Skills
97,725 packaged capabilities and playbooks for agents. Install any of them with one command.
Development
Writing or reviewing code that handles untrusted input, secrets, outbound requests, rendered content, or third-party dependencies — the OWASP Top 10:2025 lens in two modes, writing secure-by-default code and judging the risk a change introduces. Triggers on "is this safe", "secure by default", "harden", "security", "secret", "privacy", "PII", "XSS", "injection", "SSRF", "safe fetch", "access control", or a dependency review. Covers secrets and environment variables, input validation, output encoding, SSRF, access control and data exposure, and supply-chain risk.
Edit features with the Editor component/widget, configure forms, manage subtypes, handle attachments, and work with branch versioning. Use when adding, updating, or deleting features, building edit forms, managing feature attachments, or working with versioned edits.
Explore and compare architectural options before committing to a large technical direction. Use when the user wants to evaluate different architectures, compare approaches, choose between competing designs, rethink a subsystem, or understand tradeoffs before a major refactor or migration. Also use for prompts like "explore the architecture", "what are our options", "compare approaches", "what design should we choose", "audit and recommend an improved architecture", or "help me think through a large architectural change" even if the user does not mention a formal architecture review.
Add sound effects, music, audio streaming, and video players to Decentraland scenes. Covers AudioSource (local files), AudioStream (streaming URLs), VideoPlayer (video surfaces), video events, and media permissions. Use when the user wants sound, music, audio, video screens, radio, or media playback. Do NOT use for 3D model animations (see animations-tweens).
Production-ready Auth.js v5 setup for Next.js and Cloudflare Workers. Use when: setting up authentication, implementing OAuth/credentials/magic links, configuring D1 or PostgreSQL adapters, debugging session issues, migrating from v4 to v5, fixing edge compatibility, troubleshooting JWT/database sessions, resolving AUTH_SECRET errors, fixing CallbackRouteError, or implementing RBAC. Covers: Next.js App Router & Pages Router, Cloudflare Workers + D1, OAuth providers (GitHub, Google, etc.), credentials auth, magic links, JWT vs database sessions, middleware patterns, role-based access control, token refresh, edge runtime compatibility, and common error prevention. Keywords: Auth.js, NextAuth.js, authentication, OAuth, credentials, magic links, D1 adapter, Cloudflare Workers, Next.js middleware, JWT session, database session, refresh tokens, RBAC, edge compatibility, AUTH_SECRET, CallbackRouteError, CredentialsSignin, JWEDecryptionFailed, session not updating, route protection
CloudBase Node SDK auth guide for server-side identity, user lookup, and custom login tickets. This skill should be used when Node.js code must read caller identity, inspect end users, or bridge an existing user system into CloudBase; not when configuring providers or building client login UI.
Use only when working on the docs site. How a docs project is laid out and how to write its pages, sections, front matter, links, generated references and changelogs, in the house tone. Read before writing, editing, moving or reviewing any page under docs/.
Full delivery pipeline: plan, build, ship, settle. Covers: shape/spec/design, TDD build, commit, PR creation, PR fix (CI/reviews/conflicts), PR polish, simplify, test coverage, verify ACs, walkthrough, issue management. Use when: shipping features, fixing PRs, creating PRs, building issues, simplifying code, checking quality, writing commits, managing issues. Trigger: /autopilot, /build, /shape, /commit, /issue, /check-quality, /test-coverage, /verify-ac, /pr-walkthrough.
Production-ready authentication framework for TypeScript with first-class Cloudflare D1 support. Use this skill when building auth systems as a self-hosted alternative to Clerk or Auth.js, particularly for Cloudflare Workers projects. Supports social providers (Google, GitHub, Microsoft, Apple), email/password, magic links, 2FA, passkeys, organizations, and RBAC. Prevents 10+ common authentication errors including session serialization issues, CORS misconfigurations, D1 adapter setup, social provider OAuth flows, and JWT token handling. Keywords: better-auth, authentication, cloudflare d1 auth, self-hosted auth, typescript auth, clerk alternative, auth.js alternative, social login, oauth providers, session management, jwt tokens, 2fa, two-factor, passkeys, webauthn, multi-tenant auth, organizations, teams, rbac, role-based access, google auth, github auth, microsoft auth, apple auth, magic links, email password, better-auth setup, session serialization error, cors auth, d1 adapter
Best practices for building and improving CLIs that work for both humans and AI agents. Activate when building, designing, reviewing, refactoring, or improving any new or existing command-line tool or CLI application. Keywords - CLI, command line, terminal, argparse, commander, cobra, clap, oclif, typer, click, flags, subcommands, exit codes, help text, error messages. NOT for TUI/full-screen apps, GUI apps, or REST API design.
