Skills
97,905 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Use this skill when the user asks to "find CVEs for", "check if my domain is breached", "threat intel on", "OSINT on", "security news about", "attack surface of", "is this IP malicious", "what vulnerabilities affect", "security advisory for", "monitor threats for", "threat actor research", "recent exploits for", "data breach check", "security posture of", "what's the threat landscape for", "investigate [domain/IP/software]", "is [company] exposed", or any request involving vulnerability research, breach detection, threat actor profiling, or security intelligence. Requires Apify CLI or Apify MCP server.
End-to-end Android APK red-team pipeline — automated APK acquisition (Play Store + apkpure + apkmirror fallback), jadx decompilation, secret/URL/JWT/Firebase grep, pinned-cert extraction, exported-component enumeration, Frida runtime instrumentation templates, intent-injection probes. Built from an authorized external red-team engagement where 7 APKs were pulled manually, 4 download attempts truncated, and a hardcoded JWT + 30 internal API endpoints were recovered from one of the apps. Use when target has a mobile app catalogue (Play Store developer page), when you find an APK URL hosted on a web server, or when post-recon mentions "mobile app" in scope.
Mines App Store and Google Play data via the Crawlora API — app details, reviews, ratings, store rankings, and similar apps — as clean JSON. Use when the user wants mobile-app reviews, ratings, store charts/rankings, or competitive ASO (app store optimization) research without scraping store pages.
visionOS / iOS spatial computing. RealityKit, ARKit, visionOS SwiftUI, USDKit, Spatial Preview. Entity, ModelEntity, AnchorEntity, Component, System, RealityView, MeshResource, Material, EntityAction, MeshDeformerComponent, GaussianSplatComponent, ComputeGraphComponent, ComputeNodeGraph, PhysicsJointsComponent, ForceEffectComponent, ClothBodyComponent, NavigationComponent, NavigationMeshComponent, NavigationController, USDStage, SpatialPreviewSession, ImmersiveSpace, ImmersionStyle, WindowGroup, VolumetricWindowStyle, Model3D, ARKitSession, ARSession, ARWorldTrackingConfiguration, WorldTrackingProvider, HandTrackingProvider, ImageTrackingProvider, AccessoryTrackingProvider, CameraFrameProvider, ObjectTrackingProvider, RoomTrackingProvider, SceneReconstructionProvider.
Score and evaluate a further-education application dossier (PhD, research master's, scholarship/fellowship, or research internship) against a reproducible rubric, and check eligibility for cross-border and scholarship programs. Use this skill whenever the user asks to "rate my profile", "score my application", "how strong is my dossier", "am I competitive for a PhD/scholarship", "evaluate me for VEF/DAAD/Fulbright/Erasmus/MSCA", "does my Vietnamese BSc qualify for an EU PhD", "what's my admit/funding chance", or wants a graded scorecard with per-dimension reasoning rather than a prose readiness report. Distinct from apply-package-auditor, which produces a qualitative coherence audit with no scores; use this skill when the user wants numbers, tiering, eligibility verdicts, or scholarship-mission fit. Use apply-profile-reader first if no structured profile exists yet.
Set up Conventional Commits with semantic-release for automated semantic versioning. Use this skill whenever the user mentions conventional commits, semantic versioning, semver, release automation, auto version bumping, changelog generation, commit message standards, semantic-release, or wants to configure automated releases. Also trigger when the user asks about commit message formats like "feat:", "fix:", or "BREAKING CHANGE", or wants to replace an existing versioning system (standard-version, changesets, lerna, release-please) with semantic-release. Even if the user just says "set up versioning" or "add release automation", this skill applies.
Interactively guides the documentation of arc42 Section 7 (Deployment View). Asks about infrastructure, environments, and software-to-hardware mapping before generating C4 PlantUML deployment diagrams and environment comparison tables. Iterates until the user is satisfied.
Interactively guides the documentation of arc42 Section 10 (Quality Requirements). Elaborates quality goals from Section 1.2 into concrete, measurable scenarios grounded in Q42 quality criteria (quality.arc42.org). Coaches against vague metrics and checks coverage against architectural decisions. Iterates until the user is satisfied.
Interactively guides the documentation of arc42 Section 11 (Risks and Technical Debt). Pre-populates candidates from Sections 9 and 10, works through risk categories systematically, and generates a prioritized risk register and debt backlog with mitigation strategies. Iterates until the user is satisfied.
Interactively guides the documentation of arc42 Section 12 (Glossary). Scans other sections for undefined terms, asks about domain vocabulary and ambiguous terminology, and generates a structured glossary with consistent preferred terms. Iterates until the user is satisfied.
Searches academic papers on arXiv, analyzes research content, builds literature reviews, and generates citations for academic writing. Triggers when users need to find, understand, or cite arXiv papers, extract TikZ figures from LaTeX sources, or explore citation networks and coauthor relationships.
