Skills
98,067 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Guides compliance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA, S.C. 2000, c. 5). Covers the 10 fair information principles in Schedule 1, consent requirements, cross-border transfer obligations, breach notification under Division 1.1, and OPC enforcement. Keywords: PIPEDA, Canada privacy, fair information principles, OPC, breach notification, cross-border transfer, consent.
B2B case study writing with STAR framework, data visualization, and research. Covers structure, customer quotes, metrics presentation, and distribution formats. Use for: customer success stories, portfolio pieces, sales enablement, marketing content. Triggers: case study, customer story, success story, b2b case study, client testimonial, customer case study, portfolio case study, use case, customer win, results story
Apply causal inference whenever the user is interpreting metrics, debugging system behavior, reading A/B test results, or trying to understand whether an observed change was caused by an action or by something else. Triggers on phrases like "X caused Y", "since we deployed this, metrics changed", "the A/B test showed a lift", "why did this metric move?", "is this correlation or causation?", "we changed X and Y improved", "how do we know this worked?", "the data shows…", or any situation where conclusions are being drawn from observational data. Also trigger before any decision based on metric interpretation — confusing correlation with causation leads to interventions that don't work and misattribution of credit. Never assume causation without applying this skill.
THE ONLY ENTRY POINT FOR CC10X. Activate this skill for build, debug, review, and plan requests. Use when the user asks to implement, fix, review, plan, test, refactor, or continue code work. Trigger keywords: build, implement, create, write, add, review, audit, debug, fix, error, bug, broken, plan, design, architect, spec, brainstorm, test, refactor, optimize, update, change, research, cc10x, c10x. CRITICAL: Route and execute immediately. Do not stop at describing capabilities.
Use ccupp to generate weak password dictionaries based on social engineering information. ccupp is the most complete password profiling tool for Chinese-language scenarios — input the target's name, birthday, phone number, ID card number and other information, and it automatically generates a password dictionary combining pinyin variants, date variants and cultural numbers (520/1314/888). Use this skill when you need targeted weak password brute-forcing against a person, social engineering password guessing, or a customized dictionary because generic weak password dictionaries are insufficient
Use CDK for container environment penetration and escape. Use when you have entered a container environment (Docker/K8s Pod) and need to assess escape possibilities, exploit container vulnerabilities, or perform information gathering inside the container. CDK integrates container environment assessment, multiple escape techniques (privileged/mount/cgroup/lxcfs/runc/kernel vulnerabilities) and in-container lateral movement. Running the CDK assessment should be the first step after obtaining a container shell. Use this skill in scenarios involving container escape, Docker penetration, K8s security or container privilege escalation
Review documents, proposals, and plans through the lens of a CEO. Simulates feedback from a founder-CEO who is technical, data-driven, and focused on long-term vision while navigating market volatility. Use when you want high-level strategic review: does this idea make sense as a company bet? Is the team right-sized? Will this survive a downturn? Is it community-first?
Create, edit, and deliver editable chart cards in Feishu Docs when preparing reports. Supports 30+ built-in chart types, including bar/column (stacked, grouped, percentage, overlapping comparison), line, area, scatter/bubble, dual-axis, pie/doughnut, rose, radar, funnel, word cloud, Sankey, heatmap, Treemap/Sunburst, as well as business charts such as waterfall/bridge, Mekko, bullet, dumbbell, butterfly, and small-multiple panels. Chart types, annotations, and editing capabilities broadly match ThinkCell. By default, follows MBB (McKinsey/BCG/Bain) consulting-style charting standards and offers report-grade analytical annotations such as difference labels (total, hierarchical, compound growth rate), trendlines, reference lines/regions, and highlight coloring. Supports connecting to Feishu Sheet/Base/Fengshen data sources and keeping them synced; recreating charts from reference images; creating new Feishu Docx documents or inserting/replacing Chart Assistant cards in existing documents; exporting transparent-background PNGs and inserting them into Feishu Docs as selected by the user; and explaining and validating Chart Assistant configurations. Use whenever the user explicitly mentions Chart Assistant, editable charts or configurations, built-in Chart Assistant templates or cards, data-source syncing, turning Fengshen or Feishu Sheet/Base links into editable charts, or requests MBB/consulting-style charts or recreation from a reference image—even if they do not mention the skill name. Do not take over ordinary requests like “make a chart” or “draw a trend chart” unless they require the product capabilities above; do not trigger the chart-creation workflow when only a textual explanation is requested and no chart is to be created
Use this skill when the user asks to check Simulink model compliance against a standard (MISRA, MAB, JMAAB, ISO, DO, IEC, EN, CERT C/CWE, AUTOSAR, Simulink Code Inspector (SLCI)), wants to run Model Advisor checks, or needs a compliance report with fix suggestions. For JMAAB/MAB, supplement deterministic checks with agentic review of uncheckable guidelines.
