Skills
97,905 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Systematic study tool by 边淬火. Used to faithfully read through a book, a finite set of texts by one thinker, a school of thought, a body of theory, a book series or a complex knowledge system: it does not require the user to preset a learning goal; it first freezes and fully reads the finite sources, reconstructs the original system's own structure, prepares the complete set of read-through lectures in one go, then accompanies the user in continuous reading; after the first pass it redraws the map and selects nodes for close reading with /cuihuo-learning based only on real questions. Triggers: 「淬火体系」「体系学习」「系统读 X」「系统学习 X」「通读 X」「学一个思想家／学派」「先通览再精读」「继续体系学习」.
Cuihuo Thinking v2, the general thinking entry point and topic hub of the 边淬火 family. It takes unformed input such as "I'm thinking about", "I have a question", "this needs to be thought through", "I'm stuck", "I can't make sense of it" or "I'm thinking about that thing from last time", runs an old-topic check, identity check and language/material/function audit, routes to Investigation, Containment, Dissolution, Cuihuo Diagnosis, Cuihuo Questioning, Cuihuo Verification, Cuihuo Learning, Cuihuo Brainstorm, Cuihuo Logic Chain, Cuihuo Judgment Formation, Cuihuo Decision or GTD, and updates the topic once results come back. It replaces the old "Thinking" skill; do not intercept when the user has already explicitly named a downstream skill.
Concept verification and flipping tool by 边淬火. Helps users see the metaphors, rules, confusions and causal inversions hidden beneath a "taken for granted" concept, and guides them to complete the flip themselves. Two entry points: bring an old concept to verify, or bring an existing flip to deepen. The flip must come from the user's own mouth — AI only asks questions and does not flip on the user's behalf. Triggers: /cuihuo-verification, "verify this concept", "flip this concept", "is this statement right", "help me flip it"
Design and audit customer feedback intake across support tickets, sales calls, app reviews, surveys, NPS, communities, cancellation reasons, feature requests, bug reports, and product analytics. Use when teams need to turn noisy feedback into evidence, prioritization input, roadmap decisions, and customer follow-up without overreacting to anecdotes.
XSS vulnerability scanning with DalFox. Use when you need to detect reflected/stored/DOM XSS, analyze parameter injection points, or bypass WAFs. DalFox supports automatic parameter analysis, DOM mining, Blind XSS callbacks, WAF bypass, and automatic PoC generation. This skill should be used in any scenario involving XSS vulnerability detection, parameter testing, or WAF bypass
Read, build, and fix RevOS dashboards of metric cards through the RevOS MCP server. A card is one metric (a numeric measure), counted over a segment's rows or the card's own conditions, optionally broken down by a dimension. Use this whenever the user wants to see what's on a dashboard ("what's on our sales dashboard", "what does the pipeline card show"), put a metric or KPI on one ("add open pipeline to the board", "add revenue by stage as a donut"), change, reorder, move, or remove a card, create, rename, or delete a dashboard, or asks why a card shows "unavailable" or a number that looks wrong — even if they never say "dashboard" or "card". Read it before the first api_write or api_delete on `dashboards` or `dashboard-cards`.
Design and audit data imports, customer migrations, bulk uploads, CSV/schema mapping, backfills, migration wizards, dry runs, validation, idempotency, reconciliation, rollback, progress visibility, and support handoffs. Use when moving product data between systems, onboarding customers from competitors, importing files, or migrating accounts without data loss.
