Skills
100,344 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Turn ideas, observations, or long-form writing into a Chinese spoken script that Ray can record directly (in Ray's voice, stating the views fully and listing uncertain points under “待确认”); also review scripts or study Ray's authentic expression by comparing them with recorded scripts. Use for “做成口播”, “改成口播”, “审一下口播稿”, or “对比我录的”. Not for an educational video script focused on explaining one topic (if ray-kepu is installed, route it there). Does not publish.
Primary entry point for AI model analysis (router): identify the input type—model files go to file-level reverse engineering (re-ai-model), API-only access goes to behavioral evaluation (re-ai-attack), and malicious behavior goes to malware analysis. Trigger terms: AI model analysis, AI model security, model files, model leaks, model reverse engineering, AI model analysis entry point.
eBPF program reverse engineering and adversarial analysis: BPF-64 instruction set, progs/maps relationships, bpftool disassembly, and three use cases: tracing and forensics, malware samples, and EDR evasion. Trigger terms: eBPF, BPF, bpftool, bcc, libbpf, xlated, BPF instructions, bpf hook, EDR evasion, tracepoint, kprobe.
MIPS architecture reverse engineering and router firmware analysis methodology: delay slots, $gp calling convention, endianness determination, and httpd identification. Triggers: MIPS, mipsel, router firmware, embedded, delay slots, big-endian, big-endian, little-endian, httpd, busybox
RTOS structure analysis: runtime model identification for FreeRTOS/ThreadX/Zephyr/RT-Thread/VxWorks/QNX/RTEMS/NuttX/eCos/µC-OS/SYS-BIOS/SAFERTOS/CMSIS-RTX5/T-Kernel/TOPPERS/OSE/INTEGRITY/ARINC 653/PikeOS/Deos, task table and TCB identification, kernel object recovery, and task-by-task decompilation. Triggers: RTOS, FreeRTOS, ThreadX, Zephyr, VxWorks, QNX, RTEMS, NuttX, eCos, µC/OS, Micrium, SYS/BIOS, SAFERTOS, CMSIS-RTX5, T-Kernel, TOPPERS, ITRON, OSE, OSEck, Nucleus, INTEGRITY, ARINC 653, PikeOS, VxWorks 653, Deos, task table, TCB, firmware scheduling, MCU firmware, confdefs, devicetree, DKM, resource manager, FromISR, DSR, OSIntEnter, Swi, Hwi, module preamble, upper half, partition scheduling, major frame, Safety Class
React and Next.js performance optimization guidelines from Vercel Engineering. Use when writing, reviewing, or refactoring React/Next.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements. Do NOT use for component API architecture or composition patterns (use react-composition-patterns instead).
Masters Reatom v1001 async flows. Use when implementing, documenting, or reviewing Reatom async queries, mutations, wrap usage, withAsync, withAsyncData, withAbort, abortVar, sampling, take, onEvent, race, framePromise, Suspense, retry, caching, or race-prone UI workflows.
Use when receiving code review feedback, before implementing suggestions, especially if feedback seems unclear or technically questionable - requires technical rigor and verification, not performative agreement or blind implementation
Redesigns an existing design as if a new requirement had been a founding assumption, then propagates it to every reference and delivers it in working increments. Use when the user explicitly asks to redesign for a requirement or from first principles. Never infer from a feature request. Not for redoing an attempt; use redoing-implementations.
Turn what this session learned into durable changes to the repository: a lint rule, a test, a check, a skill edit, AGENTS.md or docs/DECISIONS.md. Use when wrapping up a task, after a mistake or a correction, or when the person says reflect or remember this.
Prepare one stable GitLab release runbook from an exact tag-to-head inventory, with SemVer rationale, release notes, announcement, illustration prompt, and exactly bound manual glab commands. Use when the user asks to prepare a stable release from an exact release MR. Russian discovery terms: подготовить релиз.
Create finished vertical short videos with Remotion and post them to TikTok, Instagram Reels, and YouTube Shorts. Turns a topic, article, URL, dataset, changelog, or list into a 1080x1920 kinetic-text short (large animated words, stat count-ups, top-N lists, launch and changelog videos, quotes), timed to reading speed and kept inside each app's safe zone, rendered locally with no paid API. Use when someone asks for a Remotion short, a Remotion video for TikTok/Reels/Shorts, kinetic typography or text animation video, a stats or data short, a top 5 list video, a product launch or changelog video, a quote video, faceless text shorts, or “make a short about X and post it.” Includes a review sheet with app overlays marked, a cover frame, and WoopSocial posting with confirmation.