Methodology for CI/CD pipeline and supply chain attacks. Use when the target uses CI/CD systems such as GitHub Actions/Jenkins/GitLab CI/CircleCI/Terraform Cloud/Atlantis, when pipeline security needs to be tested, or when configuration files such as .github/workflows/Jenkinsfile/.gitlab-ci.yml are discovered. Covers the three PPE (Poisoned Pipeline Execution) attack patterns (D-PPE/I-PPE/3PE), the VCS repository attack surface (code leakage/Webhook abuse/branch protection bypass), Pipeline Secrets theft and lateral movement, and paths from CI/CD into cloud environments
Use when a manuscript's claims need to be checked against the sources cited for them, when literature search results must be verified before they enter a draft, or when an agent or collaborator has proposed references that have not yet been adversarially reviewed. This is claim-to-evidence verification, not bibliography hygiene; for duplicate keys, DOI syntax, and metadata cleanup use citation-verifier instead.
Use when the user has a results draft or a set of data-backed claims and wants each one adversarially verified against the underlying dataset before publishing — a pre-publication red-team of the findings. Extracts the discrete checkable claims from the draft, reproduces each claim's number against the data, stress-tests it against the threats most likely to kill it (outliers, confounds, Simpson's reversals, tiny subgroups, alternative specifications), and marks it verified, fragile, or refuted; fragile and refuted claims are revised — hedged, scoped, or retracted — until every claim is verified or appropriately qualified. The result is a draft where every surviving claim has been reproduced and survived a stress test. Not for open-ended discovery of new findings over a dataset (that is a data-analysis task), and not for diagnosing a single known anomaly or pipeline failure — this is a gate over an existing draft.
Class-validator decorator-based validation for TypeScript. Standard in NestJS. Use when building APIs with NestJS or needing class-based validation. USE WHEN: user mentions "class-validator", "NestJS validation", "DTO validation", "decorator validation", asks about "NestJS DTOs", "ValidationPipe" DO NOT USE FOR: Zod/Yup projects (use zod/yup skills), non-decorator patterns, client-side forms (prefer Zod), non-NestJS backends
AI-native mentor and onboarding flow for the four independent Claude certification tracks in AI Engineering from Scratch. For learners who want to choose a Claude certification, prepare for CCAO-F, CCDV-F, CCAR-F, or CCAR-P, continue a certification path, interactively study the next lesson, run and verify hands-on labs, build and score artifacts, take a diagnostic or mock assessment, or shore up weak exam areas via Claude Code, Codex, ChatGPT, Cursor, or another agent on GitHub.
Manage Claude Code sessions — search by topic or ID, browse recent sessions with full metadata (tags, summaries, titles, cost), view title/nickname history timelines, resume in Ghostty tabs, spawn interactive or headless sessions, monitor live sessions, and bootstrap new setups. Triggers on resume session, find session, list sessions, recent sessions, spawn session, session history, what was I working on, open in ghostty, title history, session nicknames.
Audio processing for video files using FFmpeg. Loudness normalization to streaming standards (LUFS), noise reduction, audio mixing, extraction, replacement, silence detection and removal, equalization, compression, fade effects, format conversion, and audio ducking. Use when user says "audio", "normalize", "volume", "loudness", "LUFS", "noise", "silence", "extract audio", "replace audio", "mix audio", "equalizer", "compress audio", "ducking", or "sidechain".
Only use when the user explicitly invokes /cleanup-storage (or $cleanup-storage in Codex). Never auto-invoke. A skill for relieving storage pressure on a local machine. Examines disk usage, presents deletion candidates grouped by safety category, deletes only after getting the user's approval for each category, and reports the change in available space.
