Skills
98,067 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Go language best practices guide covering frameworks (Gin/Go-Kratos), ORM (GORM), database migrations (Goose), DDD project structure, error handling, concurrency patterns, testing (99% coverage target), and Lint tools. This skill should be used when writing, reviewing, or refactoring Go code to ensure best practices are followed. Triggers on Go project development, code review, performance optimization, or architecture design.
Google Ads campaign performance analysis using GAQL (Google Ads Query Language). Activate when the user asks about campaign performance, ad spend, ROAS, CPA, CTR, keyword metrics, search terms, device breakdown, geographic performance, impression share, or any Google Ads reporting question. Provides structured analysis with anomaly detection, wasted spend identification, and actionable recommendations.
Skip the learning curve of professional editing software. Describe what you want — generate a 30-second video clip from my product description — and get AI-generated videos back in 1-2 minutes. Upload MP4, MOV, PNG, JPG files up to 200MB, and the AI handles AI video generation automatically. Ideal for content creators and marketers who want to create videos without paying for expensive generation platforms.
This skill is designed to help users automatically extract business data from Google Maps search results. The Agent should proactively apply this skill when the user makes the following requests: searching for coffee shops in a specific city, finding dentists or medical clinics nearby, tracking competitors' locations in a certain area, extracting business leads from Google Maps lists, gathering restaurant data for market research, finding hotels or accommodation options in a region, locating specific services like coworking spaces or gyms, monitoring new business openings in a neighborhood, collecting contact information and addresses for sales prospecting, analyzing price ranges and cuisines of local eateries, getting ratings and review counts for a list of businesses, exporting local business data into a CRM or database.
Generate videos with Google Veo models via inference.sh CLI. Models: Veo 3.1, Veo 3.1 Fast, Veo 3, Veo 3 Fast, Veo 2. Capabilities: text-to-video, cinematic output, high quality video generation. Triggers: veo, google veo, veo 3, veo 2, veo 3.1, vertex ai video, google video generation, google video ai, veo model, veo video
Manage Google Play Developer Console using the gpd CLI. Use when working with Android app publishing, Play Store releases, app reviews, Android vitals, in-app purchases, subscriptions, or when the user mentions Google Play, Play Store, Android publishing, or gpd.
Apply meta-analysis to synthesize effect sizes across multiple studies, assess heterogeneity, and evaluate publication bias. Use this skill when the user needs to combine findings from prior research, compare fixed-effect vs random-effects models, compute pooled effect sizes, or when they ask 'what does the overall evidence say', 'how do I combine results across studies', or 'is there publication bias'.
Generates data visualization charts (bar, line, area, pie, doughnut, scatter, radar, treemap) as PNG using Apache ECharts v6. 1080×1080px default, 5 style presets, highlight annotations. Trigger when user says "create a chart", "visualize data", "make a bar chart", "line graph", "pie chart", "data visualization", "chart this data", "plot", "graph", or "visualize these numbers".
Creates animated looping GIFs from CSS animations (default) or AI image-to-video. 800×800px default, 6 animation types, 4 style presets. Trigger when user says "create an animated gif", "make a looping gif", "animated banner", "CSS animation gif", "social media animation", "make this loop", "animated graphic", or "motion graphic".
Search and analyze X (Twitter) using xAI Grok 4 via OpenRouter with Live Search. Trigger on prompts that explicitly or implicitly ask to "search Twitter/X", "what's trending", "tweets from @handle", "hashtag #…", "what are people saying", or that require tweet-level activity/engagement from X.
WeChat official account positioning analysis + a three-piece design (account bio / auto-reply after follow / custom menu). First reverse-engineer a one-sentence positioning through layered interviews and past articles, then derive three pieces of content that can be pasted directly into the official account backend, all with character-count validation. Triggered when the user says "official account positioning", "how to write an account bio", "feature description", "official account introduction", "reply after follow", "welcome message", "auto-reply", "how to design the menu", "menu bar", "official account setup", "how to get a new account started", or "nobody follows my account".
Short-form writing for WeChat official accounts (under 1,000 characters, text only, no images). Turn an observation, a test, or a line of thought into a quick, punchy post, or compress a long article or raw material into a short piece. The core is a set of style rules: first person without preaching, no AI tone, rhythm through paragraph breaks, and endings that land on a concrete image. Triggered when the user says "write something short", "official account short post", "under a thousand words", "jot one down", "write a short piece about this", "compress into a short post", or "the no-images kind".
A skill for retrieving 2026 FIFA World Cup data. It scrapes from Baidu Sports the group configurations, schedules and match details (analysis/lineups/match events/statistics/odds indices) of the 48 participating teams, team details (profile/lineups/historical results/data), player details (profile/updates/data/schedule) and ranking data (standings/player rankings/FIFA rankings), and connects to official sports lottery odds (win-draw-loss/handicap/score/total goals/mixed parlay) from China Sports Lottery. Use this skill when the user needs to look up 2026 World Cup teams, schedules, match data, lineups, historical results, rankings or sports lottery odds. A skill for retrieving 2026 FIFA World Cup data. Scrapes from Baidu Sports and sporttery.cn.
Interact with Home Assistant via the REST API on a NixOS host. Use when adding integrations, querying entities, managing config flows, creating API tokens, or automating HA setup programmatically. Also covers identifying device protocols (Matter, Zigbee, Thread, HomeKit) from the device registry. Trigger phrases: "add HA integration", "configure home assistant", "query HA entities", "create HA token", "HA REST API", "pair homekit", "set up matter in HA", "add spotify to HA", "is this device zigbee or thread", "what protocol is this device", "move devices to ZHA", "identify matter devices".
