Skills
98,067 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Use this skill whenever the user wants to create, improve, optimize, review, or rewrite a resume, CV, curriculum vitae, or hoja de vida. Triggers include: any mention of 'resume', 'CV', 'curriculum', 'hoja de vida', 'job application', 'ATS optimization', 'resume review', 'cover letter', or requests to prepare documents for job applications. Also use when the user asks to tailor a resume to a specific job description, improve bullet points, add metrics/quantification, check ATS compatibility, translate a resume between languages, or create multiple versions of a resume. Use this skill even if the user just says 'help me get hired', 'optimize my application', 'I need to update my resume', or 'review my experience section'. Do NOT use for LinkedIn profile optimization, portfolio websites, or general document formatting unrelated to job applications.
Parse and report retirement holdings from Vanguard and Fidelity CSV exports. CSV-only by design — the Vanguard IRAs and Fidelity 401k are not connected in SnapTrade, so there is no live/DB path yet and no persistent destination. Triggers on sync retirement, update retirement, vanguard sync, 401k update, IRA sync, or working with imports/retirement/ files.
Reverse engineer and security-review Chrome/Firefox browser extensions — unpacking the CRX/XPI, reading the manifest for over-broad permissions, and tracing the trust boundary between page, content script, background service worker, and native messaging host. Use when analyzing a suspicious or over-permissioned extension, auditing your own extension's privilege model, or investigating how a content script exposes privileged APIs to a web page
Review vendor agreements, NDAs, or SaaS subscriptions against the review guidelines. Identify the agreement structure from its title, route to the correct review skill, and consolidate the output into a single memo. Use when the user says "review this contract", "check this master agreement", "is this NDA okay", "look at this SaaS agreement", or attaches an inbound agreement for review.
Reviews a code diff for exploitable security vulnerabilities in a fresh-context read-only subagent, reporting only high-confidence findings with an exploit scenario and fix. Use when the user says "security review", or when asked for a security review of code, a diff, a branch, or a PR. Not for general review; use reviewing-code. Not for a third-party clone; use auditing-repo-security.
Reviews PostHog's warehouse suggestions with a person and acts on them. Explains why a view should be materialized, unmaterialized, certified or deprecated using the numbers in the suggestion, changes a materialize suggestion's refresh mode, keys or interval when the person wants something else, then accepts, dismisses or assigns it. Use when the user asks what PostHog suggests for their data warehouse, whether to materialize a view, why a view should refresh incrementally or every few hours, or wants to accept, change, dismiss or assign a warehouse suggestion.
Builds the "RHDH CVE Management - <version>-plugins.csv" export by walking `rhdh-plugin-export-overlays` git history on a release branch since a revision, scoped to generally-available plugin workspaces, then enriching each CVE from Jira RHIDP, RHDHBUGS, and RHDHPLAN. Use for "generate the plugin overlay CVE CSV for 1.10.3", "what CVEs were fixed in plugins since 1.10.2", or "rebuild the plugin CVE list with the ProdSec CVSS scores".
Generates the Red Hat Developer Hub dynamic-plugins.yaml configuration that makes an exported Backstage frontend plugin appear in RHDH: derive the Scalprum name from plugin-manifest.json or the package name, and write the pluginConfig.dynamicPlugins.frontend block with dynamicRoutes, menuItems, mountPoints, appIcons, apiFactories, routeBindings, entity tabs, cards, context menu items, and provider components. Use for "generate the wiring for this plugin", "which mount point does this card need", entity page customization, importName, or a plugin that installs but never renders. To apply the configuration to a running instance instead, use /rhdh-local.
Advises where a permanent automated test for the Red Hat Developer Hub dynamic-plugin ecosystem should live: which repository (rhdh, rhdh-plugins, or rhdh-plugin-export-overlays), which layer (L1 unit, L2 startTestBackend integration, L3 React Testing Library component, L4a cluster-free Playwright, or L4b cluster e2e), which harness, and which neighbouring file to mirror. Use for "where should this test live", "which repo and layer for this test", "does this need a cluster", "is this e2e too expensive", or a review comment that a test sits at the wrong layer. Advice only — it recommends a placement and names a template; it writes no test and changes no file.
Extract anonymized frame-by-frame body and hand trajectories from an authorized reference video, with skeleton previews, confidence evidence, and machine-readable keypoints. Use when the user asks to 提取博主动作, 提取人体动作轨迹, 做姿态参考, 生成骨架视频, or prepare motion control data for an avatar; do not route graphic-animation replication here.
Build a RoadRunner Scenario programmatically from an OpenSCENARIO 1.x (.xosc) file using the `roadrunner-scenario-authoring` skill. Use when the user wants to recreate a scenario from a .xosc file, interpret an OpenSCENARIO file and build it programmatically, reconstruct a .xosc as a RoadRunner scenario, generate a MATLAB script from a .xosc file, or convert an OpenSCENARIO file to MATLAB code. Do NOT use when the user says "import" a .xosc file — that means they want RoadRunner's built-in importScenario API, not programmatic reconstruction. Handles position translation (LanePosition and RoadPosition to world coordinates), construct mapping, relative references, trajectory/route handling, parameter expressions, catalog references, and phase logic topology.
