Skills
100,928 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Use this skill when the user asks to “follow red team methodology,” “perform bug bounty hunting,” “automate reconnaissance,” “hunt for XSS vulnerabilities,” “enumerate subdomains,” or needs security researcher techniques and tool configurations from top bug bounty hunters
Refactor Flutter/Dart code to improve maintainability, readability, and performance. This skill applies Dart 3 features like records, patterns, and sealed classes, implements proper state management with Riverpod or BLoC, and uses Freezed for immutable models. It addresses monolithic widgets, missing const constructors, improper BuildContext usage, and deep nesting. Apply when you notice widgets doing too much, performance issues from unnecessary rebuilds, or legacy Dart 2 patterns.
Evaluate a public GitHub repository's momentum and maintenance health. Use when asked whether a repository is healthy, growing, declining, abandoned, or well maintained, or when vetting dependencies and OSS projects. Do NOT use for code or architecture review.
Set up and maintain a research-experiment harness so experiments run fast and every paper number traces to one command. Use when starting a new project, running a sweep, aggregating runs into a paper table, or cleaning up a codebase that has become hard to navigate. Trigger on "how should I structure my code", "set up my project", "organize my experiments", "starting a new paper", "run all these configurations", "collect my results into a table", "my code is getting messy", "which run produced this number", or "I inherited this codebase". Built for researchers who are strong in the mathematics and weak in software: it fixes a pipeline contract up front so adding an experiment is one line in a list, never an edit to shared code. Not for designing the training loop itself (pytorch-training-recipe / jax-training-recipe), reproducing one paper's method (paper-to-code), choosing which experiment to run or diagnosing overfitting (experiment-design), or auditing a released artifact (reproducibility-audit).
Designs retrieval strategies for querying knowledge graphs in RAG systems, covering pattern selection (global-first, local-first, U-shaped hybrid), query decomposition for multi-hop reasoning, ranking and constraint configuration, and provenance tracking for citation. Use when designing retrieval pipelines, orchestrating search over knowledge graphs, or when user mentions retrieval strategy, search orchestration, query decomposition, multi-hop reasoning, provenance tracking, or citation in GraphRAG.
Reverse engineer minified, bundled, and obfuscated browser/Node JavaScript — unpacking webpack chunks, recovering source from sourcemaps, undoing obfuscator.io string-array and control-flow obfuscation with webcrack/synchrony/restringer, and locating a signing or crypto routine in a live bundle via Chrome DevTools. Use when a page ships a huge minified bundle, when code is full of _0x hex identifiers and a rotated string array, when a .js.map is reachable, or when you must find where a request signature or token is computed.
Review screenshots or other images with OpenRouter vision models via bundled Deno scripts. Use for quick VRT sanity checks, invalid-image screening, or CI gates. `scripts/review-image.ts` returns freeform feedback; `scripts/review-image-ci.ts` returns strict `pass|fail` JSON and exits non-zero on fail.
Use when the user wants to anticipate reviewer questions, select the strongest ablations to present, prepare rebuttals, or identify paper weaknesses before submission. Triggers on phrases like "reviewer questions", "anticipate reviewers", "rebuttal", "paper weaknesses", "defend the paper", or "strengthen the paper".
RoadRunner asset path lookup tables for map format conversions in MATLAB. Maps lane markings, signs, signals, barriers, objects, and lane types to RoadRunner asset paths. Use when converting map formats to RRHD, resolving asset paths, or assigning visual assets to HD Map objects.
Profile before optimizing, cut allocation out of hot paths, and treat LTO, codegen-units, PGO and target-cpu as the last five percent. Use when Rust code is too slow, when a benchmark regresses, when reviewing code that allocates or formats inside a loop, when release-profile or codegen flags come up, or when the user asks how to make Rust faster.
Standard single-cell RNA-seq analysis pipeline. Use for QC, normalization, dimensionality reduction (PCA/UMAP/t-SNE), clustering, differential expression, visualization, and converting R-friendly single-cell formats such as Seurat or SingleCellExperiment RDS files into h5ad for Scanpy. Best for exploratory scRNA-seq analysis with established workflows. For deep learning models use scvi-tools; for data format questions use anndata.
Performs RNA velocity analysis with scVelo on single-cell RNA-seq AnnData objects that have spliced and unspliced layers (from velocyto, STARsolo, kallisto|bustools, or alevin-fry). Covers stochastic and dynamical velocity models, velocity graphs and embedding arrows, latent time, PAGA trajectory graphs, and driver gene ranking. Use when inferring differentiation direction from snapshot data, estimating latent time from splicing kinetics, finding driver genes of a trajectory, or adding velocity arrows to a Scanpy UMAP. Not for fate probability modeling (use CellRank) or datasets without unspliced counts.
Trains and applies scvi-tools probabilistic deep generative models (scVI, scANVI, totalVI, MultiVI, PeakVI, DestVI, Solo, CellAssign, MrVI and others) on AnnData or MuData single-cell data using PyTorch. Covers batch correction, integration, cell type annotation, probabilistic differential expression, and scRNA-seq, ATAC-seq, CITE-seq, spatial and methylation data. Use when integrating batches or datasets with scVI, annotating cells with scANVI, jointly modeling RNA and protein or ATAC, deconvolving spatial spots, or testing differential expression with uncertainty. For standard preprocessing and clustering pipelines, use scanpy instead.
Search and read the decompiled C# code of the Space Engineers 1 Dedicated Server to learn how the server works inside and to get exact signatures, method bodies, IL and content files. If the se-dev-server-book handbook is installed, read it first for how a system works overall and come here for the exact code.
