Skills
97,905 packaged capabilities and playbooks for agents. Install any of them with one command.
All
This skill is designed to help users automatically extract business data from Google Maps search results. The Agent should proactively apply this skill when the user makes the following requests: searching for coffee shops in a specific city, finding dentists or medical clinics nearby, tracking competitors' locations in a certain area, extracting business leads from Google Maps lists, gathering restaurant data for market research, finding hotels or accommodation options in a region, locating specific services like coworking spaces or gyms, monitoring new business openings in a neighborhood, collecting contact information and addresses for sales prospecting, analyzing price ranges and cuisines of local eateries, getting ratings and review counts for a list of businesses, exporting local business data into a CRM or database.
Use when managing Google Play store listings, metadata, screenshots, or images. Make sure to use this skill whenever the user mentions gpc listings, store listing, metadata sync, screenshots, Fastlane metadata, localization, app description, pull listings, push listings, feature graphic, Play Store images, app title, short description, full description, changelogs, image sync, image dedup, listings images sync, save quota, publish quota exceeded, too many API saves, screenshot display order, AI-generated image attestation, --ai-generated, or wants to update any text or visual content on their Play Store page. Also trigger when someone asks about migrating from Fastlane supply, syncing metadata to/from local files, managing multi-language listings, or bulk-updating store content — even if they don't mention GPC explicitly. For releases and uploads, see gpc-release-flow.
Apply behavioral finance theory to identify systematic investor biases and their impact on asset prices. Use this skill when the user needs to analyze irrational market behavior, explain pricing anomalies through cognitive biases, diagnose investor decision errors, or when they ask 'why do investors hold losers too long', 'how does loss aversion affect pricing', or 'what biases drive this market pattern'.
Apply Cognitive Load Theory to optimize instructional design by managing intrinsic, extraneous, and germane load within working memory limits. Use this skill when the user needs to diagnose why learners are overwhelmed, redesign training or documentation for better comprehension, evaluate UI/UX information architecture for cognitive burden, or when they ask 'why is this tutorial confusing', 'how to simplify complex instructions', or 'what causes information overload'.
Apply Structural Equation Modeling (SEM) to test hypothesized causal structures by combining measurement models (CFA) and structural models (path analysis). Use this skill when the user needs to validate latent constructs, test mediation or moderation paths, assess model fit with CFI/TLI/RMSEA/SRMR, or when they ask 'do these variables form a causal chain', 'how do I test my theoretical model', or 'is my measurement model valid'.
Creates animated looping GIFs from CSS animations (default) or AI image-to-video. 800×800px default, 6 animation types, 4 style presets. Trigger when user says "create an animated gif", "make a looping gif", "animated banner", "CSS animation gif", "social media animation", "make this loop", "animated graphic", or "motion graphic".
Clarify product, domain, scope, constraints, business rules, and technology decisions through dependency-aware question sets. Read the repository first, ask all useful questions whose prerequisites are already known in each set, and use the answers to form later sets. Use when a project or feature is ambiguous and not ready for specification. When decisions are stable, recommend exactly one next skill without invoking it.
Use the `grok-wiki` CLI to generate local-agent repository wikis, ask evidence-backed questions about one or more repositories, inspect saved wikis, or run the local Grok-Wiki server/sidecar. Trigger when the user asks for Grok-Wiki CLI usage, wiki generation from GitHub or local repos, multi-repo workspace Ask, local CLI agent selection (Grok, Codex, Claude, Pi, Antigravity), or troubleshooting the local-cli-only wiki/ask flow. Keep the workflow BYOC/BYOK and vendor-agnostic: do not require API-provider keys or assume one model provider unless the user explicitly chooses one local agent.
Run a non-mutating Growth Operator clarification session for acquisition strategy that may span inbound and outbound. Use when planning repeatable acquisition, aligning inbound and outbound strategy, defining growth company/team goals, or choosing durable channel/motion projects before creating Paperclip records.
