Skills
99,719 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Build and maintain interactive Node.js/Bun CLIs with Clack (`@clack/prompts` and `@clack/core`). Use when an AI agent needs to design prompt flows, implement cancellation-safe input handling, add spinners/log/note UX, apply Clack best practices, or generate runnable examples aligned with official Clack docs.
Write and improve CLAUDE.md files following Anthropic best practices. This skill activates when the user says "crear CLAUDE.md", "mejorar CLAUDE.md", "actualizar CLAUDE.md", "revisar CLAUDE.md", "escribir instrucciones del proyecto", "create CLAUDE.md", "improve CLAUDE.md", "review CLAUDE.md", "write project instructions", "optimize docs for Claude", "auditar CLAUDE.md", "audit CLAUDE.md", "limpiar CLAUDE.md", "dead weight", or configures a new repository.
Guide to Cloudflare Email Routing, covering both Email Workers for receiving mail and the send_email binding for sending mail from Workers. Covers dashboard setup with MX, SPF and DKIM records, the email() handler and ForwardableEmailMessage, parsing with postal-mime, composing with mimetext and cloudflare:email EmailMessage, allowlists and blocklists, conditional forwarding, and automatic replies. Documents 8 known issues including Email Trigger not available, unverified destination addresses, Gmail rate limiting, SPF permerror, failed to call worker, and limited free-plan debugging. Use when enabling email routing, writing or configuring an Email Worker, sending notifications or alerts from a Worker, parsing incoming email, configuring MX records, or troubleshooting mail that is not forwarding or delivering.
Cloudflare Zero Trust Access authentication for Cloudflare Workers applications. Covers hono-cloudflare-access middleware setup, manual Access JWT validation with public key caching, service tokens for machine-to-machine auth, CORS handling in front of Access, identity providers (Azure AD, Google Workspace, Okta, GitHub), role-based access control, geographic restrictions, multi-tenant configurations, and Access policy setup. Prevents eight common errors including blocked CORS preflight requests, key cache race conditions, missing JWT headers, and dev/prod team mismatches. Use when protecting Worker routes or admin dashboards with Access, validating Access JWT claims, authenticating backend services or CI/CD jobs to a Worker API, or debugging blocked preflight requests, a missing Access JWT header, or team mismatch errors.
H3 prompt writing for a co-op two-player game main menu/intro: style and identity locks, first-frame confirmation prompt, and a 15s menu interaction timeline video prompt. Applies to game concept showcase prompts. Not for playable projects or complex multi-page UI specs.
Use when reviewing git changes, Review Gate, merge ready, pre-release audits, and quality gates for code, docs, configuration, and scripts. Outputs a structured Pass or Reject conclusion, issue severity levels, a minimum verification matrix, an evidence chain, and a re-check baseline; triggers when the user mentions review, code review, audit, review gate, merge ready, blocker, evidence, pass, reject.
Master effective code review practices to provide constructive feedback, catch bugs early, and foster knowledge sharing while maintaining team morale. Use when reviewing pull requests, establishing review standards, or mentoring developers.
Performs a structured, comprehensive code review of git changes (uncommitted, staged, current branch vs base, a single commit, or a commit range). Detects the stack and architecture automatically, applies stack- and pattern-specific rules, and reports findings by severity. Use when the user runs /code-review or /review-pr, or asks to “review my changes”, “review PR”, “review this branch”, “do a code review”, “revisar minhas mudanças”, “revisar o PR” or “fazer code review”.
Guides secure coding and security-focused code review across languages and infrastructure—OWASP-oriented vulnerability patterns (injection, XSS, auth, crypto, deserialization, SSRF, XXE), secrets handling, and IaC security (Terraform, Kubernetes, Docker, GitHub Actions). Use when writing or reviewing code that handles user input, authentication, files, databases, network requests, cryptography, or infrastructure config—or when the user asks to check for SQL injection, XSS, SSRF, hardcoded secrets, OWASP issues, Terraform security, or GitHub Actions security. Not for authorized penetration test engagements (ai-redteam, cybersecurity), compliance program mapping (compliance-engineer), YARA/malware rules (yara-rule-authoring), or CI pipeline setup only (devsecops).
Scan code for security issues: dependency vulnerabilities (npm/pip audit), secret leaks (regex and entropy analysis), and OWASP anti-patterns like SQL injection, XSS, or command injection. Use when the user mentions security scans, vulnerability detection, secret leaks, API keys, OWASP, npm audit, pip-audit, hardcoded passwords, or code security checks.
Shared vocabulary for designing deep modules. Use when the user wants to design or improve a module's interface, find deepening opportunities, decide where a seam goes, make code more testable or AI-navigable, or when another skill needs the deep-module vocabulary.
Build and query architecture-aware code search, dependency graphs, call flows, impact analysis, and belief maps for Python, TypeScript, TSX, Rust, C#, Java, Go, Ruby, and Ruby on Rails repositories. Use before non-trivial code changes to find module boundaries, blast radius, architecture violations, and the minimal source files to read.