Quickly clone the frequently used repositories of the GitHub user ruan-cat (and tocque/h5mota-web) to agreed directory names according to a fixed checklist, supporting parameter combinations such as shallow clone and multi-branch fetching. Use when the user mentions "clone ruan-cat repositories", "pull frequently used repositories", "clone-ruan-cat", "initialize local multi-repo", "sync Ruan Miaomiao's GitHub repositories", or needs to reproduce the local repository inventory with one click. The command list uses references/clone-commands.md as the single source of truth.
When the user is confused or can't keep up with an agent/LLM's English steps, tool calls, or output, recap in Chinese "what just happened, why, and where we are now". Triggers: the user says "中文说一遍", "刚才干了啥", "用中文复盘", "我跟不上", "这都英文看不懂", or shows confusion after a stretch of English-heavy tool calls/output. Only reports in Chinese; does not change the user's direction or continue the task on its own.
Reviewing a code change — a pull request, a branch or commit-range diff, or a post-implementation self-review of your own work before calling it done. The methodology for judging whether a change already written is safe to merge, and for reporting why. Not for writing the change, only for judging one that already exists. Covers the reviewer-mode reset, diff scoping, a four-tier severity scale with fixed floors, file-line evidence with fix snippets, escalation for high-risk changes, and lenses for correctness, maintainability, security, testing, and performance. Self-contained, so it works installed on its own.
Design, write, review, and test code samples in developer documentation, including executable examples, explanatory snippets, request and response pairs, placeholders, outputs, language choice, sandboxing, and autogenerated samples. Use when docs include API examples, SDK snippets, CLI commands, config examples, tutorials, or code blocks readers may copy.
Analyze codebases and automatically generate architecture diagrams, flowcharts, and org charts. Uses AST parsing to map import dependencies for Python, JS/TS, Go, and Java, outputting Mermaid or SVG files. Triggered when users ask to visualize code architecture, understand dependencies, draw a flowchart, or create a module diagram from source code.
Research a topic (a company, service, website, or product) and render a short promo video as an MP4 drawn entirely in code, in one of the bundled styles or any style the user describes or shows. The story is written from the research. Use for requests such as "make a promo video", "make an intro/launch video", "explainer video", "make a video about this company", or a named visual style. Not for live-action editing, subtitling, or sung vocals.
Generate a deep, code-first project wiki and VitePress documentation site (DeepWiki-style) for a repository. Use when asked to create a complete wiki/manual for a new codebase, build a code-first documentation site, or generate a `codewiki/` folder with structured Markdown, diagrams, and navigation based on the source code (not existing docs).
[Hyper] Use when the user explicitly wants OpenAI Codex CLI (`codex`) for an isolated session, non-interactive run, code review, or session resume. Trigger phrases: 'use codex', 'ask codex', 'run codex', 'codex exec', 'codex review', 'continue the last codex session', or 'use OpenAI CLI to inspect or fix this repo'.
Local mirror of OpenAI Codex product documentation (learn.chatgpt.com/docs): CLI, Cloud, web app, IDE extension, hooks, skills, plugins, MCP, subagents, AGENTS.md, prompts, rules, sandboxing, models, pricing, security, and configuration. Use whenever the user asks how Codex behaves, how to install or configure Codex, or what a Codex flag, slash command, or feature does (including informal phrasing such as "hooks", "--resume", "sandbox modes", "cloud environments"). Read this skill's references/ before generic web search for Codex product questions. Do NOT use for Claude Code, Cursor, or other agents -- in particular, do not use for "Claude Code hooks" or general OpenAI API, ChatGPT, Realtime, or non-Codex coding help.
How the reference commerce agents of either role are structured, covering the loop, where each rule lives, skills, the backend interface, delegates, and model fields. Load when designing or reviewing the structure of a shopping or merchant agent.
Authoring and running behavioral evals for a shopping or merchant agent, covering the case shape, authoring rules, code graders and judges, the run pattern, and poisoned fixtures. Load when writing eval cases or rubrics or deciding how a suite runs.
The reference agents' cache-stable request assembly, covering the static system and per-request context split, the fixed tool list, the rolling conversation breakpoint, which config fields are prompt bytes, and verification. Load when writing or reviewing a commerce agent's prompt assembly, when cache reads are zero, or when a turn's latency or cost is the question.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.