Skills
99,719 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Generates comprehensive GitHub activity reports across all authenticated accounts. Gathers repos, PRs, features, and themes for configurable time periods (1/5/7/30/90 days). Produces shareable markdown with tables, mermaid charts, and executive summaries. Can create a private repo with GitHub Actions automation and GitHub Pages aggregation site. Use when: "github report", "work report", "activity summary", "what did I work on", "gh-work-report", "show my github activity".
Smart Git batch-commit shortcut. Trigger words: "git 提交", "批量提交", "拆分提交", "整理提交", or when the user explicitly wants to split staged changes into multiple focused commits. Only handles commit splitting and commit message generation; branch, PR, push, merge and Issue-closing semantics follow git-workflow. After the commit completes, if the repository has skill-publish-sync or subtree-publish configuration, or is registered in this skill's config/subtree-repos.yaml (which customizes trigger timing and push commands per repository), this skill will prompt whether to publish the affected version-updated skills to ClawHub/SkillHub or push the standalone subtree repository — all such publish/push actions require explicit user confirmation.
Generate conventional commit messages automatically. Use when user runs git commit, stages changes, or asks for commit message help. Analyzes git diff to create clear, descriptive conventional commit messages. Triggers on git commit, staged changes, commit message requests.
Git create MR. Use this skill when the user asks to create an MR, merge request, merge into a certain environment/branch, or any operation involving MR creation. Also applies to colloquial phrasings such as "make an MR", "submit a merge request", "merge to test", "merge to develop", "merge to production", "merge to the test environment", "merge to the development environment", "merge to the staging environment".
Add, audit, or fix GitHub Copilot repository custom instructions — `.github/copilot-instructions.md` (repo-wide) and `.github/instructions/*.instructions.md` (path-specific) — so Copilot Chat, Copilot code review, and the Copilot coding agent all pick up project-wide guidance. Also covers `AGENTS.md`, `CLAUDE.md`, and `GEMINI.md` as alternate agent instruction files. Use when the user says "add Copilot instructions", "set up copilot-instructions.md", "audit our Copilot config", "make Copilot follow our conventions", "configure Copilot code review", "add path-specific Copilot rules", "applyTo glob", "excludeAgent", "Copilot is ignoring our guidance", or invokes /github-copilot-repo-instructions. Do NOT use for personal (per-user) Copilot instructions — that is /github-copilot-personal-instructions. Do NOT use for opinionated generation aligned with this project's opinionated engineering principles — that is the setup mode of the multi-mode Copilot driver, `/copilot setup` (if installed).
Use when refactoring existing code toward a known GoF pattern — phrases like "refactor this to use Strategy", "extract a Decorator from these flags", "this switch should be State", "replace conditional with polymorphism", "introduce a Factory here". Sequences small behavior-preserving refactor steps and links to the destination pattern skill.
Google Workspace CLI for agents. Use gog to access Gmail, Calendar, Drive, Contacts, Tasks, Sheets, Docs, Slides, Forms, Chat, and more. Triggers on: 'check my email', 'what's on my calendar', 'search gmail', 'list calendar events', 'send email', 'check tasks', 'search drive', 'list contacts', 'create event', 'upload to drive', 'read spreadsheet', or any Google Workspace task.
Generate or edit raster images through the user's ChatGPT subscription and save or preview workspace PNGs. Use for text-to-image, local-reference generation, edits, follow-up revisions, transparent PNGs, variants, multi-image batches, or subscription-backed setup in Codex, Claude Code, Google Antigravity, and compatible local agents. Preserve direct prompts verbatim; develop distinct per-output prompts when the user delegates multiple concepts. Attach actual reference files. Use subscription-native OpenAI image_gen when available; otherwise use Codex CLI with ChatGPT sign-in. Never use the Images API, OPENAI_API_KEY, API-key login, or a different provider's image generator.
Observability visualization with Grafana and LGTM stack. Dashboard design, panel configuration, alerting, variables/templating, and data sources. USE WHEN: Creating Grafana dashboards, configuring panels and visualizations, writing LogQL/TraceQL queries, setting up Grafana data sources, configuring dashboard variables and templates, building Grafana alerts. DO NOT USE: For writing PromQL queries (use /prometheus), for alerting rule strategy (use /prometheus), for general observability architecture (use senior-software-engineer with infrastructure focus). TRIGGERS: grafana, dashboard, panel, visualization, logql, traceql, loki, tempo, mimir, data source, annotation, variable, template, row, stat, graph, table, heatmap, gauge, bar chart, pie chart, time series, logs panel, traces panel, LGTM stack.
