Skills
97,725 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Use when the user wants an iterative, self-checking exploratory analysis of a dataset — surfacing findings that are each verified by re-running the computation, not asserted. Proposes one specific hypothesis at a time, writes and runs analysis code to test it, and records the finding only if the numbers support it at a meaningful effect size; loops until no new verified finding appears or the budget is hit. The result is a findings report where every claim is backed by a reproducible number. Not for diagnosing a single known anomaly or pipeline failure, and not for verifying an external claim against sources (that is a claim-verification task) — this is open-ended discovery over a bound dataset.
Turn raw business data (CSV, SQLite, spreadsheets, pasted tables) into clear analytical summaries, trend analysis, and actionable reports for small business operators, analysts, and decision-makers. Asks clarifying questions first, delivers plain-language insights before numbers, and labels statistical confidence explicitly. Does not provide financial advice or present projections as fact.
Executes GDPR Article 20 data portability requests, covering machine-readable format requirements (JSON, CSV, XML), direct controller-to-controller transfer mechanisms, and scope limitations to data provided by the subject on consent or contract basis. Activate for portability, data export, Art. 20, data transfer queries.
Design and audit data quality observability for analytics events, product metrics, warehouses, imports, pipelines, dashboards, AI datasets, billing data, and operational reports. Use when teams need freshness, completeness, accuracy, schema drift detection, lineage, backfill safety, alerting, incident ownership, and metric trust.
Design clear, scannable data tables that follow established UX conventions for alignment, formatting, and readability. Use this skill when building data tables, grids, list views, dashboards, reports, or any tabular display. Also triggers for: "design this table", "how should I display this data", "table layout", "column alignment", "grid design", "data grid", "table UX", "report table", "spreadsheet layout", "make this table easier to read", or "numeric column formatting". Covers column ordering, alignment rules, number formatting, status indicators, row density, sorting, and responsive behavior. Do NOT use for database schema design, API response design (use api-design), or chart/visualization design.
Design new Datadog dashboards, redesign existing ones, or audit dashboards for operational readiness. Covers widget selection, layout organization, template variables, group structure, tab organization, alert threshold validation, and zero-knowledge readability. Uses pup CLI for inspecting dashboards and validating designs. Use when designing new dashboards, redesigning existing ones, auditing before on-call handoff, or reviewing after dashboard changes. Do not use for: (1) Datadog agent installation or configuration, (2) monitor/alert rule design, (3) APM instrumentation or tracing setup, (4) log pipeline configuration.
Ground text-to-SQL work in DataHub catalog evidence. Use when a user asks to write, draft, debug, or execute SQL; answer a data question that requires SQL; calculate a metric; query named tables; or investigate SQL results with DataHub MCP tools available. Always begin with find_sql_context, even when the user already supplied tables or dataset URNs, and call inspect_tables_for_sql on the chosen tables before writing SQL.
Data visualization, dashboard design, and diagram expert with bundled ECharts theme, chart templates, D2 diagram templates, and CSS/HTML data-enriched diagram patterns. Use this skill whenever the user is building charts, dashboards, KPI cards, data tables, diagrams, flowcharts, or any visual representation of data or system structure — even if they don't explicitly say "dataviz." Triggers on: Recharts, ECharts, chart components, bar/line/scatter charts, dashboard layout, KPI cards, sparklines, data storytelling, metric visualization, heatmaps, treemaps, sankey, color palettes for data, axis labels, chart titles, data-ink ratio, flowcharts, process flows, architecture diagrams, sequence diagrams, ERDs, org charts, system diagrams, pipeline visualizations, D2 diagrams, or any request to "show data", "visualize metrics", "draw a diagram", "diagram the architecture", or "show the flow." Also use when reviewing existing charts or diagrams for quality, accessibility, or design improvements. If you see a chart or diagram being built or discussed, this skill applies.
Build, review, debug, migrate, or plan date-fns v4 date/time code with @date-fns/tz and @date-fns/utc. Use for date-fns, format, parse, parseISO, addDays, differenceIn*, Interval, Duration, date-fns/fp, locales, TZDate, UTCDate, tz(), utc, transpose, in option, Unicode tokens, DST, SSR hydration date bugs, and migrations from date-fns v2/v3 or date-fns-tz.
When the user wants to reorganize an entity's outstanding obligations to restore solvency. Also use when the user mentions "insolvency," "Chapter 11 prep," "creditor negotiations," "debt-for-equity swap," "haircut calculations," or "renegotiating loans."
Executes agent-enhanced council queries as one Workflow of parallel Claude analyst agents that each query a provider, evaluate response quality, ask follow-up questions, and return a schema-enforced analysis with confidence ratings and blind spot analysis. Invoked when the --agents flag is used or when complex architectural decisions are detected.
