Skills
99,064 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Investigate security incidents in Microsoft Azure (resource and subscription control plane) — reconstruct attacker activity from the Azure Activity Log and resource/data-plane diagnostic logs, anchor the investigation on the identity that made the calls (a user, service principal, or managed identity), trace privilege escalation through role assignments, hunt managed-identity token abuse and VM run-command code execution, and detect storage or Key Vault data theft while correlating back to Entra sign-in logs. Use when responding to a suspected Azure resource compromise, anomalous Azure Activity Log entries, a Microsoft Defender for Cloud alert, managed-identity or service-principal abuse, a crypto-mining VM, or storage-account exfiltration.
Investigate a security incident in Google Cloud — establishing what audit logging exists before trusting a gap, reconstructing activity from Cloud Audit Logs, triaging service-account and OAuth abuse, following Security Command Center findings, and scoping IAM and resource changes. Use when responding to a suspected GCP compromise, investigating a leaked service-account key, working a Security Command Center or Event Threat Detection alert, or reconstructing what a principal did across a GCP organization
iOS system-level exploitation methodology. Covers iOS kernel exploitation (UAF/heap overflow/type confusion), Safari/WebKit exploitation, PAC bypass, sandbox escape, the Corellium research environment, and analysis of known CVEs (CVE-2020-27950, CVE-2021-30807, iMessage zero-click). Triggers when an agent needs to analyze iOS system-level vulnerabilities, conduct kernel exploitation research, or understand iOS exploit chains.
Java and Spring Boot security patterns. Covers Spring Security, dependency auditing, secure coding practices, and OWASP for Java ecosystem. USE WHEN: user works with "Java", "Spring Boot", "Spring Security", asks about "Java vulnerabilities", "Maven security", "Gradle security", "Java injection", "Java authentication" DO NOT USE FOR: general OWASP concepts - use `owasp` or `owasp-top-10` instead, Node.js/Python security - use language-specific skills
JavaScript/TypeScript SDK for inference.sh - run AI apps, build agents, integrate with all models. Package: @inferencesh/sdk (npm install). Full TypeScript support, streaming, file uploads. Build agents with template or ad-hoc patterns, tool builder API, skills, human approval. Use for: JavaScript integration, TypeScript, Node.js, React, Next.js, frontend apps. Triggers: javascript sdk, typescript sdk, npm install, node.js api, js client, react ai, next.js ai, frontend sdk, @inferencesh/sdk, typescript agent, browser sdk, js integration
Skill dedicated to a home appliance pitfalls guide. Covers refrigerators and kitchen appliances, air conditioning, underfloor heating and fresh air systems, water heaters and water purification, washing machines and cleaning appliances, TVs, projectors and smart devices, bathroom appliances, and installation markups and after-sales pitfalls across the full process, integrating the highlights of the Xi'an Renovation Classroom member knowledge base in reverse order to help users avoid pitfalls with home appliances with less hassle.
Jimmer ORM development assistant that helps write entity mapping code and DSL queries. Use for: (1) defining or modifying Jimmer entities (interfaces annotated with @Entity); (2) writing Jimmer DSL query code; (3) configuring entity associations (@ManyToOne, @OneToMany, @ManyToMany); (4) using dynamic predicates, dynamic table joins, or implicit subqueries; (5) editing Java/Kotlin files containing Jimmer-related code.
Write a clear, inclusive, and structured job description for any role. Use when asked to write a job description, job posting, JD, or job advert. Produces a complete JD with role summary, responsibilities, requirements, and inclusive language review.
Researches job postings, hiring signals, and freelance gigs via the Crawlora API — Indeed, Google/Amazon/Apple/Meta/Tesla careers sites, any company's ATS board (Greenhouse, Lever, Workday, SmartRecruiters, Ashby, and more), plus Upwork and Fiverr — returning clean JSON. Use when the user wants to search job postings, see what a specific company is hiring for, aggregate hiring signals for a company, or research freelance gigs and sellers.
