Skills

G

gtm-monitor

cognyai / claude-code-marketing-skills

Weekly GTM container check — new, edited and removed tags, unpublished draft changes, orphaned tags, workspace status — diffed week-over-week

H

hackernews-intel

varnan-tech / opendirectory

Monitors Hacker News for user-configured keywords, deduplicates against a local SQLite cache, and sends Slack alerts for new matching posts. Use when asked to monitor Hacker News for mentions, track keywords on HN, get alerts when something is posted about a topic on Hacker News, or set up HN keyword monitoring. Trigger when a user mentions Hacker News alerts, HN monitoring, keyword tracking on HN, or wants to know when a topic appears on Hacker News.

H

hardcoded-credential-hunt

uphiago / recon-skills

Detect hardcoded passwords in HTML forms, JavaScript, and API responses.

No description yet

H

harness-master

wyattowalsh / agents

Audit harness configs, discover gaps, usage signals, apply approved fixes. Use when tuning Claude, Codex, Copilot, Cursor, Gemini, Grok, OpenCode, Cherry, or LM Studio. NOT agents, MCP, or app telemetry.

H

health-data-analysis

sidetoolco / org-charts

Specialized skill for analyzing personal health data, medical records, lab results, and supplement protocols. Use when working with health records, clinical data, lab values, or health optimization planning.

H

helm

alphaonedev / openclaw-graph

Helm is a package manager for Kubernetes that allows defining, installing, and upgrading applications via charts.

Use when working with Helm templates and template functions for generating Kubernetes manifests dynamically.

H

hermes-agent

evolv3-ai / vibe-skills

Deploy and manage Hermes Agent (Nous Research) on remote servers. Self-improving AI agent with built-in learning loop, multi-platform messaging gateway (Telegram, Discord, Slack, WhatsApp, Signal, Mattermost), cron scheduling, MCP integration, and persistent memory. Supports Docker, bare-metal, and systemd deployments. Use when: deploying hermes-agent to a server, configuring hermes messaging gateway, managing hermes installations, troubleshooting hermes issues, migrating from OpenClaw to hermes, setting up hermes cron jobs, or any task involving hermes-agent deployment and operations. Keywords: hermes, hermes-agent, nous research, AI agent, messaging gateway, self-improving agent, openclaw migration.

H

highcharts

vamseeachanta / workspace-hub

Create enterprise-grade interactive charts with Highcharts including

H

highrise

membranedev / application-skills

Highrise integration. Manage persons, organizations, deals, leads, cases, tasks and more. Use when the user wants to interact with Highrise data.

Himalaya CLI for IMAP/SMTP mail: list, read, search, compose, reply, forward, copy, move, delete

H

hinge

artemnovichkov / hinge

Control the hinge (fold) angle of a foldable iPhone Simulator such as iPhone Duo. Use when you need to fold, unfold, half-open, or animate the fold of a running simulator, read its current hinge angle, or test how an app reacts to hinge and display changes.

H

hodlmm-signal-allocator

aibtcdev / skills

Signal-gated HODLMM yield allocator. Reads aibtc.news signals and Quantum Readiness Index alongside live HODLMM APR to compute a risk-adjusted yield score, then executes a Bitflow swap to prepare wallet for HODLMM deposit when conditions align.

H

hono-routing

jackspace / claudeskillz

This skill provides comprehensive knowledge for building type-safe APIs with Hono, focusing on routing patterns, middleware composition, request validation, RPC client/server patterns, error handling, and context management. Use when: building APIs with Hono (any runtime), setting up request validation with Zod/Valibot/Typia/ArkType validators, creating type-safe RPC client/server communication, implementing custom middleware, handling errors with HTTPException, extending Hono context with custom variables, or encountering middleware type inference issues, validation hook confusion, or RPC performance problems. Keywords: hono, hono routing, hono middleware, hono rpc, hono validator, zod validator, valibot validator, type-safe api, hono context, hono error handling, HTTPException, c.req.valid, middleware composition, hono hooks, typed routes, hono client, middleware response not typed, hono validation failed, hono rpc type inference

H

how-to-print-multiple-objects-to-the-console-with-print-in-dart

rodydavis / skills

Learn how to print multiple objects to the console in Dart using Records, offering a similar experience to JavaScript's `console.log()` functionality.

H

hr-partner

membranedev / application-skills

HR Partner integration. Manage data, records, and automate workflows. Use when the user wants to interact with HR Partner data.

