Skills
97,222 packaged capabilities and playbooks for agents. Install any of them with one command.
Cloud & DevOps
Help with abapGit workflows including repository setup, cloning, serialization, branching strategies, transport-vs-git workflows, CI/CD integration, and .abapgit.xml configuration. Use when users ask about abapGit, git for ABAP, ABAP version control, abapGit clone, abapGit pull, abapGit push, branching strategy for ABAP, abapGit configuration, serialization, deserialization, transport vs git, gCTS, abapGit CI/CD, or managing ABAP code in git repositories. Triggers include "set up abapGit", "clone a repo", "push ABAP to git", "abapGit branching", "abapGit configuration", ".abapgit.xml", "transport vs git", or "CI/CD for ABAP".
Use the `asc` CLI tool (App Store Connect CLI) to manage iOS/macOS apps on App Store Connect. Use this skill when: (1) User wants to manage App Store Connect resources from terminal or CI (2) User is migrating from fastlane, Xcode GUI, or manual App Store Connect workflows (3) User asks about submitting, uploading, TestFlight, metadata, screenshots, IAPs, subscriptions, code signing, or any ASC operation (4) User says "submit my app", "list my apps", "upload screenshots", "check builds", "update app name", "create IAP", "add subscription", "migrate from fastlane", etc. (5) Setting up authentication or managing multiple App Store Connect accounts (6) Building CI/CD pipelines for App Store releases
Manage Xcode Cloud CI/CD using the `asc` CLI tool. Use this skill whenever the user mentions anything related to Xcode Cloud or CI builds, including: - "trigger a build", "start a CI build", "kick off a pipeline", "run CI" - "check build status", "did my build pass", "my build failed", "CI is broken" - "list workflows", "list products", "show me my builds" - "xcode cloud", "CI build", "build run", "pipeline", "check if my PR triggered a build" - Any `asc xcode-cloud` command usage
Create and manage on-demand sandboxes (ODS) for B2C Commerce using the b2c CLI. Use this skill whenever the user needs to spin up a new development sandbox, list running sandboxes, start/stop/restart an instance, or manage sandbox lifecycle — even if they just say "I need a sandbox" or "restart my instance".
Use when driving Cloudflare Pages web-hosting directly — creating a Pages project, deploying a build, adding a custom domain, reading deployment status, and listing/inspecting projects/deployments/domains. CLI-first on the Wrangler CLI (which reads CLOUDFLARE_API_TOKEN + CLOUDFLARE_ACCOUNT_ID and runs headlessly — never `wrangler login`) with a REST fallback on Cloudflare's official API at https://api.cloudflare.com/client/v4 (auth Authorization: Bearer <scoped token>; every path account-scoped under /accounts/{account_id}/pages/...). Resolves the Pages REST operations from a bundled OpenAPI slice via an endpoint index + a $ref-resolver, with the response envelope, deploy stage machine, and multipart-deploy + Direct-Upload-vs-Git caveats handled explicitly. Consumes caller-injected credentials (account_id from context + a token by variable name) — it does not provision them; the token is read only by the Wrangler/curl subprocess, never printed. Static/JAMstack + serverless, not full-stack container apps.
Docker containerization patterns for Python/React projects. Use when creating or modifying Dockerfiles, optimizing image size, setting up Docker Compose for local development, or hardening container security. Covers multi-stage builds for Python (python:3.12-slim) and React (node:20-alpine -> nginx:alpine), layer optimization, .dockerignore, non-root user, security scanning with Trivy, Docker Compose for dev (backend + frontend + PostgreSQL + Redis), and image tagging strategy. Does NOT cover deployment orchestration (use deployment-pipeline).
Performs a security review of Infrastructure as Code templates against the OWASP IaC Security Cheat Sheet, SLSA v1.0, and CIS Benchmarks. Auto-invoked when reviewing Terraform, CloudFormation, or Pulumi configurations. Detects hardcoded secrets, public exposure patterns, encryption gaps, overly permissive IAM, and misconfigurations equivalent to Checkov, tfsec, and KICS rules. Produces a structured findings report with remediation guidance.