Database lateral movement and cross-database attacks. Use when you have obtained access to one database (PostgreSQL/MySQL/MSSQL) and need to move laterally to other databases or internal services. Covers PostgreSQL dblink cross-database connections, MSSQL Linked Server lateral movement, MySQL federated engine cross-database access, and database → SSRF → internal network probing. When the target network is isolated but databases can communicate (databases usually have looser network policies than application servers), this is the key path to break isolation. Use this skill for any scenario involving communication between databases, lateral movement to internal databases, or cross-database queries
Universal database engineering rules covering migration discipline, audit logging, soft delete, performance, and data integrity. This skill MUST be loaded before any database work, and MUST NOT be skipped because a schema change looks small or obvious. Triggers on: 任何資料庫相關工作, 建表, 改 schema, 寫 migration, DB design, database development, 設計資料庫, 改 DB 結構, 加欄位, 加索引, 改 table, SQL, 寫 trigger, 設計 API 的 DB 層, 查詢很慢, N+1, 效能優化, 資料完整性, CASCADE, 外鍵, 新增 table, 刪除資料, backup, 環境分離, dev prod 分開
Diagnose a reported bug, task failure, or performance regression with a symptom-specific reproduction and evidence-driven probes. Use standalone for diagnosis or inline within implement-task/auto-implement when the cause is unclear; leave production fixes, verification policy, and task status to the owning workflow.
Build, review, debug, migrate, or plan arbitrary-precision decimal math with decimal.js v10. Use for decimal.js, Decimal, Decimal.clone, Decimal.set, precision, rounding modes, ROUND_HALF_UP, ROUND_HALF_EVEN, toDecimalPlaces, toFixed, plus, minus, times, dividedBy, money/currency math, BigInt decimals, NaN/Infinity handling, trig/exp/ln, decimal.js-light, and comparisons with big.js or bignumber.js.
Use this skill when the user's prompt requires (1) researching a topic across multiple sources, comparing options or alternatives, analyzing trends or history, understanding markets or industries, or reviewing literature or studies and (2) synthesizing that research into a comprehensive, narrative report. If you're planning to search the web or internal knowledge bases, consider using this skill. This skill coordinates research subagents, so use it only when you have a tool for spawning subagents (the Agent or Task tool); otherwise, research the question directly.
Universal deep research agent team. 13-agent pipeline for rigorous academic research on any topic. 8 modes: full research, quick brief, paper review, lit-review, fact-check, three-way literature scan, Socratic guided research dialogue, and systematic review with optional meta-analysis. Covers research question formulation, Socratic mentoring, methodology design, systematic literature search, source verification, cross-source synthesis, risk of bias assessment, meta-analysis, APA 7.0 report compilation, editorial review, devil's advocate challenges, ethics review, and post-research literature monitoring. Triggers on: research, deep research, literature review, systematic review, meta-analysis, PRISMA, evidence synthesis, fact-check, WHY HOW WHAT papers, 3W literature scan, guide my research, help me think through, 研究, 深度研究, 文獻回顧, 文獻探討, 系統性回顧, 後設分析, 事實查核, 三段式文獻掃描, 引導我的研究, 幫我釐清, 幫我想想, 我不確定要研究什麼, 研究方向, 研究主題.
Export raw OpenTelemetry traces from an AI application to Confident AI's Observatory. TRIGGER when the user wants to send OpenTelemetry or OTLP traces/spans from an LLM app, agent, RAG pipeline, or chatbot to Confident AI; configure the Confident AI OTLP endpoint; set confident.span.* or confident.trace.* attributes; export AI-app traces without the deepeval Python package; wire an OTLPSpanExporter, OpenTelemetry Collector, or vendor-neutral OTel SDK to Confident AI; or pick the US vs EU OTLP endpoint. Language-agnostic: the mechanism is OTLP attribute keys plus an exporter endpoint. DO NOT TRIGGER for building DeepEval pytest eval suites, datasets, goldens, metrics, or deepeval test run (use the `deepeval` skill); for instrumenting with the DeepEval SDK's @observe decorator or framework integrations (use the `deepeval-tracing` skill); or for non-AI software such as web servers, CRUD backends, or infrastructure: the confident.* attributes describe AI components only.
Guidance for Microsoft Defender for Business (MDB) — the SMB-segment endpoint security product (≤300 employees), bundled with Microsoft 365 Business Premium and available as a standalone SKU. Covers what's included vs MDE Plan 1/2 (next-gen AV, EDR with simplified configuration, ASR, automated investigation and response, vulnerability management, web content filtering, attack surface reduction, mobile threat defense add-on), wizard-driven onboarding, server add-on for SMB servers, the simplified portal experience vs full Defender XDR, transition path to MDE P2 / E5 as the org grows, and integration with Microsoft 365 Lighthouse for MSP delivery. WHEN: Defender for Business, MDB, SMB endpoint security, M365 Business Premium security, MDB server add-on, simplified EDR small business, MSP Defender for Business, M365 Lighthouse Defender, SMB upgrade to MDE Plan 2. DO NOT USE for enterprise EDR (use defender-for-endpoint), Defender XDR cross-product investigation (use defender-xdr), or Defender for Servers / Cloud (use defender-for-servers).