Penetration test report generation. Use when a security assessment is complete and a formal report must be produced. Covers report structure templates, risk rating standards (CVSS), vulnerability description writing, and remediation recommendation guidelines. Applies to formal penetration test reports and red team assessment reports
Complete report writing capability combining reading, note-taking, validation, and formatting. LOAD THIS SKILL WHEN: User needs "寫報告", "write report", "整理成報告", "產出文件" | has source materials to summarize | creating academic document. CAPABILITIES: PDF reading, structured notes, content validation, format checking. COMPOSITE SKILL: Combines pdf-reader + note-writer + content-validator + report-formatter.
Operate Resend through its official CLI for authorised sends, hosted templates, domains, contacts, broadcasts, inbound email, webhooks, or Automations. Use for explicit Resend terminal/CI operations; use resend-api for application SDK code, not this skill for generic email or inbox tasks.
Reverse engineer React Native mobile apps, including Hermes bytecode bundles, using hbctool, hermes-dec, and Frida. Use when an APK contains index.android.bundle or libhermes.so, when an IPA contains main.jsbundle, when jadx shows only ReactActivity classes, or when a bundle file starts with the Hermes magic bytes instead of readable JavaScript.
Reviews a code diff for exploitable security vulnerabilities in a fresh-context read-only subagent, reporting only high-confidence findings with an exploit scenario and fix. Use when the user says "security review", or when asked for a security review of code, a diff, a branch, or a PR. Not for general review; use reviewing-code. Not for a third-party clone; use auditing-repo-security.
Supplies the craft of writing good RHDH Jira work in RHIDP, RHDHPLAN, RHDHBUGS, and RHDHSUPP: the Feature, Epic, Story, Task, and Bug description templates with filled examples, the RHDH challenge matrix that stress-tests scope, sizing, acceptance criteria, and Epic independence, the T-shirt and Fibonacci sizing scales, keyword duplicate detection, and the tracer-bullet rules for breaking a Feature into Epics or an Epic into Stories. Use when drafting or judging the text and shape of an issue such as RHIDP-1234 — how big is this, is this AC testable, should this be one Epic or three, does this already exist. Prose and estimation craft only; it runs no Jira command.
Opens new work in RHDH Jira and decides what kind of work it is — Feature or Feature Request in RHDHPLAN, Epic, Story, Task, Spike or Vulnerability in RHIDP, Bug in RHDHBUGS, support conversation in RHDHSUPP — then interviews, drafts, and creates it with the right fields and parent link. Use for "file a ticket", "create a feature", "open an epic for this", "raise a bug", "log a spike", "we should track this in Jira", or turning an RHDHSUPP support case into an RHDHBUGS defect or an RHDHPLAN feature request. Picking the issue type is this skill's job, not the caller's. Editing or transitioning an issue that already exists, such as RHIDP-1234, is not creation.
Plan and build a new callable Recursive Language Model with predict-rlm. Use when a user wants to design an RLM, assess whether an RLM fits a workflow, or implement an RLM package with structured boundaries, skills, host-side tools, custom adapters, or runtime-kernel extensions. For optimization of an existing RLM, use rlm-gepa instead.
Source, verify and wire the sound for a Roblox game from the Creator Store by asset id - footsteps, gunshots, animal calls, UI clicks, ambience, music - with no upload, no Open Cloud audio quota and no API key. Searches the same unauthenticated toolbox endpoints Studio's own audio tab uses, then PROVES each candidate in Studio (IsLoaded plus a measured Sound.TimeLength) before anything is chosen, because the toolbox's own duration field is wrong often enough to be dangerous. Emits a SoundBank data module, an Sfx runtime helper that fails inert, and an install script so the bank can be heard in an open place immediately. Use whenever the user wants sound effects, audio, SFX, music or ambience for a Roblox game, wants sounds found and wired rather than dragged in by hand, is picking audio for a build, or asks why a Sound is silent, has no length, or will not load in their place.
Robot and world descriptions (URDF, SRDF, SDF) for ROS, MoveIt and Gazebo. Use for ROS robot_description files (links, joints, limits, inertials, meshes), MoveIt planning groups, end effectors, group states and disabled collision pairs, Gazebo/gz models and worlds (sensors, plugins, physics), and opening or reviewing a `.urdf`, `.srdf` or `.sdf`. Not the 3D CAD part itself, which the `cad` skill makes, nor a part's structural or physics analysis, nor signed-distance fields
Provides comprehensive guidance for Rollup bundler including configuration, plugins, code splitting, tree shaking, and library bundling. Use when the user asks about Rollup, needs to bundle libraries, optimize output, or configure Rollup for production builds.