Run condition-based vault health diagnostics. 8 categories — schema compliance, orphan detection, link health, description quality, three-space boundaries, processing throughput, stale notes, MOC coherence. 3 modes — quick (schema+orphans+links), full (all 8), three-space (boundary violations only). Returns actionable FAIL/WARN/PASS report with specific fixes ranked by impact. Triggers on "/health", "check vault health", "maintenance report", "what needs fixing".
Guide developers in using Hebrew NLP models and tools, including DictaLM, DictaBERT, AlephBERT, and ivrit.ai. Use when the user asks about Hebrew text processing, Hebrew NLP, “ivrit,” Hebrew tokenization, Hebrew NER, Hebrew sentiment analysis, Hebrew speech-to-text, or needs to process Hebrew text programmatically. Covers model selection, preprocessing, and Hebrew-specific NLP challenges. Do NOT use for Arabic NLP (different tools) or general English NLP tasks.
Continuous self-improvement system for Hermes Agent. Analyzes your past sessions to find recurring failures and skill gaps, then automatically creates or patches skills and runs self-evolution to fix them. Set it to run overnight and wake up to a better agent. Use /dojo to start.
Iterates toward a goal one measured change at a time, keeping what raises the score and reverting what does not, until a fresh run of the check proves the completion criteria met. Use when the user says "hillclimb", or when the user gives a goal and completion criteria and asks to hillclimb, iterate, or keep going until they pass.
Use when the user's task involves HiUI (@hi-ui/*) — writing HiUI components, debugging HiUI issues, querying HiUI props/docs, migrating from HiUI V4 to V5, or setting up React 19 compatibility with @hi-ui/patch-for-react. Triggers on imports from '@hi-ui/*', hi-ui/hiui mentions, or explicit HiUI questions.
Monitors Bitflow HODLMM bins to keep LP positions in the active earning range. Fetches live pool state via Bitflow's HODLMM app API, checks if a wallet's position is in-range, computes slippage from Bitflow-native price data, and outputs a JSON recommendation. Read-only — rebalance actions require explicit human approval.
Create event-driven hooks for Claude Code automation. Use when the user wants to create hooks, automate tool validation, add pre/post processing, enforce security policies, or configure settings.json hooks. Triggers: create hook, build hook, PreToolUse, PostToolUse, event automation, tool validation, security hook
Upload local HTML or Markdown artifacts to baseurl.ai and return a shareable, password-bearing preview URL. Use this skill whenever the user asks to publish, share, host, preview, send a link for, or make accessible any local .html, .htm, .md, or .markdown file, including reports or documents you just generated. Also use it when a workflow produces renderable local content and the next useful step is a URL someone else can open. Do not use it for production deployments, long-term hosting, or non-renderable source files unless you first create a local HTML or Markdown artifact.
Use historical analogies to inform strategic decisions by identifying structural similarities and differences between past and present situations. Use this skill when the user draws on historical precedent to justify a strategy, needs to evaluate whether a historical comparison is valid, or wants to learn from past events — even if they say 'this is like the dotcom bubble', 'history repeats itself', or 'what can we learn from how X handled this'.
Hunt insecure deserialization — Java gadget chains (ysoserial), PHP object injection (phpggc), Python pickle RCE, .NET BinaryFormatter, Ruby Marshal.load, JNDI/Log4Shell. RCE via deserialization is almost always Critical. Use when the target runs Java, PHP serialization, Python pickle, .NET, or Ruby on Rails.
Hunt MFA / 2FA bypasses across 7 patterns: (1) MFA not enforced on sensitive endpoints (password changes or email-change acceptance without an MFA challenge), (2) skipping the MFA step by navigating directly to a post-login URL, (3) MFA-token replay (the same code is accepted twice), (4) brute-forcing the 6-digit OTP without rate limiting (10^6 attempts at server speed), (5) race conditions in OTP validation, (6) recovery-code exposure via /api/me, and (7) backup-factor downgrade (SMS factor without rate limiting). Also covers the chain: cookie theft + password oracle + no step-up = ATO without an MFA challenge. Detection: trace the auth flow in Burp, find every state transition, check whether MFA is middleware-gated or enforced per endpoint, and check OTP entropy and rate limits on OTP validation. Validate that an attacker session can reach the post-MFA state. Use when hunting auth bypasses, MFA flows, or chaining primitives toward ATO.
Hunt session management vulnerabilities — session fixation (no regeneration on login), insufficient invalidation on logout / password-change / email-change, predictable or low-entropy session IDs, JWT-as-session with no exp/revocation, refresh-token rotation/reuse-detection gaps, OAuth/SSO session linkage, device-bound-session (DBSC) downgrade, and cookie attribute issues (Secure/HttpOnly/SameSite/__Host-). Validate with TWO real sessions (attacker A + victim B), body-diff every 200, and OOB confirmation for theft chains. Medium to Critical (fixation→admin hijack, no-invalidation→persistent ATO).
Hunting skill for ssrf vulnerabilities. Built from 15 public bug bounty reports including AWS metadata SSRF (HackerOne $25k Analytics PDF, Shopify Exchange $25k, Capital One 106M-record breach, Dropbox/HelloSign $4,913), GCP metadata SSRF (Snapchat $4k), Azure IMDS SSRF (Azure DevOps $15k chain, ChatGPT Custom Actions MSRC), DNS rebinding SSRF (Concrete CMS, GitLab UrlBlocker), gopher-protocol-to-Redis-RCE (Yahoo Mail $15k), link-preview SSRF (Reddit Matrix $6k), and headless-browser PDF-generator SSRF chains. Use when hunting SSRF on any target — OOB Collaborator confirmation mandatory for blind cases.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.