Skills
97,222 packaged capabilities and playbooks for agents. Install any of them with one command.
Development
Given a Chrome Releases blog post URL (chromereleases.googleblog.com), extract every CVE/bug and find the underlying Gerrit CL that fixed it by searching the local Chromium checkout and sub-repos. Use when asked to map Chrome security release notes to fixing CLs, or to find which commits correspond to CVEs in a Chrome stable update.
Class-validator decorator-based validation for TypeScript. Standard in NestJS. Use when building APIs with NestJS or needing class-based validation. USE WHEN: user mentions "class-validator", "NestJS validation", "DTO validation", "decorator validation", asks about "NestJS DTOs", "ValidationPipe" DO NOT USE FOR: Zod/Yup projects (use zod/yup skills), non-decorator patterns, client-side forms (prefer Zod), non-NestJS backends
Quickly clone the frequently used repositories of the GitHub user ruan-cat (and tocque/h5mota-web) to agreed directory names according to a fixed checklist, supporting parameter combinations such as shallow clone and multi-branch fetching. Use when the user mentions "clone ruan-cat repositories", "pull frequently used repositories", "clone-ruan-cat", "initialize local multi-repo", "sync Ruan Miaomiao's GitHub repositories", or needs to reproduce the local repository inventory with one click. The command list uses references/clone-commands.md as the single source of truth.
Use when calling the CloudCannon API from code — constructing a client, finding a site or organisation UUID, reading or writing files on a hosted site programmatically, triggering and inspecting builds, or reaching a CloudCannon endpoint the CLI has no command for (DAMs, backups, sync history, site scans, screenshots, provider connections, copying or deleting a site)
Use this skill whenever the user asks for a code review, package review, or architectural audit. Delivers severity-ranked findings with evidence and fixes, not general advice. Always saves the review as a markdown file and returns a concise summary in chat.
Design, write, review, and test code samples in developer documentation, including executable examples, explanatory snippets, request and response pairs, placeholders, outputs, language choice, sandboxing, and autogenerated samples. Use when docs include API examples, SDK snippets, CLI commands, config examples, tutorials, or code blocks readers may copy.
Use when types become extremely complex. Use when types mirror external schemas. Use when maintaining type-to-schema mappings. Use when types require extensive type-level logic. Use when types drift from data sources.
Generate a deep, code-first project wiki and VitePress documentation site (DeepWiki-style) for a repository. Use when asked to create a complete wiki/manual for a new codebase, build a code-first documentation site, or generate a `codewiki/` folder with structured Markdown, diagrams, and navigation based on the source code (not existing docs).
[Hyper] Use when the user explicitly wants OpenAI Codex CLI (`codex`) for an isolated session, non-interactive run, code review, or session resume. Trigger phrases: 'use codex', 'ask codex', 'run codex', 'codex exec', 'codex review', 'continue the last codex session', or 'use OpenAI CLI to inspect or fix this repo'.
Commit the current work — runs the quality, consistency and passport gates, branches off main if needed, stages specific files, and writes a commit whose subject states what is now true. Pushes and opens a pull request only with --pr or when the user asks; never merges — a merge happens only when the user explicitly says to merge. Use ONLY on explicit commit intent — user says "commit", "let's commit this", "open a PR", or prefixes with `/commit`. Do NOT auto-invoke on vague end-of-task phrases ("we're done", "wrap up") — those require explicit confirmation first. Never force-pushes or skips hooks.
Build and deploy the Goldsky Compose compliance-oracle example under the user's own account — a compliance-gated payment system where a smart contract holds funds in escrow, Compose screens the sender wallet via a compliance API (Webacy recommended, or bring-your-own / mock), then calls back to approve or reject. Supports two payment models: single-payee (payment gateway — funds go to a configurable recipient) and multi-payee (P2P — sender specifies recipient per transfer). Ships a second cron task that reconciles stuck transfers. Triggers on: 'build a compliance oracle', 'compliance-gated payments', 'AML screening onchain', 'KYC payment gateway', 'escrow with compliance check', 'wallet screening oracle', 'gated transfers', 'Webacy oracle', 'P2P compliance', 'payment gateway with screening'. The escrow contract's approve/reject are oracle-permissioned, so there is no shared no-deploy contract — each user deploys their own instance bound to their oracle wallet (recommended path: Base Sepolia + a MockUSDC). The oracle is a named Compose smart wallet (`compliance-oracle-wallet`, gas-sponsored) with no private key to manage on the default path. For a custom/novel Compose app, use /compose. For debugging a deployed app, use /compose-doctor. For manifest/CLI/API field lookups, use /compose-reference.
Render a Jetpack Compose or Compose Multiplatform @Preview to PNG in one call (MCP render_preview, or the compose-preview CLI) and look at it. Use whenever someone asks to render, show, or see what a composable, @Preview or Compose component looks like (including library components such as Material 3 or Wear M3 EdgeButton, which come from the hosted catalog), after editing Compose UI to verify it, to compare before/after, or to review previews against catalog design guidelines.
Guide users through creating and managing .satk/block-policy.json for controlling which blocks the agent can use, which are excluded, and which block parameters the agent should not modify. Use when setting up block usage policy for a project.
Index and router for plugin-specific Craft CMS 5 guidance — configuration, Twig API, PHP API, migrations, deployment, and pitfalls for the plugins this pack documents. Load whenever a task names a plugin this pack documents, and for passwordless or magic-link auth with no plugin named; read references/<plugin>.md first.