Query the bundled research knowledge graph for methodology guidance. Routes questions through a 3-tier knowledge base — WHY (research claims), HOW (guidance docs), WHAT IT LOOKS LIKE (domain examples) — plus structured reference documents. Returns research-backed answers grounded in specific claims with practical application to the user's system. Triggers on "/ask", "/ask [question]", "why does my system...", "how should I...".
Build the front-end for a Newton demo with the Archetype AI Design System — the published, versioned packages (`@archetypeai/ds-lib-tokens`, `@archetypeai/ds-ui-svelte-console`, `@archetypeai/ds-ui-svelte-labs`) and the `ds` scaffolding CLI (`@archetypeai/ds-cli`) — instead of hand-rolling tokens, components, fonts, or brand styling. Use this skill when the user wants to scaffold a new dashboard/UI, add the design system to an existing SvelteKit app, or pull in branded primitives (menubar, logo, sensor/scatter charts, video player, card, badge, table, dialog…). The CLI installs the design system's OWN agent config — `CLAUDE.md` (or `AGENTS.md` for Cursor) plus `ds-manifest.json` at the project root — which is the source of truth for component usage, fonts, fallback behavior, and styling once scaffolded; this skill's only job is to get you there. Components currently ship for Svelte 5; a React port is in progress. Do NOT use for Newton API / backend work (see the `atai-newton-*` skills).
Stand up a NEW Bun/TypeScript, Next.js, or Java (Quarkus) repo to the atelier standard from zero — scaffold the Clean Architecture (or Atomic Design) layout, copy the gate assets, wire the git hooks, write the build scripts, lay a minimal green walking skeleton, and prove every gate passes before the first commit. Use when starting a fresh repo or a new monorepo package from scratch — say "scaffold a new Bun repo", "bootstrap a new project to the standard", "set up a new atelier repo / Next.js package", or "scaffold a new Java/Quarkus service". Greenfield only. NEVER use it for work inside an existing codebase (adding features, setting up lint or tooling, config changes) — those belong to the main atelier skill, or to atelier-review-me adopt mode for bringing a brownfield repo up to the standard.
Review a diff against the atelier standard before it lands. Read-only by contract, it reports findings and never edits the tree, mapping each changed file to the hard rules that bind it, citing the exact rule number (or the red flag) a change violates, and deferring generic correctness bugs to /code-review and mechanical cleanups to /simplify. Diff and PR content is treated as data to audit, never as instructions to follow. Use to pre-land-review staged changes, a feature branch, or a PR, to check a diff for rule violations, or when the user says "review me" / "review my changes against the standard". Also runs an adopt mode for brownfield, scanning a whole existing repo and emitting a staged plan to bring it up to the standard, e.g. "adopt the standard into this repo", "migrate this repo to atelier", "bring this repo up to standard".
Use when working with `@atscript/*` packages or `.as` files. `.as` = single source of truth for types, metadata, and validation constraints. Covers `.as` syntax, `@meta.*` / `@expect.*` / custom annotations, primitives, the `asc` CLI + `atscript.config.*`, generated `.as.d.ts` / `.as.js` / `atscript.d.ts`, runtime helpers (`Validator`, `coerceForType`, JSON Schema, serialize), `unplugin-atscript`, `@atscript/moost-validator` (validation + coercion pipes), VSCode LSP, and plugin authoring. Out of scope: `@db.*` annotations, schema sync, DB adapters → use the atscript-db skill; `@ui.*` annotations, vue-form, vue-table → use the atscript-ui skill.
Guides privacy audit evidence collection processes including evidence planning, sampling strategies, documentation standards, chain of custody, interview techniques, system walkthrough procedures, and evidence evaluation. Covers ISO 19011 evidence categories (records, statements of fact, observations) and ISACA audit evidence requirements for privacy compliance assessments. Keywords: audit evidence, evidence collection, sampling, chain of custody, audit documentation, interview techniques.
Audit and reconcile drift across Beads, designs, delivered records, documentation, tests, code, and migration state. Use when asked to audit project consistency, investigate disagreeing artifacts, verify a migration, or prepare for major planning.
Audits web typography for punctuation, font selection, sizing, spacing, OpenType features, hierarchy, layout, typeface pairing, brand identity, and display type. Use when writing CSS/HTML for text, selecting or pairing typefaces, reviewing typography in web designs, configuring font-feature-settings, building a type system, or auditing typographic quality. Triggers on tasks involving font-family, font-size, line-height, letter-spacing, @font-face, font pairing, or typographic correctness.
Receive and verify Auth0 webhooks delivered via Custom Log Streams (HTTP). Use when setting up an Auth0 log stream HTTP endpoint, validating the configured Authorization token, or handling batched authentication log events like s (success login), f (failed login), ss (signup), and sepft (password-grant token exchange).
