Skills
98,873 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Use only when the user explicitly names session-handoff or explicitly asks to create a durable resume packet for a later agent session. Capture the exact live state, unresolved work, decisions, constraints, and next action needed to continue without re-deriving context; do not create a packet when there is no actionable state to transfer.
Mechanize Pattern 15 — the seven-pass adversarial review protocol for academic manuscripts. Spawns 7 fresh-context subagents in parallel (abstract, intro, methods, results, robustness, prose, citations), then synthesizes a prioritized revision checklist. Use for submission-ready or R&R-stage papers where single-pass review isn't enough.
Model interpretability and explainability using SHAP (SHapley Additive exPlanations). Use this skill when explaining machine learning model predictions, computing feature importance, generating SHAP plots (waterfall, beeswarm, bar, scatter, force, heatmap), debugging models, analyzing model bias or fairness, comparing models, or implementing explainable AI. Works with tree-based models (XGBoost, LightGBM, Random Forest), deep learning (TensorFlow, PyTorch), linear models, and any black-box model.
Shellcode Loader combination generation: select and combine storage/allocator/copier/executor components from the knowledge base to generate a C/C++/Rust Loader. Use when you already have shellcode and need to generate a Loader binary that runs in the target environment. First read references/loader-scenarios.json to confirm no duplicate scenario exists, then choose a combination of the 4 components to generate
Prepare a feature branch for a pull request: verify scope, sync when needed, test, review, push and open or update the PR. This skill MUST be used when the user requests this branch-to-PR workflow or explicitly invokes ship-it (開 PR、準備 PR、整理分支交付). It SHOULD be used when the user asks to prepare a completed feature for review. It MUST NOT be triggered solely by a push, merge, release, deployment request or a general readiness question.
Create, redesign, extend, debug, validate, package, test, and upgrade distinctive production Bagisto storefront themes. Use for self-contained Bagisto UI/UX direction, ultra-polished brand and commerce design systems, design tokens, responsive storefront UX, guided beginner implementation, Shop theme registration, resource overlays, distributable packages, Blade layouts/components, inline Vue, Vite/Tailwind assets, dynamic admin-controlled content, channel and theme-customization content, localization/RTL, accessibility, performance, complete Playwright commerce coverage, deployment, or resolving theme inheritance and asset-manifest failures. Derive every identity, path, version, component, locale, and command from the target checkout.
Use when an app developer needs to bill a Shoplazza merchant for app usage through the CLI — one-time application charges, recurring (subscription) charges, metered usage charges, and app-charge transaction records. Triggers include 应用收费 / 订阅费 / 一次性收费 / 用量费 / 计费 / app billing / recurring / one-time / usage charge. NOT buyer order payments or refunds (那是 shoplazza-orders 的 transactions / +refund).
Shared foundation for the shoplazza CLI: installing the CLI (安装 CLI / command not found), authentication (auth login — account-level and store-level; 登录 / 授权), auth status/scopes/logout, store switching (auth store use; 切换店铺 / 换店), multi-store profiles (add/list/use/rename/remove/info), the three access tiers (+shortcut / spec leaf / api rest), the output envelope ({ok,data} / .data), --dry-run / --jq / --fields / --format, schema introspection, api rest fallback, update notice, the safety protocol, and how to trust a filtered list read (pagination / has_more / cursor, silently-dropped filters, the exact-match precision ladder). Read this FIRST on first use of the shoplazza CLI, when the CLI is missing, when logging in / authorizing / switching store or profile, on permission errors, when a search or filter looks like it returned too much, and before using any domain skill.
Use when the user wants to manage customers (buyers) on a shoplazza store through the CLI — create a customer profile, find a customer by email or phone, get customer details or the total customer count, update names / tags / email or SMS marketing subscription, or manage a customer's shipping addresses including the default checkout address. Triggers include 客户 / 买家 / 顾客 / 客户资料 / 新建客户 / 按邮箱查客户 / 按手机号查客户 / 给客户打标签 / 退订营销 / 收货地址 / 默认地址 / customer profile / new customer / find customer by email or phone / customer count / tag a customer / unsubscribe marketing / shipping address / default address. Finding the customer RECORD by email (按邮箱找客户资料) belongs HERE (customers +search); that customer's ORDER HISTORY (该客户下过的订单 / orders placed by this email) belongs to shoplazza-orders.
Use when the user wants to manage a shoplazza store's orders through the CLI — searching / counting / viewing orders (查订单 / 找订单 / 订单列表 / 订单详情 / 新订单 / order search), shipping and fulfillment (发货 / 标记发货 / 物流 / 运单号 / 改运单号 / ship an order / update tracking), refunding a buyer (退款 / 给顾客退钱 / 退钱给买家 / refund an order — buyer refunds live HERE, not in discounts and not in billing), cancelling / creating / updating / marking orders paid (取消订单 / 代客下单 / 标记支付), an order's payment transactions (订单支付流水 / 支付交易记录 / buyer payment transactions — app-charge transactions → shoplazza-billing), fraud risk records (欺诈 / 风控 / 高风险订单 / order risk), after-sales records (售后 / post-sales), shipping zones and rates (运费区域 / 邮费 / 运费方案 / shipping zones — real-time rate carriers → shoplazza-shop carrier-services), and tracking-carrier lookup (快递承运商 / 运单号识别承运商). A customer's orders by email (按邮箱查某客户的订单) are searched HERE; the customer record itself → shoplazza-customers. NOT product stock / 库存 / 补货 (→ shoplazza-products).
