Skills
98,873 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Runs a hypothesis-driven threat hunt for Windows Scheduled Task persistence (T1053), guiding SIEM/EDR queries against task creation events (e.g. Event ID 4698), suspicious task actions, and unusual scheduling patterns. Use when hunting for scheduled-task persistence, after threat intel flags related campaigns, during incident response, or when alerts fire on schtasks/at.exe activity.
Runs a hypothesis-driven threat hunt for Volume Shadow Copy deletion (T1490) by querying SIEM/EDR telemetry for vssadmin, wmic shadowcopy, and PowerShell shadow-copy-deletion commands. Use when hunting for ransomware preparation or anti-forensics activity, after threat intel flags active campaigns, or when alerts trigger on shadow-copy deletion commands.
Elite agent skill for creating premium "Product Launch Videos" using Hyperframes. Supports brand DNA extraction, scene-by-scene art direction, premium motion design (Apple-style camera, glassmorphism, typewriter physics), and perfect sound design sync. Use when asked to create a product launch video, promo video, or high-end feature announcement.
Automated hypothesis generation and testing using large language models. Use this skill when generating scientific hypotheses from datasets, combining literature insights with empirical data, testing hypotheses against observational data, or conducting systematic hypothesis exploration for research discovery in domains like deception detection, AI content detection, mental health analysis, or other empirical research tasks.
Generate testable pain hypotheses from the company context file (ICP, win cases, product knowledge) and user input. Fast, no API keys needed — pure reasoning. Outputs a hypothesis set with search angles that directly guide list-building queries. Sits between context-building and list-building. Triggers on: "build hypotheses", "hypothesis set", "pain hypotheses", "define hypotheses", "what pain points", "campaign angles", "search angles", "refine hypotheses".
Provides comprehensive IBM Mainframe administration, development, and modernization guidance including z/OS operations, JCL scripting, COBOL/PL/I programming, CICS/IMS configuration, DB2 administration, TSO/ISPF usage, system programming, batch processing, and mainframe-to-cloud migration strategies. Covers mainframe security (RACF, ACF2), performance tuning, capacity planning, disaster recovery, and DevOps integration. Use when working with mainframe systems, z/OS, JES2/JES3, VTAM, USS, or when users mention "mainframe", "z/OS", "MVS", "TSO", "ISPF", "JCL", "CICS", "IMS", "DB2 mainframe", "VSAM", "RACF", "mainframe modernization", "legacy mainframe", or "IBM z Systems".
Upscale and enhance images with Real-ESRGAN, Thera, Topaz, FLUX Upscaler via inference.sh CLI. Models: Real-ESRGAN, Thera (any size), FLUX Dev Upscaler, Topaz Image Upscaler. Use for: enhance low-res images, upscale AI art, restore old photos, increase resolution. Triggers: upscale image, image upscaler, enhance image, increase resolution, real esrgan, ai upscale, super resolution, image enhancement, upscaling, enlarge image, higher resolution, 4k upscale, hd upscale
Manage a Nexor customer's iMessage (Apple blue-bubble) channel end to end through Nexor MCP tools: read the paid add-on offer and price, buy and provision a dedicated iMessage number (via Dial), poll it to ready, assign it to an agent, set the name and profile photo leads see, and send iMessage. Use whenever a customer asks about iMessage / blue bubble, its price or cost, wants to see, buy, provision, or assign an iMessage number, wants to change the name or photo shown on their iMessage, asks whether their iMessage is set up or which agent owns it, or wants to send an iMessage. iMessage bills at a FLAT $350/month per number — currently the only Nexor channel on a flat rate (all others are usage-based). iMessage has its OWN inventory and tools — it is NOT the Phone/SMS voice line, so never read its state from list_phone_numbers.
