Skills
99,064 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Use when judging a finished security prior-art artifact — a threat-vocabulary map, a per-angle search output, an extract record, or the threat register — to decide whether the research craft is honest, complete against its own contracts, and proportionate. An acceptance gate, not authoring: it runs the producer's validator once, then judges what a validator cannot see — whether a coverage claim is provable, whether a source failure was typed or written as a zero, whether a bail was a confident relevance bail rather than a hedge, whether an evidence tier follows from evidence the record's own body agrees with, and whether a register names threats from a real vocabulary rather than coining them. Emits VERDICT: approve|revise with condition-named findings. Keywords: security prior art review, threat research review, coverage honesty, survey acceptance gate. Judges all three survey waves.
Moves the @backstage/* dependency versions of a Backstage plugin, workspace, app, or the redhat-developer/rhdh monorepo forward to a chosen release, staying within what a Red Hat Developer Hub version ships: read backstage.json and package.json, pick the target from the RHDH compatibility matrix or an explicit version, run versions:bump and versions:migrate, preserve the repository's dependency range style, audit stale resolutions, work through release changelogs, and re-verify the repository. Use for "upgrade @backstage dependencies", "bump Backstage in rhdh", "versions:bump", "which Backstage version does RHDH 1.8 ship", moved package namespaces, or dependencies that are too old for the API they need.
Changes an RHDH Jira issue you already have a key for, in RHIDP, RHDHPLAN, RHDHBUGS, or RHDHSUPP: post a progress comment, transition status, add an issue link or a web link to a PR, close with a resolution and rationale, and pick and set the assignee from team roster, recent expertise, and sprint capacity. Use for "update jira", "update RHIDP-1234", "log my progress on this", "move this to Review", "close this out", "who should take this", or "assign RHIDP-1234". Edits existing work — it does not create issues, audit a backlog, or build a sprint.
Writes Backstage plugin source for Red Hat Developer Hub in rhdh-plugins or community-plugins: scaffold a backend dynamic plugin with createBackendPlugin or createBackendModule from @backstage/backend-plugin-api, scaffold a frontend dynamic plugin, and implement features against Backstage UI (@backstage/ui), MUI, Scalprum bundles, fetchApi, i18n, and the Backstage test utilities. Use for "scaffold a backend dynamic plugin", "create a frontend dynamic plugin", "implement this plugin feature", entity cards, scaffolder actions, catalog processors, backend extension points, renderInTestApp and TestApiProvider tests, dev app setup, and the local build gates yarn tsc:full and yarn build:api-reports:only.
Reports what is still open against an RHDH release from Jira RHIDP, RHDHPLAN, RHDHBUGS, and RHDHSUPP: issue counts by type, blocker bugs, CVEs, Engineering EPICs, per-team breakdowns, release-note lifecycle, Post Code Freeze scope, and any query in the RHIDP Operational Rich Filter export. Also reports readiness at the Feature and Program Increment level: PI funnel, feature status matrix, stretch features, epic roll-up, cross-team dependency map, per-Feature coherence, and risk assessment. Use for "release status for 1.10", "what's blocking 1.10.3", "are we ready to ship 1.10", or "PI funnel for 2.1".
Scores features using both RICE and strategic alignment for nuanced prioritisation. Use when asked to prioritise features, build a priority matrix, combine quantitative scoring with strategic fit, or decide what to build next with multiple competing initiatives. Produces a scored priority matrix with RICE scores, strategic alignment ratings, quadrant placement, and sequencing recommendations.
React Native Skia (@shopify/react-native-skia) complete best practices, GPU-accelerated 2D graphics, 60fps/120fps animation patterns, custom shaders, and production optimization for iOS and Android. Use when writing, reviewing, fixing, or optimizing React Native Skia code including Canvas rendering, shapes, paths, gradients, filters, text/fonts, images, video, Skottie/Lottie, particle systems, or custom SkSL shaders. Triggers on tasks involving @shopify/react-native-skia, Canvas, Circle, Rect, Path, Group, useImage, useFont, LinearGradient, RadialGradient, RuntimeShader, Blur, BlurMask, Shadow, Atlas, Picture, Skia.Paint, Skia.Path, useDerivedValue with Skia, interpolateColors, usePathInterpolation, useRSXformBuffer, BackdropBlur, ImageShader, FractalNoise, Turbulence, Paragraph, TextPath, TextBlob, Skottie, AnimatedImage, drawAsImage, immediate mode vs retained mode, or any Skia-based drawing/animation. Also triggers when the user asks to build charts, drawing canvases, progress rings, particle effects, frosted glass, neon glow, image filters, or other GPU-accelerated graphics with React Native Skia.