JSDoc - documentation generator for JavaScript with type annotations. USE WHEN: user mentions "JSDoc", "JavaScript documentation", asks about "documenting JavaScript", "type hints", "jsdoc comments", "API documentation generation" DO NOT USE FOR: TypeScript - use `jsdoc-tsdoc` skill for TypeScript/TSDoc
JUnit 5 testing framework with Mockito integration. Covers unit tests, mocking, and Spring Boot test integration. USE WHEN: user mentions "junit", "java test", "mockito", asks about "@Test", "@Mock", "@InjectMocks", "unit test java", "spring boot test" DO NOT USE FOR: Integration tests with containers - use `testcontainers`; REST API tests - use `rest-assured`; E2E tests - use Selenium; JavaScript/TypeScript - use `vitest` or `jest`
Create production-ready Kubernetes manifests for Deployments, Services, ConfigMaps, and Secrets following best practices and security standards. Use when generating Kubernetes YAML manifests, creating K8s resources, or implementing production-grade Kubernetes configurations.
Behavioral guardrails to prevent common LLM coding mistakes — enforces surgical changes, assumption verification, and scope discipline before and during implementation. Use when implementing features, modifying code, or when you notice yourself about to make changes without reading the existing code first.
Analyzes an app's codebase and cross-references Google Search Console, PostHog, and Google Keyword Planner to identify low-competition keyword footholds and track expansion into adjacent terms. This skill should be used when the user says "keyword wedge", "find keyword opportunities", "seo analysis", "keyword strategy", "find search wedges", "keyword research for my app", "grow organic traffic", "what keywords should I target", "SEO for my app", "organic search strategy", or "how to rank higher". Generates markdown and HTML reports and maintains state across runs for expansion tracking.
Lateral movement techniques. Use when obtained credentials (passwords/hashes/keys/tickets) need to move from the current host to other hosts. Covers SSH, RDP, WMI, PSExec, PTH, PTT, DCOM, and more. Choose the best movement method based on the target operating system and the type of credentials available
Instrument a launch so the traffic spike is ATTRIBUTABLE, not a vanity number — one consistent UTM scheme on every launch link, the conversion funnel (visit → signup → activation) wired into GA4 or the project's existing analytics, and a validate + read-out step. Writes the UTM map + event plan to `.ulpi/launch/<channel>/analytics.md`, parameterized by launch source (e.g. producthunt, hackernews) so each link and report is correctly attributed. Shared measurement block of the launch-* family — invoked by the per-platform runners (`launch-product-hunt`, `launch-hacker-news`, `launch-x`, `launch-linkedin`) to close the loop, or run standalone. Measures durable outcomes (signups, activation), extends the real stack, and NEVER puts PII in links or events. Use when a launch needs UTMs on every link and signup tracking, not just an upvote count.
Draft the copy a launch needs, in multiple angles, all bound to the REAL product — never generic placeholders. Produces taglines/headlines, one-liners, short and long descriptions, and the launch post / first comment in feature-led, benefit-led, comparison, and audience-led versions with one recommended each. Reads and reuses `.ulpi/launch/positioning.md` (the platform-agnostic product brief) so the product is described once and reused everywhere; grounds via the `browse` skill + repo when it's absent. Honors the caller's **asset profile** — hard character limits, voice, and compliance rules — to the letter. Shared copy block of the launch-* family, feeding the per-platform runners' posts (`launch-product-hunt` listing, `launch-hacker-news` Show HN, `launch-x` / `launch-linkedin` threads) or run standalone; writes to `.ulpi/launch/<channel>/copy.md` or hands drafts back. Use when a launch needs on-brand, within-limit copy grounded in one real product.