Explore a codebase to find opportunities for architectural improvement, focusing on making the codebase more testable by deepening shallow modules. Use when the user wants to improve architecture, find refactoring opportunities, consolidate tightly coupled modules, or make a codebase more AI-navigable.
Deep research expert for building comprehensive knowledge maps from first principles. Use when the user wants to deeply understand a topic — its origin, the problem it solves, the foundational theory, the architecture, and future trajectory — all grounded in primary sources.
Use when writing or reviewing Python code in this repo that calls Deepgram audio analytics overlays on `/v1/listen` - summarize, topics, intents, sentiment, diarize, redact, detect_language, entity detection. Same endpoint as plain STT but with analytics params. Covers both REST (`client.listen.v1.media.transcribe_url`/`transcribe_file`) and the WSS-supported subset (`client.listen.v1.connect`). Use `deepgram-python-speech-to-text` for plain transcription, `deepgram-python-text-intelligence` for analytics on already-transcribed text. Triggers include "diarize", "summarize audio", "sentiment from audio", "redact PII", "topic detection audio", "audio intelligence", "detect language audio".
Use when writing or reviewing Python code in this repo that calls Deepgram Conversational STT v2 / Flux (`/v2/listen`) for turn-aware streaming transcription. Covers `client.listen.v2.connect(...)`, Flux models, end-of-turn detection. Use `deepgram-python-speech-to-text` for standard v1 ASR, `deepgram-python-voice-agent` for full-duplex interactive assistants. Triggers include "flux", "v2 listen", "conversational STT", "turn detection", "end of turn", "EOT", "listen.v2", "flux-general-en", "flux-general-multi".
Guidance for Microsoft Defender External Attack Surface Management (Defender EASM) — discovers and inventories an organization's internet-facing assets (domains, hosts, IPs, SSL certs, ASNs, web pages, contacts) from the outside-in. Covers seed-based discovery, attack surface insights (CVEs, expiring certs, deprecated tech, unsanctioned cloud), labels and groups, integration with Defender for Cloud (CSPM), Defender XDR, and Sentinel, and pricing model (per asset). WHEN: Defender EASM, external attack surface management, internet-facing inventory, shadow IT discovery, expired SSL discovery, exposed RDP discovery, unknown subdomain, attack surface insights, seed-based discovery, outside-in scanning, third-party asset risk, M&A asset discovery. DO NOT USE for internal asset discovery (use defender-for-cloud-hardening / Defender XDR), endpoint vuln scan (use defender-for-endpoint MDVM), or Sentinel hunting alone.
Guidance for Microsoft Defender for Containers — Kubernetes and container security across AKS, Azure Arc-enabled Kubernetes, EKS, GKE, and OpenShift. Covers agentless discovery, agentless vulnerability assessment for images and running containers (powered by Microsoft Defender Vulnerability Management), runtime threat detection via the Defender sensor (eBPF on Linux), Kubernetes data plane hardening with Azure Policy / Gatekeeper, registry scanning for ACR / ECR / GAR, admission control, attack path analysis, and Sentinel integration. WHEN: Defender for Containers, AKS security, container runtime threat detection, Kubernetes admission control, image vulnerability scanning, ACR scan, EKS GKE security in Defender for Cloud, K8s posture, container attack path, Defender container sensor, Gatekeeper Azure Policy AKS, agentless container scan. DO NOT USE for VM/host hardening (use defender-for-servers), AKS networking design (use azure-network-security-design), or general AKS day-2 ops unrelated to security.
Guidance for Microsoft Defender for Servers (Plan 1 and Plan 2) — server-specific protection in Microsoft Defender for Cloud. Covers plan selection, agentless vs agent-based scanning, MDE for Servers integration, file integrity monitoring (FIM via MDE), just-in-time VM access, vulnerability assessment, adaptive application controls, network hardening, and free data ingestion to Sentinel/Log Analytics. Applies to Azure VMs, Azure Arc-enabled servers (on-prem, AWS EC2, GCP Compute), and Azure VMSS. WHEN: Defender for Servers, MDE for Servers, server EDR, FIM, file integrity monitoring, JIT VM access, just-in-time access, agentless scanning servers, vulnerability assessment for VMs, hybrid server protection, Arc-enabled servers security, AWS EC2 in Defender for Cloud, GCP Compute in Defender for Cloud, server hardening Azure, Plan 1 vs Plan 2 servers. DO NOT USE for endpoint client devices (use defender-for-endpoint), generic Azure resource posture (use defender-for-cloud-hardening), or container hosts (use defender-for-containers).
