Skills
101,174 packaged capabilities and playbooks for agents. Install any of them with one command.
All
A command injection audit tool for PHP web source code. Identifies command execution sinks (exec/system/shell_exec, etc.), traces user input into command concatenation, and outputs exploitability grading, PoCs and remediation advice (omission not allowed).
Runs exported policies on hardware with PolicyRuntime, execution modes, and physicalai run. Use when wiring PolicyRuntime, SyncExecution or RTC execution, runtime YAML configs, action queues, runtime callbacks, or docs/how-to/runtime run-policy-on-robot and execution modes.
Trains, validates, tests, and runs prediction for Physical AI Studio policies via the library Lightning stack. Use when running physicalai fit/validate/test/predict, calling physicalai.train.Trainer and Policy APIs from Python, writing or editing YAML configs under library/configs, wiring a model + datamodule + trainer, resuming from a checkpoint, or debugging a training run. Covers ACT, Pi0, Pi0.5, GR00T, and SmolVLA.
Use when writing Playwright tests, fixing flaky tests, debugging failures, implementing Page Object Model, configuring CI/CD, optimizing performance, mocking APIs, handling authentication or OAuth, testing accessibility (axe-core), file uploads/downloads, date/time mocking, WebSockets, geolocation, permissions, multi-tab/popup flows, mobile/responsive layouts, touch gestures, GraphQL, error handling, offline mode, multi-user collaboration, third-party services (payments, email verification), console error monitoring, global setup/teardown, test annotations (skip, fixme, slow), test tags (@smoke, @fast, @critical, filtering with --grep), project dependencies, security testing (XSS, CSRF, auth), performance budgets (Web Vitals, Lighthouse), iframes, component testing, canvas/WebGL, service workers/PWA, test coverage, i18n/localization, Electron apps, or browser extension testing. Covers E2E, component, API, visual, accessibility, security, Electron, and extension testing.
Build browser automation and web scraping with Playwright on your local machine. Prevents 10 documented errors including CI timeout hangs, extension testing failures, and Ubuntu compatibility issues. Includes stealth mode for anti-bot bypass, authenticated sessions, infinite scroll handling, screenshot/PDF generation, and v1.57 Speedboard performance analysis. Use when: automating browsers, scraping protected sites, testing with real IPs, bypassing bot detection, generating screenshots/PDFs, or troubleshooting "target closed", "page.pause() hangs CI", "permission prompts block tests", or "Ubuntu 25.10 installation" errors.
Use when: after launch, you need to analyze user growth, define growth strategies, diagnose product health, or optimize each stage of AARRR. Do NOT use when: the product is not yet launched, or you only need single-metric analysis without the full funnel.
Use when: at project kickoff you need to establish an agile development process, design team collaboration mechanisms, or plan iteration cadence. Do NOT use when: the team already has a mature agile process, or you only need a single project management tool rather than process design.
Use when: you have a preliminary requirements list that needs detail refinement, you need to clarify requirement scenarios and boundary conditions, or the requirement description is vague and needs structuring. Do NOT use when: the requirements are already detailed enough to go straight to development, or you only need quick project initiation without depth.
Use when: making major strategic decisions (build vs outsource vs acquire), investment assessment, comparing and choosing among multiple options. Do NOT use when: the decision has already been made by executives, or the impact is too small to need systematic analysis
Use when: you need to refine feature implementation details, break down complex features, prepare detailed tasks for development, or describe feature points along multiple dimensions. Do NOT use when: the feature is simple enough to go straight into development, or you only need a feature list without deep breakdown.
Use when: defining a growth strategy, optimizing growth metrics, breaking through growth bottlenecks, or designing a systematic growth plan. Do NOT use when: the product is still in validation and not yet launched, or only a single channel needs optimization rather than a systematic plan
Use when: you need to understand the full user experience journey, uncover user pain points and opportunities, or optimize user conversion flows. Do NOT use when: the user flow is already very clear and you only need analysis of a single feature rather than the overall experience
Use when: you need to clarify product positioning, design a business model, plan revenue streams, set pricing strategy, or forecast profitability. Do NOT use when: product positioning is already clear and you only need to execute without repositioning
Use when: you need to design product prototypes, plan interaction flows, decide interface layouts, or bridge the gap from PRD to visuals. Do NOT use when: the prototype has already been completed by a designer and only a text description is needed without visual output
Use when: planning the mid- to long-term product direction, setting milestones, aligning the team, or creating quarterly/annual plans. Do NOT use when: work is short-term execution with no need for long-term planning, or the direction is already locked and no roadmap is needed
Use when: you need to turn requirements into user stories, prepare agile development tasks, break down requirements, or write acceptance criteria. Do NOT use when: requirements can go straight into development, or the team does not use the user story format
PowerShell 7.5/7.6 features and enhancements. PROACTIVELY activate for: (1) PowerShell 7.5 stable features, (2) PowerShell 7.6 preview features, (3) ConvertTo-CliXml/ConvertFrom-CliXml, (4) Test-Path -OlderThan/-NewerThan, (5) += operator optimization (8x-16x faster), (6) PSResourceGet 1.1.1/1.2.0, (7) Get-Clipboard -Delimiter, (8) Get-Command -ExcludeModule, (9) DSC v3 resources, (10) .NET 9/.NET 10 integration. Provides: Latest cmdlet usage, performance benchmarks, migration patterns.