INVOKE THIS SKILL IMMEDIATELY when user asks to: write/create/build a Nextflow pipeline or workflow, create any bioinformatics pipeline (RNA-seq, DNA-seq, variant calling, ChIP-seq, etc.), or compose/chain Nextflow modules (process or workflow modules) from the Nextflow Registry. This skill handles all Nextflow workflow creation tasks.
Use when adding a card to a catalog entity's overview tab or a whole tab/page to a catalog entity page. Covers EntityCardBlueprint (overview-page cards) and EntityContentBlueprint (full tabs), entity filtering by kind/type/annotation, and access to the current entity via useEntity. Triggers on phrases like "card on the entity page", "tab on the component page", "show on entity overview", "ui:field for catalog entity page", or imports of EntityCardBlueprint / EntityContentBlueprint.
Use when drawing or auditing model boundaries — phrases like "bounded context", "where do we draw the line between X and Y", "this model is getting muddled", "should this be one service or two", "the same word means different things in different places". Defines what a bounded context is, what it isn't, and the signals that say a boundary should exist. Pairs with ddd-context-mapping for the relationships across boundaries.
Use when the user is modeling something whose identity matters beyond its attributes — phrases like “entity”, “this thing has an ID”, “two of these are the same if their IDs match”, “tracked over time”, “lifecycle”. Distinguishes entities from value objects by identity continuity. Pairs with ddd-value-object (the opposite distinction).
Use when the user wants to transform existing code toward DDD — phrases like "refactor this to use aggregates", "extract a value object from this primitive", "split this god aggregate", "make this domain model less anemic", "introduce a bounded context boundary here". Sequences refactor steps and points at the pattern skill that explains the target shape. Do NOT use for code review (route to ddd-review) or initial design (route to ddd-design).
Debug Flutter applications systematically with this comprehensive troubleshooting skill. Covers RenderFlex overflow errors, setState() after dispose() issues, null check operator failures, platform channel problems, build context errors, and hot reload failures. Provides structured four-phase debugging methodology with Flutter DevTools, widget inspector, performance profiling, and platform-specific debugging for Android, iOS, and web targets.
Periodic dependency review for Node.js/pnpm projects — outdated package triage, security audit, update batching strategy (patch/minor/major), validation checklist. Run monthly or before major releases. Use when asked to review or update dependencies in a repo.
Diagnose and resolve Gradle and Spring classpath conflicts, version drift, and binary incompatibilities in Kotlin applications. Use when `NoSuchMethodError`, `ClassNotFoundException`, linkage errors, duplicate logging bindings, Jackson or Hibernate mismatches, or BOM-versus-explicit-version conflicts appear, and the fix must respect the repository's real version authorities.
Use when implementing procedural content generation, dungeon or map generation, procedural loot tables, world seeds, noise-based terrain, NPC behavior variation, or wave function collapse. Triggers: procedural, dungeon gen, map gen, loot table, world seed, noise, BSP, wave function collapse, randomization.
Use when working on BK-CI build scheduling, such as build machine selection, queue advancement, quota control, third-party build machine scheduling, and Docker/Kubernetes scheduling. Prefer this when the user wants to change task allocation strategies rather than Agent/Worker execution details.
Create optimized, secure multi-stage Dockerfiles for .NET Core and ASP.NET Core applications. Use when (1) creating a new Dockerfile for a .NET project, (2) containerizing a .NET application, (3) optimizing an existing .NET Dockerfile, (4) setting up Docker for .NET 6/7/8+ apps, or (5) user mentions .NET and Docker/container together.
When the user is doing development, writing code, writing docs, looking up APIs, or troubleshooting deployment or operations issues related to internal projects at dida (道旅科技), proactively search the Dragon private knowledge base (via the KnowledgePlugin__knowledge_base_search tool of the dragon-knowledges MCP) to obtain internal technical docs, architecture designs, API specs, field definitions, business processes, error codes, configuration and operations material. Be sure to trigger proactively in the following scenarios, without the user explicitly saying "use Dragon" or "search the knowledge base": the user refers to internal assets with "our", "the company's", "internal", "this project's", "production", etc.; the user mentions any dida internal system name (such as Beaver, Phoenix, LionKing, Shopping, EBooking, Wolf, Wolf 2.0, AngryBirds, CRM, Analysis, Whale, Admin, Marketing, Tiger, Bingo, Kangaroo, Finance, Content, Dolphin, Grafana, Penguin, Panda, AutoLine, FalconService, f-operating, f-supplier, f-analysis, f-order, f-policy, f-profit, f-monitor, EBookingBookingAPI, Wuying/无影, customer service system, API channel system, API supplier system, Supplier Service/SS, BDS); the user asks about business rules, product logic, approval flows, alert thresholds, or the meaning of error codes; the user asks about an API field, callback structure, or internal SDK usage and the field name does not look like an open source framework; the user asks about release/canary/deployment/configuration/monitoring tied to a specific internal environment; the user writes code, fixes bugs, writes comments or writes docs in the company's internal code repository; the user mentions the didainternal.com domain or a similar internal domain. When in doubt, lean toward searching — the cost of one internal search is far lower than the cost of "answering wrong or too generically". Use this skill aggressively whenever the user is doing internal dida company development work, even without explicit mentions of Dragon/knowledge base.
Type-safe SQL ORM for TypeScript with zero runtime overhead. Use when code imports drizzle-orm, drizzle-kit, or drizzle-orm/pg-core, user asks about Drizzle schema design, queries, relations, migrations, or database management with Drizzle ORM. Covers PostgreSQL focus with pgTable, pgEnum, pgSchema, pgView, and drizzle-kit CLI.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.