Guidance for Microsoft Defender for Cloud — AI workload protection (AI-SPM and runtime threat detection for generative AI). Covers AI Security Posture Management (discovery of Azure OpenAI / Azure AI Foundry / Amazon Bedrock / Google Vertex AI resources, identification of grounding data exposure, model deployment posture), runtime threat detection on Azure OpenAI (prompt injection / jailbreak attempts, sensitive data leakage in prompts/responses, wallet abuse, credential leakage), integration with Azure AI Content Safety Prompt Shields, attack path analysis for AI workloads, alert investigation in Defender XDR, and pairing with Purview DSPM for AI (user side) and Azure AI Content Safety (model side). WHEN: Defender for Cloud AI, AI-SPM, AI workload protection, Azure OpenAI threat detection, prompt injection alert, jailbreak alert Azure OpenAI, AI wallet abuse, AI workload posture, Amazon Bedrock posture, Vertex AI posture, generative AI security Azure. DO NOT USE for end-user AI usage governance (use purview-ai-hub), content moderation API (use azure-ai-content-safety), or M365 Copilot rollout (use copilot-for-m365-readiness).
Scans your project for outdated npm, pip, Cargo, Go, or Ruby packages. Runs a CVE security audit. Fetches changelogs, summarizes breaking changes with Gemini, and opens one PR per risk group (patch, minor, major). Includes Diagnosis Mode for install conflicts. Use when asked to update dependencies, check for outdated packages, open dependency PRs, scan for package updates, audit for CVEs, or flag breaking changes in upgrades. Trigger when a user says "check for outdated packages", "update my dependencies", "open PRs for dependency updates", "scan for CVEs", or "which packages need upgrading".
Detect and fix AI design slop — the convergent look that shows up across AI-generated landing pages and dashboards (purple/indigo gradients, rounded-2xl everywhere, three-box feature grids, bento dashboards, aspirational-but-empty hero copy, etc.). Use this skill whenever the user asks Claude to build/generate/mock up a landing page, dashboard, or SaaS UI, OR when the user shares an existing design (screenshot, URL, code, Figma link) and asks for critique, feedback, "does this look AI-generated?", or "make this less generic." Trigger even if the user does not use the word "slop" — phrases like "build me a hero section," "this looks AI-made," "why does this look like every other SaaS page," or "make this feel more custom" all qualify. Prefer this skill over general design-critique when the concern is specifically convergence, sameness, or AI-generated feel.
Use for Desktop Commander MCP capabilities — persistent shells and REPLs, long-running processes, filesystem beyond the workspace, structured files (.xlsx, .docx, .pdf, images) and large local data files such as CSVs, ripgrep search at scale, SSH, or cross-turn state.
Draft developer documentation with clear goals, outlines, titles, headers, procedures, scenario walkthroughs, lists, callouts, skimmable structure, and reusable templates. Use when writing or rewriting READMEs, getting-started docs, tutorials, how-to guides, concepts, API guides, troubleshooting pages, migration guides, SaaS topics, or release documentation.
Read market data for a known Kalshi prediction market on DFlow — orderbook, trades, top-of-book prices, candlesticks, forecast-percentile history, and Kalshi in-game live data — via one-shot REST snapshots, historical ranges, or live WebSocket streams. Use when the user asks "show me the orderbook for X", "get last hour of trades", "build a live price ticker", "stream orderbook depth", "pull 1-minute candles for the last day", "watch in-game scores for this sports market", or "alert me when the orderbook moves". Do NOT use to discover markets matching a criterion (use `dflow-kalshi-market-scanner`), to place orders (use `dflow-kalshi-trading`), or to read a user's own positions/P&L (use `dflow-kalshi-portfolio`).
