Skills
97,905 packaged capabilities and playbooks for agents. Install any of them with one command.
All
All-in-one image studio. One Skill handles four high-frequency image types: Xiaohongshu covers (3:4), PPT illustrations (16:9), various charts (flowcharts/architecture diagrams/heatmaps and 12+ other types), and article logic diagrams (16:9). Built-in 12 visual styles + automatic style recommendation, covering Chinese-language scenarios. Flow: enter content → choose type → fill in details → choose style → prompt (automatic / review) → generate image. Calls LabNana's GPT-image-2 model and outputs PNG. Trigger words: "make a cover", "Xiaohongshu cover", "make an illustration", "PPT image", "draw a flowchart / architecture diagram / heatmap / mind map", "article logic diagram", "logic diagram", "add an image", "image-studio".
Elite frontend image-direction skill for generating premium, conversion-aware website design reference images via ChatGPT image generation. Fires when the user asks to generate website mockups, landing page concepts, section design references, or UI comp images. Enforces ONE separate horizontal image PER section, composition variety (bans the default left-text/right-image on every section), background-image freedom, varied CTAs, varied hero scales, narrative concept spine, second-read moments, and a single consistent palette across all images. Outputs structured prompt blueprints that produce Awwwards-tier visual references a developer or coding model can accurately recreate. Image generation only - does not write code.
Implement exactly one ready Phat task within its documented scope, update its Goal/Blocked by/Todo checklist with verified progress, preserve unrelated changes, apply the project's verification and commit policy, and prepare the task for review. Use when a task is todo or an existing in-progress continuation with all dependencies complete.
How to implement solutions using the MSH (Micro-Service Helper) TypeScript packages from @beecode/msh-* (app-boot, env, error, logger, node-session, util, config). Use this skill whenever the user works with any @beecode/msh-* package, or asks to set up app initialization and graceful shutdown, environment variable validation, HTTP-aware errors and Express error handling, logging, request-scoped sessions/CLS/async-local-storage, or shared utilities (singletons, memoize, timeout, joi validation, time helpers). Also trigger when the user mentions MSH, beecode, AppFlow, LifeCycle, AppStarter, mshEnv, mshEnvResolver, errorFactory, errorHOF, ErrorBaseModel, HttpResponseCodeMapper, PresetConsoleSimpleString, PresetConsoleJson, PresetPino, LogLevel, LoggerStrategy, NodeSessionUtil, SessionStrategy, FastAlsStrategy, ClsHookedStrategy, AsyncLocalStorageStrategy, singletonPattern, SingletonAsync, ObjectUtil, TimeUtil, JoiUtil, memoizeFactory, or msh-config eslint/prettier config. Always consult this skill before writing code that imports from @beecode/msh-* so the correct current API and the right package version are used
Split a shared growth strategy or inbound branch artifact into one level of Paperclip backlog work items for inbound, content-led, or channel-led acquisition. Use when planning LinkedIn, newsletter, YouTube, personal-brand, or content work after growth-record-strategy.
Text network analysis and knowledge graphs via the InfraNodus MCP server: text structure, content gaps, research questions and ideas, text comparison, SEO/GEO and Google search analysis, GraphRAG retrieval, structured memory. Accepts text, URLs (incl. YouTube), and saved graphs. Analyzes and optimizes an LLM's memories (Claude or Codex memory, mem0, claude-mem): optimizes their structure with optimize_knowledge_base and finds gaps to bridge them and enhance the memories. Also graphs code repos and Obsidian vaults: in a project folder ("graph this repo", "analyze this vault", "/infranodus") it mines docs, PDF text, docstrings, WHY/NOTE comments, and commit/PR/issue history into saved graphs with a report, and keeps them current as files change. When infranodus/manifest.json exists in the project root, answer questions about themes, decisions, rationale, or gaps by querying the existing graphs FIRST, before reading files. For an LLM-authored knowledge base built from sources, prefer the llm-wiki skill.
Installs, configures, or upgrades Dazbo's PR code review & issue triage GitHub Action (gemini-review-action) in a target repository. Use when the user wants to set up, configure, or update automated AI code reviews, issue triaging, or Gemini model workflows for their GitHub repository.
Guide an ISV developer or merchant through integrating Apple Pay with Payroc's payments API from merchant setup through a first successful UAT test transaction. Use this skill whenever someone asks about adding Apple Pay to their Payroc integration, implementing Apple Pay on their checkout page, handling Apple Pay sessions with Payroc, processing digital wallet payments via Apple Pay, or getting Apple Pay working with the Payroc gateway — even if they don't explicitly mention "integration" or ask for step-by-step guidance.
Guide an ISV developer or merchant through integrating Google Pay with Payroc's payments API from merchant setup through a first successful UAT test transaction. Use this skill whenever someone asks about adding Google Pay to their Payroc integration, implementing Google Pay on their checkout page, processing digital wallet payments via Google Pay, or getting Google Pay working with the Payroc gateway — even if they don't explicitly mention "integration" or ask for step-by-step guidance.