Programmatically author RoadRunner scenarios from MATLAB using roadrunnerAPI. Use when adding actors, creating routes, building scenario logic (phases, conditions, actions), placing vehicles/pedestrians, defining cut-in/crossing/ follow scenarios, or any programmatic scenario creation in RoadRunner. Triggers on: roadrunnerAPI, scenario authoring, add actor, create route, phase logic, cut-in scenario, pedestrian crossing, scenario from MATLAB.
Expert guidance for simulating RoadRunner scenarios via the MATLAB programmatic API and Simulink co-simulation. Use when the user wants to run a simulation, step through a simulation, control actors during co-simulation, add observers, attach sensors, retrieve simulation logs, or read/write scenario variables. Covers simulateScenario, createSimulation, ScenarioSimulation set/get, ActorSimulation getAttribute/setAttribute, addObserver, SensorSimulation, Simulink co-sim blocks, and publishActorBehavior. NOT for project setup, scene building, scenario authoring, or trajectory export.
Diagnose Roblox gameplay, replication, performance, and runtime issues. Use when debugging Roblox bugs, Luau errors, replication issues, RemoteEvent problems, DataStore failures, UI not updating, physics/network ownership issues, memory leaks, or performance regressions in Roblox experiences.
RouterOS /app YAML format for container applications (7.21+ builtin app, 7.22+ custom YAML creation). Use when: writing or validating RouterOS /app YAML files, working with MikroTik container apps, building docker-compose-like definitions for RouterOS, creating /app store schemas, debugging /app validation errors, or when the user mentions /app, tikapp, or RouterOS container YAML.
ALWAYS USE before running .NET tests or answering with a test command or flags. Trigger on "run the tests", "exact dotnet test command", one test/class/category/trait/target framework, combined filters, `--filter-query`, `--no-build`, `--diag`, diagnostic logs, TRX, coverage collection, crash/hang dumps, filter errors, or unrecognized options. Chooses repository-compatible classic, VSTest, bridged MTP, or native MTP syntax for MSTest/xUnit/NUnit/TUnit. DO NOT USE for platform identification alone (platform-detection), writing or debugging test code, interpreting an existing coverage report, CI investigation, migration, or a persistent hot reload/watch loop.
Design and review Bevy fixed-step 2D physics loops with velocity components, deterministic movement, collision prediction, interpolation, impulses, and tweened presentation. Use when movement depends on frame rate, collision misses appear at high speed, physics and animation are tangled, or Bevy gameplay needs stable simulation steps.
Canonical SaaS product UI skill for designing, reviewing, or implementing calm, premium, production-ready interfaces across dashboards, settings, admin/runtime screens, editors, builders, tables, forms, drawers, sidebars, and related public surfaces. Use when you need strong hierarchy, reusable tokens, typography, responsive layout rules, component consistency, and app-surface patterns rather than decorative one-off design.
Create a competitive sales battlecard for any competitor. Use when asked to build a battlecard, competitive comparison, sales cheat sheet, or objection handling guide for a specific competitor. Produces a one-page battlecard with positioning, differentiators, objection responses, and landmines.
Implementation of sandbox evasion and anti-analysis techniques. Use when a malicious payload needs to bypass automated sandbox analysis (AnyRun/Cuckoo/CAPE/Joe/Windows Defender Sandbox). Covers implementation methods for mainstream evasion techniques such as environment detection, timing evasion, user interaction detection, and virtualization detection.
Prose-quality rules for writing scientific manuscript text: abstract, introduction, results, discussion. The headline rule is a strict em-dash budget: the long dash (—) is overused and reads as a stylistic tic, so cap it and rewrite with commas, colons, parentheses, or a period. Also caps semicolons and colons, the usual replacements, and covers hedging, sentence rhythm, paragraph openers, and AI-sounding prose (去 AI 味, AI 味重, sounds AI-generated) with an information test, a corpus-checked list of tells and a detection script. Load whenever drafting or revising manuscript prose (not figures; that is figure-planner).
Comprehensive toolkit for survival analysis and time-to-event modeling in Python using scikit-survival. Use when working with censored survival data, performing time-to-event analysis, fitting Cox models, Random Survival Forests, Gradient Boosting models, or Survival SVMs, evaluating survival predictions with concordance index or Brier score, handling competing risks, or implementing any survival analysis workflow with the scikit-survival library.
This skill should be used when working with single-cell omics data analysis using scvi-tools, including scRNA-seq, scATAC-seq, CITE-seq, spatial transcriptomics, and other single-cell modalities. Use this skill for probabilistic modeling, batch correction, dimensionality reduction, differential expression, cell type annotation, multimodal integration, and spatial analysis tasks.
