Skills
98,067 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Intelligently organizes your files and folders across your computer by understanding context, finding duplicates, suggesting better structures, and automating cleanup tasks. Reduces cognitive load and keeps your digital workspace tidy without manual effort.
Use when testing file-upload handling, server-side request forgery (SSRF), and insecure deserialization — upload bypasses (type/extension/content, polyglots, path traversal), SSRF to cloud metadata and internal services, and unsafe deserialization sinks. On apps you own or are authorized to test.
Helps users discover and install Claude Code skills. Use this skill when the user asks "how do I do X", "find a skill that can do X", "is there a skill that can...", or wants to extend AI capabilities. Searches the skills.sh ecosystem, verifies quality, and assists with installation.
Fixes flaky tests by analyzing failure patterns from Tuist test insights, identifying root causes, and applying targeted corrections. Can be invoked with a specific test case URL (e.g. `https://tuist.dev/{account}/{project}/tests/test-cases/{id}`) or without arguments to discover and fix all flaky tests in the project.
When the user wants to account for property, plant and equipment or intangibles — capitalization, depreciation, disposals, impairment, or the fixed asset register. Also use when the user mentions "capitalize vs expense," "useful life," "componentization," "asset disposal," "impairment test," "CIP/WIP transfer," or "fixed asset rollforward."
Runs a multi-step procedure as a Python DAG, so ordering, branching and retries are enforced by the runner rather than described in prose a model can generate past. Use for "run these steps in order and retry the flaky one until the check passes", "build a pipeline that fetches, validates, then skips the upload when nothing changed", "make sure these steps cannot be skipped", "resume from where it broke instead of redoing the expensive early stages", "run these independent calls at once and merge the results", or any procedure of 3+ steps with branches, input contracts, or side effects that must not block the critical path. Primitives are depends_on, when=, validate=, retry_until=, detached= and journal_path=. Not for a single sequential call, for steps needing reasoning between them that no predicate captures, or for async and distributed work. To audit whether one verification check can actually go red, use gating. To fan work out across many subagents, use a dynamic workflow.
Generate text prompts or images into ready-to-share videos with this skill. Works with MP4, MOV, PNG, JPG files up to 200MB. Beginners and first-time creators use it for generating simple videos from text or images without any editing experience — processing takes 1-2 minutes on cloud GPUs and you get 1080p MP4 files.
Implement a feature or fix from an Issue, plan file, or free-text description, following project standards. Use when the user wants to start working on an Issue, implement a feature, or fix a bug — stops after opening the PR (use forge-ship to also run review).
When the user wants to optimize any form that is NOT signup/registration — including lead capture forms, contact forms, demo request forms, application forms, survey forms, or checkout forms. Also use when the user mentions "form optimization," "lead form conversions," "form friction," "form fields," "form completion rate," or "contact form." For signup/registration forms, see signup-flow-cro. For popups containing forms, see popup-cro.
Get generated video clips ready to post, without touching a single slider. Upload your text prompts (MP4, MOV, WebM, AVI, up to 500MB), say something like "generate a 30-second video from this script at no cost", and download 1080p MP4 when it's done. Built for content creators who move fast and want to create videos without paying for expensive tools.
Skip the learning curve of professional editing software. Describe what you want — turn these free images into a 30-second product showcase video — and get image-based videos back in 30-60 seconds. Upload JPG, PNG, WebP, HEIC files up to 200MB, and the AI handles AI video creation automatically. Ideal for marketers who want to create videos without original footage.
Transform UI style requirements into production-ready frontend code with systematic design tokens, accessibility compliance, and creative execution. Use when building websites, web applications, React/Vue components, dashboards, landing pages, or any web UI requiring both design consistency and aesthetic quality.
Guide for implementing Langflow frontend query and mutation patterns with Axios and TanStack React Query v5. Trigger when creating or updating API hooks in controllers/API/queries, consuming UseRequestProcessor in components, deciding whether to use useQuery or useMutation, handling conditional queries, cache invalidation, mutation error handling, or migrating legacy API calls to the query hook pattern.
