Skills
98,067 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Guides compliance with Australia's Privacy Act 1988 including the 2024 reform amendments. Covers automated decision-making transparency, children's privacy code, individual rights expansion, enforcement strengthening, and the Australian Privacy Principles (APPs). Keywords: Australia Privacy Act, APPs, OAIC, automated decisions, children privacy code, privacy reform.
Implements automated data deletion workflows for GDPR Article 17 right to erasure and retention period expiry. Covers cascading deletion across dependent systems, dependency handling for referential integrity, confirmation logging, and audit trail generation. Activate for automated deletion, erasure automation, data purge, retention expiry queries.
Generates Records of Processing Activities automatically from IT system inventories including Active Directory, cloud service catalogs, API gateway logs, and database schemas. Covers automated field population, data flow discovery, and system-to-RoPA mapping. Activate for automated RoPA, system inventory, data discovery, auto-population, IT-driven records.
axe-core - accessibility testing engine for automated WCAG compliance checks. USE WHEN: user mentions "axe", "automated accessibility testing", "a11y tests", asks about "integrating accessibility checks", "CI/CD accessibility", "Playwright accessibility", "Jest accessibility", "Vitest axe" DO NOT USE FOR: manual accessibility audits - use `wcag` skill instead
Overall methodology for penetration testing Azure cloud environments. Use when the target uses Azure/Microsoft 365/Entra ID, when Azure-related assets are discovered (Blob Storage/App Service/Azure VM/Azure Functions), when Azure credentials are obtained (Service Principal/Managed Identity/Access Token), or when a security assessment of an Azure environment is required. Provides a full decision tree from unauthenticated enumeration to Entra ID attacks, service privilege escalation, and Cloud-to-OnPrem lateral movement. Covers the attack surface of 35+ Azure services
Comprehensive backend development guide for Node.js/Express/TypeScript microservices. Use when creating routes, controllers, services, repositories, middleware, or working with Express APIs, Prisma database access, Sentry error tracking, Zod validation, unifiedConfig, dependency injection, or async patterns. Covers layered architecture (routes → controllers → services → repositories), BaseController pattern, error handling, performance monitoring, testing strategies, and migration from legacy patterns.
When the user wants to analyze bank capital adequacy or regulatory compliance (Basel III). Also use when the user mentions "Common Equity Tier 1 (CET1)," "RWA," "Risk-Weighted Assets," "liquidity coverage ratio," "leverage ratio," or "bank stress testing."
Posts content to WeChat Official Account (微信公众号) via API or Chrome CDP. Supports article posting (文章) with HTML, markdown, or plain text input, and image-text posting (贴图, formerly 图文) with multiple images. Markdown article workflows default to converting ordinary external links into bottom citations for WeChat-friendly output. Use when user mentions "发布公众号", "post to wechat", "微信公众号", or "贴图/图文/文章".
Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning, vuln hunting (30+ classes), A-to-B chaining, AI/LLM testing, bypass tables, language-specific grep, reporting. Use for ANY bug bounty task.
Behavioral testing methodology — test what users experience, not how code is structured. Use when writing tests, reviewing test quality, planning test strategy for new features, or when existing tests are brittle/verbose/coupled to implementation details. Triggers: writing tests, TDD, test review, "tests keep breaking", "too many mocks", "tests are verbose", test coverage planning, behavior-driven development.
Blender 5.x geometry nodes — procedural modeling, scattering, mesh/curve/volume ops, simulation zones, repeat zones, Bone Info, Font socket, UV nodes, volume grid nodes, and scripting node trees via Python (bpy). Includes 5.0 and 5.1 changes.
Use this skill when reviewing BoxLang code or applications for security vulnerabilities, configuring security settings, preventing injection attacks, handling file uploads safely, managing secrets, or applying secure coding patterns drawn from OWASP Top 10 and CFML/Java security history.
Use this skill when writing BoxLang markup templates (.bxm files), mixing HTML with BoxLang output expressions, using template components like bx:output, bx:loop, bx:if, bx:include, bx:script, building views, or creating any HTML-generating template files.
Use when creating or developing, before writing code or implementation plans - refines rough ideas into fully-formed designs through collaborative questioning, alternative exploration, and incremental validation. Don't use during clear 'mechanical' processes
The entry point for any brand work. Gathers the brand's existing assets itself from just a URL (crawling the site, following its links to social and press), diagnoses how much should change, routes to the right path, and gets-or-makes the brand context document every other design skill reads. Use at the start of any design project, or when the user mentions 'brand context,' 'set up the brand,' 'brand guidelines,' 'our visual identity,' 'rebrand,' 'refresh our brand,' 'what's our brand,' or wants to stop re-explaining their colors, type, and visual direction on every task. Creates and maintains `.agents/brand.md`.
Methodology for Playwright Browser MCP and xterm.js terminal interaction. Use when you need to operate terminals embedded in web pages through a browser, such as pseudo-terminals in CTF ranges, Cloud Shell, or terminals in online IDEs. Covers terminal content reading (5 methods), command execution, output capture, and screenshot fallback strategies. Use this skill whenever the target page contains any form of web terminal (xterm.js/hterm/jQuery Terminal)
Structured bug fixing with reproduction, root cause analysis, fix design, regression risk analysis, and quality review. Only invoke this skill when the user explicitly asks to use it by name (e.g. "use bug-fix", "run bug-fix") or clearly requests a structured/systematic bug fixing process. Do not invoke for general bug reports, error messages, or broken behavior — handle those directly without this skill.
