Skills
98,873 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Identifies recurring charges (subscriptions, monthly bills, biweekly paychecks) from a transaction history by clustering same-merchant transactions of similar amount on a regular cadence, requiring at least 3 confirming occurrences before promoting a candidate to active status. Detects new recurring charges, dormant subscriptions (missed expected dates), and amount drift, and computes annualized cost. Use when auditing subscriptions, building a recurring bills calendar, computing cash-flow forecast inputs, or when user mentions subscription audit, recurring detection, dormant subscription, or annualized cost.
Refactor NestJS/TypeScript code to improve maintainability, readability, and adherence to best practices. Identifies and fixes circular dependencies, god object services, fat controllers with business logic, deep nesting, and SRP violations. Applies NestJS patterns including proper module organization, provider scopes, custom decorators, guards, interceptors, pipes, DTOs with class-validator, exception filters, CQRS, repository pattern, and event-driven architecture. Transforms code into exemplary implementations following SOLID principles.
Refactor Spring Boot and Java code to improve maintainability, readability, and adherence to enterprise best practices. This skill transforms messy Spring Boot applications into clean, well-structured solutions following SOLID principles and Spring Boot 3.x conventions. It addresses fat controllers, improper transaction boundaries, field injection anti-patterns, and scattered configuration. Leverages Java 21+ features including record patterns, pattern matching for switch, virtual threads, and sequenced collections.
Performance best practices for Relay applications. Use when optimizing data fetching, reducing re-renders, configuring caching, or improving time to first meaningful paint. Covers query placement, @defer, pagination, fetch policies, garbage collection, fragment granularity, and server-side filtering. Companion to the relay-best-practices skill which covers correctness and architecture.
Summarises the delta between a tool's latest release and the last summary the user saw. Use when the user asks about what's new, the latest release, release notes, or the changelog of one of the supported tools: Claude Code, OpenCode, llama-swap, or llama.cpp.
Repurpose a completed YouTube video into newsletter issues, social media posts, and other content formats. Use when the user says 'repurpose this video', 'turn this video into a newsletter', 'create social posts from my video', 'distribute this content', or wants to maximize reach of existing video content across platforms.
Invoke when goal-clarifier analyzes user requirements to extract goals and constraints. Provides structured requirement decomposition into functional/non-functional categories, stakeholder mapping, assumption identification, and documentation format.
Append new items (research objects) to an in-progress research outline's `outline.yaml` — sourced from your direct input, a web-search agent, or both. Use mid-`/research-outline` when you've realised the items list is incomplete (a new competitor surfaced, an important historical entry was missed, a category needs broader coverage) before running `/research-deep`, so the new items are part of the parallel deep pass instead of needing a separate run.
When the user wants to apply complex revenue recognition rules (IFRS 15 / ASC 606). Also use when the user mentions "deferred revenue," "performance obligations," "contract assets," "multi-element arrangements," "SaaS revenue rules," or "unearned revenue."
Reviews PostHog's warehouse suggestions with a person and acts on them. Explains why a view should be materialized, unmaterialized, certified or deprecated using the numbers in the suggestion, changes a materialize suggestion's refresh mode, keys or interval when the person wants something else, then accepts, dismisses or assigns it. Use when the user asks what PostHog suggests for their data warehouse, whether to materialize a view, why a view should refresh incrementally or every few hours, or wants to accept, change, dismiss or assign a warehouse suggestion.
Gives the milestone dates for an RHDH version — Feature Freeze, Code Freeze, Docs Input Freeze, Docs Freeze, Go/No Go & Push, and GA announce — reading active releases from the RHDHPLAN release Feature in Jira and planned ones from the RHDH release schedule spreadsheet. Use for "when is code freeze for 1.11", "RHDH release dates", "GA date for 2.1", "what are the key dates for 1.10.3", or "has 1.10 passed feature freeze yet".
Generate a single self-contained HTML page that is genuinely visual AND interactive — charts, diagrams, motion, tabs, comparison toggles, click-to-expand, base64-inlined images, opinionated typography. Use whenever the user wants ANY rich visual artifact from arbitrary content: explainer, research write-up, PRD or spec page, pitch, internal one-pager, "make this less boring" rebuild, scroll-snap deck, landing-style summary, distilled report. Trigger phrasings: "make me a page about X", "turn this PDF/doc into something visual", "build me a deck/talk/pitch", "explain Y in a visual way", "make this readable", "give it some eye candy", "I want something I can show the team", "less boring version of this", "rebuild that page", "redo it with more visuals". Output is one .html file that renders identically when DM'd — CDN libraries (Tailwind, Chart.js, D3, GSAP, Mermaid, Lucide) load from stable jsdelivr/unpkg URLs; every image is base64-inlined. Not for plain Markdown docs (use technical-writer), not for code review (use reviewer), not for maintainable component code a team will edit over time (use frontend-design — rich-page produces one-shot HTML artifacts, not living software).
Senior risk management specialist for medical device companies implementing ISO 14971 risk management throughout the product lifecycle. Provides risk analysis, risk evaluation, risk control, and post-production information analysis. Use for risk management planning, risk assessments, risk control verification, and risk management file maintenance.
Roblox Rojo project workflow for understanding, maintaining, and syncing Roblox codebases managed with Rojo, Wally, or Aftman. Use when a Roblox project has default.project.json, *.project.json, wally.toml, aftman.toml, sourcemap.json, src folders, or the user asks about Rojo, Wally, Studio sync, generated place/model files, or Roblox repo structure.