Use when conducting a frontend security review — static analysis (risky HTML patterns, env var exposure), authentication/authorization audit (token storage, route guards, logout), and AI self-penetration testing. Runs `scripts/audit-security.sh`. For CVE triage and deprecated library detection, use `frontend-review-deps`.
Use when reviewing state management architecture — classifying state types (server/URL/form/UI), checking for over-globalization, Jotai/Zustand/Redux patterns, derived state, and logout/cache invalidation. Covers checklist 23-state-management.md.
Write tests that start with acceptance criteria, then add implementation tests for robustness. Use when writing unit tests (Vitest), end-to-end tests (Playwright), visual regression tests, or accessibility tests. Emphasizes user-centric testing, semantic locators, accessibility validation, and the balance between acceptance and implementation testing.
Selects and prototypes player-facing mechanics for meaningful choices, challenge, progression, quests, combat, collection, rewards, and tutorials. Use for deciding what the player repeatedly does and how that action supports the intended experience; defer numerical tuning to game-balance and cross-system feedback analysis to game-systems-design.
Plan and audit mobile or PC game soft launches, test markets, cohort gates, economy balance, IAP, ads, retention, FTUE, live events, store listing tests, crash/performance health, community feedback, and scale/kill decisions. Use when preparing a game before global launch or evaluating whether to expand, iterate, or stop.
GCP cloud environment attack methodology. Use when the target uses Google Cloud Platform or when GCP Service Account/Metadata/Storage Bucket is discovered. Covers Metadata service exploitation, Service Account key theft, IAM privilege escalation, GKE escape, and Storage Bucket enumeration.
Senior GDPR/DSGVO expert and internal/external auditor for data protection compliance. Provides EU GDPR and German DSGVO expertise, privacy impact assessments, data protection auditing, and compliance verification. Use for GDPR compliance assessments, privacy audits, data protection planning, and regulatory compliance verification.
A professional WeChat official account article writing assistant. Use when the user provides a website link, text material or image and needs a WeChat official account article written. Supports multiple writing styles — corporate official account copy, personal tech blogs, community event recaps, product reviews, and more. Skilled at in-depth content creation on AI/tech topics, and also produces well-standardized corporate promotional copy. Enriches content through search tools and optimizes titles and structure. Triggered when the user mentions "official account", "WeChat article", "write a tweet/post", "help me write an article to publish on the official account", and similar scenarios. Even if the user does not explicitly say "official account", consider triggering when they ask for Chinese long-form content (tech blogs, product introductions, event recaps, etc.).
Execute prompts as the Gemma seat through the Pi CLI on OpenRouter, with google/gemma-4-31b-it pinned per invocation. Use when users explicitly request Gemma execution, when a workflow needs a Gemma seat, or when a cross-runner workflow wants a Gemma-backed perspective without leaving the current workspace.
Trigger: PRD, product requirements, definir producto, idear proyecto, armar spec de producto. Genera un PRD sección por sección conversando con el usuario — profundiza con preguntas, presenta alternativas cuando hay decisión real, y solo escribe `PRD.md` cuando cada sección está validada.
Expert media production assistant. Use when requested to help with storyboarding, podcast creation, audio assembly, or complex multi-step media workflows using the GenMedia MCP servers (Veo, Lyria, Gemini TTS, NanoBanana).
The GhostCut API guide skill supports video translation and localization, content distribution overseas, and multimedia localization. It helps AI agents use GhostCut for workflows such as subtitle extraction and removal, translation and dubbing, background music processing, batch composition, and subtitle burning. It also covers image translation, image text removal, and other image-processing capabilities. Powered by GhostCut.
Generate Conventional Commits-style git commit messages from repository changes. Use when Codex needs to write, rewrite, review, or validate a commit message from staged or unstaged diffs, while deriving the correct type, scope, subject, and optional body from the current repository rather than assuming fixed scopes.