Integrate Seam's lower-level Access Codes API for direct, manual control over smart lock access codes. Create, update, and delete individual time-bound access codes on specific devices. Use this skill when someone manages their own credential lifecycle and just needs Seam for device communication, wants full control over individual access codes, or their use case doesn't fit the reservation model. Common use cases: coworking room booking, gym access, office visitor codes, custom access management. Works with August, Yale, Schlage, Kwikset, and other smart locks.
Use when hunting for exposed secrets and auditing how an app you own manages them — API keys, tokens, passwords, and private keys in source, git history, binaries, logs, config, and CI; plus vaulting, rotation, and least-privilege of the secrets themselves.
Create or refine a concise, normative security policy ("Blue Book") for sensitive applications. Use when users need a threat model, data classification rules, auth/session policy, logging and audit requirements, retention/deletion expectations, incident response, or security gates for apps handling PII/PHI/financial data.
Use when you want to security-test, pentest, audit, or find vulnerabilities in an application you own or are authorized to test — entry point that confirms authorization and routes to the right phase (threat model, code audit, active test, or hardening).
Converts the user's natural-language video request into prompts that follow the advanced Doubao Seedance 2.0 formula (8 elements: precise subject + action details + scene and environment + lighting and color tone + camera movement + visual style + image quality + constraints). Use for requests such as "write me a Seedance prompt," "generate a video prompt," "make a product ad video," or "generate XX with Seedance." If the user does not explicitly mention Seedance but describes a complex, cinematic single-shot video with multiple subjects, this skill is also preferred.
Use when searching academic papers, looking up citations, finding authors, or getting paper recommendations using the Semantic Scholar API. Triggers on queries about research papers, academic search, citation analysis, or literature discovery.
Send and receive direct messages on OpenAnt. Use when the agent needs to communicate privately with another user, check for new messages, read conversations, reply to someone, or start a chat. Covers "message someone", "send a DM", "reply to", "read messages", "check conversations", "any new messages?", "what did they say?", "check inbox".
Implement an agreed software specification, finish a partial implementation, or correct implementation and PR review findings. Use for scoped delivery with meaningful TDD where practical and evidence of complete behavior. Bring a disproved spec design to the user with options before replacing it.
Comprehensive security engineering skill for application security, penetration testing, security architecture, and compliance auditing. Includes security assessment tools, threat modeling, cryptography implementation, and security automation. Use when designing security architecture, conducting penetration tests, implementing cryptography, or performing security audits
Language-independent tokenizer treating text as raw Unicode. Supports BPE and Unigram algorithms. Fast (50k sentences/sec), lightweight (6MB memory), deterministic vocabulary. Used by T5, ALBERT, XLNet, mBART. Train on raw text without pre-tokenization. Use when you need multilingual support, CJK languages, or reproducible tokenization.
Email campaign/sequence performance review composite. Pulls campaign data (sends, opens, replies, bounces), reads actual email copy and subject lines, analyzes reply content (objections, positive interest, questions), and produces a diagnostic report covering quantitative metrics, copy quality, lead quality, and actionable recommendations. Tool-agnostic — works with Smartlead (MCP), Instantly, Outreach, Lemlist, Apollo, or CSV data.
A general-purpose A-share "chokepoint" stock-picking skill. Applies Serenity's (@aleabitoreddit) supply-chain bottleneck theory to run a structured analysis of any A-share sector or industrial chain, finding the bottleneck links where a single supply cutoff halts the entire industry, and screening small-cap stocks in those links that have technical barriers and capital signals. Triggers: analyze sector XX, find XX chokepoints, serenity analysis, A-share bottleneck industrial chain. Example sectors: power, optical modules, medical devices, semiconductor equipment, defense, new energy vehicles, and any other sector. Data sources: neodata-financial-search (market data/research reports/fund flows) + westock-data (chips/block trades/institutions). Note: this skill does not predict overall market trends and is not suitable for small caps driven purely by theme speculation with no substantive industry logic.
Build highly distinctive, production-ready Flutter interfaces with exceptional design fidelity. Use when designing a new app or new screens from scratch, where no visual language is established yet. Do not use when extending or fixing screens in an app that already has a design system, theme or style guide — follow what the app already does instead.
Initialize and configure Astro/Airflow projects. Use when the user wants to create a new project, set up dependencies, configure connections or variables, or understand project structure. For running the local environment, see managing-astro-local-env
Generate a shared devcontainer (Ubuntu base image, Node, GitHub CLI, one persistent config volume) in the current repo — one container every AI CLI installs into, added independently via its four companion setup-<tool>-devcontainer skills — optionally layering on SSH deploy-key/signing-key automation for agent-driven git push and signed commits, and/or an opt-in default-deny network egress firewall (iptables+ipset, allowlist derived from a Network Manifest). Use when the user wants to add a devcontainer to a repo, add SSH key automation to an existing devcontainer, restrict a devcontainer's outbound network, or connect a Local Checkout to a real GitHub repo. Not for adding an AI CLI itself — run the matching setup-<tool>-devcontainer skill for that, after this one.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.