H

html-report-design

ted0321 / kotetsu-work-ai-skills

Design system that makes HTML output look like a professional consulting deliverable instead of default AI styling. Use WHENEVER generating any HTML document — report, analysis memo, proposal, research summary, dashboard, artifact — and when the user says 「HTMLで資料」「HTMLでまとめて」「レポートにして」「コンサル風に」「資料っぽく」「デザインがダサい」 or asks to restyle existing AI-generated HTML. Replaces boxes, borders, gradients, emoji and rainbow colors with whitespace-driven, typography-first, print-ready (A4) design.

Convert HTML/Markdown to PowerPoint presentations using Marp

H

http-endpoints

val-town / plugins

Use when building an HTTP val — a web endpoint, API route, webhook receiver, or any val that responds to HTTP requests. Covers the handler signature, Hono usage, the endpoint URL, CORS behavior, redirects, and Val Town-specific limitations.

H

http2-header-impersonation

uphiago / recon-skills

Spoof HTTP/2 SETTINGS frames and pseudo-header order per browser profile.

H

huawei-cloud-agentarts-otel-ingestion

huaweicloud / huaweicloud-skills

OpenTelemetry ingestion skill for Huawei Cloud AgentArts observability platform. Provides OTel telemetry data (trace/metrics/logs) ingestion into AgentArts agent-ops, AI Agent observation with gen_ai semantic conventions, auto-configuration for Java/Python/Node.js/Go applications, and ingestion diagnostics and verification. Covers APM deliverConfig forwarding (Path A) and OTLP direct connection (Path B). Triggers include: "AgentArts OTel", "AgentArts observability", "AI agent tracing", "gen_ai telemetry", "AgentArts OTLP", "otel接入AgentArts", "Agent观测配置"

H

hugging-science

hkphysics / scientific-agent-skills

Use when the user is doing AI/ML work in a scientific domain such as biology, chemistry, physics, astronomy, climate, genomics, materials, medicine, ecology, energy, engineering, math, drug discovery, protein design, weather modeling, theorem proving, single-cell, or PDE solving. Hugging Science is a curated catalog of scientific datasets, models, blog posts, and interactive Spaces. This skill helps discover and use resources via `datasets`, `transformers`, the HF Inference API, `gradio_client`, and methodology citations.

H

human-writer

abpai / skills

Rewrite AI-sounding drafts into natural, specific prose — for text that feels generic, over-polished, promotional, repetitive, or too tidy.

H

humanizer-tw

yelban / humanizer.tw

Remove traces of AI generation from Chinese text. Designed for the distinctive problems of Chinese AI writing: era-setting openers, overused connectives, internet jargon, translationese, excessively formal register, formulaic structure, and boilerplate endings. Makes the text more natural, more human, and more like something a Taiwanese person would write.

H

hunt-ato

uphiago / recon-skills

Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host-header injection redirects token, predictable/numeric token, Referer leak, no-expiry/reuse), (2) email change without re-auth, (3) OAuth account-link CSRF, (4) MFA bypass (per hunt-mfa-bypass), (5) session fixation, (6) JWT manipulation (alg:none, RS256→HS256 key confusion, weak HMAC secret, kid injection), (7) password change without step-up (chain with login timing/length oracle), (8) social-recovery / security-question brute-force, (9) SSO subdomain takeover at OAuth redirect_uri. Chains: cookie theft + password oracle + no step-up = persistent ATO; lax redirect_uri = auth-code theft; dangling-CNAME takeover at redirect_uri = ATO. Validate: demonstrate real takeover of test account B from attacker A's session; OOB/Collaborator confirm blind token-leak steps. Use when hunting ATO chains, testing password reset / email change / MFA / OAuth / session / JWT, or chaining primitives toward Critical.

H

hunt-host-header

uphiago / recon-skills

Hunt Host Header Injection — password reset poisoning → ATO, web cache poisoning via unkeyed Host/X-Forwarded-Host, routing-based SSRF (Host picks upstream → cloud metadata/internal services), path-override SSRF/ACL-bypass (X-Original-URL/X-Rewrite-URL), OAuth redirect_uri/issuer poisoning, and absolute-URL link poisoning in emails. High to Critical when it reaches ATO or mass cache poisoning. Built on public Host-header research (PortSwigger 'Practical web cache poisoning' + James Kettle, and the classic password-reset-poisoning class). Use on any forgot-password flow, CDN/reverse-proxy-fronted app, OAuth/OIDC endpoint, or absolute-URL-in-email feature

H

hunt-nextjs

uphiago / recon-skills

Hunt Next.js specific vulnerabilities — Server Actions arbitrary function execution, Middleware auth bypass via static asset paths, ISR cache poisoning, Image Optimization SSRF (/_next/image), RSC payload leakage, getServerSideProps injection, source map exposure, debug endpoint leakage. Use when target runs Next.js 13/14/15 or any React SSR framework.