ROACH v3.0.0 — Striker-only scanner, senpi_runtime_helpers migration. Plumbing-only flip from openclaw-CLI subprocess + mcporter subprocess to in-process SenpiClient. Thesis preserved verbatim from v2.1.0: Stalker permanently disabled, only trades violent FIRST_JUMP / IMMEDIATE_MOVER explosions backed by 1.5x volume, 1h price alignment, 4h trend agreement. Long stretches of silence are EXPECTED — the patience is the edge.
Create structured roadmap presentations calibrated to any audience. Use when asked to build a product roadmap, present roadmap to leadership, create a roadmap slide, or communicate quarterly plans to execs, teams, or customers. Produces an audience-calibrated Now/Next/Later roadmap with strategic context, initiative tables, success metrics, and explicit deprioritisation rationale.
RouterOS hotspot captive portal for wired/wireless access control. Use when: configuring hotspot on RouterOS, setting up captive portal, writing hotspot profiles or instances, configuring walled garden, setting DHCP option 114 (RFC 8910 captive portal URI), integrating RADIUS with hotspot, or when the user mentions /ip/hotspot, walled-garden, hotspot profile, or captive portal on MikroTik.
Use when you have a written implementation plan to execute. Loads the plan, reviews critically, executes tasks in dependency order, and reports completion. Triggers when the user says "run the plan", "execute the plan", or "let's start implementing".
Entry point for the psychology toolkit. Routes to the right psychology skill based on your situation. Use when you say 'psychology', 'what's driving this behavior', 'why is this person doing X', 'what biases are at play', 'how do I change a habit', 'how do I persuade', 'should I trust my gut', 'what motivates them', or want cognitive/behavioral analysis without knowing which specific tool fits.
Canonical SaaS product UI skill for designing, reviewing, or implementing calm, premium, production-ready interfaces across dashboards, settings, admin/runtime screens, editors, builders, tables, forms, drawers, sidebars, and related public surfaces. Use when you need strong hierarchy, reusable tokens, typography, responsive layout rules, component consistency, and app-surface patterns rather than decorative one-off design.
Mobile and web push notification strategy — opt-in optimization, rich push, segmentation, timing, frequency capping, deep linking, A/B testing, and analytics. Covers strategy and implementation across Braze, OneSignal, Airship, Firebase/FCM, Customer.io, Klaviyo, Iterable, and MoEngage. Use when push opt-in rates are low, users are disabling notifications, push campaigns get poor click-through, you're unsure which push provider to pick, or notifications feel spammy and drive uninstalls. Do NOT use for in-app messages (use /sales-in-app-messaging), email marketing (use /sales-email-marketing), SMS/WhatsApp messaging (use /sales-braze or platform-specific skill), or cold outbound (use /sales-cadence). For Braze-specific help, use /sales-braze. For Customer.io-specific help, use /sales-customerio.
Scaffold a new SciAgent-Skills entry. Picks pipeline/toolkit/database/guide template, creates skills/{category}/{name}/SKILL.md with valid frontmatter, appends the registry.yaml entry, runs validation. Enforces name uniqueness, kebab-case, description keyword rules, schema rules from AGENTS.md. TRIGGER when user says (any language): "add a SciAgent skill", "add a skill for <X>", "create new skill", "create a SKILL.md for <X>", "scaffold a skill", "new skill entry", "register a skill", "신규 skill 추가", "스킬 만들어줘", "스킬 생성", "skill 만들어", or any request to add a new SKILL.md to this repo. ALWAYS invoke this skill BEFORE writing to skills/ or registry.yaml. DO NOT TRIGGER when: editing existing entry's content (just edit the file directly); migrating an existing entry (read AGENTS.md "Migrating from Existing Entries" first); only updating registry.yaml without creating a new SKILL.md.
Create publication-quality scientific diagrams, flowcharts, and schematics using Python (graphviz, matplotlib, schemdraw, networkx). Specialized in neural network architectures, system diagrams, and flowcharts. Generates SVG/EPS in figures/ folder with automated quality verification.
Guide users to build Zaps that use the official ScraperAPI Zapier integration. Use this skill whenever the user wants to add web scraping, SERP data, or e-commerce data to a Zapier workflow through ScraperAPI — even when they don't say "skill" or name the integration. Triggers include: "build a Zap that scrapes Amazon prices and emails me", "connect ScraperAPI to Zapier", "automate a daily Google search scrape in Zapier", "use ScraperAPI in a Zap to enrich new leads from a webhook", "how do I add ScraperAPI as a step in my Zap", "Zapier workflow to crawl a site with ScraperAPI", "extract data from a URL inside Zapier". Produces a step-by-step build guide for the Zap editor, since Zapier integrations are assembled in the web UI (not imported as JSON). Note: Transmits user-supplied URLs, queries, and page content to ScraperAPI.
