Skills
97,222 packaged capabilities and playbooks for agents. Install any of them with one command.
All
GSDL (Get Shit Done Light) orchestrator. Runs the full pipeline: pick up the work item → brainstorm → SPEC.md → decompose into slices → human review → branch → execute → verify gates → open PR and address review-bot findings → close loop with evidence. Use when the user wants to build something end-to-end, says "let's GSD", "run the GSDL pipeline", "pick up this ticket", or wants the full workflow. Coordinates gsdl-fetch-source, gsdl-create-spec, gsdl-decompose, gsdl-execute, gsdl-verify-gates, gsdl-open-pr, gsdl-close-loop, and gsdl-tracker-sync. Works with any issue tracker (Linear, Jira, GitHub Issues, Notion) or none at all, and with any model provider. Can be invoked from ANY session model — it routes each step to that step's capability tier. Accepts a work-item URL/ID, a doc URL, a plain idea, or an existing project name to resume: /gsdl [url|id] OR /gsdl [project-name] OR /gsdl [idea].
Build an ordered, locally-served HTML reading order for a large commit, PR (by number, branch or github url - the repo need not be checked out here), working tree or conflict resolution, grouped by theme, with each file's diff inline in an editable Monaco editor (2-way, or 3-way current | resolution | incoming for a conflict), per-line review notes, and a pan/zoom compare viewer for changed images. Use when a commit/PR is too large to read file-by-file in git-log order and the user wants a guided path through it; to review changed Playwright screenshot baselines / any image diffs visually (the scripted snapshots-only mode needs no authoring at all); and offer it, unasked, straight after you (or another agent) resolve non-trivial merge, rebase, cherry-pick or revert conflicts - before the operation is continued or committed - so the user can check the resolution against both sides.
Operate macOS via Hammerspoon, either one-off `hs -c` Lua (launch, quit, or focus apps and browser tabs; volume, wifi, caffeinate, alerts, clipboard) or persistent hotkeys, watchers, and menubar items in ~/.hammerspoon. Use when asked to control an app, tab, or Mac system state, keep the Mac awake, or write a Hammerspoon module. Not for web page content.
Generates the Somnio HandShake Step 3 - Acknowledgement PDF document from raw evaluation notes. Use this skill whenever an Engineering Manager (EM) wants to create, generate, or produce one or more HandShake Acknowledgement documents, career review PDFs, seniority evaluation documents, or anything related to the Somnio bi-annual performance review process. Trigger even if the user says things like: generar el documento del handshake, armar el PDF de la evaluacion, crear el acknowledgement para un dev, generar el informe del career path, procesar estas fichas, or similar. The skill handles both single and batch (multiple devs) generation: it reads all attached ficha files, pre-fills what it can infer, confirms all data with the EM in a single table, then generates one PDF per dev.
Cloudflare Tunnel (cloudflared add-on) HTTPS for Home Assistant OS (HAOS): give a HAOS instance a real HTTPS URL. Use when the user wants HTTPS or remote access for Home Assistant, or mentions cloudflared or Cloudflare Tunnel. Also consult it before suggesting DuckDNS, port forwarding, or HA-native SSL for a HAOS box.
Creates, configures, and debugs `@hapi/hapi` servers — implements routes, plugins, auth schemes, validation, caching, and request lifecycle hooks. Use when building HTTP APIs, setting up stale-while-revalidate caching, registering server methods, configuring views, managing startup sequences, or troubleshooting response marshalling.
Create customer-facing help documentation for product features. Use when writing help articles, knowledge base entries, how-to guides, or support documentation. Analyzes codebase to extract feature details and transforms them into user-friendly walkthroughs with troubleshooting sections.
Filter China A-share stocks using natural-language queries and combinations of market, technical, financial, industry, and concept criteria. Returns relevant data for matching stocks. This skill must be used when the user asks about filtering A-share stocks by market data, financial data, technical indicators, industry concepts, or related criteria.
Stack Honey onto Superpowers-style workflows (subagent-driven-development, dispatching-parallel-agents, executing-plans) and any orchestration that dispatches fresh subagents. Dispatched subagents run in isolated context and do NOT inherit the session's Honey hook, so they emit full-fat code and verbose reports. Use when you are about to dispatch implementer/reviewer/fixer/parallel subagents: it gives the exact Honey directive to paste into each dispatch prompt, with a worker variant and a reviewer variant, so the levers apply inside the subagents too — where the multiplied cost actually is.