Find what a change could break somewhere else before it ships, beyond the diff, and prove the one fact it's safe because of by running real code instead of writing it up. Use for 'blast radius of X', 'what could this break', or reviewing a small diff you don't trust.
Use only when working on the docs site. The list of every block a page may use beyond plain markdown, callouts, embeds, figures, fences, tables, layout components, and the styling rules behind them. Read before adding anything richer than markdown to a page, or before touching a project's theme.
Use for root-cause analysis, impact assessment, and regression recommendations for confirmed bugs: reproduce → inspect code to locate the root cause → analyze impact across five areas → recommend regression tests. Save a Bug entry with five extended fields: root cause, impact, Severity rationale, fix recommendation, and regression recommendation. Not for: collecting Bug evidence only (automated-e2e-testing / api-testing), or suspected, unconfirmed defects (Cx records in test-case-writing).
Python-specific extension to myai's `architecting-changes`. Load after myai's `architecting-changes` when a Python app has multiple interfaces sharing logic, such as CLI, GUI, API, or automation entry points. Multi-interface Python apps: reusable core, thin adapters, composition root, and layered architecture for GUI + CLI + API sharing business logic.
Use when acquiring unfamiliar business knowledge and distilling it into a BK-CI skill or architecture document, such as reading iWiki, cross-validating with code, extracting module boundaries, and rewriting knowledge documents. Prefer this when the user wants to understand the business before writing documentation.
Decision guide for delegating to caveman-style subagents. Tells the main thread WHEN to spawn cavecrew-investigator (locate code), cavecrew-builder (1-2 file edit), or cavecrew-reviewer (diff review) instead of doing the work inline or using vanilla Explore. Subagent output is caveman-compressed so the tool-result injected back into main context is ~60% smaller — main context lasts longer across long sessions. Trigger: "delegate to subagent", "use cavecrew", "spawn investigator/builder/reviewer", "save context", "compressed agent output"
Diagnose a failing CI run against an 11-pattern playbook. Classifies the failure, cites the relevant memory entry, proposes the exact fix command — but NEVER applies without explicit user approval. Use when a specific PR check or GitHub Actions run failed and you want a diagnosis instead of speculation. Don't use for org-wide CI sweeps (that's /status) or for app-level test failures (the playbook is CI-infra-specific).
[Hyper] Use when the user explicitly wants Anthropic Claude Code CLI (`claude`) for an isolated session, non-interactive (`-p`) run, session resume by ID or name, or a CI-friendly `--bare` invocation. Trigger phrases: "use claude code", "ask claude", "run claude", "continue the last claude session", "resume the auth-refactor claude session", or "use Anthropic's CLI to inspect or fix this repo".
Production-ready starter project for React 19 + Cloudflare Workers + Hono, with D1, KV, R2, and Workers AI pre-configured plus opt-in enable scripts for Clerk auth, AI chat, Queues, and Vectorize. Ships Tailwind v4, shadcn/ui, TypeScript, the Vite Cloudflare plugin, AI SDK provider setup (Workers AI, OpenAI, Anthropic, Gemini), planning docs, and a session handoff protocol. Use when starting a new full-stack Cloudflare project, scaffolding a React + Hono web app, building an AI chat or RAG application, or needing a complete production boilerplate instead of hours of manual setup. Prevents service binding mistakes, CORS errors, frontend-backend connection issues, Clerk integration problems, and AI SDK configuration confusion.
