Skills
97,222 packaged capabilities and playbooks for agents. Install any of them with one command.
Security
Best-practice authoring guidance AND a read-only policy gate for AWS Terraform generated by a migration skill. Load during any phase that writes a terraform/ directory — first as the "what to emit" posture rules + security-baseline spec, then after writing as the deterministic policy verdict. Read-only: it reports whether the generated Terraform passes; it never edits .tf files, never touches .phase-status.json, and never decides phase completion. Complements (does not replace) terraform fmt/init/validate
Scaffolds a Better Auth setup in a Next.js (App Router) + Drizzle project — lib/auth.ts, lib/auth-client.ts, the /api/auth/[...all] route handler, middleware.ts, .env.example, and a permissions module. Produces convention-enforced templates for three plugin presets (minimal, social, advanced with twoFactor+magicLink). Trigger even when the user doesn't explicitly say "scaffold" — phrases like "set up Better Auth", "wire up auth", "initialize auth in this project", or "add auth to Next.js" should pull this in. Pairs with the `better-auth` skill, which covers the rules these templates encode.
Scan project dependencies for known vulnerabilities, generate software bills of materials, and enforce license compliance across the software supply chain. Use when the user requests dependency scanning or provides relevant inputs for this workflow.
Triage and remediate vulnerabilities found by a Strix pentest (open-source CLI or app.strix.ai cloud), then re-run Strix to verify each fix. Use after a Strix scan reports findings, or when the user asks to fix security issues from a strix_runs report, vulnerabilities.json, findings.sarif, or a cloud scan's vulnerabilities.
Reviews REST and GraphQL APIs against the OWASP API Security Top 10:2023. Auto-invoked when reviewing OpenAPI/Swagger specs, API endpoint code, or GraphQL schemas. Covers BOLA, BFLA, authentication, rate limiting, and SSRF. Produces findings mapped to API1-API10 with remediation guidance.
Use when upgrading an iOS or macOS app's Auth0.swift SDK from v2 to v3. Detects the current version, fetches the new SDK source to confirm API signatures, and applies only the breaking changes that affect real call sites — use even if the user says "update my Auth0 Swift SDK" or "migrate to Auth0.swift v3".
Comprehensive Cloudflare platform skill covering Workers, Pages, storage (KV, D1, R2), AI (Workers AI, Vectorize, Agents SDK), networking (Tunnel, Spectrum), security (WAF, DDoS), and infrastructure-as-code (Terraform, Pulumi). Use for any Cloudflare development task
Apply rigorous supply chain security hygiene to software projects — audit dependencies, detect risks, minimize attack surface. Use this skill when the user wants to audit project dependencies, is concerned about supply chain attacks, wants to set up secure dependency management, needs to review a requirements.txt or package.json, or says "dependency audit", "supply chain risk", "check packages", "secure dependencies", "pin versions", "check pypi". Based on Karpathy 28k-like litellm supply chain post.
This skill should be used when the user asks to “use Metasploit for penetration testing,” “exploit vulnerabilities with msfconsole,” “create payloads with msfvenom,” “perform post-exploitation,” “use auxiliary modules for scanning,” or “develop custom exploits.” It provides comprehensive guidance for leveraging the Metasploit Framework in security assessments.
(NS) Security/compat/a11y + Vercel Web Interface Guidelines. Use when hardening security, fixing CSP/CORS/headers, reviewing UI / checking a11y / auditing UX, or Web Interface Guidelines — even without saying "best practices"; also ns-proto-creator close-out. Do NOT use for MR/SOLID (ns-reviewer), visual redesign (ns-frontend-design), or features (ns-coder / ns-spec-driven).
Receive and verify PayPal webhooks. Use when setting up PayPal webhook handlers, debugging certificate-based signature verification, or handling payment events like PAYMENT.CAPTURE.COMPLETED, PAYMENT.SALE.COMPLETED, BILLING.SUBSCRIPTION.CREATED, or CHECKOUT.ORDER.APPROVED.
Diagnostica, sem alterar nada, se este computador e este repositório estão prontos para trabalhar com SDD: repositório git, agente de código, identidade do git, acesso ao remoto (credencial, rede, repositório ainda vazio), worktrees órfãs, dependências, editor e dado exposto (senha, certificado A1 ou chave privada já salvos no git; .env fora do .gitignore; npm sem ignore-scripts; repositório público). Responde em uma linha quando está tudo certo e, quando não está, lista o que impede primeiro, cada item com o comando exato que resolve. Use quando o usuário pedir para checar o ambiente, antes de abrir a primeira frente de trabalho num projeto, ou quando algo estranho acontecer (commit que falha, comando não encontrado, worktree que sumiu).