Materialize an approved Growth Clarification Summary into Paperclip goals, durable channel/motion projects, strategy parent issues, branch parent issues, campaign parent issues, and plan documents one missing layer at a time. Use after growth-clarify when the operator approves recording or revising acquisition strategy.
Standalone GTM audit of a B2B service company on 23 weighted criteria in 4 blocks (Team 20% · Processes 30% · Data 25% · Interfaces 25%), maturity scale 0-4, band Critical/Weak/Working/System, coverage %, top-3 gaps and a first-30-days shortlist. Use when the user says GTM-аудит, зроби аудит, audit our go-to-market, де рветься воронка, оціни нашу систему продажів, or at the start of an engagement before any list, campaign or content work. Runs from whatever evidence exists (site, LinkedIn, CRM export, call notes, pasted answers) and never invents a score. Not a website UX audit and not a reply audit.
Step-by-step guidance for the initial installation and setup of the Google Workspace CLI (gws). Covers npm installation, gcloud CLI installation, OAuth authentication, Claude Code skill installation, and Korean encoding setup. A guide for users using gws for the first time.
Monitors Hacker News for user-configured keywords, deduplicates against a local SQLite cache, and sends Slack alerts for new matching posts. Use when asked to monitor Hacker News for mentions, track keywords on HN, get alerts when something is posted about a topic on Hacker News, or set up HN keyword monitoring. Trigger when a user mentions Hacker News alerts, HN monitoring, keyword tracking on HN, or wants to know when a topic appears on Hacker News.
Set up OpenAI's harness engineering methodology in any repository. Creates the full agent-first infrastructure: AGENTS.md progressive disclosure map, architectural layer boundaries with mechanical enforcement, testing framework, CI pipeline, golden principles documentation, garbage collection scripts, and pre-commit hooks. Use when asked to "set up harness engineering," "make the repo agent-ready," "add architectural boundaries," "set up testing and CI," or "adopt agent-first engineering." Works with any stack — React, Next.js, Python, Go, Rails, etc.
Design, implement, and integrate generalized validation harnesses across a producer-consumer boundary after a local harness contract exists. Use when refactoring custom validation CLIs/MCPs for large polyrepos, extending Steward across sibling repos, or deploying a local tool to a consumer project for dogfooding and testing; use mcp-harness-repo-maintainer first for initial steward.yaml adoption and cold-start proof.
HBuilderX CLI command line tool skill. Use when the user needs to start a uni-app development environment from the command line, view run logs, run automated tests, configure the HBuilderX CLI environment, or integrate HBuilderX workflows into npm scripts. Covers multi-platform development for Web, Android, iOS, HarmonyOS, mini programs and more.
Deploy and manage Hermes Agent (Nous Research) on remote servers. Self-improving AI agent with built-in learning loop, multi-platform messaging gateway (Telegram, Discord, Slack, WhatsApp, Signal, Mattermost), cron scheduling, MCP integration, and persistent memory. Supports Docker, bare-metal, and systemd deployments. Use when: deploying hermes-agent to a server, configuring hermes messaging gateway, managing hermes installations, troubleshooting hermes issues, migrating from OpenClaw to hermes, setting up hermes cron jobs, or any task involving hermes-agent deployment and operations. Keywords: hermes, hermes-agent, nous research, AI agent, messaging gateway, self-improving agent, openclaw migration.
Same pixels, fewer tokens — for user-facing deliverables where visual polish is the spec. Use when building or editing a landing page, marketing site, hero, pricing/feature section, dashboard, or any HTML/CSS UI component. Keeps the full rendered design (layout depth, hierarchy, motion, responsive richness, a11y) and cuts tokens by expressing that design densely — CSS custom properties, shared classes, shorthand, fluid units — instead of by cutting the design. The honey core trims code and prose; this trims how the design is *written*, never how it looks. Reach for it whenever output is user-facing markup, even if the user never says "minimal".
Review a diff for what Honey would cut — over-engineering (speculative generality, hand-rolled stdlib, single-caller abstractions) and over-verbosity (dead code, narration, redundant comments). Outputs a terse delete-list, one line per finding, with the line count each cut saves. Use when asked to review, trim, or de-bloat a change, or before opening a PR. Quality lever only — it finds waste, not correctness bugs.