Prepare and run a product/company launch on LinkedIn end to end — the launch link goes in the FIRST COMMENT, not the post body, and you never edit the post right after publishing. Grounds in the real product, then writes a paste-ready package to `.ulpi/launch/linkedin/`: `POST.md` (the launch **post** — a strong hook in the first ~2 lines before the "…see more" cut, a skimmable body, the reach-earning format, hashtags, and the product link as the **first comment**), `PLAN.md` (timing, the **golden-hour** engagement runbook, team amplification, and the post-launch plan), and `CHECKLIST.md` (a blocking pre-flight gate). The LinkedIn runner of the launch-* family: it owns LinkedIn mechanics, format rules, and the gate, and composes the shared `launch-copy` (post copy), `launch-outreach` (team amplification, mode `linkedin`), and `launch-analytics` (UTM + conversion tracking), degrading to built-in fallbacks if a companion isn't installed. Reads the shared `.ulpi/launch/positioning.md`. Engagement asks to your network and team are fine (no vote-ring rules), but it avoids what LinkedIn penalizes — a link-preview card in the body, engagement-bait, pods, and an early edit. Use when the user wants a LinkedIn launch post written and launch day planned.
Build and notify a launch's supporter audience with paste-ready, platform-COMPLIANT outreach — the messages you send to PEOPLE, never the on-listing copy. Recruits an audience before launch, segments it (team · friends · users/waitlist · communities · public followers), and notifies it in timed waves on the day. Drafts the teaser DMs, waitlist and launch-day emails, community heads-ups, 1:1 DMs, and X/LinkedIn amplification posts, and writes them to `.ulpi/launch/<channel>/OUTREACH.md`. Parameterized by a per-platform COMPLIANCE MODE the caller passes (Product Hunt: supporter waves allowed, ask for feedback not upvotes; Hacker News: NO vote mobilization at all); grounds every message in `.ulpi/launch/positioning.md` and NEVER solicits/incentivizes votes or mass-spams. Shared audience block of the launch-* family, invoked by the per-platform runners (`launch-product-hunt`, `launch-hacker-news`, `launch-x`, `launch-linkedin`) or run standalone. Use when a launch needs who-to-tell and what-to-say, compliant to each platform's rules.
Investigate, document, or change an unfamiliar legacy codebase using local repository maps, scoped source context, and verified evidence. Use for undocumented internal frameworks, cross-module behavior, large repositories, or source files too large to read or refactor in one pass; a known-file edit or single-symbol search usually needs only direct search
Product PRD generation tool. Combining the product storytelling methodology of 《创造》, the positioning framework of product-position, and the PRD best practices of Lenny's Newsletter, it helps you turn an idea into an actionable product requirements document. Triggers: /li-prd, "help me write a PRD", "generate a requirements document", "write a product doc", "turn this idea into a PRD", "hackathon PRD", "organize product requirements", "I'm about to start building, help me clarify the requirements". Even if the user doesn't say "PRD", this skill should trigger whenever they want to turn a product idea into an actionable document. DO NOT trigger for: content creation tasks such as content script generation, topic analysis, or data review.
Use when selecting, replacing, pinning, or auditing an Arduino, ESP32, RP2040, C++, or vendor-framework library. Compare architecture support, framework and version compatibility, API behavior, footprint, maintenance, provenance, security, and hardware assumptions before installation.
Plans LinuxMirrors Docker Engine installation, Docker CE package source changes and Docker Registry Mirror configuration for Linux hosts, covering version selection, existing installations, registry-only changes, multiple mirror addresses, daemon.json merging, service verification and rollback. Use when the user mentions docker.sh, DockerInstallation.sh, Docker pull acceleration or `--only-registry`; do not use this skill for ordinary system package source changes.
Structure and write a literature review for any research topic. Use when asked to write a literature review, systematic review summary, narrative review, or research background section. Produces a structured review with thematic organisation, critical analysis, and gap identification.
Tactical LLM-friendly site optimization for making a website the best citable answer for AI assistants and RAG retrieval. Use for auditing and optimizing sites such as mlllm.io for llms.txt, AI citation readiness, pillar pages, direct-answer blocks, TL;DR sections, FAQ/schema, article/news schema, topic-to-URL matrices, external citation signals, weekly LLM citation monitoring, and content architecture for ChatGPT, Claude, Perplexity, Gemini, Copilot, Google AI features, Bing, Brave, and other assistant/search retrieval systems.
