Skills
100,928 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Authorized security testing — source-code vulnerability hunting, driven by this session's own model by default; network scanning via clearwing when that is genuinely needed and authorized; and exploit verification against a live authorized web application via the vendored Shannon, likewise driven by this session's model. Use when asked to "pentest", "security scan", "hunt vulnerabilities", "scan this code for exploits", or "scan a host". Not for a routine diff review (use /defense for OWASP/secrets, /iac-scan for deploy config, /code-review for correctness)
Find LinkedIn profiles of decision makers at target companies using Extruct's company_people_finder. Takes a company table, adds a people finder column, and produces a linked child people table with names, roles, and LinkedIn URLs. No external API credits — uses Extruct's index only. Triggers on: "find linkedin", "find people", "find contacts", "find decision makers", "people search", "linkedin search", "who to contact", "find profiles".
Guard serialization and canvas-render pipeline performance against regressions. Use when modifying serializeTimelineDirect.ts or any hot path in the foreignObject/native render pipeline to ensure changes don't increase p95 frame-capture time.
Turns kube-bench output into a finished CIS Kubernetes Benchmark audit: interpreting PASS/FAIL/WARN per control, judging which failures are genuine on a managed cluster, writing remediation, and packaging evidence for SOC 2 or PCI DSS. Use when conducting a scheduled compliance audit, triaging kube-bench results, deciding which controls are not applicable on EKS, GKE, or AKS, or producing hardening evidence for an auditor. Keywords: CIS Kubernetes Benchmark, control plane, remediation, compliance evidence, SOC 2, PCI DSS, managed cluster exception. Do not use for installing and running the tool - use benchmarking-kubernetes-with-kube-bench.
Conduct a NIST Cybersecurity Framework (CSF) 2.0 maturity assessment across the six core Functions (Govern, Identify, Protect, Detect, Respond, Recover), scoring organizational posture against the four Implementation Tiers (Partial, Risk-Informed, Repeatable, Adaptive) and producing an improvement roadmap. Use when benchmarking an organization's cybersecurity program maturity or preparing a CSF-based gap analysis and remediation plan.
Use when the user wants product requirements rather than code: “write a PRD”, “product requirements”, “spec this feature for the team”, “ooo pm”. Runs a PM-focused interview with automatic question classification and produces a PRD/PM document. Not for implementation requests
Skill for operating PocketBase backend via REST API and Go package mode. Provides collection CRUD, record CRUD, superuser/user authentication, backup & restore, migration file generation (JS and Go), Go hooks, custom routes, and design guidance for API rules, relations, and security patterns. Use for requests related to PocketBase, pb_migrations, collection management, record operations, Go framework embedding, and backend design.
Create, manage, and deploy Power BI semantic models inside Microsoft Fabric workspaces via `az rest` CLI against Fabric and Power BI REST APIs. Use when the user wants to: (1) create a semantic model from TMDL definition files, (2) retrieve or download semantic model definitions, (3) update a semantic model definition with modified TMDL, (4) trigger or manage dataset refresh operations, (5) configure data sources, parameters, or permissions, (6) deploy semantic models between pipeline stages. Covers Fabric Items API (CRUD) and Power BI Datasets API (refresh, data sources, permissions). For read-only DAX queries, use `powerbi-consumption-cli`. For fine-grained modeling changes, route to `powerbi-modeling-mcp`. Triggers: "create semantic model", "upload TMDL", "download semantic model TMDL", "refresh dataset", "semantic model deployment pipeline", "dataset permissions", "list dataset users", "semantic model authoring".
Every TicketData price signal for any event, performer, or venue, plus a local price-history store for trend math, drift alerts, and cross-event comparisons no ticket tool ships. Trigger phrases: `get-in price for`, `ticketdata price for`, `when should I buy tickets to`, `price history for`, `is this ticket cheap right now`, `which date is cheapest for`, `use ticketdata`, `run ticketdata`.
Based on the macrochen/ppt-master workflow, turns PDF, URL or Markdown material into an editable PowerPoint project and PPTX. Use for initializing a project, importing source material, running SVG post-processing and export, and generating presentations with the Strategist/Executor flow.
Create or reuse a ready-for-review GitHub PR for the current repository change against the requested base, or the repository's remote default branch when none is named. Always use this skill for an actual PR publication, including requests to create, open, raise, publish, or reuse a pull request, put work up for review, or make and share a GitHub review link. Complete the needed commit, base synchronization, and branch publication, but stop before merge.
Transform PRD (Product Requirements Document) into actionable engineering specifications. Creates detailed technical specs that developers can implement step-by-step without ambiguity. Covers data modeling, API design, business logic, security architecture, deployment, and agent system design. Use when: converting product requirements to technical specs, validating PRD completeness, planning technical implementation, creating task breakdowns, or defining test specifications. Triggers: 'PRD to spec', 'convert requirements', 'technical spec from PRD', 'engineering doc from requirements', 'validate PRD'.
Use when a SaaS founder needs to set, audit, or redesign pricing — choosing a value metric, structuring tiers and packaging, setting price points, designing discounts, planning a price increase, or optimizing a pricing page. Also for monetization questions like free-to-paid conversion, expansion revenue, willingness-to-pay research, or per-seat vs usage-based. Not for which acquisition channels to use (use channel-expert) or the wording of the pricing page (use copywriter-skill).
