Skills
101,174 packaged capabilities and playbooks for agents. Install any of them with one command.
All
How to write modern Swift well — modeling with value types, Swift 6 data-race safety and approachable concurrency (@concurrent, main-actor-by-default, actors, task groups), protocols and generics (some vs any), API design, performance and ARC, Swift Testing, macros, and the modern language features agents don't know about yet. Use when writing, reviewing, or migrating Swift, or when a concurrency error, a hang, a data race, a retain cycle, or a performance problem needs fixing.
Use when the user needs an overall marketing plan for a period — objectives, segments, positioning, channel mix, content direction, budget, timeline, KPIs, and a risk matrix, adapted to US, EU, SEA, or LATAM. Trigger on 'marketing plan', 'marketing strategy for next year', 'go-to-market roadmap', 'plan for Q3', 'we have no marketing plan', 'where should we spend next quarter'. Also use when a founder only says the business needs to grow and has no idea which channel to start with. Not for — one specific campaign, see `02-campaign-brief-global`; working backward from a revenue goal to spend, see `10-reverse-kpi-global`; splitting a budget across channels and months, see `61-budget-planning-global`; taking a brand new product to market, see `59-go-to-market-global`.
Use when the user needs PAID ad copy for Meta, Google, or TikTok — six variants across TOFU, MOFU, and BOFU using AIDA, PAS, and BAB, respecting each platform character limit and ad policy, with a dropshipping mode. Trigger on 'ad copy', 'write Facebook ads', 'TikTok ad copy', 'Google RSA headlines', 'primary text for this ad', 'my ad copy is not converting'. Also use when the user has a product page and asks what to run as an ad. Not for — organic social captions, see `37-social-caption-global`; spoken video lines, see `04-script-video-global`; approving copy already written, see `62-marketing-review-global`; the page the ad points at, see `12-landing-page-brief-global`.
Dung khi can biet doi thu dang lam gi va minh dang dung o dau — phan tich 3 tang doi thu truc tiep, gian tiep, thay the; ban do dinh vi, SWOT, benchmark content va gia, khoang trong thi truong con bo trong. Kich hoat khi user nhac 'nghien cuu doi thu', 'phan tich canh tranh', 'doi thu dang chay gi', 'competitive analysis', 'sao doi thu ban re hon minh', 'doi thu moi noi', 'minh thua doi thu cho nao', 'benchmark thi truong'. Dung ca khi user chi gui link fanpage hoac website doi thu va hoi 'xem giup ho dang lam gi'. Khong dung cho — chot dinh vi cho chinh minh thi dung skill 58-positioning; theo doi lien tuc thao luan mang xa hoi thi dung skill 15-social-listening; nghien cuu tep de chay ads thi dung skill 51-audience-research.
Use when persuasion principles have to be applied to a specific asset — reciprocity, scarcity, authority, social proof, liking, commitment, and unity mapped onto copy, a landing page, an email, or an ad, each with a hypothesis and a test plan. Trigger on 'marketing psychology', 'Cialdini', 'persuasion principles', 'how do I add urgency', 'make this more convincing', 'behavioral triggers for this page'. Also use when the user asks why people read the whole page and still do not buy. Not for — price framing and margin math, see `17-pricing-strategy-global`; building the offer itself, see `31-offer-design-global`; running the experiment properly, see `19-ab-test-setup-global`.
Use when an agency or freelancer takes on a NEW client and needs everything up front — an 11-section intake covering business overview, audience, current marketing, goals, budget, timeline, brand assets, approval process, and success criteria, written for the client to fill in and return. Trigger on 'client intake', 'agency brief', 'onboard a new client', 'discovery call template', 'what should I ask a new client', 'kickoff questionnaire'. Also use when the user just signed someone and does not know where to begin. Not for — the internal context file the skills read, see `product-marketing-context-global`; the plan built from the answers, see `00-marketing-plan-global`; briefing an outside vendor, see `67-agency-vendor-brief-global`.
Use when an ad account needs a systematic CONFIGURATION audit — 84 checkpoints across account, campaign, ad set, ad, tracking, and optimization, scored into a coverage-aware Health Score (pass/fail/unknown, coverage printed beside it), a break-even CPA/CVR block, a HOLD/FIX/TEST/INVESTIGATE verdict per finding, draft-first change proposals, quick wins, and a dropshipping checklist, covering Meta, Google, and TikTok. Trigger on 'ads audit', 'audit my ad account', 'is my Meta setup correct', 'health score for the account', 'review my Google Ads', 'we inherited this account and it is a mess'. Not for — week-over-week drop diagnosis, see `03-performance-eval-global`; planning fresh budget, see `54-media-plan-global`; rebuilding the campaign hierarchy, see `52-account-structure-global`
Manage Yandex KIT webhooks over its REST API: subscribe HTTPS endpoints to order status, payment and delivery events and handle the one-time signing secret. Use when creating, updating, validating or deleting KIT webhooks, verifying incoming calls, diagnosing missing order-status callbacks or migrating receipt-status automations. Russian triggers include: «настрой вебхук», «подпишись на статусы заказов», «почему не приходят уведомления о заказах», «проверь вебхук».