Find the pull request for the current branch on GitHub, GitLab, Bitbucket Cloud or Data Center, or Azure DevOps; retrieve unresolved inline CodeAnt AI review threads through the source-control provider; validate each finding; apply safe minimal fixes; verify them; and resolve only fixed threads. Use when asked to address, fix, triage, or resolve CodeAnt PR comments without installing or using codeant-cli.
Python coding standards and best practices covering error handling, performance optimization, async patterns, SOLID design principles, documentation, data validation, and object-oriented programming. Use when writing, reviewing, or refactoring Python code, or when the user asks about Python style, design, or best practices
Use when handling cross-cutting technical practices in the BK-CI backend, such as AOP, distributed locks, retries, parameter validation, performance monitoring, scheduled tasks, and audit logs. Prefer this when the user wants to implement such framework-level practices rather than specific business features.
Build and deploy the Goldsky Compose VRF (verifiable random function) example under the user's own account — a Compose app that listens for a `RandomnessRequested` event on an EVM contract, fetches verifiable randomness from the drand beacon, and writes it back on-chain via `fulfillRandomness` with the drand round + BLS signature so anyone can verify it. Triggers on: 'build a VRF', 'verifiable random function', 'onchain randomness', 'provably fair random numbers', 'drand oracle', 'random number generator onchain', 'set up / deploy the VRF example', 'compose vrf'. Recommends the shared, fully-unpermissioned RandomnessConsumer on Base Sepolia so there's nothing to deploy. This skill carries the complete app source (manifest, contract, ABI, tasks, drand lib) so the assistant can deploy it off the shelf or customize it. For a custom/novel Compose app that isn't this VRF, use /compose. For debugging an already-deployed app, use /compose-doctor. For manifest/CLI/API field lookups, use /compose-reference.
Write git commit messages that follow the Conventional Commits v1.0.0 spec. Use this whenever you are about to author a commit on the user's behalf, prepare or run `git commit`, suggest or clean up a commit message, split a diff into commits, write a PR title/description that references commits, or generate a CHANGELOG from history — even when the user never says "conventional commits". If a commit message is being written in a git repo, this skill applies.
Apple Core Bluetooth framework for BLE and Bluetooth Classic. Use for central/peripheral workflows, scanning, connecting, advertising, GATT services/characteristics, read/write/notify, L2CAP, background processing or state restoration, and error handling across Apple platforms.
Find the mistakes agents keep repeating in this repo and make each one impossible. Try architecture first, then types, then a lint whose error names the fix, then a test, and write docs last. Prove each check fails on a real past mistake. Repeat this each time the operator corrects you. Use for /correct.
Azure Cosmos DB SDK and developer tooling for .NET, Java, Python, Go, and Spring Boot: singleton CosmosClient, async APIs, Direct vs Gateway connection mode, retry/429 handling, preferred and excluded regions, availability strategy, circuit breaker, diagnostics, enum serialization, ETag optimistic concurrency, conditional create, patch counter increment, continuation-token guards, per-call request options, content response on write, Spring Data annotations and repositories, NuGet package setup, Python async deps, emulator SSL, and local development / VS Code tooling. USE FOR: reuse CosmosClient as singleton, Direct mode, handle 429 retries, preferred regions, ETag concurrency, atomic patch increment, Spring Boot config, .NET package setup, run the emulator locally, browse data in VS Code. DO NOT USE FOR: modeling/partition/index/query (use cosmosdb-data-and-queries); throughput, global, monitoring, security (use cosmosdb-operations); LangChain/LangGraph/vector/full-text search (use cosmosdb-ai-and-search).
This skill should be used when the user asks to "create a new project", "scaffold a Next.js app", "initialize a new app", "start a new project", "set up a new Next.js project", or mentions "create-next-project". Provides a guided, opinionated full-stack Next.js project initialization with Biome, Tailwind v4, shadcn/ui, better-auth, and Vercel deployment. Uses agent teams for parallel execution.
Creates browser-executable JavaScript bookmarklets with strict formatting requirements. Use when users mention bookmarklets, browser utilities, dragging code to bookmarks bar, or need JavaScript that runs when clicked in the browser toolbar.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.