Integrate Seam Reservation Automations into a property management system (PMS) or vacation rental platform. Push reservation data (check-in, check-out, guest info) and Seam automatically creates and revokes access codes on smart locks. Supports August, Yale, Schlage, Kwikset, and other smart locks. Use this skill when someone wants to automate access codes from reservations, let Seam handle credential management, or integrate a PMS with smart locks without building device management UI. Not for hotel ACS systems (Salto, Visionline, Brivo) — those need a different approach.
Detect, audit, and remediate Security Misconfiguration vulnerabilities (OWASP A02:2025) in Python web applications — especially FastAPI and Flask. Use this skill whenever a user asks about: hardening a Python/FastAPI/Flask app, checking for debug mode leaks, missing security headers, exposed API docs, hardcoded secrets, insecure cookie flags, XXE vulnerabilities, or any OWASP A02 misconfiguration issue. Also trigger for tasks like "security audit", "pen test prep", "production checklist", "find misconfigs", or "harden my app". This skill covers static analysis patterns, runtime checks, tooling (Bandit, OWASP ZAP), and remediation code snippets for each sub-category of misconfiguration.
Break complex plots or story outlines into a multi-shot structure for Seedance 2.0, such as “Shot 1 / Shot 2 / Shot 3.” Organize each shot across four dimensions: camera movement, subject actions and expressions, position and spatial changes, and audio. Use for requests like “turn this story into Seedance prompts,” “storyboard script,” “multi-shot video,” “complex story video,” or “convert a script into a storyboard.”
World-class prompt engineering skill for LLM optimization, prompt patterns, structured outputs, and AI product development. Expertise in Claude, GPT-4, prompt design patterns, few-shot learning, chain-of-thought, and AI evaluation. Includes RAG optimization, agent design, and LLM system architecture. Use when building AI products, optimizing LLM performance, designing agentic systems, or implementing advanced prompting techniques.
Comprehensive QA and testing skill for quality assurance, test automation, and testing strategies for ReactJS, NextJS, NodeJS applications. Includes test suite generation, coverage analysis, E2E testing setup, and quality metrics. Use when designing test strategies, writing test cases, implementing test automation, performing manual testing, or analyzing test coverage.
When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," "SEO health check," "my traffic dropped," "lost rankings," "not showing up in Google," "site isn't ranking," "Google update hit me," "page speed," "core web vitals," "crawl errors," or "indexing issues." Use this even if the user just says something vague like "my SEO is bad" or "help with SEO" — start with an audit. For building pages at scale to target keywords, see programmatic-seo. For adding structured data, see schema-markup. For AI search optimization, see ai-seo.
Grow organic search traffic for a product or local-business site from a .seo workspace. Use for an SEO review, deciding what to build or fix next for search, a traffic drop, AI-search visibility ("how do we show up in ChatGPT"), setting up SEO, or the monthly SEO scoreboard.
Serverpod web server (Relic) — REST APIs, webhooks, middleware, static files, server-rendered HTML, SPAs, Flutter web. Use when adding raw HTTP routes, serving web pages or web apps, or intercepting requests. Not for RPC endpoints called from the generated client — use serverpod-endpoints for those.
Use when invoked explicitly as /session-harvest, or when the user asks what's worth saving before compacting/ending a session, or says something like 'harvest this session', 'anything to remember here', 'anything dangling before I stop', or 'is it safe to compact'. Reviews the conversation for anything worth keeping and routes each item to a plain file every agent can read: plan-specific content to plans/*.md (per the plan-conveyor skill), repo-specific durable knowledge to that repo's AGENTS.md/docs/contributing, and cross-repo/personal preference to ~/.agents/AGENTS.md. Never a harness's own memory store, for any reason — that vendor-locks the work. Then sweeps live state the conversation can't show: processes the session left running, unpushed commits in every repo it touched, CI on what it pushed, and work it promised but never verified. Ends with a report ordered least- to most-urgent, a safe-to-compact verdict, and a next-session prompt. On-demand only — never installs hooks or runs automatically.
Share Claude Code sessions between developers. Use when user mentions "share session", "export session", "import session", "send session to", "continue from colleague", or needs to (1) export current session to file, (2) import session from another developer, (3) hand off work context. Enables private, secure session transfer via direct file sharing.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.