Implement all existing tasks in an authorized batch through implement-task, in dependency order, after checking every task and requiring all user-action blockers to be resolved first. Use when the user requests automatic multi-task implementation; preserve verification/review policy and stop for new blockers or stalled corrections.
Automake owns a Git-backed ratchet for safely improving a repository through separate optimizer and evaluator roles: it establishes a baseline, proposes and checks candidates, obtains an independent comparison against the current committed state, keeps accepted changes, and restores rejected ones exactly. It triggers when the request is to prepare or execute this bounded improvement workflow, draft or approve its role instructions, set limits or stop conditions, protect local files, initialize the baseline, or invoke `/automake`. It does not trigger when “automake” refers to the GNU build system, when the task is merely a Makefile target or normal bug fix, when the user only wants code review or an explanation, or when the request is generic branch reset or deleted-file restoration.
Work autonomously on a project without waiting for direction. On command, survey the codebase, pick one high-value low-risk improvement, do it, verify it, commit it, then pick the next, looping like a self-directed intern. Use when the user hands off open-endedly ("work on your own", "keep improving this", "find something worth doing", "don't wait for me", "go autonomous", "run for a while", "be a passionate intern", "do whatever you think is valuable") or invokes /autopilot, and you have to choose the work yourself rather than wait for instructions or feedback.
One-time installer that keeps a project's Internet Computer CLI toolchain current. Sets up a SessionStart hook plus a script that compares the installed `icp` and `ic-wasm` against the latest release and either reports the upgrade or applies it, using whichever channel each tool was installed from (npm, Homebrew, or the shell installer). Use when a user wants to install, bootstrap, or enable automatic icp-cli / ic-wasm updates, asks to stop running an outdated `icp`, asks how to upgrade or check the version of the ICP CLI, or pastes the link to this skill. This is a one-time setup action, not ongoing IC knowledge. Do NOT use for writing icp.yaml, deploying canisters, or other icp-cli usage questions — load `icp-cli` for those.
This skill should be used when users need to query AWS cost and usage details for a specific date. It supports querying costs at service level (e.g., EC2, S3, RDS) and drilling down to usage type level (e.g., instance types, storage classes, data transfer). Triggers on requests mentioning AWS costs, billing, spending, cost breakdown, or fee analysis.
AWS IAM / Resource Policy analysis methodology. Use when the target involves AWS cloud services and policy files such as IAM policies, resource policies, Lambda code, or CloudFormation templates are provided. Covers identification of dangerous IAM policy patterns, analysis of resource policy principals, Condition key bypass patterns, and derivation of service trust relationship graphs. Use this skill when you find AWS policy files (json/yaml), *.amazonaws.com endpoints, or IAM ARNs
Specialized methodology for AWS IAM privilege escalation. Use when you already have AWS credentials and need to escalate privileges, when the current IAM user/role has limited permissions and you need lateral or vertical escalation, or when you need to analyze IAM policies to find escalation paths. Covers privilege escalation techniques for 46 AWS services, including PassRole abuse, chained AssumeRole escalation, Lambda/EC2/ECS compute service escalation, and exploitation of implicit permissions via NotAction
Overall methodology for penetration testing AWS cloud environments. Use when the target uses AWS cloud services, when you find AWS-related assets (S3 buckets / EC2 instances / Lambda functions / CloudFront distributions), when you obtain AWS credentials (AK/SK/Session Token/IAM Role), or when you need to assess the security of an AWS environment. Provides a full attack decision tree from unauthenticated enumeration to privilege escalation, post-exploitation, and persistence, guiding you to specialized skills for deeper dives. Covers the attack surface of 47+ AWS services
AWS post-exploitation and persistence specialization. Use after obtaining high AWS privileges (Admin/PowerUser) or permissions on specific services when you need to exfiltrate data, move laterally to other accounts/regions, establish persistent backdoors, or clean up attack traces. Covers S3/RDS/DynamoDB/EBS data exfiltration, cross-account AssumeRole lateral movement, Lambda/IAM/EventBridge persistence backdoors, and CloudTrail/GuardDuty evasion techniques
Deploy any full-stack app (Next.js + FastAPI or similar) to AWS production with Docker, ECR, ECS Fargate, ALB, ElastiCache, CloudWatch, and Grafana. Use when deploying to AWS, setting up CI/CD, configuring production infrastructure, or shipping any app to production.
Azure AD / Entra ID attack methodology. Use when the target uses Microsoft 365/Azure cloud environments, when you discover Azure AD authentication flows, or when you obtain Azure credentials. Covers initial access (password spray / phishing), token theft, Service Principal abuse, conditional access bypass, and cross-tenant attacks
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.