Presentation creation, editing, and analysis. When Claude needs to work with presentations (.pptx files) for: (1) Creating new presentations, (2) Modifying or editing content, (3) Working with layouts, (4) Adding comments or speaker notes, or any other presentation tasks
[Hyper] Use this skill when the user asks to create or update a layered product planning package under `.hyper/prd/[slug]/` in the order PRD → feature specification → user flow → low-fidelity wireframe, with planning diagram, HTML preview, source log, and optional flow tracking. Do not use it for research-only fact-finding, implementation, brainstorming with no saved artifact, or final visual UI design.
Audit an existing interface for respect of user preferences including motion, contrast, colour scheme, and text scaling. Chains: user-preference-respect, responsive-accessibility, colour-independence. Use when reviewing an existing product for adaptive behaviour.
Explain advanced technical topics the way a senior professor mentors a graduate student — intuition and motivation first, mathematical rigor second, critical judgment throughout. Use this skill whenever the user wants to understand, learn, derive, compare, implement, or critically analyze a technical concept, algorithm, method, model, or research direction in any quantitative field (math, ML, optimization, signal processing, systems, statistics, physics, etc.). Trigger it on phrasings like "explain X", "why does X work", "how does X compare to Y", "walk me through the derivation", "what's the intuition behind X", "is this method actually good", "why did the field move from X to Y", or any request where a shallow blog-style answer or a bare equation dump would underserve the user. Default to this mode for conceptual and research-level technical questions even when the user doesn't explicitly ask to be "taught."
GPU kernel profiling workflow across supported kernel implementation languages. Provides commands for all 4 profiling modes (annotation, event, ncu, nsys), metric interpretation tables, bottleneck identification rules, and the output contract for returning compact results to the orchestrator. Use when: (1) profiling a kernel version, (2) interpreting profiling artifacts/reports, (3) comparing kernel versions, (4) identifying bottlenecks and optimization opportunities, (5) documenting performance in the development log.
Pipeline skill for protein structure analysis covering PDB/mmCIF parsing, RMSD superposition, Ramachandran/dihedral analysis, binding pocket detection, contact maps, B-factor flexibility, DSSP secondary structure, and format conversion. Triggers on PDB, protein structure, RMSD, Ramachandran, binding pocket, Biopython, PyMOL, pocket detection, fpocket, DSSP, PDBQT, structural alignment, superposition.
Export all layers of a Photoshop (.psd) file as separate PNG images. Useful for extracting layer images from PSD files, generating slices for web development, or preparing layer assets for other tools. Automatically handles layer naming, skips invisible layers, and recursively exports nested layer groups.
This skill MUST be used when generating high-conversion marketing angles, campaign hooks, landing page messaging, promotional copy directions, social post hooks, or CTA concepts with psychological triggers such as FOMO, justification, desire, priming, anchoring, and framing, especially for offers, launches, limited-time promotions, and Traditional Chinese marketing for Taiwan audiences.
Guidance for Microsoft Purview Data Security Posture Management for AI (DSPM for AI) - discovering, monitoring, and protecting sensitive data interactions with generative AI apps like Microsoft 365 Copilot, Security Copilot, Copilot Studio agents, and third-party AI (ChatGPT, Gemini). Covers AI usage visibility, one-click recommendations, oversharing risk surfaced to AI, and DLP for AI. WHEN: DSPM for AI, AI data security posture, Copilot data risk, monitor AI prompts, sensitive data in AI, generative AI data protection, third-party AI usage visibility, secure Copilot data, what sensitive data is being sent to AI, monitor what users are putting into Copilot prompts, detect sensitive data in AI responses, ChatGPT data leakage risk. DO NOT USE when the goal is remediating overshared SharePoint content before Copilot rollout (use purview-copilot-oversharing) or building IRM policies for departing users (use insider-risk-baseline).