ALWAYS USE before running .NET tests or answering with a test command or flags. Trigger on "run the tests", "exact dotnet test command", one test/class/category/trait/target framework, combined filters, `--filter-query`, `--no-build`, `--diag`, diagnostic logs, TRX, coverage collection, crash/hang dumps, filter errors, or unrecognized options. Chooses repository-compatible classic, VSTest, bridged MTP, or native MTP syntax for MSTest/xUnit/NUnit/TUnit. DO NOT USE for platform identification alone (platform-detection), writing or debugging test code, interpreting an existing coverage report, CI investigation, migration, or a persistent hot reload/watch loop.
Grows an email list or newsletter audience — lead magnets, content upgrades, cross-promotion, referral programs, social-to-email conversion, SEO-to-email, viral loops, opt-in optimization. Use when subscriber growth has stalled, lead magnets aren't converting, referral program isn't driving signups, opt-in forms have low conversion rates, or social followers aren't joining your email list. Do NOT use for sending emails to your list (use /sales-email-marketing), monetizing your newsletter (use /sales-newsletter), or platform-specific setup (use /sales-kit, /sales-mailchimp, etc.).
Tomba.io platform help — domain search, email finder, email verifier, enrichment, author finder, LinkedIn finder, phone finder, bulk operations, browser extensions, API, integrations. Use when you can't find a prospect's email address in Tomba, Tomba verification results look wrong, your enriched contacts are missing data, the Tomba API isn't returning expected results, a Tomba integration isn't syncing, or your Tomba lead lists are disorganized. Do NOT use for enrichment strategy across tools (use /sales-enrich), building prospect lists (use /sales-prospect-list), cross-platform deliverability (use /sales-deliverability), or connecting tools generically (use /sales-integration).
Parses and processes SARIF files from static analysis tools like CodeQL, Semgrep, or other scanners. Triggers on "parse sarif", "read scan results", "aggregate findings", "deduplicate alerts", or "process sarif output". Handles filtering, deduplication, format conversion, and CI/CD integration of SARIF data. Does NOT run scans — use the Semgrep or CodeQL skills for that.
Write, rewrite, edit, review, or localize Russian text for interfaces, marketing materials, and documentation, or generate an interface component that contains Russian text. Use only for UI copy; marketing copy such as landing pages, product pages, ads, promotional emails, campaign messages, and promotional social posts; and documentation such as user guides, technical documentation, instructions, README files, help content, and API references. Do not use for ordinary answers, explanations, discussions, correspondence, meeting notes, support replies, editorial articles, or other Russian text outside interface, marketing, and documentation work.
Autonomous browser control with Cowork-style skill recording. Use when user requests "control my screen", "record workflow", "verify Lovable", "test scrapers", "debug DOM", "autonomous testing", or any browser automation task. Uses CDP + Accessibility Tree for 10x faster, 100% reliable element targeting. NO screenshots.
Reusable .docx formatting conventions for formal standardization documents. Use when formatting headings, notes, enumerations, tables, figures, cross-references, citations, and text in technical standards documents. Applies across SDOs -- concrete style names are provided by the per-SDO drafting skill. Triggers include "format this document", "apply styles", "add cross-references", "insert table/figure", "format notes or citations".
Deploy any GitHub project to Sealos Cloud in one command. Assesses readiness, generates Dockerfile, builds image, creates Sealos template, and deploys — fully automated. Use when user says "deploy to sealos", "deploy this project", "deploy to cloud", "deploy this repo", mentions Sealos deployment, wants to deploy a GitHub URL or local project to a cloud platform, or asks about one-click deployment. Also triggers on "/sealos-deploy".
Audit mobile app source code for insecure data storage vulnerabilities per MASVS-STORAGE controls and MASTG tests. Use when reviewing how an app stores sensitive data locally, checks for data leakage, or assesses data-at-rest protection on Android or iOS.
Application security principles and OWASP Top 10 for building secure web applications. Use when the user asks to review code for security vulnerabilities, implement authentication or authorization, handle secrets or API keys, configure security headers, prevent injection attacks (SQL, XSS, CSRF), prepare for a security audit, or respond to a vulnerability report. Covers input validation, data protection, secrets management, session handling, and common security antipatterns.
Review code for security issues before merge — authz gaps, injection, secrets, unsafe defaults, SSRF, path traversal. Use when reviewing a PR, auditing a diff, shipping auth/payments/uploads, or when the user asks for a security review or OWASP check.
This skill should be used when the user asks to "design system architecture", "evaluate microservices vs monolith", "create architecture diagrams", "analyze dependencies", "choose a database", "plan for scalability", "make technical decisions", or "review system design". Use for architecture decision records (ADRs), tech stack evaluation, system design reviews, dependency analysis, and generating architecture diagrams in Mermaid, PlantUML, or ASCII format.
World-class computer vision skill for image/video processing, object detection, segmentation, and visual AI systems. Expertise in PyTorch, OpenCV, YOLO, SAM, diffusion models, and vision transformers. Includes 3D vision, video analysis, real-time processing, and production deployment. Use when building vision AI systems, implementing object detection, training custom vision models, or optimizing inference pipelines.
Comprehensive SecOps skill for application security, vulnerability management, compliance, and secure development practices. Includes security scanning, vulnerability assessment, compliance checking, and security automation. Use when implementing security controls, conducting security audits, responding to vulnerabilities, or ensuring compliance requirements.
When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," or "SEO health check." For building pages at scale to target keywords, see programmatic-seo. For adding structured data, see schema-markup.
Pull real SEO metrics for any domain using Apify scrapers for Semrush and Ahrefs data. Gets domain authority, organic traffic estimates, keyword rankings, backlink profiles, top performing pages, and auto-discovers competitors from keyword overlap. No Semrush/Ahrefs subscription needed — uses Apify actors that scrape public pages.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.