Perform a broad, authorized security audit across application, infrastructure, identity, dependencies, and operations. Use when the user needs a scoped security posture review; use the SAST, DAST, dependency-scanning, or threat-modeling skill when the request is limited to one specialist activity.
Trigger when the user asks to audit, review, or security-check a Solana smart contract, or the codebase contains solana_program, anchor_lang, pinocchio, #[program], or #[derive(Accounts)]. Also trigger for requests such as "check for vulnerabilities", "find exploits", or "security review" on Rust code with Solana dependencies.
Lets an AI agent or CLI session sign in to Internet Identity and act as a user's app-specific principal (e.g. for oisy.com or nns.ic0.app) via `icp identity link web`. Use when the user asks an agent to log in to an II-powered app, obtain a delegation, or make authorized canister calls on their behalf. Do NOT use for adding II sign-in to a frontend — use the internet-identity skill instead.
Use when upgrading an Android app's Auth0 SDK (com.auth0.android:auth0) to the next major version. Detects the current version, checks prerequisites, and applies only the breaking changes that affect the project's real call sites. Use even if the user just says “update my Auth0 Android SDK” or “migrate to Auth0 Android v4.”
Installs and runs the kube-bench tool against a Kubernetes cluster as a Job, DaemonSet, or standalone binary, selecting the correct benchmark version and targets (control plane, etcd, kubelet, worker nodes) and emitting JSON or JUnit output for pipelines. Use when setting kube-bench up for the first time, choosing which benchmark version and node targets to run, wiring it into CI, or troubleshooting skipped or misdetected checks. Keywords: kube-bench, DaemonSet, --benchmark, --targets, JSON output, JUnit, CI integration. Do not use for interpreting the findings or producing an audit report - use performing-kubernetes-cis-benchmark-with-kube-bench.
Receive and verify Discord webhook events. Use when setting up Discord webhook handlers, debugging Ed25519 signature verification, handling PING endpoint validation, or processing events like APPLICATION_AUTHORIZED, ENTITLEMENT_CREATE, or LOBBY_MESSAGE_CREATE.
Automated PCI Secure Software Standard (SSS) v2.0 readiness gap-assessment of an application from its source code and documentation. Deterministically enumerates every applicable Test Requirement from a pinned catalog, gathers source/doc evidence, and emits an evidence-bound per-requirement verdict (MET / NOT_MET / PARTIALLY_MET / NOT_APPLICABLE / REQUIRES_MANUAL_REVIEW) with file+line citations, then a Transilience gap report. Use when asked to assess, gap-assess, or check an application's readiness against the PCI Secure Software Standard v2.0 / PCI SSF, or to map source code and design docs to PCI SSS Security Objectives and Test Requirements. Produces a readiness gap-analysis only — NOT an official PCI validation.
Manage Cloud Firewall (CFW) Internet Firewall public IP protection switches on Alibaba Cloud. Use this Skill when enabling or disabling firewall protection for public IPs, querying asset protection status, batch protecting ECS/EIP/NAT/SLB resources, toggling all public IPs at once, or configuring auto-protection for new assets. Supports multi-account management via member-uid. 管理阿里云云防火墙（CFW）互联网防火墙的公网IP防护开关。 当用户需要开启云防火墙、管理互联网防火墙开关、查看公网IP是否受保护、 批量开启ECS/EIP/NAT/SLB等资源的防火墙、配置新资产自动防护时使用此Skill。 支持多账号管理（member-uid）。
Use when installing or managing the Auth0 native integration in Vercel Marketplace, connecting Auth0 to a Vercel project, or syncing Auth0 configuration into a Vercel-hosted Next.js application. Also use when troubleshooting auth failures specific to Vercel's v0 preview — iframe cookie issues, redirects going to localhost, or "state parameter is invalid" errors. Use even if the user doesn't mention Auth0 explicitly.
Review code for bugs, logic errors, security vulnerabilities, code quality issues, and adherence to project conventions, using confidence-based filtering to report only high-priority issues that truly matter. Use this skill when reviewing a small set of changes locally (such as unstaged diff), when dispatched as a sub-task during feature-dev quality review, or when the user wants a critique of a specific file or function.
Systematically deobfuscates multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure. Use during incident response or malware analysis when a PowerShell script is obfuscated with encoding, string manipulation, or invocation tricks and you need to recover the underlying commands, dropped payloads, or C2 endpoints.
Administer Debian servers for applications and clusters with APT, systemd, SSH, nftables, sysctl, storage, users, updates, and Docker Engine. Use to prepare, review, or diagnose the host; use Ansible to automate state and Docker Swarm for cluster services.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.