Use when user wants to develop on the SecondMe platform (second-me.cn, develop.second-me.cn). Triggers: building SecondMe third-party apps, SecondMe OAuth login integration (Client ID/Secret, token exchange), MCP integration for SecondMe, Agent Memory API, Act stream API, app scaffolding, review submission, or hackathon projects targeting SecondMe. Covers the full developer lifecycle from app creation and credentials to release. NOT for casual SecondMe usage like browsing profiles, adding friends, or social features — only for building and integrating with SecondMe as a developer platform.
Manages encryption and decryption of repository secrets (such as .env or *.tfvars) using git-crypt, keeping credentials secure with parallel encrypted files. Use when managing secrets, setting up git-crypt, or encrypting/decrypting environment files.
Step 4 of the PaperOrchestra pipeline (arXiv:2604.05018). ONE single multimodal LLM call that drafts the remaining paper sections (Abstract, Methodology, Experiments, Conclusion), extracts numeric values from experimental_log.md into LaTeX booktabs tables, splices the generated figures from Step 2, and merges everything into the template that already contains Intro + Related Work from Step 3. TRIGGER when the orchestrator delegates Step 4 or when the user asks to "write the methodology and experiments sections" or "fill in the rest of the paper".
Design, implement, audit, test, troubleshoot, or migrate secure OAuth 2.0 and OpenID Connect (OIDC) systems using RFC 9700 / BCP 240. Use for authorization servers and OpenID Providers, OAuth clients and OIDC relying parties, resource servers, native apps, browser-based apps, multi-issuer login, redirect URIs, authorization code and PKCE flows, state and nonce handling, ID Token validation, token storage and replay, refresh-token rotation, sender-constrained tokens (DPoP or mTLS), mix-up and injection attacks, discovery and metadata, reverse proxies, or migration away from implicit and resource-owner-password grants.
Perform language and framework specific security best-practice reviews and suggest improvements. Use when the user explicitly requests security best practices guidance, a security review or report, or secure-by-default coding help. Supports Python, JavaScript/TypeScript, and Go. Do NOT use for general code review, debugging, threat modeling (use security-threat-model), or non-security tasks.
The animal is the lead and a phone is the only camera. Lock the count to exactly one, keep the animal behaving like an animal, and let the payoff come from it closing in on the lens. Use when the user wants a Seedance 2.5 / 2.0 video prompt for this kind of clip (pets and animals as the lead; 中文触发词: 宠物动物当主角, 宠物, 猫, 狗, 动物), or asks how published cases of this type were prompted. Read references/cases.md before drafting.
Full Sentry Snapshots setup for Apple/Cocoa projects. Use when asked to "setup SnapshotPreviews", "setup Apple snapshot testing", "upload Apple snapshots to Sentry", "setup Apple snapshot GitHub Actions", or "setup Apple selective snapshot testing".
Backlink profile analysis: referring domains, anchor text distribution, toxic link detection, competitor gap analysis. Works with free APIs (Moz, Bing Webmaster, Common Crawl) and DataForSEO extension. Use when user says backlinks, link profile, referring domains, anchor text, toxic links, link gap, link building, disavow, or backlink audit.
Live SEO data via DataForSEO MCP server. SERP analysis (Google, Bing, Yahoo, YouTube, Google Images), keyword research (volume, difficulty, intent, trends), backlink profiles, on-page analysis (Lighthouse, content parsing), competitor analysis, content analysis, business listings, AI visibility (ChatGPT scraper, LLM mention tracking), and domain analytics. Requires DataForSEO extension installed. Use when user says "dataforseo", "live SERP", "keyword volume", "backlink data", "competitor data", "AI visibility check", "LLM mentions", "image SERP", "google images", "image rankings", or "real search data".
Search Experience Optimization: reads Google SERPs backwards to detect page-type mismatches, derives user stories from search intent signals, and scores pages from multiple persona perspectives. Identifies why well-optimized pages fail to rank by analyzing what Google rewards for each keyword. Use when user says "SXO", "search experience", "page type mismatch", "SERP analysis", "user story", "persona scoring", "why isn't my page ranking", "intent mismatch", or "wireframe".
Installs prerequisite CLI tools (gh, glab, jq), guides GitHub/GitLab authentication, installs uvx, and configures the existing mcp-atlassian MCP server for Jira in OpenCode. Idempotent: safe to rerun the skill. Triggered when the user says “setup,” “install prerequisites,” or “configurer jira.” To build a new MCP server (rather than configure an existing one), use mcp-builder instead.
Sharpe ratio inference for ONE strategy under non-Normal, serially correlated returns. Implements the ρ-corrected (AR(1), skew, kurtosis) Sharpe variance of López de Prado, Lipton & Zoonekynd (2026, Eq 2-3) and the single-test tools built on it: PSR, MinTRL, critical Sharpe ratio and test power. Numba JIT. Use when computing Sharpe significance, a Sharpe confidence band, minimum track record length or power with autocorrelation and fat tails. TRIGGERS - PSR, probabilistic sharpe ratio, MinTRL, minimum track record length, sharpe variance, non-iid sharpe, autocorrelated sharpe, sharpe significance, sharpe power.
Run commands in an isolated Linux microVM sandbox using the shuru CLI. Use when the user asks to execute untrusted code, install packages safely, test in a clean environment, run Docker containers or a headless browser inside a VM, or needs Linux-specific tooling on macOS.
Signals scout for Core Web Vitals (`$web_vitals`). Watches each page's p75 LCP / INP / CLS / FCP against Google's thresholds and its own history — poor-band pages, band crossings, sharp regressions — and dates each regression against deploys and flag rollouts.
When the user wants to optimize signup, registration, account creation, or trial activation flows. Also use when the user mentions "signup conversions," "registration friction," "signup form optimization," "free trial signup," "reduce signup dropoff," or "account creation flow." For post-signup onboarding, see onboarding-cro. For lead capture forms (not account creation), see form-cro.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.