When the user wants to submit an iOS app to the App Store. Use when the user mentions 'App Store,' 'App Store Connect,' 'TestFlight,' 'iOS submission,' 'app review,' 'EAS build,' 'eas submit,' 'Apple review,' 'app rejection,' or 'iOS release.' This skill covers the entire process from setup to App Store review approval.
Configure DigitalOcean Managed Postgres with bindable variables or schema isolation. Use when setting up databases, creating users, managing permissions, configuring multi-tenant schemas, or troubleshooting database connectivity on App Platform.
Expert in Windows security hardening and PowerShell security configuration. Specializes in securing automation, enforcing least privilege, and aligning with enterprise security baselines. Use for securing PowerShell environments and Windows systems. Triggers include "PowerShell security", "constrained language mode", "JEA", "execution policy", "security baseline", "PowerShell logging".
Oxylabs proxy networks: Residential, Mobile, shared Datacenter/ISP, and Dedicated Datacenter/ISP proxies with geo-targeting, IP rotation, session persistence, and port-based sticky IPs. Use when routing traffic through proxies, building scrapers with proxy auth, rotating or sticky sessions, whitelisting IPs, or accessing geo-restricted content.
Supabase (open source Firebase alternative, BaaS) reference. PostgreSQL database, Auth (Email / OAuth / Magic Link / Phone / SSO), Storage, Edge Functions (Deno), Realtime (subscriptions / presence / broadcast), Vector embeddings, supabase-js, supabase CLI, RLS (Row Level Security), migrations. Based on PostgreSQL. SQL Server / node-mssql is a separate skill, mssql.
Manage Volcengine's AI-native BaaS platform (Supabase edition / AIDAP / 火山引擎 AI 原生 BaaS 平台 Supabase 版) — a Volcengine-operated distribution that differs from official Supabase. Use when the user asks to create, inspect, or manage Volcengine Supabase or AIDAP resources — workspaces, branches, computes, SQL queries, schema changes, Auth, Realtime, Edge Functions, Storage buckets, frontend static-site hosting (Pages), API keys, connection info, or TypeScript type generation — or when a Volcengine deployment selects AIDAP as its database provider. Also trigger on Chinese prompts mentioning "火山引擎 Supabase" or "火山 Supabase". Operations run through the byted-supabase-cli command-line tool (installed via `npm i -g @byted-supabase/cli`; this is NOT the official `supabase` CLI). Do NOT use it for general database discussions, non-Supabase services (RDS MySQL, Redis), or pure client-side coding unrelated to Supabase backend management.
Generate accurate Volcengine SDK examples by locating an API through API Explorer search, fetching its swagger, and calling api/common/explorer/make-code with user-provided Params. Use when the user asks how to write Volcengine SDK code, generate SDK samples, or call a Volcengine API in Python, Go, Java, PHP, cURL, Node.js. Supports Chinese and English API names such as "角色扮演", "AssumeRole", or "STS AssumeRole". Also use for explicit SDK configuration questions about retry, timeout, AK/SK, STS, AssumeRole, temporary credentials, proxy, connection pooling, SSL, debug mode, request signing, response parsing, and error handling. If the user only needs API parameters, enum values, required fields, error codes, response schemas, pagination, or API comparisons, hand off to volcengine-api. If they need CLI-based operations, hand off to volcengine-cli.
Publish, review, organize, and share work with Artifact Server, or operate an installation when the user explicitly requests administrator work. Use for Artifact Server links, files or sites to upload, project, artifact, version, tag, sharing, or comment work, connection help, and explicit install, deploy, upgrade, backup, restore, or repair requests. Do not use for unrelated package publishing or for building software that the user did not ask to store in Artifact Server.