Use this skill whenever the user needs to generate, edit, or integrate AIGC images or videos with imini Open Platform — text-to-image, image editing with references, text-to-video, image-to-video, first/last frame, reference video, motion control, video editing, or multimodal generation. Two paths — (A) ad-hoc one-shot generation right now via bundled Python scripts (no codegen, no token burn for re-deriving submit/poll logic); (B) writing async integration code into the user's own project. Triggers on mentions of imini, openapi.imini.ai, or any imini model id (nano-banana, nano-banana-pro, nano-banana-2, gpt-image-2, kling-v3, kling-v3-omni, kling-v3-motion-control, seedance-2.0, seedance-2.0-fast, happyhorse-1.0).
Standards for implementing and reviewing React/TypeScript/Next.js features in codebases that use React Hook Form, Zod, React Query or Connect Query, and proto-generated API types. Use when building frontend forms, hooks/components, state flows, and type-safe UI mappings in this stack.
Use for all repository edits and their planning, including simple code, documentation, configuration, and test changes. Also use to choose the next task from a tracker, continue work, recover context, or split implementation into tasks. Review-only and publication-only requests are outside this workflow.
Configures Google Workspace advanced phishing and malware protection settings in the Admin Console — pre-delivery message scanning, attachment protection, spoofing/impersonation detection, and Enhanced Safe Browsing enforcement. Use when hardening Gmail against phishing, spoofing, and malware, or when tuning Workspace email security policies.
Implements and trains LLMs using Lightning AI's LitGPT with 20+ pretrained architectures (Llama, Gemma, Phi, Qwen, Mistral). Use when need clean model implementations, educational understanding of architectures, or production fine-tuning with LoRA/QLoRA. Single-file implementations, no abstraction layers.
Find deepening opportunities in a codebase, informed by the domain language in CONTEXT.md and the decisions in docs/adr/. Use when the user wants to improve architecture, find refactoring opportunities, consolidate tightly-coupled modules, or make a codebase more testable and AI-navigable.
Triages all inbound leads from a given period — demo requests, free trial signups, content downloads, webinar registrations, chatbot conversations. Classifies by urgency, qualifies against ICP, enriches with context, and produces a prioritized action queue with recommended response for each lead. Tool-agnostic — works with any CRM, form tool, or lead source.
Converts NetBox device-type and module-type definitions (the netbox-community devicetype-library format, also published via the NetBox Data Exchange / NDX) into Infrahub object templates as Infrahub object YAML, using a bundled Python converter driven by a schema mapping profile. TRIGGER when: importing NetBox device types or module types, exporting device types from a running NetBox instance, building object templates from vendor device models, converting line cards / PSUs / transceivers from NetBox module types into Template* objects, re-running a conversion after changing the mapping profile, debugging a wrong or failed conversion. DO NOT TRIGGER when: importing CSV/TSV data (use infrahub-importing-data), authoring schemas from scratch (use infrahub-managing-schemas), writing ordinary object data files (use infrahub-managing-objects), or setting up continuous two-way replication with a live NetBox (that is infrahub-sync, a separate product; a one-off export of device types is in scope here).
Resolve a natural-language element description ("the red button in the hero", "the third card from the top") to a concrete DOM element in the current preview + source-code location. Uses Chrome DevTools MCP take_snapshot UIDs for deterministic targeting. Use when user asks to change/style/remove a specific visual element without pointing at source code.
Strategic guidance for setting up the right data integration -- workflow selection, field mapping, and configuration. Use when the user needs help choosing the right integration approach, wants advice on field mapping, or needs to plan a data integration.
Control interactive terminal applications like vim, git rebase -i, git add -i, git add -p, apt, rclone config, sudo, w3m, and TUI apps. Can also supervise another CLI LLM (cursor-agent, codex, etc.) - approve or reject its actions by pressing y/n at confirmation prompts. Use when you need to interact with applications that require keyboard input, show prompts, menus, or have full-screen interfaces. Also use when commands fail or hang with errors like "Input is not a terminal" or "Output is not a terminal". Better than application specific hacks such as GIT_SEQUENCE_EDITOR or bypassing interactivity through file use.