Diagnose one bug by reproducing it, testing hypotheses, locating the root cause, and returning an evidence-backed diagnosis report. Use when the user wants root-cause analysis before implementation, or when triangulate-diagnosis delegates an independent diagnostic pass.
Use when confronting a specific counterpart about a breach, violation, or adversarial behavior — situations where trust is already broken and the goal is accountability or resolution, not relationship-building. Not for giving developmental feedback (use feedback-coach) or building trust with new people (use rapport-builder).
Brute-force enumeration of web directories and files with dirsearch. Use when you need to discover hidden directories, files, admin paths, or backup files. dirsearch ships with high-quality wordlists and supports multiple extensions, recursive scanning, and status code filtering. Use this skill for any scenario involving directory enumeration, path discovery, admin panel discovery, or sensitive file discovery
Use when a complex development, fix, refactor, migration, verification, or OpenSpec change must be advanced across resumable checkpoints, recovered after context loss, or executed with durable progress and failure notes that stay inside the concrete OpenSpec change or archive directory. Also use when the user asks to generate a Claude Code `/goal`, Codex `/goal`, or do-long-task prompt. Do not use for short one-off edits, Q&A, simple formatting, changesets, release notes, or pure planning.
Docker Compose for multi-container apps. Covers services, networks, and volumes. Use for local development environments. USE WHEN: user mentions "docker-compose", "docker-compose.yml", "multi-container", "service dependencies", "docker compose up", asks about "local dev environment", "microservices setup", "database + app setup", "docker networks", "docker volumes" DO NOT USE FOR: single container Dockerfiles - use `docker` skill instead, production orchestration - use `kubernetes` skill instead, CI/CD pipelines - use `github-actions` skill instead
MUST USE for any task involving the dotenvx CLI tool — encrypting .env files, running commands with injected env vars, managing secrets across environments, and decrypting at runtime. Use this skill whenever the user mentions dotenvx, dotenv encryption, DOTENV_PRIVATE_KEY, encrypted .env files, or the dotenvx encrypt/run/set/get/decrypt/keypair commands. Also trigger when the user wants to: commit .env files safely to git, stop sharing secrets over Slack/chat, encrypt environment variables with public-key cryptography, set up multi-environment .env configs (production/staging/ci), manage secrets in a monorepo with -fk flag, migrate from python-dotenv or plain dotenv to encrypted envs, inject env vars into any process across any language (Node, Python, Ruby, Go, Rust, etc.), or configure CI/CD pipelines (GitHub Actions, Docker) with encrypted env files. This skill contains the authoritative CLI reference — without it, responses will hallucinate non-existent commands and flags.
CLI for Drupal.org issue lifecycle management. Use when fetching issue details, generating patches/interdiffs, listing project or maintainer issues, looking up releases, or working with GitLab merge requests on issue forks. Also supports projects that have migrated to GitLab work items. Pass --format=llm to every read command for structured XML output optimised for agent consumption.
Guides AI agents through the complete GDPR Data Subject Access Request (DSAR) workflow under Article 15, including identity verification, 30-day deadline calculation with extensions, response formatting, exemptions, and fee provisions. Activate when handling DSAR, access request, subject access, Art. 15, or SAR queries.
Search, retrieve and analyse data from the DUV Ultramarathon Statistics database (statistik.d-u-v.org, 10M+ results, 2.4M+ runners, 115k+ events). Use whenever the user asks about ultramarathon results, runners, races or rankings: national, continental and age-group records and their progression, personal bests, race results and course records, race history and winners, race calendars, IAU championship medallists, head-to-head comparisons, lifetime or yearly ultra mileage, oldest finishers, women who won outright, doping cases. Examples: 'Hungarian 100 km record', 'Spartathlon 2024 results', 'top 24 h women in 2024', 'course record at Ultrabalaton', 'who ran the most km in 2025', 'compare runner A and B'. Also Hungarian: 'országos csúcs', 'magyar rekord', 'pályacsúcs', 'ultrafutó eredmények', 'ki futott a legtöbbet', 'VB-érmesek'. Not for training data from Garmin/Strava or ITRA trail scores
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.