Skills
100,696 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Standalone skill for multi-perspective PLC code security and quality analysis. Triggers on: "review", "audit", "analyze", "security check", "vulnerability scan", "code review", "check this code", "is this safe", "find issues" when combined with PLC, SCL, ST, LAD, FBD, Structured Text, or block context. Also triggers when the user pastes PLC code and asks for feedback, or uploads exported SimaticML XML files. This skill is independent of tia-openness-roadmap — it does not perform engineering automation. It analyzes code that has already been exported or pasted.
Recreate screenshots/design mockups as Pencil .pen designs and output a structured design document alongside on the same canvas. Use this Skill when the user mentions "recreate from an image", "build a page from a screenshot", "image to pencil", "make an identical page", "create a design mockup from this image", or "output the design and document". Also applies when the user asks to modify an existing .pen page, append a design document on the right, do pixel-level alignment, or combine multiple screenshots into one set of pages. This Skill must call the pencil MCP tools for reading, drawing, and screenshot verification; if information is incomplete, ask the user for the missing details before drawing.
Multi-agent coordination daemon for coding agents. Use for deterministic port claims, session tracking, salvage, file claims, notes, pub/sub, tuple-space coordination, background fleets, and debugging multi-agent failures across Claude Code, Codex, Gemini CLI, Cursor, or Windsurf. NOT for production deploy orchestration, Docker or Kubernetes networking, or cloud service discovery.
Help users sync and manage their application users in Portaly Vibe, including initial migration, incremental sync, and dashboard viewing. Trigger when the user mentions Portaly user sync, user management, user synchronization, member sync, or wants to push user data to Portaly.
Publish content to Xiaohongshu, supporting image-text notes and video notes. Automatically determines the publish type, validates the title and assets, and publishes after user confirmation. Use when the user wants to publish content on Xiaohongshu — including posting a note, posting image-text, posting a video, uploading images, writing a Xiaohongshu post, sending content to Xiaohongshu, recommendation notes, product sharing, etc. It should also trigger even if the user only says "help me post it" when the context clearly refers to Xiaohongshu.
EffectComposer setup and architecture for Three.js post-processing pipelines. Use when setting up multi-pass rendering, combining effects, creating custom passes, managing render targets, or building reusable effect stacks. Foundation skill for all post-processing work.
Expert guidance on using PostgreSQL with Swift. Use when developers mention: (1) PostgreSQL or Postgres in Swift, (2) postgres-nio library, (3) SQL queries in Swift, (4) PostgreSQL connection pooling, (5) prepared statements, (6) type-safe database access, (7) bulk loading or COPY FROM, (8) PostgresClient or PostgresConnection.
Generate YAML code pasteable into Power Apps Studio using the pa.yaml v3 schema. Includes modern controls, caching patterns, Gallery with collections, and all lessons learned to vibe code without errors. Trigger: when the user asks to create screens, controls or code for Power Apps in YAML format.
Every Semrush Analytics + Projects feature, plus a local SQLite store and cross-domain joins no other Semrush tool has. Trigger phrases: `show me what changed for <domain> this week`, `find the keyword gap between <my domain> and <competitor>`, `show me new referring domains for <domain>`, `triage my Site Audit`, `what did Semrush cost me this month`, `detect keyword cannibalization on <domain>`, `track SERP feature changes for <keyword>`, `use semrush`, `run semrush`.
Generate an interactive PR review walkthrough as an HTML page. Fetches PR data via gh API, categorizes files into core vs mechanical changes, adds reviewer annotations, and renders diffs with moved-code detection. Use when the user pastes a GitHub PR URL and asks for a review, walkthrough, or summary, or says "review this PR".
Define go-to-market strategy including launch plan, messaging, channels, and timing during PRD v0.9 Go-to-Market. Triggers on requests to plan launch, define GTM strategy, or when user asks "how do we launch?", "go-to-market", "launch plan", "marketing strategy", "messaging", "launch channels", "GTM". Outputs GTM- entries with launch plan components.
Use when the user needs to scope, write, or audit a product spec — a PRD, feature spec, user stories, acceptance criteria, or a "spec this out"/"break this into stories"/"definition of done" request — or wants an existing spec reviewed for gaps and anti-patterns. Triggers whenever a feature idea needs to become structured requirements that align a team on what to build. For the analytics behind success metrics, use data-analysis; for the technical design, use software-architect.
Prometheus monitoring and alerting for cloud-native observability. USE WHEN: Writing PromQL queries, configuring Prometheus scrape targets, creating alerting rules, setting up recording rules, instrumenting applications with Prometheus metrics, configuring service discovery. DO NOT USE: For building dashboards (use /grafana), for log analysis (use /logging-observability), for general observability architecture (use senior-software-engineer with infrastructure focus). TRIGGERS: metrics, prometheus, promql, counter, gauge, histogram, summary, alert, alertmanager, alerting rule, recording rule, scrape, target, label, service discovery, relabeling, exporter, instrumentation, slo, error budget.
Query and interact with Prometheus HTTP API for monitoring data. Use when Claude needs to query Prometheus metrics, execute PromQL queries, retrieve targets/alerts/rules status, access metadata about series/labels, manage TSDB operations, or troubleshoot monitoring infrastructure. Supports instant queries, range queries, metadata endpoints, admin APIs, and alerting information.