Use when asked to "build habit-forming products", "Hooked model", "trigger action reward investment", "create sticky behavior loops", or "design habit loops". Helps design products that form unprompted user habits. The Hooked Model (created by Nir Eyal) explains how products create habits through Trigger, Action, Variable Reward, and Investment.
Writes and reviews semantic, accessible HTML and template markup that stays readable and low-noise. Use when creating or refactoring HTML or Svelte templates, cleaning up div soup, choosing better elements, improving form markup, fixing heading or landmark structure, or replacing custom controls with native HTML.
OpenTelemetry ingestion skill for Huawei Cloud AgentArts observability platform. Provides OTel telemetry data (trace/metrics/logs) ingestion into AgentArts agent-ops, AI Agent observation with gen_ai semantic conventions, auto-configuration for Java/Python/Node.js/Go applications, and ingestion diagnostics and verification. Covers APM deliverConfig forwarding (Path A) and OTLP direct connection (Path B). Triggers include: "AgentArts OTel", "AgentArts observability", "AI agent tracing", "gen_ai telemetry", "AgentArts OTLP", "otel接入AgentArts", "Agent观测配置"
Apply narrative structure and storytelling techniques for brand, business, and communication contexts. Use this skill when the user needs to craft a compelling story, build a brand narrative, structure a presentation around a story arc, or use storytelling to communicate data or strategy — even if they say 'tell a better story', 'make this presentation more engaging', or 'how do we build our brand story'.
Remove traces of AI generation from Chinese text. Designed for the distinctive problems of Chinese AI writing: era-setting openers, overused connectives, internet jargon, translationese, excessively formal register, formulaic structure, and boilerplate endings. Makes the text more natural, more human, and more like something a Taiwanese person would write.
Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host-header injection redirects token, predictable/numeric token, Referer leak, no-expiry/reuse), (2) email change without re-auth, (3) OAuth account-link CSRF, (4) MFA bypass (per hunt-mfa-bypass), (5) session fixation, (6) JWT manipulation (alg:none, RS256→HS256 key confusion, weak HMAC secret, kid injection), (7) password change without step-up (chain with login timing/length oracle), (8) social-recovery / security-question brute-force, (9) SSO subdomain takeover at OAuth redirect_uri. Chains: cookie theft + password oracle + no step-up = persistent ATO; lax redirect_uri = auth-code theft; dangling-CNAME takeover at redirect_uri = ATO. Validate: demonstrate real takeover of test account B from attacker A's session; OOB/Collaborator confirm blind token-leak steps. Use when hunting ATO chains, testing password reset / email change / MFA / OAuth / session / JWT, or chaining primitives toward Critical.
Hunt Host Header Injection — password reset poisoning → ATO, web cache poisoning via unkeyed Host/X-Forwarded-Host, routing-based SSRF (Host picks upstream → cloud metadata/internal services), path-override SSRF/ACL-bypass (X-Original-URL/X-Rewrite-URL), OAuth redirect_uri/issuer poisoning, and absolute-URL link poisoning in emails. High to Critical when it reaches ATO or mass cache poisoning. Built on public Host-header research (PortSwigger 'Practical web cache poisoning' + James Kettle, and the classic password-reset-poisoning class). Use on any forgot-password flow, CDN/reverse-proxy-fronted app, OAuth/OIDC endpoint, or absolute-URL-in-email feature
Hunt Next.js specific vulnerabilities — Server Actions arbitrary function execution, Middleware auth bypass via static asset paths, ISR cache poisoning, Image Optimization SSRF (/_next/image), RSC payload leakage, getServerSideProps injection, source map exposure, debug endpoint leakage. Use when target runs Next.js 13/14/15 or any React SSR framework.
Hunt Node.js specific vulnerabilities — Prototype Pollution → RCE chains (lodash/merge/assign), Express trust proxy misconfiguration, child_process/eval injection, template engine SSTI (EJS/Pug/Handlebars), path traversal in file servers, require() injection, environment variable exfil via /proc/self/environ. Use when target runs Node.js/Express/Fastify/NestJS/Koa.