Guidance for Microsoft Purview eDiscovery (unified experience consolidating prior Standard and Premium) - identifying, preserving, collecting, reviewing, analysing, and exporting content across Microsoft 365 for legal cases, regulatory requests, and investigations. Covers cases, custodians, legal holds, searches, review sets, analytics, and export. WHEN: eDiscovery, legal hold, preserve content, collect for litigation, review set, export evidence, eDiscovery case, custodian, search and hold Microsoft 365, legal investigation, EDRM workflow, defensible collection.
Guidance for an end-to-end Microsoft Purview information governance / information protection strategy - sequencing classification, labelling, protection, lifecycle, and risk into a coherent program aligned to the Zero Trust data pillar. Covers maturity-based rollout sequencing, ownership, and metrics. WHEN: information governance, information protection strategy, data protection program, sequence Purview rollout, MIP strategy, protect and govern data end to end, Zero Trust data pillar program, Purview roadmap, data security maturity.
Builds, fits, checks, and compares Bayesian models in Python with PyMC and ArviZ. Covers hierarchical (multilevel) models, NUTS MCMC sampling, variational inference (ADVI), prior and posterior predictive checks, convergence diagnostics (R-hat, ESS, divergences), and LOO/WAIC model comparison. Use when writing a PyMC model for regression, count, or binary data. Use when fitting a hierarchical model with partial pooling. Use when diagnosing divergences, low ESS, or high R-hat. Use when comparing candidate models with LOO. Use when choosing priors or running prior predictive checks. Not for non-Bayesian regression; use statsmodels or scikit-learn instead.
Complete FastAPI production system. PROACTIVELY activate for: (1) Project structure (scalable layout), (2) Pydantic schemas (input/output separation), (3) Dependency injection, (4) Async database with SQLAlchemy, (5) JWT authentication, (6) Error handling patterns, (7) Docker deployment, (8) Gunicorn + Uvicorn production, (9) Rate limiting, (10) Testing with httpx. Provides: Project templates, schema patterns, auth setup, Docker config. Ensures production-ready FastAPI applications.
Use when writing or reviewing tests for Python behavior, contracts, async lifecycles, or reliability paths. Also use when tests are flaky, coupled to implementation details, missing regression coverage, slow to run, or when unclear what tests a change needs. Use for multi-Python version testing (nox) and free-threaded Python thread-safety validation.
High-performance vector similarity search engine for RAG and semantic search. Use when building production RAG systems requiring fast nearest neighbor search, hybrid search with filtering, or scalable vector storage with Rust-powered performance
Enterprise middleware testing patterns for message routing, transformation, DLQ, protocol mediation, ESB error handling, and EIP patterns. Use when testing middleware layers, message brokers, ESBs, or integration buses.
Observability and monitoring validation patterns for dashboards, alerting, log aggregation, APM traces, and SLA/SLO verification. Use when testing monitoring infrastructure, dashboard accuracy, alert rules, or metric pipelines.
Security-first visual testing combining URL validation, PII detection, and visual regression with parallel viewport support. Use when testing web applications that handle sensitive data, need visual regression coverage, or require WCAG accessibility compliance.
Create new Claude Code Skills with proper YAML frontmatter, progressive disclosure structure, and complete directory organization. Use when you need to build custom skills for specific workflows, generate skill templates, or understand the Claude Skills specification.
Legal-health radar for the clients and suppliers of a Qonto account. Ranks every counterparty by real exposure (unpaid client invoices, supplier commitments, recurring spend), measures actual payment delays against due dates, and—when a Datagouv MCP is available—cross-checks French public registries (SIRENE deregistrations/cessations, BODACC collective procedures: receivership, liquidation, safeguard) to raise alerts like “client X owes you N € AND just entered receivership — chase today”. Use for “who owes me money and are they in trouble?”, “check my clients' legal health”, “mon client est-il en redressement ?”, “which supplier could fail me?”, “rank my counterparties by risk”.
Quantizes LLMs to 8-bit or 4-bit for 50-75% memory reduction with minimal accuracy loss. Use when GPU memory is limited, need to fit larger models, or want faster inference. Supports INT8, NF4, FP4 formats, QLoRA training, and 8-bit optimizers. Works with HuggingFace Transformers.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.