Discover and run Holoscan Sensor Bridge example applications on a connected devkit. Filters available apps by the user's platform, HSB software version, board type, and sensors. Supports timed execution, failure analysis, code-edit suggestions, and iterative re-runs.
Flash the FPGA on an HSB board connected to an NVIDIA devkit. Supports HSB Lattice boards (FPGA versions 2407, 2412, 2507, 2510) and Leopard Imaging VB1940 “all-in-one” cameras (FPGA versions 2507, 2510). Uses release-specific YAML manifests and board-type-specific program commands. Lattice and VB1940 commands must never be mixed.
Clone the latest NVIDIA Holoscan Sensor Bridge repo, ask which supported devkit is being used, configure the host per platform, build the correct demo container, run it, and verify HSB connectivity by pinging 192.168.0.2. Use for Holoscan Sensor Bridge setup, build, container launch, and first-connectivity bring-up.
Execute QA test plans on Holoscan Sensor Bridge hardware. Reads a user-provided test document, filters tests based on the user's setup, determines which tests can run automatically, executes them with pass/fail evaluation, and produces a structured test results report.
Skill-set loader for /hunt orchestrator. Fingerprints the target, picks the right platform attack skills, and loads the Red Team or WAPT skill set. Use when /hunt has just received a mode answer (redteam or wapt + blackbox|greybox) and needs to load the appropriate skills and print the taxonomy. Not for direct user invocation.
Hunt Firebase / Firestore / GCP exploitation — Firebase API key discovery in JS bundles, anonymous auth via signUp endpoint, Firestore collection enumeration with anon key, Realtime Database read/write without auth, Firebase Storage bucket listing, Firebase Hosting detection, GCP service account JSON exploitation, IAM policy enumeration from leaked SA keys. Built from field experience where Firebase API keys in JS bundles unlocked full Firestore read-access on 12+ targets including healthcare platforms and delivery apps. Use when a JS bundle, APK, or .env file reveals a Firebase API key (AIzaSy...) or when target uses firebaseio.com / firestore.googleapis.com endpoints.
Hunt Supabase exploitation — Supabase anon key discovery in JS bundles, REST API table enumeration with anon key, Row Level Security (RLS) bypass via missing organization_id check, RPC function abuse returning cross-organization data, Storage bucket listing, Auth signUp/signIn with anon key, multi-tenant enumeration via WHOIS, bucket file upload/download without auth. Built from field observation of Lovable.dev + Supabase stack on rapidly-built platforms where RLS policies are consistently misconfigured. Use when a JS bundle, .env, or APK reveals a Supabase URL (project.supabase.co) and anon key (eyJ...).
Hunt TLS/SSL and DNS misconfigurations — missing HSTS (downgrade attack), weak cipher suites, expired/invalid certificates, mTLS bypass, missing SPF/DKIM/DMARC (email spoofing), DNS Zone Transfer (AXFR), dangling CNAME subdomain takeover, CAA records. Most of these are Info/Low on their own — this skill is opinionated about which findings actually pay (spoofable DMARC with delivered-to-inbox proof, AXFR returning internal hosts, dangling-CNAME takeover) versus which get rejected as best-practice noise (missing CAA, missing HSTS with no MitM position). Use during recon to find infrastructure weaknesses, and to TRIAGE them honestly before reporting
Implement real-time Hotwire behavior: Turbo Streams over WebSocket/SSE, custom stream actions, inline stream tags, live list updates, and cross-tab state synchronization. Prefer this skill when the core problem is push-based updates or stream action orchestration. Use hwc-navigation-content for pull-based pagination/tab/lazy-navigation flows, hwc-forms-validation for form lifecycle and validation, hwc-media-content for media upload/playback behavior, hwc-ux-feedback for generic loading/progress/transitions, and hwc-stimulus-fundamentals for non-stream Stimulus fundamentals.
Covers Stimulus controller fundamentals: lifecycle hooks, values and valueChanged callbacks, targets and target callbacks, outlets, action parameters, keyboard events, and controller architecture patterns. Prefer this skill when the request is primarily about Stimulus APIs and controller design independent of a specific Hotwire domain. Use hwc-forms-validation for form-specific workflows, hwc-navigation-content for Turbo navigation concerns, hwc-realtime-streaming for Turbo Streams/WebSocket patterns, hwc-media-content for media integrations, and hwc-ux-feedback for loading, progress, or transition UX patterns.
