Skills
97,222 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Research prediction-market odds, order books, price history, and public market-rule context from Polymarket, Kalshi, Metaculus, and DraftKings Predictions. DraftKings routes expose categories, availability maps, and rules, not live quote data. Use when the user asks what a market or forecasting community reports.
Security and privacy specialist for differential privacy, encryption, and complianceUse when "privacy, encryption, differential privacy, PII, GDPR, CCPA, access control, audit trail, data retention, privacy, security, encryption, differential-privacy, gdpr, ccpa, pii, opendp, ml-memory" mentioned.
Design entire feature flows end-to-end with user needs, user stories, and ASCII prototypes. Explores codebase to understand existing patterns, reuses existing components and modals, asks alignment questions, then designs world-class Linear/Stripe/Vercel-quality UI/UX. Writes final PRD into .todo/[feat-name]/PRD.md. Use when designing a new feature, flow, or screen — especially before implementation.
Act as a product-manager copilot that turns evidence into product decisions and artifacts: backlogs and prioritization, PRDs and user stories, metrics and OKRs, experiments, launch plans, feedback triage, and pricing/packaging, kept in a per-product workspace. Use whenever the user wants to decide what to build, spec it, or ship it: "write a PRD for…", "prioritize our backlog", "what should we build next", "plan OKRs", "define our north star metric", "design an A/B test", "plan the launch", "triage this customer feedback", "platform or feature?", in any language ("viết PRD", "ưu tiên tính năng nào", "quản lý sản phẩm", "プロダクト管理", "产品经理"), even when they never say "product manager". Also use when the user returns to a product workspace this skill created (a directory holding `product.md`, `state.md`, and `decisions.md`). Not for deep user discovery (design-thinking), desk market facts (market-researcher), or company-level bets (strategy-board).
Builds the product positioning document — customer language, differentiation, personas, and proof points. Triggers for 'positioning', 'target audience', 'differentiation', 'proof points', 'customer language', 'product marketing context', 'ICP', 'ideal customer profile', 'buyer persona', 'messaging framework', 'competitive positioning', 'value proposition', or 'brand messaging'.
Scaffolds per-repository agent context so coding agents share the same issue tracker rules, triage label vocabulary, domain glossary, ADR layout, and handoff conventions. Triggers on: "set up project context", "configure agent docs", "create CONTEXT.md", "setup agent workflow", "agent issue tracker setup", "triage labels", "domain glossary for agents". Use when a repo needs durable context files before planning, triage, debugging, TDD, architecture review, or multi-agent implementation.
Onboard an AI agent into any project — detect stack (web, mobile, backend), research up-to-date docs, run a universal 8-category audit (pages, state, UI, API, data, auth, jobs, integrations) with auto-detection and auto-skip, interview the developer, and generate structured context files with task-based routing so the agent never wastes time exploring the project again. Re-running project-onboard on an already-onboarded repo refreshes changed context, re-runs the feature audit, preserves interview answers, and updates routing without requiring separate update or audit commands. Use this skill whenever the user says "onboard", "onboard again", "rerun onboard", "update onboard", "refresh context", "set up context", "scan this project", "generate AGENTS.md", "generate CLAUDE.md", "map this codebase", "audit features", "what does this project do", or any request to help an AI agent understand a new or existing codebase. Also trigger when the user starts working in an unfamiliar repo or an existing repo with stale `.context/` files and would benefit from structured context generation.
Collaborative purple-team operations — threat-informed adversary emulation planning (ATT&CK, CTID, Atomic Red Team, CALDERA), the detect-tune-validate loop, detection coverage measurement (DeTT&CT/Navigator), safe execution and deconfliction, and MTTD/coverage reporting
PyGraphistry connector workflows for external data sources and graph databases. Use when asked to "connect graphistry to Neo4j", "load from Splunk into graphistry", "query Kusto/ADX and visualize", "Databricks graph", "TigerGraph with pygraphistry", "ingest SQL into a graph", or any "graphistry + [external platform]" request. Also triggers on Neptune, Postgres, BigQuery, Memgraph, or connector/plugin keywords. Proactively suggest when the user has data in an external system and wants graph visualization without first loading it into a DataFrame.
Core PyGraphistry workflow: auth, DataFrame-to-graph shaping, and first interactive plot. Use when asked to "register graphistry", "get started with pygraphistry", "plot my edges dataframe", "graphistry.register()", "bind src and dst columns", "make a hypergraph", "materialize nodes", or any first-graph / ETL-to-plot task. Also triggers on "first graphistry graph", "graphistry install", "api=3", or questions about graphistry auth credentials. Proactively suggest when the user is setting up graphistry for the first time or can't get a basic plot working from a DataFrame.
Guidance for starting and configuring QEMU virtual machines with proper serial console access. This skill should be used when tasks involve starting QEMU VMs, configuring serial console or telnet access, booting ISO images, or troubleshooting VM startup issues. Covers pre-flight checks, idempotent startup procedures, and intelligent readiness verification.
Use when writing tests, designing test coverage, handling defect fixes, performing root-cause analysis, setting up CI verification, or configuring commit-time hooks. Also use when creating test matrices or choosing between unit/integration/E2E tests. Do not use for general development or linting setup.