Guide a developer through integrating Payroc Payment Links — creating shareable payment URLs, distributing them by email, and managing their lifecycle (retrieve, list, update, deactivate, view sharing history). Use this skill whenever someone asks about Payroc payment links, generating a payment URL to send to a customer, sending a payment request by email, building an invoice payment flow, setting up a donation link, creating a hosted payment link, sharing or re-sharing a link, updating or expiring a payment link, or deactivating a link — even if they don't explicitly say "payment links". Also trigger when a developer has a Payroc API key and wants to charge customers without embedding a payment form in their site.
A set of resources to help me write all kinds of internal communications, using the formats that my company likes to use. Claude should use this skill whenever asked to write some sort of internal communications (status reports, leadership updates, 3P updates, company newsletters, FAQs, incident reports, project updates, etc.).
Support IATF 16949 internal audit programme - QMS audits, process audits, product audits, and layered process audits. Covers audit planning, checklists, findings, and corrective actions. USE WHEN user says 'internal audit', 'audit checklist', 'process audit', 'product audit', 'QMS audit', 'audit finding', 'nonconformance', or 'LPA'. Integrates with AutomotiveManufacturing and A3criticalthinking skills.
TRIGGER THIS when preparing interviews, planning hiring processes, creating interview questions, building evaluation frameworks, developing interviewer guides, or standardizing interview approaches. Builds complete interview kits with competency-based questions, scorecards, rubrics, interviewer training, and structured evaluation protocols.
[Fix & Debug] Use when you need to investigate and explain how existing features or logic work. Flag: --mode=explain produces a one-way developer-narrative explanation (Purpose → How → Why → Impact) tuned by coding level; use /understand for the standalone prompt-driven explainer.
Invokes Google Gemini models for structured outputs, image generation, text-to-speech narration, multi-modal tasks, and Google-specific features. Use when users request Gemini, image generation, Gemini TTS or a synthesized voice, structured JSON output, Google API integration, or cost-effective parallel processing.
Enables GitHub repository operations (read/write/commit/PR) for Claude.ai chat environments. Use when users request GitHub commits, repository updates, DEVLOG persistence, or cross-session state management via GitHub branches. Not needed in Claude Code (has native git access).
IOC (indicator of compromise) analysis and countermeasure methodology. Blue team perspective: how to collect, enrich, and correlate IOCs for threat hunting. Red team perspective: how to avoid generating identifiable IOCs from your own infrastructure and tools, and how to make IOCs expire quickly. Use when the red team needs to assess its own exposure or plan C2 infrastructure
Handle deep links in an Ionic Capacitor app — custom URL schemes (myapp://), iOS Universal Links, and Android App Links. Trigger when adding password-reset links, share-to-app URLs, OAuth callbacks, magic-link sign-in, or branded https:// links that open the app instead of the browser.
JVM performance profiling with Java Flight Recorder (JFR), jcmd, and GC analysis. Use for identifying bottlenecks and memory issues. USE WHEN: user mentions "Java profiling", "JFR", "JVM performance", asks about "Java Flight Recorder", "jcmd", "heap dump", "GC tuning", "thread dump", "Java memory leak" DO NOT USE FOR: Node.js/Python profiling - use respective skills instead
JavaScript best-practices and rule enforcement — naming conventions, modern syntax idioms, `this`-handling, module structure, array/iteration performance, and nullability. TRIGGER when: language (JavaScript, JS, .js, .mjs, .cjs, Node.js, browser JS, ESM, CommonJS), syntax (const/let, destructuring, optional chaining, nullish coalescing, arrow functions), patterns (this binding, detached method, module imports, barrel file, index.js), performance (array chains, filter().map(), intermediate arrays, hot path, GC pressure), nullability (null vs undefined, sentinel value, == null check), naming (camelCase, PascalCase), ask (idiomatic JS, JS conventions, JS best practices, JS code review). ALSO APPLIES to TypeScript — load alongside `typescript` on `.ts`/`.tsx`; for type-system rules (generics, `as`, interfaces, narrowing) route to `typescript` / `typescript-type-system`. DO NOT USE as primary skill for type-system questions — this skill still applies for naming and JS idioms.
JSC GC reference for Bun. Use for use-after-free, JS object leaks, "collected too early", or when touching WriteBarrier, visitChildren, visitAdditionalChildren, JSRef, JSC::Strong/Weak, hasPendingActivity, ensureStillAlive, addOpaqueRoot, reportExtraMemoryAllocated, IsoSubspace, HeapAnalyzer, finalize.
Best practices and usage guide for the JAW SDK (@jaw.id/core, @jaw.id/wagmi, @jaw.id/ui). Use this skill when writing code that uses jaw-sdk or @jaw.id packages, integrating JAW smart accounts into an application, configuring JAW SDK features (passkeys, permissions, gas sponsoring, ENS), building with JAW wagmi hooks, implementing headless/server-side smart account operations, debugging JAW SDK issues, or when asked about JAW SDK patterns, APIs, or best practices.