Implement cross-cutting Hotwire UX feedback patterns: loading states, busy indicators, progress bars, optimistic UI, render interception, and view/page transitions. Prefer this skill when the core goal is perceived performance and user feedback, independent of a single feature domain. Use hwc-forms-validation for form correctness and validation behavior, hwc-navigation-content for navigation/history/cache mechanics, hwc-realtime-streaming for push/stream orchestration, hwc-media-content for media-specific behavior, and hwc-stimulus-fundamentals for base Stimulus API questions.
Run a self-referential self-improving agent loop where a meta-agent iteratively modifies a task-agent's code to optimize for any measurable target. Based on Facebook Research's Hyperagents paper (arXiv:2603.19461). Use when asked to “run hyperagent,” “self-improve this,” “optimize with self-modification,” or “evolve this agent/script.”
Validate a business idea before investing time or money. Use whenever a solopreneur has a raw idea and needs a structured process to stress-test it against reality — covering problem definition, demand evidence, competitive context, customer discovery, riskiest-assumption testing, and a scored go/no-go decision. Trigger on phrases like "validate my idea", "is this worth building", "should I pursue this", "test my business idea", "does this idea have legs".
You MUST use this before building any new feature, planning a migration, designing a system, or turning scattered ideas into a plan. Triggers on: feature requests, project ideas, brain dumps, 'help me plan,' 'spec this out,' 'think through this,' 'interview me,' 'I want to build,' 'let's design,' or any unstructured idea that needs structure before code. Covers small single-spec projects through multi-phase initiatives. Runs a conversational interview, writes an interactive HTML contract, then generates implementation-ready Markdown specs. Skip ONLY for well-defined implementation tasks (writing code to a known spec, fixing bugs, refactoring, explaining code).
Edit existing images with natural language using each::sense AI. Modify colors, add or remove objects, change styles, inpaint regions, outpaint to extend canvas, retouch photos, and apply creative effects. Supports up to 4 reference images. Use for: photo retouching, object removal, style transfer, inpainting, outpainting, color correction, creative edits. Triggers: edit image, modify image, change image, image editing, photo edit, retouch, inpaint, outpaint, remove object, add object, style transfer, color grade image
Elite website image-to-code skill for Codex. For visually important web tasks, it must first generate the design image(s) itself, deeply analyze them, then implement the website to match them as closely as possible. In Codex, it must prefer large, readable, section-specific images instead of tiny compressed boards, generate fresh standalone images for sections or detail views instead of cropping old ones, avoid lazy under-generation, avoid cards-inside-cards-inside-cards UI, and keep the hero clean, spacious, readable, and visible on a small laptop.
Architecture patterns for GDPR Article 5(1)(c) data minimization and Article 25(1) data protection by design. Covers field-level encryption, data masking, aggregation, pseudonymization per Article 4(5), and anonymization per Recital 26. Includes ENISA pseudonymization techniques and a data minimization assessment matrix.
Configures AIDE (Advanced Intrusion Detection Environment) for file integrity monitoring on Linux, covering baseline database creation, scheduled integrity checks via cron, change detection, and alerting on unauthorized modifications. Use when setting up host-based file integrity monitoring, detecting unauthorized file changes, or meeting compliance requirements for FIM on Linux systems.
Impression share analysis and root cause diagnosis for Google Ads Search campaigns. Auto-invoke when investigating underspending, analyzing auction competitiveness, or diagnosing budget vs. quality issues. Interprets Search IS, Budget Lost IS, and Rank Lost IS metrics in smart bidding context
Teaches Infrahub concepts (schema, objects, branches, proposed changes, checks, transforms, generators, menus) from wherever the learner is, using their own repo files and live instance as lesson material. TRIGGER when: the user wants to learn or understand an Infrahub concept, asks "teach me", "explain how X works in my instance", "I'm new to Infrahub", asks what the equivalent of a NetBox/Nautobot concept is in Infrahub, wants a guided tour, or wants to resume a learning session. DO NOT TRIGGER when: the user wants the work done for them (use the infrahub-managing-* skills), wants live operational answers (use infrahub-analyzing-data), or is debugging a failure (use infrahub-collecting-diagnostics).
Design resilient HTTP, messaging, and scheduled integrations for Kotlin plus Spring services with explicit timeout budgets, retries, idempotency, circuit breakers, DLQ behavior, and failure observability. Use when integrating with unstable external systems, designing retry logic, handling duplicate delivery, preventing thundering herds, or making message-driven and scheduled workflows safe in production.
Create and update Pitch Decks, One-pagers, Investor Memos, Accelerator Applications, Financial Models and fundraising materials. Use this when the user needs investor-facing documents, projections, Use-of-funds tables, milestone plans, or internal consistency across multiple fundraising assets.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.