Skills
97,905 packaged capabilities and playbooks for agents. Install any of them with one command.
Development
Use when designing or reviewing concurrent Python code — selecting between asyncio, threads, or multiprocessing; structuring cancellation and deadline propagation; bounding fan-out and backpressure. Also use when diagnosing race conditions, deadlocks, slow throughput, or thread/task leaks under load.
Python security patterns for Django, FastAPI, and Flask. Covers Bandit, Safety, secure coding practices, and OWASP for Python ecosystem. USE WHEN: user works with "Python", "Django", "FastAPI", "Flask", asks about "Python vulnerabilities", "pip security", "Bandit", "Python injection", "Python authentication" DO NOT USE FOR: general OWASP concepts - use `owasp` or `owasp-top-10` instead, Node.js/Java security - use language-specific skills
Quantizes LLMs to 8-bit or 4-bit for 50-75% memory reduction with minimal accuracy loss. Use when GPU memory is limited, need to fit larger models, or want faster inference. Supports INT8, NF4, FP4 formats, QLoRA training, and 8-bit optimizers. Works with HuggingFace Transformers.
Electron desktop app reverse engineering: asar unpacking, main/renderer process JS, V8 bytecode (.jsc) boundaries, CDP dynamic debugging, and anti-debugging countermeasures. Triggers: Electron, asar, desktop app reverse engineering, .jsc, V8 snapshot, CDP, ELECTRON_RUN_AS_NODE, devtools detection.
Firmware/embedded/hardware analysis gateway. Workflow: extraction → rootfs → emulation → hardware interfaces. Subskills: [[re-fw-extract]] [[re-fw-rootfs]] [[re-fw-emulate]] [[re-hardware-io]] [[re-automotive]] [[re-uefi]] [[re-rtos]] [[re-tee]]. Trigger terms: firmware analysis, firmware, IoT, unpacking firmware, rootfs, firmware emulation.
Virtualization reverse engineering: VT-x/SVM, hypervisor detection, VMCS/EPT analysis, and partitioning and vdev semantics in Xen / QNX Hypervisor / Jailhouse / ACRN / Bao / Hyper-V·VMBus / XtratuM / LynxSecure / Quest-V. Trigger terms: hypervisor, VT-x, SVM, virtualization detection, EPT, Xen, grant table, event channel, Jailhouse, cell, ACRN, ivshmem, Bao, shmem_id, vdev, GPA/HPA, Hyper-V, VMBus, VSC, VSP, GPADL, SR-IOV, XtratuM, XM_CF, LynxSecure, Quest-V, sandbox kernel
Managed code reverse-engineering gateway. Orchestration: identify runtime → decompile → deobfuscate → route malware scenarios to [[re-malware]]. Subskills: [[re-dotnet]] [[re-java]] [[re-script-deob]] [[re-wasm]] [[re-ai-triage]] → [[re-ai-model]] [[re-blockchain]] [[re-python]]、[[re-browser-ext]]、[[re-electron]]、[[re-javacard]]. Trigger terms: .NET, dnSpy, ILSpy, Java, jar, bytecode, PowerShell obfuscation, VBA macro, JS deobfuscation, managed code.
Transpile React Web applications (v18+) into Taro 4.x code optimized for WeChat Mini Program. Use this skill when converting React components, pages, or utilities to Taro-compatible code with proper JSX element mapping, event handler transformation, navigation/routing conversion, and API shim layer.
Use when building interactive 2D or 3D graph or network visualizations in React with the reagraph library (GraphCanvas, node-link diagrams, force-directed layouts). Covers data shapes (GraphNode, GraphEdge), 16 layout algorithms, selection, lasso, camera controls, sizing strategies, and theming.
Research a factual, codebase, product, or external-documentation question using primary sources and return an evidence-backed answer. Use when the user asks to investigate, compare docs, find current behavior, answer a research ticket, or gather facts before a spec, prototype, or implementation.
