pipelines, or communicating breaking changes.
Help users install and configure the mirrord Operator for team/enterprise environments. Use when users ask about operator setup, Helm installation, cloud API key or license configuration, air-gapped/offline licensing, enabling features (queue splitting, DB branching, preview environments, multi-cluster), internal registries, OpenShift/GKE Autopilot, RBAC, or multi-user mirrord deployments. Also use when an AI agent hits a Team or Enterprise feature on a cluster with no license and needs to offer the user a trial (agent-started trial; the trial is Enterprise tier).
Expert in legacy Windows PowerShell 5.1. Specializes in WMI, ADSI, COM automation, and maintaining backward compatibility with Windows Server environments. Use for Windows-specific automation on legacy systems. Triggers include "PowerShell 5.1", "Windows PowerShell", "WMI", "ADSI", "COM object", "legacy PowerShell".
Use when you already have a components map and several module pages, and now need to converge business modules (products<=6), fix the run/troubleshoot/rollback entry points (ops), and execute the DoD gate and incremental Discover (Delta Discover, stale expiry detection) to keep the knowledge base usable and maintainable.
Scores Kubernetes resource manifests with Kubesec to flag misconfiguration and privilege-escalation risk before deployment, mapping each finding back to the securityContext change that fixes it. Use when gating manifests in CI, reviewing YAML or a rendered chart before it reaches a cluster, or explaining why a manifest scored negatively. Keywords: Kubesec, manifest score, securityContext, readOnlyRootFilesystem, runAsNonRoot, CI gate. Do not use for scanning built images for CVEs - use scanning-docker-images-with-trivy; for admission-time enforcement use implementing-opa-gatekeeper-for-policy-enforcement.
Replay-first debug flow for SGLang serving problems. Use when a live or recent server shows health-check failures, latency or throughput regressions, queue growth, timeouts, distributed stalls, crash dumps, wrong outputs after deploys, or PD/EP/HiCache issues, and the job is to turn the problem into a replay plus the right next debug tool.
Turborepo (high-speed monorepo build system) reference. turbo.json, turbo run, task dependencies (dependsOn), caching (local / remote), workspaces (pnpm / npm / yarn / bun), --filter, Remote Cache (Vercel), parallel execution, turbo gen (code generation), watch mode, error message diagnostics (recursive turbo invocations, missing root task, invalid env prefix).
Classify Splunk upgrade, advisory, vulnerability, compliance, and post-change incident requests; preserve the minimum applicability and ownership context; ask one route-changing question when necessary; and hand each outcome to the exact public-product, upgrade-readiness, vulnerability/compliance, platform-operations, Cloud-administration, app-lifecycle, or provider owner. This skill routes only. It does not answer product or advisory questions, assess exposure, plan or execute changes, implement controls, or troubleshoot incidents.
Assess cited Splunk Enterprise and Splunk Cloud version, maintenance, and security-patch readiness. Use when a planned version change or Splunk security advisory needs one evidence-labeled applicability and readiness decision covering compatibility, prerequisites, sequencing, change control, recovery, validation, and Cloud-versus-Enterprise ownership without executing the change.
Use Terraform/IaC for Volcengine resources only when the user explicitly chooses Terraform/IaC, already has a Terraform workflow/state, or confirms they need plan/diff/drift/destroy safety for VKE, managed databases/cache/storage, load balancers, domains/certificates, logging/monitoring, or team-managed infrastructure.
Use when the user wants to deploy a local directory or GitHub repository to Volcengine and needs the project analyzed, the app shape understood, and a ranked recommendation across ECS, VKE, and veFaaS before choosing an execution path. Also trigger when the user asks "what deploy mode should I use", "is this repo ready for Volcengine", or "check my repo before deploying". This skill prepares the decision; `volcengine-deploy` skill performs the chosen deployment, and `volcengine-iac` skill is used only when the user chooses Terraform/IaC or the task already has an IaC workflow.
Generate accurate Volcengine SDK examples by locating an API through API Explorer search, fetching its swagger, and calling api/common/explorer/make-code with user-provided Params. Use when the user asks how to write Volcengine SDK code, generate SDK samples, or call a Volcengine API in Python, Go, Java, PHP, cURL, Node.js. Supports Chinese and English API names such as "角色扮演", "AssumeRole", or "STS AssumeRole". Also use for explicit SDK configuration questions about retry, timeout, AK/SK, STS, AssumeRole, temporary credentials, proxy, connection pooling, SSL, debug mode, request signing, response parsing, and error handling. If the user only needs API parameters, enum values, required fields, error codes, response schemas, pagination, or API comparisons, hand off to volcengine-api. If they need CLI-based operations, hand off to volcengine-cli.
Webly hosts what agents make: publish a website, or share files and folders, at a live URL in seconds with no account, then let the person sign in and claim it to keep it, edit it over MCP, and publish drafts they approve. Use when asked to "publish this", "host this", "deploy this", "put this online", "make a website", "share this as a web page", "give me a link to this site", "share these files", "send these files", "give me a download link", "keep my site", "claim my site", "make a Webly account", "connect Webly", "connect my domain", "use my own domain", or when working on a site hosted on Webly (*.webly.site). Also use at the start of any session where a Webly site or an unfinished Webly step is waiting on this machine.
Helps users migrate from Azure Cache for Redis (ACR/OSS) Basic, Standard, and Premium tiers to Azure Managed Redis (AMR). Provides SKU mapping, real-time pricing scripts, cache metrics assessment, automated migration via ARM REST APIs with DNS switching, and IaC template migration (ARM, Bicep, Terraform). Use when users ask about: Redis migration, ACR to AMR, OSS to AMR, automated migration, DNS switch migration, cache retirement deadline, ACR retirement date, SKU selection, AMR vs ACR features, feature compatibility, Redis module support, pricing comparison, cache upgrade, Basic/Standard/Premium tier migration, P1/P2/C3 cache migration, AMR SKU recommendation, migration rollback, migration validation, connection string changes, port changes, cache assessment and metrics, IaC template migration (ARM, Bicep, Terraform), or checking for amr-migration-skill updates. Do NOT use for: Enterprise (ACRE) tier migrations, creating new Redis caches, or general Redis performance tuning.
Configure domains, routing, CORS, VPC, static IPs, and inter-service communication for DigitalOcean App Platform. Use when setting up custom domains, subdomain routing, cross-origin API access, or secure database connectivity.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.