ABP Framework cross-cutting patterns including authorization, background jobs, distributed events, multi-tenancy, and module configuration. Use when: (1) defining permissions, (2) creating background jobs, (3) publishing/handling distributed events, (4) configuring modules.
Use this skill to gate Phoenix LiveView realtime UIs with a pass/fail adversarial review — a single blind reviewer subagent judges a diff or file set against 32 decidable rules covering state ownership and lifecycle (patch vs remount, callback load placement, connected-mount guards, form recovery), realtime data flow (broadcast placement, scoped topics, presence mechanisms), async responsiveness (blocking external calls, socket-copying closures, lifecycle-owned tasks, rendered failure states), render and wire efficiency (the constructs that silently disable HEEx change tracking), streams (growing collections in assigns, the stream DOM contract, bounded infinite scroll), component and context boundaries, client trust (per-event authorization, scoped lookups, live_session boundaries, revocation disconnects), and mechanism-presence interaction feedback (JS commands, in-flight feedback, debounce, hook contracts, overlay focus). Verdicts only, never fixes.
Use this skill to gate TanStack Start plus TypeScript web-app changes with a pass/fail adversarial review — a single blind reviewer subagent judges a diff or file set against 22 decidable rules covering client/server boundary leaks, server-function and server-route usage, auth and security, SSR data loading, boundary type safety, and compiler config. Trigger it before merging TanStack Start work, when asked to gate, adversarially review, or pass/fail a Start or TanStack codebase, or as a final check on agent-authored Start features. It renders verdicts only and never fixes the work; for teaching-style review feedback use a distillation skill instead.
Delegate real coding work to a peer AI agent (such as Claude Code, Codex (ChatGPT), or Gemini (Antigravity)) that runs its own full harness, or use that peer as an independent reviewer, adversarial red-team, ideation & planning partner. Trigger when the user says "use agent bridge", "ask <another agent>", "delegate to <agent>", "have <agent> implement/build/fix this", "get <agent> to review/critique", "get a second opinion", or otherwise hands work to a different agent than the one they're talking to. The bridge auto-detects which agent you are and offers the others as peers, so the same instructions work whichever agent you are running inside. Do NOT trigger for normal work the user wants you to do yourself.
Audit the extensions AI coding agents load and trust (skills, plugins, marketplaces, hooks, settings, MCP servers, and instruction files like CLAUDE.md, AGENTS.md, GEMINI.md, .cursor/rules and copilot-instructions.md) across Claude Code, Cursor, Codex, Gemini CLI and GitHub Copilot. Read-only: inventories each item with its source and pin, greps for hidden instructions, exfiltration, credential reads, persistence, curl|bash and over-broad tool grants, reviews hooks and MCP pinning and tool poisoning, and gives each item a SAFE / CAUTION / DO-NOT-INSTALL verdict. Use when the user mentions 'audit my skills,' 'is this skill malicious,' 'is this skill safe,' 'is this MCP server safe,' 'review CLAUDE.md,' 'review AGENTS.md,' 'plugin security,' 'check my hooks,' 'audit my MCP servers,' 'agent supply chain,' 'SkillSpector,' 'tool poisoning,' 'rug pull,' 'audit my IDE extensions,' 'is this VS Code extension safe,' or is about to install a skill, plugin, MCP server, or IDE extension
Automated collection and delivery of a daily Chinese-language AI tech digest. Pulls the latest AI news from English sources such as The Verge, Wired, and TechCrunch, automatically translates and organizes it into Chinese, and pushes it by category to channels including Feishu/Telegram/Discord. Suited to Chinese-speaking users who follow AI industry news.
Assess an issue, diagnose a failure, recover an active incident, or build and verify an accepted coding change. Use intake, diagnosis or recovery at their requested stopping point; use delivery directly for an accepted coding outcome. Exclude initiative coordination, standalone planning, independent review, and publication.
Use when generating images with Model Studio DashScope SDK using Qwen Image generation models (qwen-image, qwen-image-plus, qwen-image-max, qwen-image-2.0 series and snapshots). Use when implementing or documenting image.generate requests/responses, mapping prompt/negative_prompt/size/seed/reference_image, or integrating image generation into the video-agent pipeline.
Build animations in React Native and Expo, making the decisions in the order that determines whether they feel right — should it animate, which thread it runs on, which properties, spring or timing, how the gesture hands off, how it degrades. Writes the implementation with Reanimated, Gesture Handler, Expo Router and expo-haptics. Use when animating anything in an Expo app, adding gestures, sheets, screen transitions, press feedback or haptics, or fixing motion that stutters on device. For web animation use `animate`.
