Skills
100,928 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Security architecture and threat modeling. OWASP Top 10 2025 analysis, OWASP Agentic AI Top 10 (ASI01-ASI10), AI/LLM security patterns, supply chain security, modern API authentication (OAuth 2.1, DPoP, Passkeys/WebAuthn), vulnerability assessment, and security review for code and infrastructure.
This skill should be used when the user needs to design, review, or document complex software architectures. Use when creating C4 diagrams, writing Architecture Decision Records (ADRs), applying Clean, Hexagonal, or Domain-Driven Design patterns, or conducting system design reviews.
Make Sentry stack traces readable—upload source maps for JavaScript/TypeScript, or debug files for native and mobile (dSYM, ProGuard/R8, NDK symbols, Dart obfuscation maps, .NET PDBs). Use when frames in Sentry show minified names, bundled paths, hex addresses, “unknown”, or method names with no file/line, instead of your original source.
When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," or "SEO health check." For building pages at scale to target keywords, see programmatic-seo. For adding structured data, see schema-markup.
SERP-based semantic topic clustering for content architecture planning. Groups keywords by actual Google SERP overlap (not text similarity), designs hub-and-spoke content clusters with internal link matrices, and generates interactive visualizations. Optionally executes content creation if codex-blog is installed. Use when user says "topic cluster", "content cluster", "semantic clustering", "pillar page", "hub and spoke", "content architecture", "keyword grouping", or "cluster plan".
Hreflang and international SEO audit, validation, and generation. Detects common mistakes, validates language/region codes, and generates correct hreflang implementations. Use when user says "hreflang", "i18n SEO", "international SEO", "multi-language", "multi-region", or "language tags".
Maps intelligence for local SEO — geo-grid rank tracking, GBP profile auditing via API, review intelligence across Google/Tripadvisor/Trustpilot, cross-platform NAP verification (Google/Bing/Apple/OSM), competitor radius mapping, and LocalBusiness schema generation from API data. Three-tier capability: free (Overpass + Geoapify), DataForSEO (full intelligence), DataForSEO + Google (maximum coverage). Use when user says "maps", "geo-grid", "rank tracking", "GBP audit", "review velocity", "competitor radius", "maps analysis", "local rank tracking", "Share of Local Voice", or "SoLV".
Strategic SEO planning for new or existing websites. Industry-specific templates, competitive analysis, content strategy, and implementation roadmap. Use when user says "SEO plan", "SEO strategy", "SEO planning", "SEO best practices for <topic>", "content strategy", "keyword strategy", "content calendar", "site architecture", "SEO roadmap", or asks for organic growth guidance without a specific URL.
When the user wants to check live SERP results for a keyword, see what's in the local pack right now, check People Also Ask, see AI Overviews, verify SERP features, or do a quick spot-check of local search results. Trigger on "what shows up when you search," "check the SERP," "who's in the map pack," "what does the search results page look like," or "search for [keyword]."
Use to manage Omni-Channel attribute-based routing rules through the Tooling API. TRIGGER when: list attribute-routing rules, inspect a WorkSkillRouting rule, create an inactive routing rule, add a field-to-skill mapping, activate a complete routing rule, deactivate a routing rule, or delete a routing rule or attribute. Do not use to create agent skills or routing flows.
Interactive setup wizard for the claude-ops plugin. Installs missing CLIs, configures env vars for each channel (Telegram, WhatsApp, Email, Slack, Notion, Linear, Sentry, Vercel), builds the project registry, and saves user preferences. Run once after installing the plugin or any time to reconfigure.
Build or update a GitHub Pages documentation site with the same design as fandhe-frontend. Covers Rust SSG, Markdown management, automated deployment with Actions, and branding configuration (the site table in nav.toml). Use for requests such as “I want to publish on GitHub Pages,” “create a docs site,” “use the same design as fandhe-frontend,” “update the Pages site,” or “bring the design up to date.” For publishing with Firebase, use setup-firebase-hosting; for a standalone HTML page, use create-html-report.
This skill should be used when the user asks to “search for exposed devices on the internet,” “perform Shodan reconnaissance,” “find vulnerable services using Shodan,” “scan IP ranges with Shodan,” or “discover IoT devices and open ports.” It provides comprehensive guidance for using Shodan's search engine, CLI, and API for penetration testing reconnaissance.
Sinch Functions, the beta serverless platform for voice, SMS and conversation apps. Use for platform questions: what it is, how deployment works, choosing Node.js or C#, install and auth, FunctionContext, handlers, the Voice v2 call lifecycle and `call.*` events, voice services and `VOICE_SERVICE_ID`, and SVAML. Runtime code lives in sinch-functions-node and sinch-functions-dotnet.
Write C#/.NET Sinch Functions with the `Sinch.Functions.Runtime` NuGet package. Use when writing or editing a function controller: answering and controlling calls with Voice API v2, IVR menus, placing, bridging or transferring calls, realtime AI voice agents, SMS/WhatsApp/RCS webhooks, custom HTTP endpoints, dependency injection, cache/storage/database and authorization. Run and deploy with the sinch-cli skill.
Identify overlooked small-cap high-growth companies in the A-share market. Use this skill when the user asks about small-cap growth stocks, low-market-cap high-growth companies, overlooked small-cap stocks, specialized and sophisticated SMEs, or requests screening A-shares with small market cap but fast growth.
Synthesis judgment for deep research; use when multiple sub_reports are complete and you need to produce synthesis.md that clarifies the main thesis, strength of evidence, cross-dimension consensus, key conflicts, explanations for conflicts, uncertainties, and the answer to the original question. It is for "thinking the conclusion through first," not for writing the final report directly.
