Skills
99,951 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Runs FASTQ-to-VCF germline and somatic variant calling via the Nextflow nf-core/sarek pipeline pinned to -r 3.10.0 — builds the samplesheet.csv (patient, sex, status, sample, lane, fastq_1, fastq_2), runs bwa-mem/bwa-mem2/dragmap alignment plus GATK4 MarkDuplicates and BQSR against the GATK GRCh38 resource bundle (dbSNP, Mills/1000G indels), and selects callers — explicitly correcting that sarek defaults to Strelka when --tools is unset (pass haplotypecaller for GATK best practice or deepvariant for CNN accuracy), with a non-Nextflow manual GATK4 fallback. Use when the user wants a variant-calling pipeline, FASTQ to VCF, germline or somatic SNV/indel calling, nf-core/sarek, GATK best-practices alignment-to-VCF, or BQSR/HaplotypeCaller/Mutect2/DeepVariant; annotate hits with alterlab-clinvar/alterlab-gnomad/alterlab-cosmic, parse VCFs with alterlab-pysam, store at scale with alterlab-tiledbvcf. Part of the AlterLab Academic Skills suite.
Designs validated research data-capture instruments and aligns them to CDISC submission standards. Builds REDCap projects from a requirements spec: instrument and field design, the 18-column data dictionary (Variable/Field Name, Form Name, Field Type, Choices, Branching Logic, Text Validation, Identifier?), field validation (date_ymd, integer, number, email, phone), branching/show-field logic, longitudinal events and survey settings, and lints a data dictionary for common errors. Maps a study to CDISC: CDASH collection fields, SDTM domain mapping (special-purpose DM; Events AE, MH; Findings VS, LB; Interventions EX, CM), and NCI-EVS controlled terminology. Use when the user wants to build a REDCap project, write or lint a data dictionary, set up branching logic or validation, or map a study to CDISC SDTM/CDASH/CDISC CT. For LabArchives ELN bridging use alterlab-labarchive; for Likert/sampling/reliability use alterlab-survey-design. Part of the AlterLab Academic Skills suite.
Comprehensive one-click analysis of a stock or company. Parallel subagents collect data across five dimensions at once — stock price, news sentiment, industry comparison, market environment, and the company's official website — then the main thread performs cross-analysis, causal attribution, and trend forecasting, and outputs a standardized HTML analysis report (including the day's quotes and a 7-day trend). Trigger phrases: analyze XX stock, analyze TICKER, how is XX doing, is XX worth buying. Supports A-shares, Hong Kong stocks, and US stocks.
Android app penetration testing methodology. Covers APK static analysis (decompilation/code audit/Manifest analysis), dynamic analysis (Frida Hook/SSL Pinning bypass/traffic capture), data storage security, component security (Activity/Service/Provider/Receiver), WebView security, and Root detection bypass. Triggered when an Agent needs to test Android app security, analyze APK files, or bypass app protection mechanisms.
Apidog CLI usage check and version confirmation: use when commands succeed but the client does not show resources, create results cannot be found by list/get, test runs fail, reports are missing, agentHints/help/runtime behavior disagree, or the local CLI may be outdated
Guide for using Argo to create polished product demo videos from Playwright scripts with AI voiceover and animated overlays. Use this skill whenever the user mentions Argo, demo videos, product demos, screen recordings with narration, Playwright video demos, voiceover generation, or wants to automate creating marketing/sales/onboarding videos from a web app. Also use when you see imports from '@argo-video/cli', files named '*.demo.ts' or '*.scenes.json', or an 'argo.config.js' in the project. Even if the user just says "record a demo" or "make a video of my app", this skill applies.
Plan and audit research artifact releases for papers, including code, data, models, configs, checkpoints, scripts, environment files, licenses, and artifact evaluation instructions. Use this skill whenever the user wants to release a paper codebase, prepare an artifact evaluation package, map paper tables to reproduction commands, write release instructions, check whether a repository supports the paper's claims, or package models/data safely. Use reproducibility-audit to test whether results can be reproduced; use this skill to decide what to include and how to present the release.
Attack OAuth 2.0 and OpenID Connect flows — enumerate endpoints from the OIDC discovery document, break redirect_uri validation with path traversal, open-redirect chaining, subdomain and regex weakness, and %2F/@ parser tricks, exploit missing state (callback CSRF) and absent or downgraded PKCE, steal codes and tokens via open redirectors and referer leakage, replay and inject authorization codes across clients, escalate scope and bypass consent, confuse access_token with id_token, and take over accounts through "Sign in with X" email trust and device-code consent phishing. Use when you see /authorize, /oauth/token, response_type, redirect_uri, client_id, code= or state= parameters, a "Sign in with Google/Microsoft/GitHub" button, or an OIDC discovery document at /.well-known/openid-configuration.