Use as the follow-up to brainstorm-beagle when a spec has an Open Questions section (or quietly carries latent gaps) that need closing before planning or implementation can begin. Triggers on: \"resolve the open questions\", \"close the gaps in this spec\", \"research the open items\", \"finalize my spec\", \"make this spec implementation-ready\", \"answer the TBDs\". Also triggers whenever the user points at a brainstorm-beagle spec and asks for research, proposals, or answers to unresolved items. Orchestrates parallel research subagents when available (falls back to inline sequential research otherwise), proposes answers one at a time for user approval, then rewrites the spec in place so it arrives at planning with no known gaps. Does NOT write code, design implementation, or create plans — it only produces a complete spec.
Analyses sprint delivery data and produces a structured retrospective brief. Use when asked to run a retrospective, analyse sprint data, prepare a retro brief, or turn sprint metrics into discussion prompts. Produces a data-grounded retrospective brief with completion stats, pattern analysis, Start/Stop/Continue prompts, and one concrete experiment for next sprint.
Reproduces, diagnoses, and fixes a defect in a Backstage plugin inside the rhdh-plugins or community-plugins repositories: resolve the report from a RHIDP, RHDHBUGS, RHDHPLAN or RHDHSUPP Jira key, a GitHub issue, or plain prose; locate the owning workspace; write a throwaway reproduction test that fails for the stated reason; record before and after Playwright video evidence for a UI defect; then apply the smallest fix and verify it. Use for "fix this plugin bug", "reproduce RHIDP-1234", a plugin that renders the wrong thing, or a regression that needs evidence before and after.
React Native Skia (@shopify/react-native-skia) complete best practices, GPU-accelerated 2D graphics, 60fps/120fps animation patterns, custom shaders, and production optimization for iOS and Android. Use when writing, reviewing, fixing, or optimizing React Native Skia code including Canvas rendering, shapes, paths, gradients, filters, text/fonts, images, video, Skottie/Lottie, particle systems, or custom SkSL shaders. Triggers on tasks involving @shopify/react-native-skia, Canvas, Circle, Rect, Path, Group, useImage, useFont, LinearGradient, RadialGradient, RuntimeShader, Blur, BlurMask, Shadow, Atlas, Picture, Skia.Paint, Skia.Path, useDerivedValue with Skia, interpolateColors, usePathInterpolation, useRSXformBuffer, BackdropBlur, ImageShader, FractalNoise, Turbulence, Paragraph, TextPath, TextBlob, Skottie, AnimatedImage, drawAsImage, immediate mode vs retained mode, or any Skia-based drawing/animation. Also triggers when the user asks to build charts, drawing canvases, progress rings, particle effects, frosted glass, neon glow, image filters, or other GPU-accelerated graphics with React Native Skia.
Use when you have a written implementation plan to execute. Loads the plan, reviews critically, executes tasks in dependency order, and reports completion. Triggers when the user says "run the plan", "execute the plan", or "let's start implementing".
Plan safe database schema evolution and zero-downtime change rollout for Kotlin plus Spring systems using Flyway, Liquibase, or equivalent migration tooling. Use when changing tables, columns, constraints, indexes, or data shape in systems with live traffic, rolling deploys, large datasets, or backward-compatibility requirements between old and new application versions.
Integrate Seam Reservation Automations into a property management system (PMS) or vacation rental platform. Push reservation data (check-in, check-out, guest info) and Seam automatically creates and revokes access codes on smart locks. Supports August, Yale, Schlage, Kwikset, and other smart locks. Use this skill when someone wants to automate access codes from reservations, let Seam handle credential management, or integrate a PMS with smart locks without building device management UI. Not for hotel ACS systems (Salto, Visionline, Brivo) — those need a different approach.
Perform language and framework specific security best-practice reviews and suggest improvements. Trigger when the user requests: security review, security report, threat assessment, vulnerability scan, security audit, secure-by-default coding, hardening guidance, or security best practices guidance. Supported languages: Python, JavaScript/TypeScript, Go. Covers OWASP Top 10, supply chain security, secrets management, dependency auditing, and modern cloud deployment hardening.