Adds multi-language support to Next.js websites with proper SEO configuration including hreflang tags, localized sitemaps, and language-specific content. Use when adding new languages, setting up i18n, optimizing for international SEO, or when user mentions localization, translation, multi-language, or specific languages like Japanese, Korean, Chinese.
When the user wants to value inventory, choose or apply costing methods, or handle write-downs. Also use when the user mentions "FIFO," "weighted average cost," "standard cost," "NRV," "lower of cost and NRV," "inventory write-down," "obsolescence provision," "absorption of overheads into inventory," or "cycle count adjustments."
Professional investment analysis assistant skill providing technical analysis, fundamental analysis, market sentiment analysis and comprehensive investment advice. Preferred use cases: stock analysis requests, investment decision support, technical indicator calculation, financial data interpretation, risk assessment, buy and sell recommendations, etc. This skill should be the first choice for all investment-analysis-related requests.
Write a structured monthly or quarterly investor update. Use when asked to write an investor update, investor newsletter, board update, or startup progress report for investors. Produces a clear, credible update with highlights, metrics, challenges, and asks — in the format investors actually want to read.
Software development engine for coding. A production-grade skills system for web apps and mobile architecture, APIs, databases, web, mobile, AI, security, UX, SaaS, and ERP engineering. Encodes reusable engineering judgment through layered baseline and specialist skills to help generate secure, scalable, maintainable, high-performance software systems
Use when building or modifying Jigx Core SDK apps, including screens, forms, datasources, tabs, navigation, local dynamic data, media, PDFs, JavaScript functions, validation, icons, and build/deploy workflows. This skill is generic and should be used before writing Jigx app code.
Dedicated Skill for the fine-decorated home renovation pitfall guide. Covers the full process including old-house and second-hand home renovation, kitchen and bathroom renovation, wall and floor renewal, demolition and alteration items and their order, budgets, quotes and rights protection, and minor fine-decoration alterations, integrating the highlights of the Xi'an Renovation Classroom members' edition knowledge base in reverse order, helping users renovate with less hassle and fewer pitfalls in fine-decorated home renovation.
Jujutsu (jj) — the Git-compatible version control system. Activate ONLY when a .jj/ directory is present in the project or when jj/jujutsu is explicitly mentioned. Do NOT activate for plain git repos without .jj/. Use for any VCS operations in jj-managed projects: commit, push, pull, branch, bookmark, rebase, squash, merge, diff, log, status, working copy, change ID, revset, fileset, template, configuration, workspaces.
Detect buying intent from job postings. When a company posts a job in your problem area, they've allocated budget and are actively thinking about the problem. This skill finds those companies, qualifies them, extracts personalization context, and outputs everything to a Google Sheet. Does NOT do outreach — just delivers qualified leads with reasoning.
Write and maintain JSDoc comments for JavaScript and TypeScript APIs: functions, classes, modules, parameters, returns, examples, and TODO annotations. Use when documenting code, generating API docs, setting JSDoc conventions, or when the user mentions JSDoc tags like @param, @returns, or @todo.
JSDoc and TSDoc documentation standards. Covers syntax, tags, TypeScript integration, documentation generation, and API documentation best practices. USE WHEN: user mentions "TSDoc", "TypeScript documentation", "API documentation", asks about "documenting TypeScript", "@param", "@returns", "TypeDoc", "API Extractor", "documentation tags" DO NOT USE FOR: JavaScript-only JSDoc - use `jsdoc` skill for plain JavaScript
A CTF flag judging checklist. Use when determining whether a CTF challenge is complete (whether the flag has been captured), analyzing why an attack failed, or providing precise guidance for the next attack step. Covers flag search and verification, vulnerability discovery assessment, exploitation assessment, flag location inference, and common challenge pattern matching (SQLi/LFI/RCE/IDOR/SSRF/deserialization)
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.