Use when an app developer needs to manage webhook subscriptions on a Shoplazza store through the CLI — subscribe to store events (order created, product updated, …) so the platform pushes notifications to an app's endpoint, and list / get / update / delete / count those subscriptions. Triggers include webhook / 事件订阅 / 事件回调 / 事件通知 / 推送通知 / 回调地址 / subscribe to an event / event notification. NOT the events themselves in shoplazza-orders / shoplazza-products — this domain owns the SUBSCRIPTION.
Interview a founder or senior marketer one question at a time, mine current work and owned proof for net-new short-form video ideas, and return a ranked table with one five-second overlay hook, virality and three-second-hook scores, exactly three talking bullets, a complete payoff, and a mapped CTA. Use for Instagram Reels, TikTok, YouTube Shorts, LinkedIn video, founder-led content planning, hook development, content-day production queues, or turning active AI, marketing, and operating work into credible short-form concepts.
Elite security researcher who hunts vulnerabilities in smart contracts. Has found critical bugs worth millions in TVL. Specializes in reentrancy, access control, oracle manipulation, and economic exploits across EVM and Solana. Use when "audit, security review, vulnerability, exploit, reentrancy, access control, oracle manipulation, flash loan attack, smart contract security, slither, mythril, formal verification, invariant testing, security, audit, smart-contracts, solidity, vulnerabilities, defi, exploits, reentrancy, access-control, oracle-manipulation" mentioned.
Turn a post, article, or idea into a complete slide-by-slide carousel script for Instagram or LinkedIn, with a hook cover, one-idea-per-slide content slides, a recap, and a CTA slide. Use when someone says "make a carousel", "carousel about", "slide deck post", or "LinkedIn document post". Every slide ships with its copy plus a design note and an image-generation prompt a designer or image model can execute directly. Instagram feed carousels and LinkedIn document posts follow different size, density, and cover conventions, so the script adapts to the platform chosen. Reads social-context.md for brand voice and audience setup so slides sound like the brand and land with the right readers.
Multi-slide carousel design for Instagram, LinkedIn, and Twitter/X with layout rules and hooks. Covers slide structure, text hierarchy, swipe psychology, and platform-specific specs. Use for: carousel posts, Instagram carousels, LinkedIn carousels, slide posts, educational content. Triggers: carousel, instagram carousel, linkedin carousel, slide post, carousel design, swipe post, multi-image post, carousel template, educational carousel, carousel content, instagram slides, linkedin slides
Use this when the user wants to deeply understand something through guided questioning. Trigger phrases include: "quiz me", "help me understand", "Socratic", "teach me", "walk me through with questions", "test my understanding", or when the user asks for an explanation and would benefit more from guided discovery than a direct answer.
Security testing skill for OWASP A08:2025 — Software or Data Integrity Failures in Python web applications (FastAPI and Flask). Use this skill whenever the user wants to audit, detect, test, or fix integrity vulnerabilities including: insecure deserialization (pickle, yaml, jsonpickle, dill), mass assignment flaws, untrusted CDN/module inclusion, unsigned updates, CI/CD pipeline integrity, or Subresource Integrity (SRI) checks. Trigger this skill for ANY task involving pickle/deserialization security, CWE-502, CWE-915, CWE-829, CWE-345, or CWE-494, even if the user doesn't explicitly mention OWASP A08.
Expert guidance on detecting, assessing, and remediating Software Supply Chain Failures (OWASP A03:2025) in Python applications — the highest-exploit-score category in the 2025 OWASP Top 10. Use this skill whenever the user mentions dependency scanning, vulnerable packages, SBOMs, pip-audit, safety check, lockfile integrity, hash pinning, transitive dependencies, CI/CD pipeline security, compromised packages, supply chain attacks (SolarWinds, Log4Shell, typosquatting), or requests a security review of requirements.txt / pyproject.toml. Also trigger for any question about CWE-1104, CWE-1395, or CWE-1329.
Apply SOLID principles to write flexible, maintainable, and testable code. Use when designing classes, interfaces, and module boundaries. Covers Single Responsibility, Open/Closed, Liskov Substitution, Interface Segregation, and Dependency Inversion with practical TypeScript examples and detection heuristics.
Create 2.35:1 header image covers for WeChat official accounts, generated with Codex's built-in image_gen, following the "lightweight AI product infographic" visual system (white/light lavender background, ink-black large headings, tech purple and lime green accents, rounded cards, linear icons). Includes a built-in share safe-zone check — when a WeChat official account cover is shared to Moments, only the central 1:1 square is kept, and this Skill ensures the title is not cropped. Triggered when the user says "make a WeChat official account cover", "make a header image", "article lead image", "2.35:1 cover", "WeChat official account cover image", or "make a few cover versions".