World-class prompt engineering skill for LLM optimization, prompt patterns, structured outputs, and AI product development. Expertise in Claude, GPT-4, prompt design patterns, few-shot learning, chain-of-thought, and AI evaluation. Includes RAG optimization, agent design, and LLM system architecture. Use when building AI products, optimizing LLM performance, designing agentic systems, or implementing advanced prompting techniques.
Expert guide for Schema.org structured data and JSON-LD implementation. Use when creating schema markup, validating structured data, implementing rich results (FAQ, HowTo, Product, Article, LocalBusiness, Breadcrumb, Organization, etc.), troubleshooting rich snippet eligibility, or understanding Google's structured data requirements.
Write, debug, and optimize Shadertoy shaders and GLSL fragment shaders for procedural graphics. Use when creating visual effects, generative art, or WebGL shaders; when writing .glsl files; or when user says "write a shader", "make a Shadertoy effect", "help with GLSL", or "create a procedural animation".
Use when a public website needs an AI assistant with source-bounded answers, RAG/content scope, injection protection, escalation, logging, rate limits, refusals, and no hallucinated product/legal/price claims. Planning or implementation handoff only; do not expose secrets or give destructive tools.
Use when the user wants to build, migrate, or troubleshoot a Smart X routine -- TOTVS's metadata-driven UI framework that generates modern PO-UI screens from a data dictionary Object/Model/Interface/Launcher chain. Covers the model.tlpp/interface.tlpp/launcher artifacts, ADVPL function integration via pageActions/tableActions/onChange, converting a legacy MVC browse to Smart X, and common troubleshooting. Also triggers on Portuguese phrasing like "tela Smart X", "gerar tela por metadados", "migrar MVC para Smart X", "criar Modelo e Interface Smart X", "launcher Smart X", or names like FINA050SM/MATA110SX.
Write professional software requirements documents (SRS, PRD, BRD, FRD, User Stories, Use Cases). Use when a user asks to write requirements, create an SRS or PRD, turn a feature description into user stories, generate acceptance criteria, review an existing requirements document, or convert an informal idea into structured requirements. Also trigger when the user mentions "acceptance criteria", "functional requirements", "non-functional requirements", or "requirements traceability matrix".
Hardhat 3 development workflow for Solidity smart contracts. Use when building, testing, or deploying with Hardhat 3.x (hardhat, ignition, EDR). Covers ESM-first project setup, defineConfig, Solidity-native tests, TypeScript tests, multichain support, Hardhat Ignition deployment, and hook-based plugin system. Triggers on tasks involving hardhat init, hardhat build, hardhat test, hardhat ignition, or Hardhat-based Solidity development.
Generate a structured sprint brief from sprint data and goals. Use when asked to write a sprint brief, create a sprint summary, document sprint goals and scope, or produce a team-facing sprint overview. Produces a scannable brief with sprint goal, rationale, grouped work, critical path, risks, and definition of done.
Structure and facilitate sprint planning sessions. Use when asked to plan a sprint, organise backlog items, assign story points, create sprint goals, or prepare sprint planning agendas. Produces a sprint goal, velocity-calibrated backlog, capacity plan, risk flags, and a structured sprint planning meeting agenda.
Explains, optimises, writes, and documents SQL queries. Use when asked to explain a SQL query, optimise slow SQL, translate SQL to plain English for non-technical stakeholders, write a query from a natural language description, or produce query documentation. Produces plain-English explanations, annotated optimised queries, or a data dictionary covering output shape, assumptions, and known limitations. Works across PostgreSQL, MySQL, BigQuery, Snowflake, and standard SQL.
Production logging patterns for observability and incident debugging. Structured JSON logging, correlation IDs, context propagation, log levels, and performance. Use when implementing logging, adding observability, or debugging production systems. Triggers on logging setup, logger configuration, observability, distributed tracing, or incident response workflows.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.