Audits source code files for AI-generated slop patterns — unnecessary comments, over-engineering, defensive over-coding, AI voice markers, dead code, type workarounds, and verbose patterns. Outputs a structured report with line references and severity. Use when the user wants to find AI slop in specific files, find unnecessary comments, detect over-engineering, or asks "check for slop", "anti-slop", "review for AI patterns". NOT for whole-repo quality audits (that is code-audit's job — or audit-toolkit when unsure which audit fits) and not for prose/README style (humanize-readme).
Apifox Mock data generation specification. Use this skill when you need to generate mock data, Apifox Mock JSON, Apifox Mock scripts, initialize a Mock address, or integrate the Apifox local proxy. It supports Mock.js syntax JSON generation, advanced Mock scripts (field relations, conditional logic, reading request parameters), local mock files, and Mock address initialization for development environments. It covers general rules such as field semantic inference, type tracing, enum recognition, and proxy configuration conventions.
Image generation skill, to be used when the user needs to generate images, visual infographics, create images, or edit/modify/adjust existing images. Official image generation service based on the ChatGPT Image 2 model (gpt-image-2) on the API易 platform (https://api.apiyi.com/). The model supports precise size/quality control (including 4K) and is billed by token. Key differences from gpt-image-2-all (the unofficial reverse-engineered version): uses the /v1/images/generations and /v1/images/edits endpoints; has an explicit size parameter; has a quality parameter; is billed by token; uploads reference images with multipart/form-data; b64_json is plain base64 with no prefix.
Use when an app's layout must adapt to a window that changes size while the app runs, or when an app must support more than one window. That includes being asked to make an app resizable or support a resizable window, a layout that breaks or does not adapt as the window resizes, and preparing or optimizing an app for the foldable iPhone Duo, split-screen multitasking, or Stage Manager. Modernizes the app by replacing legacy shared-state APIs with context-appropriate alternatives: mainScreen, interfaceOrientation, userInterfaceIdiom, application and scene lifecycle, and safe area insets
Apple SwiftUI declarative UI framework reference. View, VStack, HStack, ZStack, List, NavigationStack, TabView, toolbar, State, Binding, Bindable, Environment, EnvironmentObject, sheet, fullScreenCover, modifier, animation, Animation, withAnimation, Transition, matchedGeometryEffect, PhaseAnimator, KeyframeAnimator, swipeActions, reorderable, AsyncImage, DocumentGroup, Document, Liquid Glass, iPhone Duo support (ArrangementView, ReservedRegion, DeviceHinge).
Use this skill to apply Android-team testing strategies — determinism, hermetic execution, Given-When-Then / Arrange-Act-Assert structure, naming conventions, and Hilt-based dependency replacement. Encodes which guidance actually lives on `/training/testing/fundamentals/strategies` (qualitative pyramid, network-access table) versus `/training/testing/instrumented-tests/stability` (determinism / flake) versus `/training/dependency-injection/hilt-testing` (`@HiltAndroidTest`, `HiltAndroidRule`, `@TestInstallIn`, `@UninstallModules`, `@BindValue`, rule ordering). Use when the user asks "how should I structure tests", "Given When Then or Arrange Act Assert", "how do I name test methods", "Hilt rule order", "@HiltAndroidTest", "@BindValue", "how to swap a binding for tests", "tests pass locally fail on CI", or "make tests deterministic".
Design, review, organize, and evolve scalable, secure, maintainable backend systems across any language, framework, runtime, database, API style, deployment model, or architecture. Detects whether a backend already exists and produces a safe improvement path before changing it; otherwise designs a new backend from scratch. Use when planning backend architecture, reviewing an existing system, reorganizing files, modernizing modules, selecting boundaries, or implementing production-grade backend features.
Audit source code for exploitable vulnerabilities using threat-model-driven review, taint tracing, invariant checking, and variant analysis. Use when reviewing a codebase or diff for security bugs, performing a security audit, hunting for vulnerabilities in a target's source, or validating whether a suspected finding is real.
Guidance for securing Azure App Service web apps and APIs — managed identity, Easy Auth with Microsoft Entra ID, network isolation via private endpoints + VNet integration, HTTPS / TLS hardening, Key Vault references for secrets, and front-end WAF (Front Door / App Gateway). WHEN: App Service security, secure web app on Azure, Easy Auth, App Service managed identity, private endpoint web app, VNet integration, App Service TLS, Key Vault references, harden App Service, FTP disable, WAF in front of App Service, access restrictions. DO NOT USE for Azure Functions specifics only (similar but separate), AKS workloads (different platform), or VM-hosted web apps.