Design and review Rust async code around task ownership, suspension points, cancellation, blocking work, and runtime boundaries. Use when writing, refactoring, or reviewing futures, async functions, Tokio tasks, spawn, JoinHandle, Send futures, async traits, cancellation, or mutexes across await points.
Design and review thread-based Rust concurrency with explicit ownership, sharing, and synchronization choices. Use when writing, refactoring, or reviewing threads, scoped threads, channels, Arc, Mutex, RwLock, Condvar, atomics, OnceLock, LazyLock, Send, Sync, deadlocks, or shared state.
Use when preparing, containerizing, configuring, testing, or reviewing Rust services for deployment, especially Docker multi-stage builds, runtime configuration, environment overrides, secrets, health checks, SQLx offline builds, release profiles, image-size reduction, or production startup validation.
Use when adding, changing, debugging, or reviewing Rust service error handling and observability, especially when separating domain errors from HTTP responses, adding thiserror/anyhow, implementing ResponseError or IntoResponse, adding tracing spans, redacting secrets, or diagnosing async failures.
Design and review Rust FFI boundaries that keep raw declarations isolated behind safe ownership, lifetime, error, and cleanup wrappers. Use when writing, refactoring, or reviewing unsafe extern blocks, C ABI wrappers, repr(C) types, CString, CStr, raw handles, Drop cleanup, bindgen, cbindgen, or panic-safe foreign boundaries.
GitHub Actions CI/CD for Rust+Node.js hybrid repos. Covers workflow structure, installable composite actions, artifact flow, caching, and dev versioning. Use when: (1) setting up or fixing GitHub Actions workflows, (2) adding CI for a Rust+Node.js project, (3) working with composite actions (setup-workspace, rust-cross-build, compute-version, wait-npm-propagation), (4) debugging CI failures, (5) setting up the cross-platform build matrix. Triggers on "CI", "workflow", "GitHub Actions", "cross-build", "artifact", or work in .github/workflows/.
Publish Rust binaries to npm using the optionalDependencies platform package pattern. Covers the full publish pipeline, version sync, workspace:* protocol, and platform package architecture. Use when: (1) publishing Rust binaries to npm, (2) setting up the platform package pattern (main + per-OS packages), (3) debugging publish failures, (4) managing version sync across pnpm + Cargo workspaces, (5) working with workspace:* protocol. Triggers on "publish", "platform packages", "optionalDependencies", "bin.js", "version sync", "workspace protocol", "npm tag", or "prepare-publish".
Design and review Rust trait APIs, generic bounds, dispatch models, and conversion contracts for clear public interfaces. Use when designing, refactoring, or reviewing traits, generics, trait objects, associated types, impl Trait, From/TryFrom, AsRef, Borrow, or crate APIs.
Designs and architects Salesforce solutions using the Well-Architected framework (Trusted, Easy, Adaptable), Architect Decision Guides, and integration patterns. Use when the user mentions Salesforce architecture, solution design, org strategy, data modeling, integration patterns, multi-cloud design, Agentforce architecture, Data 360, Experience Cloud, automation strategy, security/sharing model, governor limits, DevOps/ALM, ERDs, record-triggered automation, building forms, event-driven architecture, or migration/deployment strategy. Also triggers for phrases like "design my Salesforce," "best pattern for," or "review my Salesforce org."
Run the complete Gathered Scenes workflow from a supplied photograph to a static poster, a scene-authored adaptive v0.2 flat paper-tear Apple Live Photo ZIP, and optional handoff of that ZIP to the local Live Photo Importer. Use when the user wants the full source-to-Live-Photo flow with a custom narrative tear path and broad rounded low-frequency contours; do not use for static-only posters, 3D paper curls, or motion inside the photographed scene.
Core skill for the deep research and writing tool. Write scientific manuscripts in full paragraphs (never bullet points). Use two-stage process: (1) create section outlines with key points using research-lookup, (2) convert to flowing prose. IMRAD structure, citations (APA/AMA/Vancouver), figures/tables, reporting guidelines (CONSORT/STROBE/PRISMA), for research papers and journal submissions.
This skill should be used when the user asks to "create note", "capture thought", "save this", "document idea", "write note", "jot down", "quick note", "remember this", "capture this", or mentions wanting to save knowledge, ideas, or learnings for later reference in their secondbrain.
This skill should be used when the user asks to "scan for vulnerabilities", "check for security issues", "find secrets in code", "audit dependencies", "detect SQL injection", "find XSS vulnerabilities", "check for OWASP issues", "scan for hardcoded credentials", or mentions security analysis of code.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.