Access Claude, Gemini, Kimi, GLM and 100+ LLMs via inference.sh CLI using OpenRouter. Models: Claude Opus 4.5, Claude Sonnet 4.5, Claude Haiku 4.5, Gemini 3 Pro, Kimi K2, GLM-4.6, Intellect 3. One API for all models with automatic fallback and cost optimization. Use for: AI assistants, code generation, reasoning, agents, chat, content generation. Triggers: claude api, openrouter, llm api, claude sonnet, claude opus, gemini api, kimi, language model, gpt alternative, anthropic api, ai model api, llm access, chat api, claude alternative, openai alternative
Run this repository's local CI parity commands and `pnpm run ci:local` jobs. Use when validating a change against the same job shapes used in GitHub Actions, choosing the smallest local CI job for a package, workflow, E2E, Metro, devtools, bundle-size, or build-and-test change.
Activate when the user needs to understand extreme events (bubbles, crashes, mass hysteria, cults, mob behavior), diagnose systemic organizational failure, or assess the risk of multiple psychological, market, or institutional forces stacking in the same direction at once. Typical trigger signals: the phenomenon the user describes is "far beyond what any single factor could explain"; the user tries to explain an extreme outcome with a single cause; the user worries that "multiple adverse factors will erupt at the same time." Not applicable to routine single-factor decision analysis or gradual incremental change assessment.
Periodic pass that keeps a project's verification skill and feature map honest: parallel source readers per feature, one live session driving every feature, at most one PR of proven corrections. Use for /maintain-verification-skill or "audit the verify skill".
CRITICAL: Use for Makepad 2.0 animation system. Triggers on: makepad animation, makepad animator, Animator, AnimatorState, hover effect, makepad transition, animation state, Forward, Snap, Loop, ease function, makepad animate, timeline, snap(), default @off, animation group, 动画, 过渡, 悬停效果, 动画状态, 缓动函数
CRITICAL: Entry-level skill for Makepad 2.0 GUI development. This is the FIRST skill to load for any Makepad task — it provides design judgment anchors ABOVE the other 13 Makepad 2.0 skills. Triggers on: makepad, makepad app, makepad project, makepad design, live_design!, app_main!, script_mod!, Cx, WidgetRef, Widget, makepad-widgets, makepad architecture, makepad how to, "how should I", "should I use", "what's the best way", makepad 架构, makepad 设计, makepad 怎么做, makepad 最佳实践, 组件拆分, 状态管理, 数据流, 渲染思维
CRITICAL: Use for migrating from Makepad 1.x to 2.0. Triggers on: makepad migration, live_design to script_mod, makepad upgrade, makepad 1.x, old syntax, new syntax, makepad breaking changes, makepad 迁移, 旧语法, LiveHook to ScriptHook, apply_over to script_apply_eval, Live to Script, live_design!, angle brackets to curly braces
CRITICAL: Use for Makepad 2.0 Vector graphics widget. Triggers on: makepad vector, Vector widget, SVG path, makepad path, makepad circle, makepad gradient, makepad tween, vector animation, Gradient, RadGradient, Filter, DropShadow, Group transform, vector drawing, inline SVG, 矢量图形, SVG, 路径, 渐变, 矢量动画
Development guidelines and patterns for building React component libraries with Mantine UI, TypeScript, and modern tooling. Use this skill when creating, editing, or maintaining Mantine-based React components, implementing Styles API patterns, managing component composition, or working with TypeScript-safe component factories.
When the user wants to optimize markdown strategy, price optimization for clearance, or minimize inventory markdowns. Also use when the user mentions "markdown," "clearance pricing," "price elasticity," "promotional pricing," "discount optimization," "sell-through," "inventory liquidation," or "dynamic pricing." For initial allocation, see retail-allocation. For promotional planning, see promotional-planning.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.