Archive and export Xcode projects to IPA/PKG using the `asc` CLI tool, with optional upload to App Store Connect. Use this skill when: (1) Archiving an Xcode project: "asc builds archive --scheme MyApp" (2) Exporting an archive to IPA or PKG for distribution (3) Archive + export + upload in one step: "asc builds archive --scheme MyApp --upload --app-id ..." (4) User says "archive my app", "build for TestFlight", "export IPA", "archive and upload", "build and distribute", "create an IPA from my Xcode project" (5) User wants to go from Xcode project to TestFlight without manually running xcodebuild
Upload IPA/PKG builds to App Store Connect and manage the full build distribution workflow. Use this skill when: (1) Uploading a build: "asc builds upload --app-id ... --file MyApp.ipa ..." (2) Checking or listing build upload records: "asc builds uploads list/get/delete" (3) Linking a build to an App Store version before submission: "asc versions set-build" (4) Adding or removing a beta group from a build for TestFlight distribution (5) Setting TestFlight "What's New" notes: "asc builds update-beta-notes" (6) Setting Apple's export-compliance answer (ITSAppUsesNonExemptEncryption): "asc builds set-encryption-compliance" (7) User says "upload my build", "distribute to TestFlight", "set what's new", "link build to version", "missing compliance", "encryption compliance", "ITSAppUsesNonExemptEncryption"
Manage App Store Connect code signing resources using the `asc` CLI tool. Use this skill when: (1) Managing bundle identifiers — register, list, or delete (`asc bundle-ids`) (2) Managing signing certificates — create from CSR, list, or revoke (`asc certificates`) (3) Registering or listing test devices (`asc devices`) (4) Managing provisioning profiles — create, list, or delete (`asc profiles`) (5) Setting up the full code signing chain for CI/CD pipelines (6) User says "set up signing", "create a profile", "register my device", "revoke cert", "list certificates", "create bundle id", or any code-signing related task
Performs an AWS security posture review against the CIS Amazon Web Services Foundations Benchmark v3.0.0. Auto-invoked when reviewing AWS infrastructure, IAM policies, S3 configurations, CloudTrail settings, VPC security groups, or RDS encryption. Walks through all five benchmark sections, evaluates each recommendation, and produces a prioritized findings report with remediation guidance mapped to specific CIS control IDs.
Grades a repository's GitHub Actions configuration against CI best practices (the CI Score: eleven pass/fail configuration facts computed from the repo's own workflow YAML) and hands back concrete fixes for every gap, ranked by impact and risk, each with an apply-now option and a paste-able agent prompt. Use when: (1) the user asks to grade or score their CI, or audit CI configuration against best practices ("grade my CI", "CI score", "CI best practices audit", "how healthy is my CI config"), (2) re-scoring after workflow changes. Requires a local checkout of the target repository. Do NOT trigger for: CI speed, cost, or wall-clock audits, "why is CI slow", or optimization-opportunity analysis (use ci-speedup); security audits or posture review (ci-score is not a security audit — exactly two rubric checks, action pinning and OIDC token scoping, happen to be security-related); writing new workflows from scratch; non-GitHub-Actions CI.
Day-to-day CircleCI from the terminal with the circleci CLI — authenticate, validate config before you commit, watch the run your push triggered, review pipeline/workflow/job status, read job logs and failed tests, download artifacts, and rerun/cancel/trigger. Use when a developer asks to authenticate CLI access, check their build or pipeline status, watch a run after pushing, see why CI failed, read job output/logs, find failing tests, rerun failed jobs, cancel or re-trigger a run, validate a config change locally, or look up a project's environment variables, contexts, triggers or pipeline definitions. For first-time project connection / pipeline-definition setup use the onboarding skill; for the diagnose-and-fix methodology on a failing build use circleci-builds.
Guidance for cloud and SaaS security posture management - combining Defender for Cloud CSPM (IaaS/PaaS) and Defender for Cloud Apps SSPM (SaaS) to assess and harden posture across cloud and SaaS apps. Covers Secure Score, MCSB, attack-path analysis, SSPM recommendations, and governance. WHEN: cloud security posture, SaaS security posture management, SSPM, CSPM, secure cloud apps, posture recommendations, harden SaaS configuration, app security posture, multicloud and SaaS hardening, harden Microsoft 365 SaaS settings, find misconfigured Salesforce or ServiceNow settings, SaaS app misconfiguration. DO NOT USE for IaaS/PaaS workload threat protection plans (use defender-for-cloud-hardening) or for SaaS threat detection only (use defender-for-cloud-apps).