Generates Spartan/ng UI code and guidance for Angular projects using @spartan-ng/helm (styled components copied into the repo) and @spartan-ng/brain (headless primitives). Covers installation, Tailwind v4 theming, component usage across all categories (forms, overlays, layout, display, data), Brain primitives, ReactiveForms / Signal Forms integration, and accessibility. Use when the user mentions Spartan, spartan-ng, @spartan-ng, hlm-* or brn-* components, OR when the Angular project's package.json contains @spartan-ng/* dependencies. Pairs with angular-developer for Angular fundamentals.
Implement SPC charting, process capability analysis, and control chart interpretation. Covers control chart selection, capability indices, and out-of-control rules. USE WHEN user says 'SPC', 'Cpk', 'Ppk', 'control chart', 'process capability', 'X-bar R', 'statistical control', or 'out of control'. Integrates with ControlPlan, MSA, and AutomotiveManufacturing skills.
Statistical Process Control (SPC) — select the correct control chart, interpret out-of-control signals using Western Electric rules, calculate and interpret Cp, Cpk, Pp, Ppk. Use when setting up SPC for a new characteristic, interpreting control chart signals, responding to special cause variation, or auditing SPC implementation. Covers AIAG SPC 2nd edition and IATF 16949 §8.3.3.
Optional skill. Reconstruct a human-review-preparation file from an existing pull request, merge request, branch diff, or commit range in a repository the user trusts. Use when the user wants retrospective understanding of already-implemented changes, AI-side assessment and recommendations, and an optional provider-specific sharing variant written to a local file when needed.
Compact an active task file without changing meaning. Use when converting a no-subtask task to subtask form, when adding a new subtask after earlier subtasks already contain full section content, when duplicated section content should be compacted before approval seeking, or when a task file has become too large to use safely.
Build UIs with Spectrum Web Components (SWC), Adobe's Spectrum 1 web component library. Use when developers are working with @spectrum-web-components/* packages or sp-* custom elements. Includes component API references, usage examples, accessibility guidance, and integration guides.
Use when a large uncommitted diff has piled up on a branch and needs to be split into a chain of small, safe, sequential PRs — explicit triggers include "разбей PR", "слишком большой PR", "раздели изменения на несколько PR", "split this PR", "too many files in one PR". Retroactive only: it acts on a diff that already exists, never on work not yet started. Splits the diff into stacked branches/PRs, each capped at 15 business-logic files (assets/docs excluded from the cap) unless breaking the cap is the only way to keep coupled files together. Does not run its own build/lint/test — that's left to the project's own pre-push hook. Tracks progress in a JSON state file (deleted automatically once the split completes) so the split survives session restarts and no file from the original diff is ever silently dropped.
Declarative HTTP client for microservices communication with Spring Cloud OpenFeign. Covers @FeignClient, error handling, interceptors, and circuit breaker integration. USE WHEN: user mentions "feign", "openfeign", "@FeignClient", "declarative HTTP client", "service-to-service communication", "microservices client" DO NOT USE FOR: external APIs - consider WebClient or RestClient, simple HTTP calls - use RestClient
Use this skill when the user asks to "automate SQL injection testing," "enumerate database structure," "extract database credentials using sqlmap," "dump tables and columns from a vulnerable database," or "perform automated database penetration testing." It provides comprehensive guidance for using SQLMap to detect and exploit SQL injection vulnerabilities.
Subscribe to real-time stock market data via WebSocket long connection from receiver nodes (A-shares, HK stocks, ETFs). Use this skill when the user wants to monitor live stock prices, set up real-time alerts, or stream minute-level K-line data. The skill provides a WebSocket server that connects to receiver nodes and pushes real-time price updates to all connected clients.
Screen stocks and backtest trading strategies using reportify-sdk (Python) and reportify-cli. Supports 80+ technical indicators (MA/EMA/MACD/KDJ/BOLL/RSI) and fundamental factors (PE/PB/ROE/ROA/EPS), time series analysis, multi-condition screening, and strategy backtesting. Use when user needs stock screening, filtering stocks by conditions, quantitative analysis, or backtesting trading strategies.
Audit store review and platform policy risk across App Store, Google Play, Microsoft Store, Steam, web/direct download, mobile apps, games, SaaS companions, utilities, subscriptions, IAP, ads, UGC, privacy, permissions, health, finance, children, AI features, notifications, dark patterns, refunds, and review notes. Use when preparing submission, launch, major monetization changes, or auditing any product that may be rejected, delisted, or delayed by channel policy.
Continuously improve Remotion Studio by making a video, reproducing real UX and performance issues, fixing them, and verifying the result. Use for ongoing Studio dogfooding and maintenance, including checkpoints that hand one PR over for review while work continues in a stacked PR.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.