Audit work, verify claims with concrete evidence, and explain the result in simple grade-5 language. Use when the user asks to review, audit, check, verify, explain a change or fix, summarize test results, validate whether something works, or translate technical findings into plain language for non-technical readers.
Elite frontend orchestrator — slams the full design stack together for Awwwards-tier, blow-my-mind UI work. Use when the user asks for an elite/premium/showcase/standout/hero/jaw-dropping/portfolio-grade/award-worthy frontend, a landing page that has to wow, a client demo that needs to land, a brand site, a marketing hero, a creative coding piece, an interactive showcase, a Remotion video composition, or any single-shot HTML/React artifact where the bar is craft, not just function. Composes frontend-design + impeccable + ui-ux-pro-max + design-motion-principles + color-expert + color-palette-extractor + agent-browser + remotion-best-practices, plus the proven runtime stack of Framer Motion + anime.js + Three.js + 21st.dev component patterns via the Magic MCP. Triggers on phrases like 'elite', 'blow my mind', 'Awwwards', 'absolutely insane', 'go all out', 'showcase', 'something special', 'don't hold back', 'jaw-dropping', 'wow factor', 'premium feel', 'hero piece', 'pitch deck slide', 'creative coding', and on any request to build a brand site, landing hero, portfolio, demo reel, or interactive artifact where craft outranks shipping speed. NOT for utilitarian admin UI, internal CRUD dashboards, or quick patches — use frontend-design or impeccable alone for those.
Backtest crypto and traditional trading strategies against historical data. Calculates performance metrics (Sharpe, Sortino, max drawdown), generates equity curves, and optimizes strategy parameters. Use when user wants to test a trading strategy, validate signals, or compare approaches. Trigger with phrases like "backtest strategy", "test trading strategy", "historical performance", "simulate trades", "optimize parameters", or "validate signals".
Better Auth — framework-agnostic TypeScript authentication & authorization library. Covers setup, email/password, social OAuth (40+ providers), passkeys, magic links, 2FA, organizations, sessions, plugins, admin, hooks, and security hardening. Use when implementing auth with Better Auth: configuring auth instances, adding providers, setting up database adapters (Prisma, Drizzle, PostgreSQL, MySQL, SQLite, MongoDB), integrating with frameworks (Next.js, Nuxt, SvelteKit, Astro, Hono, Express, Elysia, Fastify, Expo), managing sessions, or extending with plugins.
Systematically review biblical content through a 10-point quality checklist. Works with bible-buddy reference files, any file path, URLs, or text pasted directly in the conversation. Use when asked to review, audit, check, or verify biblical content. Trigger on: "檢查冷知識", "fact check", "檢查經文", "review bible", "幫我檢查這段", "bible-fact-check", or any request to find errors, duplicates, or issues in biblical reference content.
Read-only brainstorming mode for exploring ideas, plans, architecture, debugging approaches, product decisions, research topics, codebase questions, and alternatives without mutating the user's codebase. Use when the user invokes $brainstorm, says "brainstorm", "brainstorming session", "let's think", "explore this", "research only", "read-only", or otherwise asks to discuss before implementation. Remain read-only until the user explicitly asks to implement, edit, write, apply, commit, install, or otherwise change state.
Static analysis security vulnerability scanner for Ruby on Rails applications. Use when analyzing Rails code for security issues, running security audits, reviewing code for vulnerabilities, setting up security scanning in CI/CD, managing security warnings, or investigating specific vulnerability types (SQL injection, XSS, command injection, etc.). Also use when configuring Brakeman, reducing false positives, or integrating with automated workflows.
Build a portable brand-kit.json for the user's product — colors, typography, voice — that other skills (video, ad creative, landing page) can consume. Multiple discovery paths so it works whether the user has access to their site's source code or only a public URL or just a logo image.
Security testing skill for A01:2025 Broken Access Control — the #1 OWASP risk for two consecutive cycles. Use this skill whenever the user asks about: access control vulnerabilities, IDOR (insecure direct object references), authorization bugs, SSRF testing, CORS misconfiguration, privilege escalation, JWT/session manipulation, CSRF protection, or auditing FastAPI/Flask endpoints for missing auth guards. Also trigger when the user says "test my API for access control", "check authorization", "find IDOR bugs", "review permissions", "audit my routes", or mentions CWE-284, CWE-285, CWE-352, CWE-639, CWE-862, or CWE-918.
Build a layered, LLM-friendly documentation system for a project. For existing projects: scan the project structure → classify the architecture → generate the CLAUDE.md main index → base module documentation → business module API/data model/pitfall documentation → configuration documentation → git changelog (with risk assessment + rollback guide) → cross-validation. For new projects: parse the PRD → design the architecture according to scaffolding standards → break requirements down into development tasks → merge with code standards to generate the CLAUDE.md development guide → module-level API design + data models + development checklist. Use when the user needs to create AI programming documentation for a project, establish a project index, sort out code, plan a new project, or mentions llm.txt/CLAUDE.md.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.