Detects unauthorized runtime drift in containers by monitoring binary execution, filesystem changes, and configuration deviation from the original immutable image, using Falco and Microsoft Defender for Containers. Use when validating immutable-infrastructure controls, hunting for unexpected package installs or binaries written inside a running container, or determining whether a container diverged from the image it was built from. Keywords: drift, immutable infrastructure, new binary executed, package install, image mismatch, Falco. Do not use for detecting breakout from the container to the host - use detecting-container-escape-attempts.
Guidance for Microsoft Entra ID (formerly Azure AD) — cloud identity and access management and the control plane for Zero Trust. Covers tenant and identity model, authentication methods (passkeys, FIDO2, certificate-based), hybrid identity with Entra Connect or Cloud Sync, app registrations and consent governance, groups and administrative units, break-glass accounts, and Zero Trust identity foundations. WHEN: Microsoft Entra ID, Azure AD, identity provider setup, SSO, hybrid identity, Entra Connect, Cloud Sync, authentication methods, passwordless, passkey, FIDO2, certificate-based auth, app registration, enterprise application, illicit consent grant, break-glass account, emergency access, administrative units, SSPR, password writeback. DO NOT USE for risk-based detection (use entra-id-protection), Conditional Access design (use conditional-access-mfa), PIM (use azure-pim), or identity governance lifecycle (use entra-id-governance).
Huawei Cloud MRS cluster alarm diagnosis skill. Analyzes the root cause of an MRS alarm based on user-provided alarm information (alarm ID, alarm name, alarm details, occurrence time, node IP, related service and logs), then outputs the root cause, repair steps, and verification method. Diagnosis is driven by the built-in LakeWatch API client (lakewatch mode) or the MRS Manager API client (manager mode) and the per-alarm knowledge base under alarms/ (lakewatch) or alarm_manager/ (manager). The API mode is auto-detected by check_api_mode.py. No commands outside the knowledge base are fabricated. Applicable to MRS alarm diagnosis and root cause localization scenarios where an alarm ID is provided. Trigger words: "告警诊断", "告警定位", "alarm diagnosis", "alarm diagnose", "MRS告警", "告警原因", "告警ID", "alarm ID", "root cause"
Collect a redacted local diagnostic bundle (logs, config, version, state) for an OpsMill expert hand-off. TRIGGER when: Infrahub is broken/failing/erroring, the user asks for help debugging, wants to collect logs/diagnostics, prepares a hand-off for OpsMill support, or reports a crash/timeout/connection issue (upgrade failure, stuck branch, container CrashLoopBackOff, 500s, OOM). DO NOT TRIGGER when: debugging a check, transform, generator, menu, or schema in the repository (use the infrahub-managing-* skills), a bundle has already been collected and the user wants it analyzed (use infrahub-analyzing-diagnostics), filing a public GitHub issue (use infrahub-reporting-issues), running operational queries (use infrahub-analyzing-data), or planning an upgrade that has not run yet (use infrahub-planning-upgrades).
Deploy the current project to OpenDeploy from an agent, including plan review, managed dependencies, persistent volumes, environment setup, deployment monitoring, and bind-first guest handoff. Use when the user invokes /opendeploy or asks to deploy, redeploy, host, publish, or get a live app with OpenDeploy.
Injects controlled faults (network partition, latency, process kill, disk pressure) into distributed systems and validates recovery behavior. Use when testing circuit breakers, failover paths, retry logic, or building confidence in system resilience through chaos engineering.
Performs a structured network segmentation review against NIST SP 800-207 (Zero Trust Architecture) and CIS Controls v8 (Control 12 -- Network Infrastructure Management). Auto-invoked when reviewing network architecture, VLAN configurations, micro-segmentation policies, or DMZ designs. Produces a segmentation maturity assessment with zone mapping, trust boundary analysis, and remediation guidance.
Custom Dockerized inference workers on Together AI's managed GPU infrastructure. Build with Sprocket SDK, configure with Jig CLI, submit async queue jobs, and poll results. Reach for it whenever the user needs container-level control rather than a standard model endpoint or raw cluster.
Async communication patterns using message brokers and task queues. Use when building event-driven systems, background job processing, or service decoupling. Covers Kafka (event streaming), RabbitMQ (complex routing), NATS (cloud-native), Redis Streams, Celery (Python), BullMQ (TypeScript), Temporal (workflows), and event sourcing patterns.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.