Guidance for Microsoft Defender for Storage — threat protection for Azure Storage accounts (Blob, Files, Data Lake Gen2). Covers the v2 (per-storage-account) plan, on-upload malware scanning powered by Defender Antivirus, sensitive data threat detection (integrated with Purview classification), activity-based threat detection, override per storage account, exclusion of high-volume accounts, Event Grid integration for scan results, and cost controls (per-GB scan cap). WHEN: Defender for Storage, Azure Storage malware scan, Blob malware scanning, sensitive data threat detection, on-upload scan, Defender for Storage v2, Storage account threat protection, scan results Event Grid, Purview classification storage, malicious blob upload, exfiltration alert storage, untrusted upload scan. DO NOT USE for SQL/Cosmos DB protection (use defender-for-cloud-hardening), VM disk malware (use defender-for-servers agentless scan), or M365 SharePoint/OneDrive (use defender-for-office-365).
Create or update a concise, repository-grounded design document with canonical user stories ready for independent review and feature delivery. Use when asked to write a design doc, PRD, implementation plan, feature spec, requirements, or to turn a technical discussion into an implementable design.
Specialized skill for reverse-engineering Design Systems from websites. Uses Python pre-processing to extract design tokens without hitting token limits, and generates complete HTML documentation using real fragments and images from the original site.
Detect anomalies in Modbus/TCP and Modbus RTU industrial traffic via function code monitoring, register range validation, timing analysis, and deep packet inspection, using Zeek's Modbus analyzer, Suricata IDS with OT rules, and Python Markov chain models of normal transaction sequences. Use for deploying Modbus IDS in OT environments, baselining polling patterns, investigating suspicious Modbus traffic, or building function code allowlists.
Flag misspelled, brandjacked, and typosquatted package names across npm, PyPI, and crates.io before installation, using edit-distance, keyboard-proximity, and known-target corpus matching with typomania, Microsoft OSSGadget's oss-find-squats, and pypi-scan. Use before adding a new dependency, as a CI/CD gate on pull requests, when reviewing an AI-generated ("slopsquatting") dependency list, or when auditing a lockfile diff for a swapped package.
Research developer documentation audiences by mapping user goals, learning objectives, business goals, developer traits, user questions, personas, user stories, journey maps, and friction logs. Use when planning docs for APIs, SDKs, platforms, CLIs, developer tools, onboarding guides, SaaS docs, or support-heavy docs before writing or restructuring content.
Find Kalshi prediction markets on DFlow that match a criterion — arbitrage (YES+NO<$1), cheap long-shots, near-certain short-dated plays, biggest movers, widest spreads, highest volume, closing soonest, and series/event-level scans. Use when the user asks "where's the free money?", "any mispriced markets?", "cheap YES with volume", "what moved today?", "markets closing soon", "cheapest YES in this event", "top markets by volume", or "alert me when X happens" (streaming). Do NOT use to place orders (use `dflow-kalshi-trading`), to view a user's own positions (use `dflow-kalshi-portfolio`), or for general live-data plumbing unrelated to a scan (use `dflow-kalshi-market-data`).
View what a wallet holds on DFlow's Kalshi prediction markets — current positions, unrealized mark-to-market, realized P&L, activity history, and redeemable winners. Use when the user asks "what are my positions?", "what do I own?", "am I up or down?", "what's my fill history?", "what can I redeem?", "mark my portfolio to market", or "show me this wallet's DFlow activity". Read-only. Do NOT use to place sells or redemptions (use `dflow-kalshi-trading`), for market-wide data unrelated to a wallet (use `dflow-kalshi-market-data`), or to discover new markets (use `dflow-kalshi-market-scanner`).
Buy, sell, or redeem YES/NO outcome tokens on Kalshi prediction markets via DFlow. Use when the user wants to bet on an event, place a Kalshi order, take a YES or NO position, exit a Kalshi position, redeem winning outcome tokens after a market resolves, tune priority fees on a PM trade, or build a gasless / sponsored PM flow where the app pays tx / ATA / market-init costs. Covers both the `dflow` CLI and the DFlow Trading API. Do NOT use to discover markets, view positions, stream prices, complete Proof KYC, or for non-Kalshi spot swaps.
Upload local files to a Dify pipeline knowledge base through the published pipeline datasource flow and optionally apply existing metadata fields. Use when the target dataset is a published rag_pipeline/local_file knowledge base or ordinary Dify document create APIs return completed with 0 chunks.
Manage documents, folders, and content in DingTalk Cloud Docs. Use when users want to create documents or files such as spreadsheets, mind maps, whiteboards, presentations, or multidimensional tables; search documents; read or write document content; create folders to organize documents; traverse folder structures; or precisely edit document block elements. Also use when users mention keywords such as cloud docs, online docs, DingTalk docs, or 钉文档. Do not trigger when users need to manage schedules, send messages, or handle approval workflows.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.