A guided interview to challenge and validate QA automation plans, test strategies, and framework designs before implementation. Use when the user wants to validate a test architecture, challenge a testing decision, prepare an AI-assisted testing rollout, or uses any "grill" trigger phrase (grill my test plan, audit my QA automation framework, challenge my QA strategy, review my test architecture).
Use when designing or reviewing a user-facing GUI and the goal is to reduce first-use cognitive load, clarify the primary path, improve discoverability and feedback, prevent errors, ensure accessibility, and ground decisions in established HCI and usability theory.
H3 prompt writing for 15-second videos blending hand-drawn glowing animation with live-action footage: real contact, continuous morphing, and slightly delayed follow-cam, outputting a single integrated prompt in the user's language. Applies to single-scene creative film prompts. Not for polished CG, horror jump scares, or multi-scene hard-cut notes.
Proactively harden a cloud account or organization before an incident — prioritizing IAM and identity risk over checkbox findings, closing the exposures that become attack paths (public storage, over-broad roles, missing audit logging, unencrypted data), reading CSPM output critically, and enforcing guardrails at the org level. Use when reviewing a cloud environment's security posture, triaging a Prowler/ScoutSuite/Security Hub report, deciding which misconfigurations actually matter, or setting preventive controls across AWS, Azure, or GCP.
Build type-safe APIs with Hono - fast, lightweight routing for Cloudflare Workers, Deno, Bun, and Node.js. Set up routing patterns, middleware composition, request validation (Zod/Valibot/Typia/ArkType), RPC client/server with full type inference, and error handling with HTTPException. Use when: building APIs with Hono, setting up request validation with schema libraries, creating type-safe RPC client/server communication, implementing custom middleware chains, handling errors with HTTPException, extending context with custom variables, or troubleshooting middleware type inference issues, validation hook confusion, RPC performance problems, or middleware response typing errors.
The html skill owns creating and revising durable, standalone HTML artifacts: a complete self-contained index.html saved in a requested or generated artifact directory, with inline dependencies, accessible structure, loopback serving, and exact-file verification. It triggers when a user asks to create, build, turn content or data into, save, revise, or update a “durable HTML artifact,” “one-file dashboard,” “single-page local artifact,” or named HTML artifact, or explicitly says “use /html” or “activate the HTML skill.” It does not trigger for integrating HTML into React or Next.js routing, reviewing or explaining HTML or accessibility, browser-based QA of an existing page, converting Figma designs into reusable components, or merely serving an existing dist directory.
Manage CloudRobo model training tasks and simulation reinforcement learning (SimRL) tasks — create pretrain (TRAIN_FROM_SCRATCH) and finetune (MODEL_TUNING) tasks with FFT/SFT/LORA/QLORA/DEEPSPEED methods; manage the full task lifecycle (create/read/update/delete/stop/restart/resume/draft); save and resubmit draft configs; count tasks by status; monitor execution stages, resource usage, training logs, signed URLs, and events; diagnose failures. SimRL tasks (simulation reinforcement learning) are managed via the same CLI with a --sim-rl flag and cover the same CRUD + lifecycle + monitoring surface (except resume, which is train-only). Triggers include: model training, fine-tuning, pretraining, training task, training stages, resource usage, training logs, training events, draft task, restart training, stop training, resume training, task stats, simulation reinforcement learning, SimRL, 仿真强化学习, 模型训练, 模型微调, 训练任务, 训练阶段, 资源使用, 训练日志, 训练事件, 草稿任务, 重启训练, 克隆训练, 停止训练, 续训训练, 任务统计.
Use when managing secrets, credentials, encryption keys, certificates, or any sensitive data on Huawei Cloud. Covers CSMS (Cloud Secret Management Service) for secret lifecycle management, KMS (Key Management Service) for encryption key management, rotation diagnosis, and KMS key usage auditing via CTS (Cloud Trace Service). Service keywords: dew, kms, csms, cts, secretsmanager, secrets manager, cloud secret management service, key management service, data encryption workshop, data encryption service, DEW service, KooCLI, 数据加密服务, 密钥管理服务, 凭据管理服务, DEW, KMS, CSMS, CTS, 密钥, 凭据, 加密, 轮转. Provides 10 huawei_* actions: huawei_list_csms_secrets, huawei_describe_csms_secret, huawei_list_csms_secret_versions, huawei_list_kms_keys, huawei_analyze_dew_rotation, huawei_analyze_dew_key_usage, huawei_create_kms_key, huawei_enable_csms_secret_rotation, huawei_update_csms_secret_version, huawei_delete_kms_key. Triggers include: "secret","credential","API key","token","password","encrypt","decrypt","KMS","CSMS","DEW","secretsmanager","certificate","CSR","rotation","密钥","凭据","加密","轮转","数据加密","访问密钥","加密密钥". Activates for ANY task involving secrets or credentials — load this skill before touching secrets.