Use GitHacker to exploit .git directory disclosure and recover the target's source code. GitHacker is a multi-threaded .git disclosure exploitation tool that, unlike git-dumper/GitHack, can recover more complete content — including stash, all branches, tags, and reflog. Even if the target disables directory listing (403), it can recover branches and tags through brute-force enumeration. Use this skill when the target's /.git/HEAD or /.git/config returns 200, when a .git/ directory is found in directory listings, or when version-control-related files are found during reconnaissance. After recovering the source code, you can look for hardcoded credentials, API keys, and database connection strings.
GitHub MCP Server for repository management, file operations, PR/issue tracking, branch management, and GitHub API integration. Enable AI agents to clone repos, read code, create/update files, manage issues and pull requests, search code, and interact with the GitHub platform. Essential for development workflows, code review automation, CI/CD management, and repository operations. Use when agents need to work with Git repositories, manage development workflows, automate GitHub tasks, or interact with source code.
(NS) Generate and adapt .gitlab-ci.yml for SaaS products with backend and frontend — test, build, E2E gate, deploy by branch. Use when the user asks for GitLab CI, pipeline setup, or CI/CD bootstrap for a monorepo product. Uses references/templates/gitlab-ci.template.yml as baseline. Out of scope for pure agent-runtime repos without backend+frontend layout.
Standard end-to-end workflow for shipping a feature/bugfix from a Jira task to a merged GitLab MR. Use when the user references a Jira task ID (WRA-XX, etc.), asks to "start a task", "create branch from task", "review the last change" / "review change" (optionally with "simplify" keyword, e.g. "review change simplify", to auto-clean before review), "review the whole branch", "commit and push", "create a merge request", "review the MR !N", "post review result to the MR", "fix all issues", or "merge the request". Covers branch naming, commit format, MR creation, micro + macro code review (3-agent parallel), fix loop, and merge.
Screen and evaluate resumes against criteria using ZhiPu GLM-V multimodal model. Reads multiple resume files (PDF/DOCX/TXT), compares against user-defined screening criteria, and outputs a Markdown table with pass/fail analysis. Use when the user wants to filter resumes, compare candidates, or batch-evaluate job applications.
Install the Globalize CLI, authenticate, and verify your organization. Use this skill when the user asks to set up Globalize, install the Globalize CLI, sign in or authenticate with Globalize, or connect their Globalize account. Also use when the user mentions @globalize-now/cli-client or globalise-now-cli and needs to get signed in. This skill handles installation and authentication only—to create a translation project and connect a repository, use globalize-now-project-setup. For managing existing projects (glossaries, style guides, team members), use globalize-now-cli-use.
Trade perpetuals and spot on GMX V2 — open/close leveraged positions, place limit/stop orders, add/remove GM pool liquidity, query markets and positions. Trigger phrases: open position GMX, close position GMX, GMX trade, GMX leverage, GMX liquidity, deposit GM pool, withdraw GM pool, GMX stop loss, GMX take profit, cancel order GMX, claim funding fees GMX.
Goal-driven long-run workflow: run an agent autonomously for hours toward a verifiable goal. Five stages — ① deep intake interview and output contract (approach frozen before launch) ② layered acceptance criteria + design the /goal condition (measurable end state, stated check, constraints, turn/time cap) ③ sub-agent division and context management (context-rot mitigation) ④ launch the long run (/goal, claude -p non-interactive, or manual-loop fallback) ⑤ completion report and human acceptance. Built on Claude Code’s native /goal harness, with a generic fallback for environments without /goal. Triggers — 「goal 长跑」「goal run」「goal-driven」「目标驱动长跑」「一个 goal 下去跑」「长跑目标」「无人值守跑任务」「goal-run」 / goal run, goal-driven, long-run goal, autonomous run, run until done
Draft, review, or activate a compact /goal when the user wants Codex to keep working until a verifiable result is true. Defines the result, evidence, boundaries, stop conditions, and only useful delegation. Not for ordinary implementation, Q&A, one-off edits, loose brainstorming, or subjective work with no completion test.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.