Patterns for snapshot testing in .NET applications using Verify. Covers API responses, scrubbing non-deterministic values, custom converters, HTTP response testing, email templates, and CI/CD integration. Use when implementing snapshot tests for API responses, verifying UI component renders, detecting unintended changes in serialization output, or approving public API surfaces.
Use when designing or implementing Spring Data JPA on Spring Boot 4 — repository boundaries, projections, query patterns, custom repositories, CQRS read models, entity relationships, or persistence performance fixes. Not for generic SQL help, database admin work, or project-wide migration (see the springboot-migration skill).
Detects the database stack(s) of a project — paradigm, engine, ORM, platform, and the authoritative source_of_truth — by wrapping scripts/detect-stack.mjs. Emits the stacks array plus routing (which paradigm profile and module set each stack drives) and the source_of_truth precedence. Never guesses an engine; an empty result routes to /claude-db:start. Invoked by db-orchestrator (Phase 1); not usually called directly.
Use when choosing or evaluating a startup revenue model, pricing/value metric, packaging/tier design, or calculating unit economics (LTV, CAC, payback, gross margin, NRR), including usage-based/credit/AI pricing and variable compute/COGS constraints.
Guide for annotating statistical significance (p-value asterisks) on comparison plots. Covers standard notation (ns, *, **, ***, ****), matplotlib bracket+asterisk implementation, and use with seaborn box/violin/bar plots. Use when preparing publication-ready figures with significance markers.
Use when the user asks about grid trading, ETH/USDC bot, automated trading on Base, grid bot status, trade history, PnL report, or mentions running/stopping/monitoring the grid bot. Covers: grid tick execution, start/stop daemon, status/report/history, market analysis, deposit tracking, retry failed trades. Do NOT use for manual token swaps or DeFi lending — use strategy-auto-rebalance for yield optimization.
Server-side Stripe webhook idempotency patterns. PROACTIVELY activate for: (1) Stripe webhook handler design, (2) Transactional dedup via stripe_processed_events, (3) credit_transactions.idempotency_key UNIQUE partial indexes, (4) Idempotency-Key header priority (header > body > server UUID), (5) Idempotency key format/charset/length validation at the handler edge, (6) FOR UPDATE row locking when a UPDATE depends on a prior SELECT, (7) Webhook signature verification (stripe.webhooks.constructEventAsync, tolerance, raw-body reading), (8) Retry-safe endpoints with randomUUID fallback, (9) Durable checkpoint row ordering (checkpoint FIRST, mutation SECOND). Provides: complete webhook handler skeleton, Idempotency-Key validator, dedup SQL, FOR UPDATE pattern, signature verification example.
Write, review, or audit Cairo anonymizer (helper) contracts for stateless or atomic STRK20 private DeFi. Covers the privacy_invoke entry point, OpenNoteDeposit returns, the balance-delta idiom, and swap, Vesu lending, and escrow patterns. Use when a privacy_invoke helper is actually the selected route; persistent positions may instead use the canonical shadow-account route in strk20-wallet-api.
Build privacy wallets and key-holding backends with the Starknet Privacy SDK (@starkware-libs/starknet-privacy-sdk). Covers createPrivateTransfers wiring, register, deposit, transfer, withdraw, multi-op batches, shadow accounts (formerly private sub-accounts), note discovery, setup requirements, and proving configuration. Also use for debugging SDK submissions: provingBlockId, proofFacts, tip 0n, INVALID_NONCE, note maturity, fresh-account sequencing, and AddressMap lookups. If the app talks to the user's wallet instead of holding keys, use strk20-wallet-api. For concepts use strk20-privacy.
Svelte 5 special elements skill. Use when the user needs svelte:boundary, svelte:window, svelte:head, svelte:element, svelte:options and other special elements, or when configuring compiler options, custom elements, catching render errors or async pending states.
SvelteKit configuration/build/deployment/performance skill. Use when the user configures adapters (node/static/cloudflare/netlify/vercel), uses advanced routing/layouts, optimizes performance (code splitting/asset/hydration), handles images (@sveltejs/enhanced-img), implements accessibility/SEO, debugs a SvelteKit app, or migrates from SvelteKit v1/Sapper.
SvelteKit data loading, forms, and page options skill. Use when the user loads data with +page.js/+page.server.js, uses +server.js API routes, handles form actions (default/named/GET), uses use:enhance for progressive enhancement, or configures prerender/ssr/csr/trailingSlash page options in SvelteKit.
Expert guidance on Swift Concurrency best practices, patterns, and implementation. Use when developers mention: (1) Swift Concurrency, async/await, actors, or tasks, (2) modern concurrency patterns or structured concurrency, (3) migrating to Swift 6 or strict concurrency checking, (4) data races or thread safety issues, (5) refactoring closures to async/await, (6) @MainActor, Sendable, or actor isolation, (7) concurrent code architecture or performance, (8) concurrency-related linter warnings, (9) AsyncSequence, AsyncStream, or task groups, (10) nonisolated, @preconcurrency, or @unchecked Sendable.
Expert guidance on Swift best practices, patterns, and implementation. Use when developers mention: (1) Swift configuration or environment variables, (2) swift-log or logging patterns, (3) OpenTelemetry or swift-otel, (4) Swift Testing framework or @Test macro, (5) Foundation avoidance or cross-platform Swift, (6) platform-specific code organization, (7) Span or memory safety patterns, (8) non-copyable types (~Copyable), (9) API design patterns or access modifiers.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.