H

hunt-nodejs

uphiago / recon-skills

Hunt Node.js specific vulnerabilities — Prototype Pollution → RCE chains (lodash/merge/assign), Express trust proxy misconfiguration, child_process/eval injection, template engine SSTI (EJS/Pug/Handlebars), path traversal in file servers, require() injection, environment variable exfil via /proc/self/environ. Use when target runs Node.js/Express/Fastify/NestJS/Koa.

H

hunt-open-redirect

uphiago / recon-skills

Hunt Open Redirect — all types including low-impact, chained to OAuth token theft → ATO, phishing chains. URL parameter manipulation, JavaScript redirect, meta refresh, header injection. Use when hunting redirect bugs or building ATO chains.

H

hunt-source-leak

uphiago / recon-skills

Hunt source code and build artifact leakage — JavaScript source maps (.js.map) reconstructing TypeScript/ES6 source, Swagger/OpenAPI JSON endpoint discovery, .env/.git exposure, webpack chunks with hardcoded secrets, robots.txt/security.txt recon, build-info files, asset-manifest.json API route discovery, .DS_Store file listing. Use at the START of every recon session — these findings often unlock the entire attack surface.

H

hunt-springboot

uphiago / recon-skills

Hunt for Spring Boot-specific vulnerabilities: Actuator endpoints (heapdump, env, loggers, mappings, shutdown), Spring Expression Language (SpEL) injection → RCE, H2 console RCE, Jolokia JMX exposure, Spring4Shell (CVE-2022-22965), Spring Cloud Function SpEL (CVE-2022-22963), and credential extraction from heap dumps. Use when the target runs Spring Boot, detected via the X-Application-Context header, /actuator, Whitelabel Error Page, or Java stack traces.

H

hunt-ssti

uphiago / recon-skills

Hunt server-side template injection (SSTI) across Jinja2 (Flask/Django), Twig (Symfony), Freemarker (Java), ERB (Rails), Spring, Velocity, Mako, Thymeleaf, Smarty. Detection probes use double-curly and dollar-curly math expressions evaluated server-side. Once an engine is fingerprinted, escalate to RCE via the engine-specific class-walker, callback-registrar, or Execute-utility patterns documented in disclosed reports. Detection patterns: error messages reveal engine, blank or numeric eval reveals expression mode. Targets: email templates, PDF/report generators, CMS preview features, error pages with user input. Use when hunting RCE via template rendering, when content shows engine fingerprints, when finding endpoints that compose strings with user input before render

H

hunt-xxe

uphiago / recon-skills

Hunting skill for XXE vulnerabilities. Built from 10 public bug bounty reports, including SVG-upload XXE, Office-doc (PPTX/DOCX) XXE, SOAP XXE, SAML AssertionConsumer XXE, blind OOB XXE via DTD callback, parameter-entity XXE, XXE-to-LFI, XXE-to-SSRF, and XXE-to-RCE chains (Adobe Commerce CosmicSting CVE-2024-34102). Use when hunting XXE on any target, with an emphasis on the OOB-Or-It-Didn't-Happen Gate for blind cases.

H

hunting-for-persistence-via-wmi-subscriptions

mukul975 / anthropic-cybersecurity-skills

Hunts for adversary persistence via WMI event subscriptions (MITRE T1546.003)

I

ib-stop-loss

staskh / trading_skills

Downside stop-loss management for PMCC, naked LEAPS, and stock positions in IB. Computes stop prices, detects alerts, and places conditional combo orders. Dry-run by default. Requires TWS or IB Gateway running locally.

I

icp-builder

victor-shulga / outbound-engine-skills

Use when asked to build an ICP from scratch, define the ideal customer profile, or structure ICP documentation for use across skills

I

icp-validation

victor-shulga / outbound-engine-skills

Use when asked to validate a company against ICP criteria, score fit, or check if a company is worth targeting

Complete idea-to-exit pipeline for solo builders, with 8 interconnected agents managing the entire product lifecycle

I

idea-md

ckorhonen / claude-skills

Create or expand an Idea.md / IDEA.md file from a rough description, existing repo, conversation history, notes, or other early-stage product inputs. Use when the user asks to "write an Idea.md", "turn this into an idea file", "capture this product idea", "expand this concept", or wants a repo-grounded concept brief before validation, PRD, or implementation work.

I

image-generation

answerzhao / agent-skills

Implement AI image generation capabilities using the z-ai-web-dev-sdk. Use this skill when the user needs to create images from text descriptions, generate visual content, create artwork, design assets, or build applications with AI-powered image creation. Supports multiple image sizes and returns base64 encoded images. Also includes CLI tool for quick image generation.

I

implement

beeltec / skills

Execute one ready backlog work item or Epic serially on its sole acceptance branch through claim, implementation, review, acceptance, and archival. Use with an explicit WORK-NNN, EPIC-NNN, backlog path, or unambiguous conversational selection.