Remove signs of AI-generated writing from text. Use when editing or reviewing text to make it sound more natural and human-written. Based on Wikipedia's comprehensive "Signs of AI writing" guide. Detects and fixes patterns including: inflated symbolism, promotional language, superficial -ing analyses, vague attributions, em dash overuse, rule of three, AI vocabulary words, negative parallelisms, and excessive conjunctive phrases. Credits: Original skill by @blader - https://github.com/blader/humanizer
Rewrite text so it reads like a real person wrote it, not an AI. Auto-detects Russian vs English and applies the matching rule set. Use when the user asks to humanize text, remove the “AI smell,” de-AI, or make AI output sound natural—especially for Russian. Russian requests count too: очеловечь, перепиши как человек, оживи текст, убери запах ИИ, сделай живее, звучит как робот, убери канцелярит. Also use when asked whether a text was written by AI—нейросеть писала?, похоже на ChatGPT?, видно ли, что это ИИ, человек или бот писал, did AI write this?—then check and report findings without rewriting. While installed, also keep your own Russian and English writing free of the quick-list stock phrases, silently; never edit the user's text unless asked.
Run hypothesis-driven threat hunts across endpoint, network, cloud, and identity telemetry using stack counting, outlier analysis, and ATT&CK-based hypotheses, with SIEM query patterns for Splunk, KQL, and Elastic. Use when proactively searching for undetected compromise, validating an intel report against your environment, or converting a hunch into a repeatable hunt
Implement hybrid search combining vector and keyword retrieval for RAG systems. Use this skill when building RAG retrieval, combining semantic search with BM25, implementing reciprocal rank fusion (RRF), or optimizing retrieval accuracy. Activate when: vector search, keyword search, BM25, semantic search, hybrid RAG, retrieval optimization, search relevance, reranking.
Evidence-based muscle hypertrophy training, nutrition, exercise selection, periodization, recovery, supplements, and progress tracking. Use when Codex needs to build strength-training programs, set volume or RIR targets, choose exercises, troubleshoot plateaus, calculate macros/TDEE, or answer bodybuilding and muscle-growth questions.
End-to-end website audit through ICP eyes. Builds synthetic personas (if they don't already exist), runs a structured scorecard review of the client's site, then runs a head-to-head competitive comparison against top competitors. Produces a single consolidated report with persona feedback, competitive positioning, and prioritized recommendations. The complete "how do our buyers actually experience our site vs the competition?" workflow.
Develop a premise for a Chinese web novel. Use when the user wants to choose a genre, find a hit concept, distill a one-line hook, design the opening three chapters, or validate a novel idea’s market potential. Produces a ready-to-write concept plan (platform category + genre + cheat ability + hook + opening strategy).
Uses Calico's own policy CRDs beyond the upstream Kubernetes API - GlobalNetworkPolicy, HostEndpoint, NetworkSet, policy tiers, and DNS-based egress rules - applied and audited with calicoctl. Use when a policy must span namespaces or protect the host itself, when egress has to be expressed by domain name, or when ordering policies into tiers. Keywords: calicoctl, GlobalNetworkPolicy, HostEndpoint, NetworkSet, tier, DNS egress, order. Do not use for portable upstream NetworkPolicy - use implementing-network-policies-for-kubernetes; for installing Calico and writing standard policy with it use implementing-kubernetes-network-policy-with-calico.
Guides zero trust implementation across AWS, Azure, and GCP per NIST SP 800-207 and BeyondCorp principles, covering identity-centric access, micro-segmentation, continuous verification, device trust assessment, and Identity-Aware Proxy deployment. Use when migrating from perimeter security to identity-centric access, removing VPN dependency, or designing micro-segmentation for multi-cloud workloads.
Set up PostHog in a user's GitHub repository from a chat, without a terminal. Wizard, PostHog's setup agent, runs in the cloud, adds the SDK and first events, and opens a pull request. Use only when you can't read or edit the user's code, which is common in web chat apps such as ChatGPT on the web or Claude on the web. Typical requests: install, add, or set up PostHog in their app or repository, or open a pull request that adds PostHog. When you're working in the user's repository, use installing-posthog-in-a-codebase instead. Covers connecting GitHub, picking the repository, starting the run, polling it, and sharing the pull request.
Internal network information gathering and topology mapping. Use after breaching the boundary and obtaining an internal foothold. Covers live host discovery, port scanning, service identification, and locating key infrastructure (domain controllers/databases/mail/file servers). The first step of internal penetration testing — read the map before acting
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.