Iterative code review and planning discussion between the local agent and Codex CLI. Orchestrates an automatic back-and-forth debate where both agents discuss findings, architecture decisions, or implementation plans until reaching consensus. Codex CLI runs READ-ONLY and never modifies files; model and reasoning effort come from the user's local Codex config. Supports plan mode: when the local agent has a plan ready, Codex evaluates and iterates on it before implementation, producing an updated consensus plan. Use when the user asks to review with codex, analyze with codex, discuss code with codex, iterate with codex, consult codex, ask codex, review the plan with codex, validate plan with codex, or any Codex CLI request for code review, architecture review, plan review, or implementation strategy. Does NOT trigger on non-code topics like diet, fitness, writing, life decisions, or general strategy; use codex-discuss for those.
A complete workflow that turns descriptive text into comic pages. Supports two styles, sketch (black-and-white line art) and colored (color comics), reads text from direct input or files (.docx, .txt), allows editing individual pages after generation, and outputs the final result as a PDF document.
Use when reviewing commercial lease terms, structuring net/triple-net/modified-gross deals, evaluating renewal options, analyzing TI and free rent, advising on landlord-tenant rights, or preparing VTS-style approval memos with tenant profile and accretive/dilutive NER conclusions.
Integrate and maintain Commet billing with the installed Node, Python, Go, Java, or PHP SDK and the Next.js, AI SDK, Better Auth, or CLI integrations. Use for subscriptions, usage, seats, checkout, customer portal, webhooks, feature access, payments, migrations, errors, or any repository that imports a Commet package. Resolve the version-matched installed documentation before editing and use doctor evidence when the local Commet CLI is available.
AUTOMATICALLY invoke this skill whenever git commit is needed - no user request required. Direct git commit will FAIL validation. This skill contains required pre-commit setup. Triggers: "커밋해", "커밋 ㄱㄱ", "커밋 만들어줘", "커밋 찍어줘", or ANY situation requiring git commit.
Drafts messages, creates and verifies signed commits, and preflights authorized direct or GitHub PR publication. Use for message drafts, new commits, or their delivery. Excludes history amendment and existing merge, rebase, cherry-pick, or revert operations.
Use when analyzing competitor brands to find visual or positioning white space before making identity decisions, such as auditing competitor colors, typography, logos, imagery, and voice, or building a perceptual map. Keywords - competitive audit, competitor analysis, visual landscape, differentiation, white space, perceptual mapping, zig when others zag.
Produce a structured competitive analysis for any product or market. Use when asked for a competitor analysis, competitive teardown, market comparison, SWOT, or positioning map. Generates a structured teardown with positioning map, feature comparison, messaging gaps, and strategic recommendations. For a full landscape doc with feature matrix and win/loss analysis use competitive-analysis instead.
Strict verification discipline for completion claims: do not claim tests passed, a fix works, or a task is complete without fresh evidence from commands or checks run in the current turn; label unavailable checks as pending and state the exact action required. Referenced by PDCA verification stages via staged-review-flow and host workflows. Triggers: “completion requires evidence”, “verification evidence discipline”, “verify before claiming completion”, “completion evidence” / completion evidence discipline, fresh verification evidence. An opened-UI pass claim must cite a non-empty image saved this turn. Do not use as a standalone product workflow.
Generate a prioritised compliance checklist for GDPR, SOC 2, ISO 27001, FCA, HIPAA, or other frameworks with a gap analysis. Use when asked for a compliance checklist, gap analysis, readiness assessment, or audit preparation for any regulatory framework. Produces a structured checklist with prioritised gaps, quick wins, and evidence requirements. Optimised for Opus 4.7 and newer models. Not a substitute for legal or compliance professional advice.
Inspect, capture, create, and refine graphics in an open Singular Composer session, including composition elements, control nodes, layouts, timeline animations, and composition scripts. Use when AI needs to control Composer, verify graphics and runtime behavior, or respond to generate improvement handoff with retrospective feedback on user corrections; the retrospective requires no paired session.
Check and configure cache-busting strategies for Next.js and Vite projects. Use when configuring content hashing for Next.js or Vite builds, setting up CDN cache headers for Vercel or Cloudflare, adding build verification scripts for hashed assets, or auditing static asset caching strategy. Natural triggers: "configure cache busting", "set up CDN cache headers", "add content hashing".
Transform long-form content into 15+ platform-ready assets. Use when repurposing a blog post, article, or guide into social media content. One piece becomes threads, carousels, audiograms, video scripts, quizzes, and discussion prompts across all major platforms.
When the user wants to plan a content strategy, decide what content to create, or figure out what topics to cover. Also use when the user mentions "content strategy," "what should I write about," "content ideas," "blog strategy," "topic clusters," or "content planning." For writing individual pieces, see copywriting. For SEO-specific audits, see seo-audit.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.