Builds AI agents on Cloudflare using the Agents SDK with state management, real-time WebSockets, scheduled tasks, tool integration, and chat capabilities. Generates production-ready agent code deployed to Workers. Use when: user wants to "build an agent", "AI agent", "chat agent", "stateful agent", mentions "Agents SDK", needs "real-time AI", "WebSocket AI", or asks about agent "state management", "scheduled tasks", or "tool calling".
Build and deploy applications on inference.sh. Use when getting started, understanding the platform, creating apps, configuring resources, or needing an overview of inference.sh app development. Supports both Python and Node.js. Triggers: inference.sh app, belt app, inf.yml, inference.py, inference.js, deploy app, app development, build app, create app, GPU app, VRAM, app resources, app secrets, app integrations, multi-function app
Build, review, debug, configure, migrate, teach, or plan Bun JavaScript/TypeScript work with current docs and a full usage guide. Use for bun 1.4 runtime, bun install/add/remove/update/ci/audit/dedupe/prune, bun.lock, isolated linker and globalStore, workspaces catalogs overrides, trustedDependencies, bunx, Bun.serve (HTTP/2), Bun.Image, Bun.WebView, Bun.markdown, Bun.cron, Bun.Terminal, bun:sqlite, Bun.redis, Bun.SQL, Bun.file, Bun.$, bun test --parallel/--isolate/--shard, bun build --compile --bytecode, bunfig.toml, Node.js 26 compatibility, --hot/--watch, and npm/pnpm/yarn migration to Bun.
This skill is required when initializing, maintaining, and executing the by-harness workflow. Applies when the user mentions by-harness, harness, initialization, continuous task breakdown, executing feat, plan/build/qa/fix, quick fix, session_close, automatic continuation, runtime upgrades, or needs to issue a Java master gate or distributed Java gate to constrain model coding. This skill generates an independent closed-loop scaffold, sharded task storage, a quick-fix triage tool, session close-out tooling, and runtime upgrade tooling, and issues Java hard-rule gates and a distributed Java coding contract; feature_list serves only as a legacy compatibility mirror.
ByteHouse hybrid search Skill supports full-text search + vector search, combining them with the RRF reranking algorithm for more precise results. Use this Skill when the user needs full-text search + vector search in a ByteHouse database, combined with RRF reranking for more precise results.
A ByteHouse cluster load analysis and performance monitoring tool for analyzing cluster load, monitoring resource usage, analyzing query throughput, and identifying performance bottlenecks. Use this Skill when users need to analyze ByteHouse cluster load, monitor resource usage, analyze query throughput, or identify performance bottlenecks.
A skill for starting the ByteHouse MCP Server locally and invoking its tools. Use it to connect to a ByteHouse database and query data, interact with ByteHouse via the MCP protocol, and generate data asset catalogs and lineage analyses. Use this skill when users need to connect to a ByteHouse database, query data, interact with ByteHouse via MCP, or generate data asset catalogs and lineage analyses.
ByteHouse slow query analysis and performance optimization tool for identifying and analyzing slow queries, query performance optimization suggestions, viewing query execution plans, and analyzing query history trends. Use this Skill when users need to identify and analyze slow queries in ByteHouse databases, get query performance optimization suggestions, view query execution plans, or analyze query history trends.
Seederive unstructured data labeling platform, using LLM to batch-analyze and process text, audio and image data. Use this Skill whenever the user mentions any of the following scenarios: data labeling, annotation, sentiment analysis, tag classification, opinion extraction, translation, comment analysis, astroturfing detection, content scoring, tag library management, prompt optimization. Even if the user does not directly mention "Seederive", trigger this Skill whenever it involves classifying/labeling/analyzing/translating/scoring a batch of texts, or mentions phrases such as "help me analyze these comments", "what is the sentiment of this data", "identify astroturfing", "extract opinions", "translate this content", "build a tag system", "optimize it for me because results are poor". It also applies when the user provides a CSV/Excel file and requests batch processing.
Downsamples, resizes, and compresses images using Volcengine LAS with multiple interpolation methods (lanczos, bilinear, nearest). Image resizing, image scaling, and image compression — reduces image resolution, dimensions, and file size. Changes and adjusts DPI settings. Converts between image formats including JPEG, PNG, TIFF. Generates thumbnails and optimizes images for web or print. Supports batch resize for photos and images up to 100MB and 225 megapixels. Note: downscale only, does not upscale. Use this skill when the user wants to resize or downscale images, compress images to reduce file size, change image format (JPEG/PNG/TIFF), adjust image DPI, generate image thumbnails, optimize images for web/print, or batch process multiple images.
Transforms and inspects image objects stored in Volcengine TOS. Use this skill only when the task explicitly involves a TOS bucket/object key, TOS image processing, TOS-to-TOS save-as output, or Volcengine TOS image process syntax such as image/info, image/resize, image/format, image/watermark, image/draw, image/blindwatermark, or image/understanding. Do not use this skill for ordinary uploaded screenshots, local images, UI screenshot analysis, generic OCR, face detection, or visual question answering unless the user clearly says the image is a TOS object or asks to process/save it through TOS.
Inspects videos, extracts frames, and concatenates video clips stored in Volcengine TOS: read video metadata, capture single snapshots, batch-capture multiple frames by explicit timestamps or interval, concatenate multiple video clips, and save results locally or back to TOS. Use this skill when the user needs to get video duration or codec info, capture a poster image or thumbnail, extract frames at specific timestamps, sample frames at regular intervals, merge or join multiple video clips into one — even if they don't explicitly mention 'video processing' or 'frame extraction'.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.