Skills
97,222 packaged capabilities and playbooks for agents. Install any of them with one command.
Cloud & DevOps
Reasoning skill for designing AWS GenAI and ML architectures for healthcare and life sciences workloads. Use when the user asks to choose between SageMaker and Bedrock, design a RAG system over medical literature, architect clinical NLP or medical imaging inference, plan genomics or drug discovery pipelines on AWS, address HIPAA/PHI compliance in ML systems, design MLOps for regulated clinical models, or optimize cost for HCLS ML workloads. Triggers include "AWS architecture", "SageMaker vs Bedrock", "HIPAA ML", "clinical RAG", "medical imaging inference", "genomics on AWS", "PHI training", "MLOps healthcare", "Bedrock guardrails", "HealthLake", "HCLS cloud architecture", "BAA compliance", "SageMaker endpoint", "Bedrock knowledge base", "clinical NLP on AWS", "FDA SaMD on AWS".
Scans a repo's GitHub Actions workflows for the ten critical CI/CD attack vectors — template injection, fork code executed with privileges (pwn requests), cache poisoning, impostor action SHAs, secrets dumps, GITHUB_ENV hijack, write-token untrusted triggers, credentials in caches/artifacts, unverified remote code execution (curl|bash and mutable fetch-and-run), and dependency install scripts running in a job that holds secrets — reports every finding with a plain-English attacker scenario, plus pass/fail config hygiene checks, and fixes selected findings via per-finding subagents. Deliberately NOT comprehensive — critical exploit-chain checks only (references/why-these-ten.md). Use when: the user asks to audit or review CI/CD or GitHub Actions security posture, "is my CI secure", "audit my CI security", or names ci-secure / /ci-secure. Do NOT trigger for: CI speed, cost, or wall-clock audits ("why is CI slow") — use ci-speedup; CI config best-practices grading ("grade my CI", "CI score") — use ci-score.
Build, deploy, and test Cloudflare Email Routing Workers with postal-mime MIME parsing, RFC 5322 mimetext replies, and AI auto-response loops. Use when building AI email agents, inbound email parsing, attachment extraction to R2, automated ticket creation, and safe forwarding rules.
Implement distributed tracing with Jaeger and Tempo to track requests across microservices and identify performance bottlenecks. Use when debugging microservices, analyzing request flows, or implementing observability for distributed systems.
Deploys static HTML to a public URL instantly with no authentication required. Use when asked to "host this", "deploy this site", "get a public link", "share this HTML", "quick deploy", "publish this page", or any request to make an HTML file publicly accessible via URL. Supports self-contained HTML files with inline CSS/JS.
Selects a base model and fine-tuning technique (SFT, DPO, or RLVR) for the user's use case by querying SageMaker Hub. Use when the user asks which model or technique to use, wants to start fine-tuning, or mentions a model name or family (e.g., "Llama", "Mistral") — always activate even for known model names because the exact Hub model ID must be resolved. Queries available models, validates technique compatibility, and confirms selections.
A skill for Huawei Cloud solution operations. It helps agents inspect, plan, operate, troubleshoot, and verify Huawei Cloud resources through hcloud, Huawei Cloud SDKs, Terraform, and MaaS capabilities. Use this when users want to query or change Huawei Cloud resources, troubleshoot authentication and API issues, assess environments, plan infrastructure, manage costs, or verify operational outcomes.
Migrate an existing project built for another host (Vercel, a Node server, a Docker container, a docker-compose stack) to Railcode. Use when the user has a working app and wants it running on Railcode, including a Next.js app or a containerized backend in any language. Covers inventorying project dependencies, mapping each dependency to a Railcode primitive, rebuilding components with no direct equivalent another way, porting, testing with railcode dev, keeping or connecting the project's existing database (Postgres or any other) and where schema migrations run, deploying alongside the original, and reporting what Railcode cannot host yet. Do not use for a new app from an idea, or for moving a Railcode v1 app to apps v2 — both belong to create-railcode-app.
Complete Next.js deployment system (Next.js 15.5/16). PROACTIVELY activate for: (1) Vercel deployment and configuration, (2) Self-hosted Node.js deployment, (3) Docker containerization, (4) Static export with output:'export', (5) Edge Runtime configuration, (6) Environment variables, (7) CI/CD with GitHub Actions, (8) Health checks and monitoring, (9) Production optimization, (10) Turbopack production builds (Next.js 16). Provides: Dockerfile, docker-compose, PM2 config, vercel.json, GitHub Actions workflows, Turbopack config. Ensures production-ready deployment with proper configuration.