Your dev team ships features nobody asked for while user-reported bugs pile up for months. Operations blames engineering for ignoring users; engineering blames operations for not understanding technical constraints. This gives you the complete Product × Engineering × Operations alignment SOP — from unified backlog to 10-day sprint cadence to veto power rules. What's inside: • Dual-layer Kanban system (master backlog + sprint board with unified tagging) • 10-day sprint standard process (Day 1 dev → Day 6 testable build → Day 10 ship) • Issue template with reproducibility requirements (3x reported = auto-severe) • Tri-party alignment meetings (daily standup / sprint planning / sprint review) • Operations veto power on releases (P0 bug = block shipping) • User feedback → product iteration closed loop (beta testing + interview SOP) • Core metrics framework (acquisition → activation → retention → monetization → referral) • Technical debt management (20-30% sprint capacity reserved) • Ready-to-use templates: Bug Report, Sprint Planning, Responsibility Matrix Built from: Real product strategy meetings + beta testing frameworks. References Supabase sprint model, Manus/DeepSeek commercialization alignment. By @WeiYipei. Triggers: "product ops" | "engineering operations" | "product development SOP" | "sprint planning" | "iteration management" | "cross-functional alignment" | "product engineering ops" | "dev ops collaboration" | "产研运协同" | "迭代管理" | "产品研发运营" | "プロダクト開発運営" | "제품개발운영"
Master-control skill pack for product promo video production. Used to produce 60-90 second promo videos from product descriptions, official sites, app screenshots, or GitHub repositories, completing the brief, storyboard, assets, HyperFrames editing, BGM design, and delivery in stages. Use when the user wants to make a promo video, product video, project intro video, launch video, open source project promo, BGM beat-synced cut, or promo video featuring real software interfaces.
Helps with Prowler repository CI and PR gates (GitHub Actions workflows). Trigger: When investigating CI checks failing on a PR, PR title validation, changelog gate/no-changelog label, conflict marker checks, secret scanning, CODEOWNERS/labeler automation, or anything under .github/workflows.
Therapeutics Data Commons (TDC) AI-ready drug discovery datasets. Curated ADME, toxicity, DTI, DDI with scaffold/cold splits, standardized metrics, molecular oracles, and ADMET benchmarks for therapeutic ML and property prediction. For chemical database queries use chembl-database-bioactivity; for featurization use molfeat.
Execute a comprehensive Python project health audit. Analyze the tech stack, architecture, API/interface design, data layer, testing, code quality, CI/CD, and documentation. Produce a shareable Markdown report with section scores and a weighted overall score. Use when the user asks to audit a Python project, run a health check, evaluate backend quality, or assess technical debt. Triggers on: 'python audit', 'python health audit', 'fastapi audit', 'django audit', 'flask audit', 'tech debt assessment', 'python health', 'python project quality', 'python quality check', 'python code review'.
Produce an implementable PyTorch or PyTorch Lightning training recipe with dataset handling, optimization, logging, checkpointing, and debugging checks. Use when turning a paper idea into runnable training code — including new experiments, reproductions, fine-tuning setups, scaling recipes, and debugging unstable training.
Decision framework for React Three Fiber projects. Routes to specialized R3F skills (fundamentals, geometry, materials, performance, drei) based on task requirements. Use when starting an R3F project or needing guidance on which R3F skills to combine.
Test and benchmark RAG systems with proper metrics and evaluation frameworks. Use this skill when evaluating RAG quality, measuring retrieval performance, using RAGAS metrics, or building RAG test suites. Activate when: RAG evaluation, RAG testing, RAGAS, retrieval metrics, faithfulness, relevance, context precision, RAG benchmarking.
Build Retrieval-Augmented Generation (RAG) systems for AI applications with vector databases and semantic search. Use when implementing knowledge-grounded AI, building document Q&A systems, or integrating LLMs with external knowledge bases.
Unified handling of address space conversion: determining PIE/ASLR base addresses, RVA/VA conversion, loader offset (firmware load address vs link address), cross-tool address alignment (Ghidra/angr/frida/gdb). Triggers: PIE, ASLR, base address, RVA, VA, loader offset, address conversion, relocated address, computing addresses in gdb, angr addresses.
Land handed-over material of any shape (a note, a link, a dump, a correction) in the document of an existing knowledge base that owns it: read the base's own routing documents first, edit in each document's own grammar, hash files before writing, and report what cannot be placed instead of guessing. User-invoked. Not for researching the subject or designing a new structure.
Republish a GitHub repository as one signed commit: squash its whole history into one commit with the same tree, then delete the remote and recreate it under the same name and settings, because a force push leaves the old commits reachable by hash, in forks and in pull requests. User-invoked, and the deletion cannot be undone.
Use when the user wants to know how a company gets its users, reverse engineer a competitor's growth or distribution, copy what a winning company does on each channel, or study a brand's content strategy (titles, thumbnails, covers, captions, graphics) on YouTube, TikTok, Instagram, X, LinkedIn or Reddit. Also for "how did X grow", "teardown of X's marketing", "what content works for X".
Create a React component using the Container/Presentation pattern in src/components by asking for the component name and type (ui or features), then scaffold files that follow this repository's TypeScript, Storybook, and SCSS conventions. Use when the user explicitly asks for a Container/Presentation-based component or runs /react-container-presentation-component.
Assesses and responds to incoming code review feedback on PRs (reviewer comments, requested changes), especially when suggestions are unclear, technically questionable, or scope-expanding. Use before implementing review suggestions to align on intent and keep changes minimal.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.