Use when user asks to create/edit/query Online reports, SQL reports, data reports, or says "创建报表", "生成报表", "新建报表", "查询报表", "online报表", "SQL报表", "数据报表", "统计报表", "create report", "generate report", "data report". Also triggers when user describes report requirements like "做一个销售统计报表", mentions JeecgBoot cgreport/online report, or says "查看现有报表" / "列出所有报表". This skill handles Online 报表 (SQL-driven data display/reports), not Online forms (cgform) or designer forms (desform).
Offline password cracking with John the Ripper. Use when you need to crack hashes (MD5/SHA/NTLM/Kerberos/ZIP/RAR/PDF/SSH Key, etc.). John supports automatic hash type detection, dictionary attacks, rule-based mangling, and incremental brute-forcing, and ships with the *2john toolchain for extracting hashes from various formats. Use this skill for any scenario involving offline password cracking, hash recovery, or password auditing
Enforces purposeful JSDoc on complex or non-obvious TypeScript code—algorithms, invariants, side effects, edge cases, and public contracts—without restating types or narrating simple code. Use when writing or reviewing TypeScript, adding documentation comments, cleaning noisy JSDoc, documenting public APIs, or when the user says jsdoc, JSDoc, document this, or add docs comments.
Traffic hijacking and sensitive information theft in Kubernetes sidecar containers. Use when a target Pod has an Istio/Envoy/Linkerd sidecar, when the challenge mentions an 'invisible bystander' or 'shared network', or when you need to sniff traffic from inside a Pod. Covers tcpdump packet capture, plaintext traffic capture from sidecars, and exploitation of shared network namespaces. Use this skill whenever you find signs of a sidecar or multiple co-existing containers in a K8s Pod
Kubernetes Admission Webhook abuse and policy engine exploitation. Use when the cluster has Kyverno/OPA Gatekeeper/custom webhooks, when DNS scanning reveals kyverno-svc or gatekeeper services, or when you need to extract injected secrets from a Mutating Webhook. Core technique: forging AdmissionReview requests. Use this skill for any scenario in K8s where a webhook service or policy engine is found
Kubernetes cluster DNS service discovery and reconnaissance with k8spider. Use when you need to enumerate Services in a K8s cluster with low privileges, probe DNS services, scan network ranges for PTR/SRV records, or attempt AXFR zone transfers. k8spider needs only DNS access to discover all services in a cluster, with no API Server permissions required. Use this skill for scenarios involving K8s service discovery, DNS reconnaissance, cluster information gathering, PTR scanning, or SRV enumeration. Trigger it also when the user mentions k8spider, K8s DNS enumeration, cluster service scanning, or DNS zone transfer
Answer from the knowledge bundle. Use when the user asks what they/the project know about something, wants to look something up, explore connections, or compare things that live in a knowledge/ bundle — and when any task would be informed by an existing bundle, consult it here before answering from scratch. Navigates by progressive disclosure and files valuable answers back so the bundle compounds.
Complete attack methodology for Kerberoasting and AS-REP Roasting. Use when you hold any domain user credentials (Kerberoasting) or discover accounts that do not require pre-authentication (AS-REP Roasting). Covers SPN discovery, ticket requests, offline cracking, AES vs RC4 strategy selection
A collection of advanced Kerberos protocol attack techniques. Use the advanced techniques in this skill when basic Kerberoasting/AS-REP Roasting and delegation attacks are not enough. Covers sAMAccountName spoofing (noPac/CVE-2021-42278), Kerberos relay (KrbRelayUp), Timeroasting (unauthenticated hash extraction over NTP), ASREQroast (MITM AS-REQ capture), SPN-jacking (targeted Kerberoasting), UnPAC-the-hash (certificate → NT Hash), Sapphire ticket (highly stealthy ticket forgery), Bronze Bit (CVE-2020-17049 delegation bypass), and the RODC attack chain (key list export/RODC Golden Ticket/RODC DACL exploitation).
Use this skill when starting a new project and defining baseline repository rules, especially for optional devcontainer setup, mise-first tooling, pnpm security settings, Vite+ workflows, kiso.css adoption, pre-push test gates, and project-local post-edit lint/format hooks that run after AI agent file edits.
Reads yesterday's Linear issues and GitHub commits for the authenticated user, formats a standup update (done / doing / blockers), and posts it to Slack. Use when asked to write a standup, generate a standup update, post to the standup channel, summarize yesterday's work, or automate the daily standup. Trigger when a user says "write my standup", "post standup", "generate standup update", "what did I do yesterday", or "kill the standup".
Use KMSG to read, watch, and send KakaoTalk messages safely from a coding agent. Use whenever the user mentions KakaoTalk or kmsg and wants chat discovery, recent messages, monitoring, text or image delivery, setup checks, or CLI troubleshooting. Do not use for other messaging platforms or private KakaoTalk protocol work.
When the user wants to solve knapsack optimization problems, select items with constraints, or maximize value with limited capacity. Also use when the user mentions "0/1 knapsack," "bounded knapsack," "unbounded knapsack," "multiple knapsack," "multidimensional knapsack," "value-based packing," "capacity-constrained selection," or "resource allocation with limits." For bin packing, see 2d-bin-packing or 3d-bin-packing. For general optimization, see optimization-modeling.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.