I

implement-copy

nstaab1 / nathan-agent-skills

Implement a piece of work based on a spec or set of tickets.

I

implement

yansfil / vibe-engineering

Use when the user asks Claude Code to execute an approved PRD or scoped task. Read the requirements, create a live checklist, implement the smallest safe changes, and keep acceptance criteria and verification evidence tracked.

I

implementing-mobile-application-management

mukul975 / anthropic-cybersecurity-skills

Implements Mobile Application Management (MAM) policies to protect enterprise

How to implement solutions using the MSH (Micro-Service Helper) TypeScript packages from @beecode/msh-* (app-boot, env, error, logger, node-session, util, config). Use this skill whenever the user works with any @beecode/msh-* package, or asks to set up app initialization and graceful shutdown, environment variable validation, HTTP-aware errors and Express error handling, logging, request-scoped sessions/CLS/async-local-storage, or shared utilities (singletons, memoize, timeout, joi validation, time helpers). Also trigger when the user mentions MSH, beecode, AppFlow, LifeCycle, AppStarter, mshEnv, mshEnvResolver, errorFactory, errorHOF, ErrorBaseModel, HttpResponseCodeMapper, PresetConsoleSimpleString, PresetConsoleJson, PresetPino, LogLevel, LoggerStrategy, NodeSessionUtil, SessionStrategy, FastAlsStrategy, ClsHookedStrategy, AsyncLocalStorageStrategy, singletonPattern, SingletonAsync, ObjectUtil, TimeUtil, JoiUtil, memoizeFactory, or msh-config eslint/prettier config. Always consult this skill before writing code that imports from @beecode/msh-* so the correct current API and the right package version are used

I

implementing-policy-as-code-with-open-policy-agent

mukul975 / anthropic-cybersecurity-skills

Implements policy-as-code enforcement with Open Policy Agent (OPA)

I

implementing-threat-intelligence-lifecycle-management

mukul975 / anthropic-cybersecurity-skills

Build out a full CTI program around the six-phase threat intelligence

I

in-app-ui

knocklabs / skills

Guidance for implementing Knock in-app UI in a web app, with a focus on setting up, rendering, and debugging Knock guides in React.

I

in-product-education-review

sylphxai / skills

Design and audit in-product education, onboarding checklists, tooltips, empty-state guidance, contextual help, tours, templates, examples, nudges, feature discovery, upgrade education, and help-center handoffs. Use when a product needs to teach users without cluttering UI, blocking expert workflows, or becoming spammy growth messaging.

I

incident-response

alphaonedev / openclaw-graph

Manages detection, analysis, containment, and recovery of security incidents in DevOps environments.

I

incidentio

membranedev / application-skills

Incident.Io integration. Manage incidents, services, integrations. Use when the user wants to interact with Incident.Io data.

I

infinite-brassring

membranedev / application-skills

Infinite BrassRing integration. Manage data, records, and automate workflows. Use when the user wants to interact with Infinite BrassRing data.

I

inflight

inflightsoftware / skills

Set up the Inflight feedback widget, authenticate with the CLI, and share staging URLs for design review. Use when the user wants to collect design feedback, add Inflight to a project, or share a staging deployment for review.

I

infrahub-teaching-concepts

opsmill / infrahub-skills

Teaches Infrahub concepts (schema, objects, branches, proposed changes, checks, transforms, generators, menus) from wherever the learner is, using their own repo files and live instance as lesson material. TRIGGER when: the user wants to learn or understand an Infrahub concept, asks "teach me", "explain how X works in my instance", "I'm new to Infrahub", asks what the equivalent of a NetBox/Nautobot concept is in Infrahub, wants a guided tour, or wants to resume a learning session. DO NOT TRIGGER when: the user wants the work done for them (use the infrahub-managing-* skills), wants live operational answers (use infrahub-analyzing-data), or is debugging a failure (use infrahub-collecting-diagnostics).

I

ingest-figma

bluzir / claude-code-design

Pull design tokens + frame structure from a Figma URL via the Figma REST API. Requires FIGMA_TOKEN env var.

I

inspecting-skills

oaustegard / claude-skills

Discovers and indexes Python code in skills, enabling cross-skill imports. Use when importing functions from other skills or analyzing skill codebases.

I

instagram

refly-ai / refly-skills

Integrate with Instagram for social media. Use when you need to: (1) post content to Instagram, (2) manage media and insights, or (3) automate Instagram publishing workflows.

I

intelliprint

membranedev / application-skills

Intelliprint integration. Manage Organizations. Use when the user wants to interact with Intelliprint data.

Write clear, professional internal memos for company communication