Skills
99,064 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Complete reference for the ffuf fuzzing tool. Used for directory/file discovery, parameter fuzzing, virtual host enumeration, POST data fuzzing, and multi-position fuzzing. Use when you need path brute-forcing, parameter discovery, or subdomain enumeration on web applications. More flexible than gobuster/dirsearch — supports multiple FUZZ positions and custom filtering. Use this skill for any scenario requiring brute-force enumeration of web paths or parameters
Plan user flows and screen states for a Figma design before any designing starts. Use when asked to plan a user flow, map out screens for a feature, define screen states, plan a Figma file structure, or work out what needs to be designed before opening Figma. Produces a complete flow map with all screens, states, entry/exit points, and a suggested Figma page structure.
How to find, build, and run tests in workerd. Covers wd-test, kj_test target naming, bazel query patterns, and common flags. Also covers parent project integration tests if workerd is used as a submodule. Load this skill when you need to locate or run a test and aren't sure of the exact target name or invocation.
Persist flaker's DuckDB storage across GitHub Actions runs and feed it from multiple sources (vitest reports, custom adapter reports, etc.). Use when wiring `@mizchi/flaker` into a new repo's CI, adding a new ingest source to an existing flaker setup, or debugging why `flaker apply` / `flaker run --gate ...` "lost its history" between runs. Encodes the cache key shape, fetch-depth requirements, `--changed` derivation, and the import-step placement that internal flaker users converged on.
Comprehensive Flutter API reference guide covering widgets, Material Design, Cupertino, animations, gestures, navigation, state management, and platform integration. Use when developing Flutter applications and needing detailed API knowledge for widgets, layout, styling, animations, platform channels, or any Flutter SDK functionality. Essential for building cross-platform mobile, web, and desktop applications with Flutter.
Generic contract/schema boundary audit across authoring, discovery, validation, and execute—detecting split-brain between listings and invoke paths, gateway divergence, and permissive placeholders. Use when changing tool registration, RPC/plugin registries, dynamic tools, MCP or WebMCP surfaces, CLI exec aliases, OpenAPI or JSON Schema contracts, migrators/codegen, bridge argument encoding, or platform docs that describe API contracts.
Use when assessing code quality hygiene — TypeScript strictness, lint violations, dead code, and duplication. Runs `audit-typescript.sh`, `audit-lint.sh`, `audit-similarity.sh`. Does NOT cover dependency freshness or CVE audit — use `frontend-review-deps` for that.
Use when reviewing React rendering performance — profiler-first diagnosis, memo/useCallback/useMemo correctness, virtual scroll, useTransition/useDeferredValue, and canvas/WebGL separation for data-heavy UIs. Covers checklist 24-rendering-performance.md.
Comprehensive intranet scanning and exploitation with fscan. When you have an intranet foothold and need host discovery, port scanning, weak credential brute-forcing, or vulnerability detection, fscan is the first choice — a single zero-dependency binary that completes the full host discovery + port + service + weak credential + POC workflow in one command. It also supports post-exploitation operations such as Redis public key/scheduled task writing, SSH command execution, MS17-010 exploitation, Pass-the-Hash, and WMI remote execution. Use this skill for any scenario involving intranet scanning, subnet probing, bulk weak credential detection, intranet vulnerability scanning, domain controller identification, or NetBIOS probing. Even if you just want a quick look at which hosts are alive on a subnet, prefer fscan over nmap
Use for game development tasks: new games, gameplay design, features, fixes, and playtesting. Research comparable games before choosing new mechanics, inspect actual gameplay, and verify changes by playing through real controls. Keep small fixes within the existing design.
Operate the joelclaw gateway daemon — the always-on pi session that receives events, notifications, and messages. Use the joelclaw CLI for ALL gateway operations. Use when: "restart gateway", "gateway status", "is gateway healthy", "push to gateway", "gateway not responding", "telegram not working", "messages not going through", "gateway stuck", "gateway debug", "check gateway", "drain queue", "test gateway", "stream events", or any task involving the gateway daemon.
Break down a PRD + Technical Design Document into an ordered backlog of implementable specs, each ready to start a Spec-Driven Development (SDD) cycle. Use when the user asks to break down, decompose, or turn a PRD/technical design into a backlog, roadmap, feature list, or list of specs to implement.