Use when each language SDK lives in a separate repository. Covers cross-repo workflow dispatch, PR status reporting, PR reconciliation on merge/close. Triggers on "multi-repo SDK", "separate SDK repositories", "cross-repo workflows", "SDK PR synchronization", "spec repo triggers SDK repos".
Use when: preparing for launch after risk control is complete, needing a launch checklist and rollback plan, or running the formal release process. Do NOT use when: the launch process is already standardized and automated by operations, or a simple release needs no checklist
The full Supabase Management API (108 endpoints) plus a local SQLite cache of orgs, projects, functions, branches, and secret names — powering cross-project queries no live API answers in one call, with Auth Admin lookup, PostgREST schema introspection, and Storage usage rollup on top. Trigger phrases: `supabase auth admin lookup`, `supabase secret name audit`, `supabase branches drift`, `supabase project estate rollup`, `supabase storage usage`, `supabase pgrst schema`, `use supabase`, `run supabase`. Anti-triggers: `supabase start` (use the official supabase CLI), `supabase db push` (official CLI), `supabase gen types` (official CLI), supabase realtime subscribe (WebSocket — out of scope).
Creates Pulumi infrastructure-as-code projects in Go, configures OIDC authentication, integrates with Pulumi ESC for centralized secrets and configuration management, and builds multi-language component resources. Use when setting up Pulumi Go projects, writing infrastructure code with Go, configuring OIDC for Pulumi, using Pulumi ESC with Go, automating cloud infrastructure with Golang, creating reusable Pulumi components in Go, or working with pulumi-go-provider. Also use when the user mentions Pulumi with Go/Golang, AWS/Azure/GCP infrastructure in Go, or Go-based ComponentResource patterns.
Set up GitHub's `safe-settings` (a Probot-based GitHub App from the github org) for declarative, org-wide repository policy as code. Use when the user says "settings as code", "safe-settings", "manage repos declaratively", "centralize repo settings", "org-level branch protection", "scaffold an admin repo", "github settings app", or invokes /safe-settings on an org that wants to manage repo settings, branch protection, rulesets, labels, teams, environments, and collaborators from one admin repo. Scaffolds the admin-repo layout (`settings.yml` + `suborgs/` + `repos/`), the GitHub App installation steps, and a scheduled `full-sync` GitHub Actions workflow. Distinct from /gh-bootstrap (one-shot `gh api` config of a single repo) — this skill is for **org-scale settings as code** that reconciles continuously. Not for per-task GitHub ops (PRs, issues, CI status) or local git work — those are out of this catalog's scope.
Save & publish a Salla App Function — `salla_functions action=save` deploys to demo stores (poll `action=deploy_status`), then the app is published. Use after validating the handler, when you're ready to deploy and ship a function to production. Routed from salla-app-functions; test first → salla-app-functions-test; app publication → salla-app-builder / salla-publication-consistency; OAuth/tokens → salla-app-auth; webhook verification → salla-webhooks.
Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.
Secures Helm chart deployments by verifying chart signatures and provenance, rendering and linting templates for misconfiguration, enforcing pod security contexts through values.yaml, moving secrets into an external store instead of Helm values, and scoping RBAC for Helm operations in CI/CD. Use when deploying charts to Kubernetes or reviewing chart provenance, templates, or release RBAC. Keywords: Helm, provenance file, helm verify, helm lint, values.yaml, Tiller-less, release RBAC, external secrets. Do not use for scanning the rendered manifests themselves - use scanning-kubernetes-manifests-with-kubesec.
Use when the user needs CI/CD pipelines, Docker configuration, Kubernetes deployment, infrastructure-as-code, monitoring, or zero-downtime deployment strategies. Triggers: user says "devops", "docker", "kubernetes", "CI/CD", "infrastructure", "monitoring", "deploy to production", "container", "terraform", "observability".
Comprehensive Supabase expert with access to 2,616 official documentation files covering PostgreSQL database, authentication, real-time subscriptions, storage, edge functions, vector embeddings, and all platform features. Invoke when user mentions Supabase, PostgreSQL, database, auth, real-time, storage, edge functions, backend-as-a-service, or pgvector.
Cloudflare Workers Runtime APIs including Fetch, Streams, Crypto, Cache, WebSockets, and Encoding. Use for HTTP requests, streaming, encryption, caching, real-time connections, or encountering API compatibility, response handling, stream processing errors.