Design industry R&D solution directions grounded in prior successful cases, academic papers, technical reports, and credible industry publications. Use whenever the user has a vague business, banking, fintech, enterprise, or operational problem and wants to brainstorm methods, draft a theoretically motivated solution, compare solution families, or justify a proposal with publications instead of unsupported intuition. Also use when the user asks for "prior successful cases", "paper-backed solutions", "method draft", "research-backed proposal", or "what has worked before" for an applied industry problem.
Build real-time applications with PubNub pub/sub messaging. Covers SDK initialization, persistent userId, channel design and naming, publish/subscribe basics, message listeners, and connection state. Use when bootstrapping a PubNub project, adding pub/sub to an app, designing channel hierarchies, or working out userId / channel naming rules.
Rebase the current Git checkout onto the requested remote base branch, or the repository's remote default branch when none is named, without losing local work. Always use this skill for an actual base-branch synchronization operation, including requests to pull or sync main, master, trunk, or the default branch; update a branch from its base; rebase onto a remote base; bring incoming base commits into the current checkout; or update a detached worktree from that base.
Publish local Git commits on a named branch without losing local or remote work. Always use this skill for an actual Git branch publication, including requests to push, publish, upload, or put the current or detached checkout on origin or another Git remote. Use it for detached-HEAD publication and post-rebase lease-protected updates; it pushes existing commits only and does not commit dirty changes, create a PR, or merge.
Use when the developer wants the agent to work without approving every write — “tu dong hoan toan”, “cu lam het di”, “dung hoi tung buoc”, “work autonomously”, “approve everything for this task”, a long build session — or when an apply preview says autopilot is active, paused, expired or not covering a statement. Requests one developer-approved lease, works strictly inside it, stops where it stops, and reports every write it made.
Use when a change spans more than one statement or file — a release or migration script, “chay script DDL”, “deploy ban release”, “run these .sql files”, a table with its comments and indexes, a package spec and body together, a directory of numbered scripts. Orders the statements, previews every one, gets one approval for the set, runs them through apply's six steps in order and stops at the first failure.
Use when designing or writing a new package, procedure, function or trigger, or restructuring one — “viet package”, “tao procedure”, “them function”, “them trigger”, an API another team will call, an error-handling or logging design, a spec change. Applies the industry-standard PL/SQL design rules — the spec as a contract, named exceptions, one transaction owner, thin triggers — beneath the house conventions, which always win.
Use when creating or changing a table, column, constraint, index, sequence or comment — “add a column”, “create a table for X”, “them cot”, “tao bang”, “sua kieu du lieu”, “comment cho cot”, a migration script, or a column type change. Designs the DDL to the house standard and Oracle practice, documents every table and column with COMMENT ON, and lands it through pythia deploy with the honest rollback.
Use when a query, report or PL/SQL unit is slow, before adding an index or a hint, or when someone says “cham”, “toi uu truy van”, “optimize this query”, “why is this report slow”, or “full table scan”. Measures with the optimizer's own plan and statistics, changes one thing at a time, and proves the gain with the same measurement — license-safe, no AWR/ASH or Tuning Pack.
Use before saying an Oracle task is done, fixed, deployed, faster or working — before the final report, before “xong roi”, “da sua xong”, “deployed”, before ending an autopilot session. Collects the evidence from this session — compile errors, INVALID objects against the baseline, lint, journal entries, before/after plans when performance was the point — and reports only what that evidence proves.
Execute the self-contained final QA gate as a Spec's authored terminal `qa` Task — derive a resumable QA matrix from the PRD and task evidence, execute real user flows through every declared surface, probe high-risk user behavior, capture auditable evidence, classify findings by user impact, and write the spec-local dated QA report. Do not use as a substitute for implementation tests or a broad standalone QA knowledge base.
AI model security assessment and forensics (behavioral layer): extraction assessment (API black-box extraction assessment), fingerprint verification (behavioral fingerprinting and attribution verification), privacy leakage evaluation (membership inference/privacy leakage assessment), and robustness evaluation (adversarial robustness assessment). Triggers: API model theft, black-box model replication, model fingerprinting, membership inference, adversarial examples, behavioral watermarking, model security assessment, privacy leakage assessment.
ARM architecture reverse engineering (non-Android): Cortex-M/A vector tables, Thumb/ARM switching, AAPCS calling convention, position-dependent code relocation, and MMIO peripheral register cross-referencing. Trigger terms: ARM, arm32, Cortex-M, Cortex-A, Thumb, AAPCS, embedded reverse engineering, bare-metal firmware, stm32, vector table.
CTF practice gateway. Orchestration: identify challenge type → simple challenges go directly to [[re-binary-core]] → automation needed [[re-angr]]/[[re-z3]] → obfuscation [[re-deobfuscate]]. Sub-skills: [[re-angr]] [[re-z3]] [[re-pwn]], [[re-stego]]. Triggers: CTF, challenge, reverse-engineering challenge, pwn, babyre, automated solving, symbolic execution, angr, z3, solver, find flag.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.