Use when the user asks to commit changes, organize commits, write commit messages, or split working-tree changes into Conventional Commits. Trigger on phrases like "commit my changes", "커밋해줘", "커밋 분리", "make commits", "/git-commit", "$git-commit", or whenever the user wants to turn current changes into Conventional Commit-style commits. For commit + push use `git-commit-push`; for rewriting non-Conventional commit history use `git-commit-rewrite`.
Use when the user asks to commit working-tree changes AND push to the remote. Trigger on phrases like "commit and push", "커밋하고 푸시해줘", "/git-commit-push", "$git-commit-push", or "push my commits". Runs the git-commit workflow, then `git push` (never `--force`). For commit-only use `git-commit`; for history rewrite use `git-commit-rewrite`.
Sets up and debugs the Crowdin GitHub Action (crowdin/github-action), which syncs a repository with a Crowdin project and opens the translation pull request. Use whenever the user wires Crowdin into GitHub Actions, writes or reviews a .github/workflows/crowdin.yml step, tunes its inputs (upload_sources, download_translations, localization_branch_name, create_pull_request, command), or debugs a run that opened no pull request, opened one that gets no CI checks, or hit a 409 while a build was in progress - including bare phrasings like "automate translations in CI" or "my Crowdin workflow is broken"
Expert Go backend code reviewer specializing in microservices, GORM/DAL patterns, dependency injection, and resource management. Focuses on logic correctness, goroutine leak detection, and Go-specific best practices for production-grade services.
Unified external research for documentation, GitHub code, and package versions. Use when the user needs to look up library docs or API references, search code in a public GitHub repo, check the latest version of a package, verify whether a dependency is deprecated, or any task requiring external knowledge beyond the local codebase and training data.
Unified local codebase search across keyword, structural, and semantic modes. Use when searching a codebase for code patterns, tracing how features work across files, finding structural code issues, answering conceptual questions about a codebase, or exploring unfamiliar projects. Do not use for external library docs or GitHub searches.
Use only when the user explicitly names grill-me or explicitly asks for an interactive grilling of a plan, decision, or idea. Stress-test the decision by resolving facts from available evidence, asking one unresolved decision-changing question at a time, and stopping when no material branch remains; do not implement the plan.
Grilling session that challenges your plan against the existing domain model, sharpens terminology, and updates documentation (CONTEXT.md, ADRs) inline as decisions crystallise. Use when user wants to stress-test a plan against their project's language and documented decisions.
Apply the grug brain philosophy to software development - fight complexity, prefer simplicity, and build maintainable code. Use when the user asks to "simplify this code", "is this too complex", "should I abstract this", "review for over-engineering", "grug brain", "keep it simple", or when reviewing code for complexity issues, making architectural decisions, or refactoring code to reduce complexity.
Guo Degang's thinking framework and way of expression. Based on deep research across 9 dimensions (including original-text analysis of 3 first-hand works plus 6 dimensions of web research) and 80+ first- and second-hand sources, distilled into 6 core mental models, 10 decision heuristics, and a complete expression DNA. Purpose: to serve as a thinking advisor, analyzing problems, reviewing decisions, and providing feedback from Guo Degang's perspective. Use when the user mentions "from Guo Degang's perspective", "what would Guo Degang think", "Guo Degang mode", or "guodegang perspective". It should also trigger even if the user only says "help me think from Lao Guo's angle", "what would Guo Degang do", or "switch to Guo Degang".
A Pythonic interface to the HDF5 binary data format. It allows you to store huge amounts of numerical data and easily manipulate that data from NumPy. Features a hierarchical structure similar to a file system. Use for storing datasets larger than RAM, organizing complex scientific data hierarchically, storing numerical arrays with high-speed random access, keeping metadata attached to data, sharing data between languages, and reading/writing large datasets in chunks.
Produce or consume agent-to-agent handoff context so another session can resume work without re-deriving decisions, state, and next steps. Use when the user invokes $handoff, says "handoff", "hand off", "session handoff", "write a handoff", "resume from handoff", "context for the next agent", or asks to package current work for another AI agent or later session.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.