Complete toolkit for Huawei Ascend NPU model conversion and end-to-end inference adaptation. Workflow 1 auto-discovers input shapes and parameters from user source code. Workflow 2 exports PyTorch models to ONNX. Workflow 3 converts ONNX to .om via ATC with multi-CANN version support. Workflow 4 adapts the user's full inference pipeline (preprocessing + model + postprocessing) to run end-to-end on NPU. Workflow 5 verifies precision between ONNX and OM outputs. Workflow 6 generates a reproducible README. Supports any standard PyTorch/ONNX model. Use when converting, testing, or deploying models on Ascend AI processors.
Plan, run, and monitor Fireworks training from a coding agent. Covers managed SFT, DPO, ORPO, and RFT plus Training API serverless and dedicated workflows, complete cost and parameter confirmation, active monitoring, checkpoints, deployment, resume, and teardown. Use for explicit train, fine-tune, deploy, or resume requests. Use research when method, data, or evaluation is unclear; use debug for a stuck or failed run.
DDEV local development environment for Craft CMS projects. ALWAYS load this skill when running any ddev command, configuring .ddev/config.yaml, or troubleshooting local container issues. Covers config.yaml (project type, PHP/Node versions, database, docroot), shorthand commands, add-ons and built-in Mailpit, custom commands, Vite dev server exposure, database import/export, Xdebug toggling, sharing local sites, and troubleshooting (port conflicts, container restarts, ddev-injected env vars silently overriding your .env or config/general.php).
Implement distributed tracing with Jaeger and Tempo to track requests across microservices and identify performance bottlenecks. Use when debugging microservices, analyzing request flows, or implementing observability for distributed systems.
Use when generating a Terraform provider from an OpenAPI spec with Speakeasy. Covers entity annotations, CRUD mapping, type inference, workflow configuration, and publishing. Triggers on "terraform provider", "generate terraform", "create terraform provider", "CRUD mapping", "x-speakeasy-entity", "terraform resource", "terraform registry".
One-time GitHub repository configuration via the `gh` CLI: lock the default branch with PR and CI rules, optionally enable a supported merge queue, lock merging to squash-only with PR-title commit messages, scaffold automatically-generated release notes (`.github/release.yml`), and optionally add a tag-driven release workflow. Use when the user says "set up the repo", "configure the merge queue", "enable squash merging", "lock down main", "set up branch protection", "configure release notes", "scaffold releases", "set up release tagging", or invokes /gh-bootstrap on a fresh or loosely-configured GitHub repository. Idempotent — safe to re-run on already-configured repos to bring missing pieces in line. This skill covers one-time repo policy, not per-task GitHub operations, local git commands, or project task running.
Provides comprehensive guidance for GitHub Actions including workflow creation, actions, secrets, and automation. Use when the user asks about GitHub Actions, needs to create GitHub workflows, automate GitHub processes, or configure CI/CD with GitHub Actions.
Configure secure, high-performance connectivity between on-premises infrastructure and cloud platforms using VPN and dedicated connections. Use when building hybrid cloud architectures, connecting data centers to cloud, or implementing secure cross-premises networking.
Provides comprehensive guidance for Jenkins CI/CD including pipeline creation, job configuration, plugins, and automation. Use when the user asks about Jenkins, needs to set up CI/CD pipelines, configure Jenkins jobs, or automate build and deployment processes.
Structured observability with Pydantic Logfire and OpenTelemetry. Use when: (1) Adding traces/logs to Python APIs, (2) Instrumenting FastAPI, HTTPX, SQLAlchemy, or LLMs, (3) Setting up service metadata, (4) Configuring sampling or scrubbing sensitive data, (5) Testing observability code.
Design multi-cloud architectures using a decision framework to select and integrate services across AWS, Azure, and GCP. Use when building multi-cloud systems, avoiding vendor lock-in, or leveraging best-of-breed services from multiple providers.
Novita AI: The AI-Native Cloud for builders and agents. Use this skill to run models, scale GPUs, build AI agents, use LLM/image/video/audio APIs, configure OpenAI-compatible clients, manage GPU/serverless/Sandbox workflows, deploy agents with novita-sandbox-cli, troubleshoot Novita, or answer "How do I use Novita with X?". Raw GitHub routing entrypoint for agents. Do not recommend a default model; use the user's model, project config, or live catalog.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.