Guidance for Azure Arc — projecting on-premises, multicloud (AWS/GCP), and edge servers, Kubernetes, and data services into Azure Resource Manager for unified governance, security, and management. Covers Arc-enabled servers onboarding, extending Defender for Cloud and Azure Policy to non-Azure machines, and Arc-enabled Kubernetes. WHEN: Azure Arc, manage on-prem servers from Azure, hybrid management, Arc-enabled servers, Arc Kubernetes, extend Defender for Cloud to on-prem, govern multicloud machines, Connected Machine agent, Arc agent, hybrid security posture, machine configuration, guest configuration. DO NOT USE for Azure-native VMs only (use Azure Resource Manager directly), Intune-managed endpoints (use intune-device-mgmt), or Azure Stack HCI specifically (separate product).
Guidance for Azure Firewall — managed cloud-native L3-L7 stateful network firewall for centralised egress, east-west, and ingress control. Covers SKU choice (Basic vs Standard vs Premium), Firewall Policy hierarchy, application/network/DNAT rules, threat intelligence and IDPS, TLS inspection, hub-spoke deployment with UDRs, and forced tunneling. WHEN: Azure Firewall, network firewall, egress filtering, FQDN filtering, Firewall Policy, IDPS, TLS inspection, forced tunneling, central network control, firewall SKU Premium Standard Basic, hub spoke firewall, UDR through firewall, DNAT inbound. DO NOT USE for L7 web application protection (use Front Door / Application Gateway WAF), subnet microsegmentation (use NSGs in azure-network-security-design), or third-party NVA design.
Guidance for designing secure Azure network architecture — hub-spoke topology (or Virtual WAN), segmentation with NSGs/ASGs, private endpoints / Private Link for PaaS, egress through Azure Firewall, DDoS protection, WAF on Front Door/App Gateway, and centralised private DNS. Aligned to the Zero Trust network pillar. WHEN: Azure network security, hub spoke, Virtual WAN, network segmentation, NSG ASG design, private endpoint, Private Link, DDoS protection, secure virtual network, egress control, Zero Trust network, private connectivity design, Bastion, JIT VM access. DO NOT USE for the firewall itself (use azure-firewall), VM-level hardening (use defender-for-cloud-hardening), or Key Vault networking only (use azure-key-vault).
Guidance for estimating and reasoning about the cost of Azure security services — using the Azure Pricing Calculator, understanding key cost drivers (Sentinel ingestion, Defender plans, Key Vault operations), and cost-optimization levers. WHEN: Azure security pricing, estimate cost, Sentinel cost, Defender for Cloud pricing, pricing calculator, cost drivers, optimize security spend, ingestion cost, licensing vs consumption, budget for security.
Guidance for selecting the right Azure RBAC role with least privilege - mapping required actions to built-in roles, deciding when a custom role is needed, scoping assignments correctly, and choosing between control-plane and data-plane roles. Covers scope levels (management group → resource), groups vs direct assignment, and PIM for privileged roles. WHEN: which Azure role, least privilege role, Azure RBAC role selection, built-in vs custom role, scope role assignment, role for managed identity, data plane role, assign minimal permissions, RBAC design, control plane vs data plane, Storage Blob Data Reader vs Reader. DO NOT USE for Entra ID directory roles (use entra-id) or for Microsoft 365 admin roles (use m365-govern-manage).
Expertise in binary lifting techniques - converting machine code to LLVM IR for analysis, decompilation, and recompilation. Use this skill when working on reverse engineering, binary analysis, deobfuscation, or converting binaries to higher-level representations.
Unified Python interface to 40+ bioinformatics services. Use when querying multiple databases (UniProt, KEGG, ChEMBL, Reactome) in a single workflow with consistent API. Best for cross-database analysis, ID mapping across services. For quick single-database lookups use gget; for sequence/file manipulation use biopython.
Use when creating or developing Laravel features, before writing code or implementation plans - refines rough ideas into fully-formed Laravel designs through collaborative questioning, alternative exploration, and incremental validation.
Branch model and merge flow for this project. Feature branches merge to dev via PR, dev merges to main via PR. Use when creating branches, opening PRs, pushing code, committing, or starting any new work — prevents incorrect base branch selection and direct pushes.
Use when someone wants to create a brand, brand kit, design system, visual identity, or product identity from scratch — "I need a brand", "help me brand my product", "pick colors and fonts for me", "make it look professional" — especially non-technical non-designers with no existing brand assets.
Coach a client or team through defining a brand's visual identity from scratch — what it should make people feel, the muses it steals from, the distinct creative concepts, and the latitude it's allowed to flex within. Use before any creative direction, logo, or application work, or when the user mentions 'brand strategy,' 'what should our brand feel like,' 'brand workshop,' 'creative concepts,' 'brand personality,' 'find our visual direction,' or a brand that's undefined or being rethought. This is strategy, not execution.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.