Hunt source code and build artifact leakage — JavaScript source maps (.js.map) reconstructing TypeScript/ES6 source, Swagger/OpenAPI JSON endpoint discovery, .env/.git exposure, webpack chunks with hardcoded secrets, robots.txt/security.txt recon, build-info files, asset-manifest.json API route discovery, .DS_Store file listing. Use at the START of every recon session — these findings often unlock the entire attack surface.
Hunt for Spring Boot-specific vulnerabilities: Actuator endpoints (heapdump, env, loggers, mappings, shutdown), Spring Expression Language (SpEL) injection → RCE, H2 console RCE, Jolokia JMX exposure, Spring4Shell (CVE-2022-22965), Spring Cloud Function SpEL (CVE-2022-22963), and credential extraction from heap dumps. Use when the target runs Spring Boot, detected via the X-Application-Context header, /actuator, Whitelabel Error Page, or Java stack traces.
Hunt server-side template injection (SSTI) across Jinja2 (Flask/Django), Twig (Symfony), Freemarker (Java), ERB (Rails), Spring, Velocity, Mako, Thymeleaf, Smarty. Detection probes use double-curly and dollar-curly math expressions evaluated server-side. Once an engine is fingerprinted, escalate to RCE via the engine-specific class-walker, callback-registrar, or Execute-utility patterns documented in disclosed reports. Detection patterns: error messages reveal engine, blank or numeric eval reveals expression mode. Targets: email templates, PDF/report generators, CMS preview features, error pages with user input. Use when hunting RCE via template rendering, when content shows engine fingerprints, when finding endpoints that compose strings with user input before render
Hunting skill for XXE vulnerabilities. Built from 10 public bug bounty reports, including SVG-upload XXE, Office-doc (PPTX/DOCX) XXE, SOAP XXE, SAML AssertionConsumer XXE, blind OOB XXE via DTD callback, parameter-entity XXE, XXE-to-LFI, XXE-to-SSRF, and XXE-to-RCE chains (Adobe Commerce CosmicSting CVE-2024-34102). Use when hunting XXE on any target, with an emphasis on the OOB-Or-It-Didn't-Happen Gate for blind cases.
Online password brute-forcing with Hydra. Use when you need to brute-force, password-spray, or credential-stuff SSH/FTP/HTTP/SMB/RDP/MySQL/MSSQL and other services. Hydra is the classic online brute-force tool, supporting 50+ protocols. Use this skill for any scenario involving online password brute-forcing, login cracking, or protocol brute-force testing
Icon and illustration systems: grid and sizing scales, library selection (Lucide, Heroicons, Phosphor, SF Symbols, Material Symbols), illustration style guides, SVG optimization, and accessible iconography. Use when choosing an icon set, sizing icons, or establishing an illustration style.
Analyze liquid markets with a strict ICT/SMC framework that combines multi-timeframe bias, liquidity sweeps, displacement, close-confirmed MSS/BOS, FVG/OB/Breaker/OTE retracements, premium-discount location, session timing, invalidation, targets, and risk-to-reward. Use for ICT chart reviews, live-market analysis, OHLCV scans, or validating a user's trade thesis. Return an auditable setup status and conditional plan; do not use for generic indicator analysis, order execution, or claims of proven institutional intent.
Reverse engineering and binary analysis with IDA Pro and ida-cli. Use when driving headless IDA workflows from the shell or from an agent loop: disassembly, decompilation, cross-references, struct recovery, type work, patching, FLIRT, IDAPython scripting, emulation-based call tracing, and devirtualization of commercial VM protectors (Themida / VMProtect / Code Virtualizer / WinLicense). Covers the ida-cli flat CLI, the router service, stdio + streamable HTTP transports, the installable skill bootstrap, and the bundled `vm_devirt.py` emulator. Supports PE, ELF, Mach-O, and firmware binaries.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.