Implement a production-ready LLM query loop / agent loop for AI applications. Use this skill whenever the user wants to add tool calling, ReAct-style reasoning-action-observation cycles, function calling loops, query engines, agent runtimes, tool_result feedback, max-turn exits, or Claude Code-like Agent Loop behavior to their own product or codebase.
Upload files to Cloudflare R2, AWS S3, or any S3-compatible storage (like MinIO) and generate secure, time-limited presigned download links with configurable expiration, typically set to 5 minutes. Use when the user needs to upload a file to cloud storage and get a shareable link, or mentions R2, S3, presigned URLs, temporary links, or file uploads with expiration.
NVIDIA RAG Blueprint — deploy, configure, troubleshoot, and manage. Handles any RAG action: deploy, install, start, enable, disable, toggle, change, configure, troubleshoot, debug, fix, shutdown, stop, or tear down any RAG feature or service (Agentic RAG, VLM, guardrails, query rewriting, models, search, ingestion, observability, summarization, reasoning, and more).
Autonomous AI coding loop that ships features while you sleep. Use when the user wants to run Ralph, start an autonomous coding session, work overnight, or let Claude implement multiple user stories autonomously. Triggers on "ralph", "autonomous mode", "overnight coding", "autonomous loop", or requests to implement multiple stories without supervision.
Use when building trust with people who don't yet know or trust you — new teams, new roles, hostile audiences, or strained relationships where the goal is connection before any ask. Applies Tactical Empathy through mirroring, labeling, and belonging cues. Not for confrontation (use difficult-conversations) or giving feedback (use feedback-coach).
Upload, sync, and manage files across cloud storage providers using rclone. Use when uploading files (images, videos, documents) to S3, Cloudflare R2, Backblaze B2, Google Drive, Dropbox, or any S3-compatible storage. Triggers on "upload to S3", "sync to cloud", "rclone", "backup files", "upload video/image to bucket", or requests to transfer files to remote storage
Enforces React component ownership boundaries—colocate state, queries, and mutations with consuming leaves; avoid prop drilling and parent data hubs; structure trees for render isolation and composability. Includes TanStack Query, Router, Start, Form, and Store patterns. Use when designing or reviewing component architecture, refactoring prop-heavy trees, fixing unnecessary re-renders from lifted state, deciding where API or query logic should live, or when the user says react-boundaries, ownership boundaries, push state down, or stop prop drilling.
React Suspense for data fetching, code splitting, and async operations. Covers Suspense boundaries, lazy loading, streaming SSR, Error Boundaries, suspense-enabled data libraries, and progressive loading patterns. USE WHEN: user mentions "Suspense", "lazy loading", "React.lazy", "code splitting", "streaming SSR", "loading states", asks about "async components", "fallback UI" DO NOT USE FOR: React 17 and earlier (limited Suspense support), Class components, Non-React frameworks
Opinionated assistant for installing and configuring Tailwind CSS in React projects, then revamping components using Tailwind utility classes and semantic design tokens. Use when working on React (CRA, Vite, Next.js, Remix, plain SPA) and you need guidance on Tailwind setup, dependency selection and installation order, configuration, semantic theme design, and common UI recipes (forms, data tables, navigation, modals, layout).
Multi-sector batch domain expansion — identify untested/under-tested sectors, generate candidate company domains (national chains, franchises, regionals), filter against existing test coverage, probe alive domains, and run the full testing pipeline across 20+ new targets in a single session. Complements per-sector recon-* skills by telling you WHICH sectors to expand into next.
Implement access control and permission checking with Recur entitlements API. Use when building paywalls, checking subscription status, gating premium features, or when user mentions "paywall", "權限檢查", "entitlements", "access control", "premium features". Taiwan subscription billing via PAYUNi (recur.tw, 台灣訂閱金流).
Quick setup guide for Recur payment integration, from account signup (via the Recur MCP OAuth flow) to the first checkout. Use when starting a new Recur integration, creating a Recur account, setting up API keys, creating a product, installing the SDK, or when user mentions "申請 Recur 帳號", "integrate Recur", "setup Recur", "Recur 串接", "金流設定". Taiwan subscription billing via PAYUNi (recur.tw, 台灣訂閱金流).
Set up and handle Recur webhook events for payment notifications. Use when implementing webhook handlers, verifying signatures, handling subscription events, or when user mentions "webhook", "付款通知", "訂閱事件", "payment notification". Taiwan subscription billing via PAYUNi (recur.tw, 台灣訂閱金流).
Use when the user wants to adversarially stress-test a guardrail, classifier, prompt, or API they own or are authorized to test, to surface the distinct ways it fails. Generates adversarial inputs, runs them through the target and a ground-truth oracle, logs every target-vs-oracle disagreement as a failure de-duplicated by technique class, and loops until rounds stop surfacing new classes. Produces a catalogue of distinct, reproducible failures — the attacker half of a find→fix setup. Not for patching the target, and not for attacking systems the user does not own or have permission to test.
Run SQL against Amazon Redshift — submit statements, poll status, page through results, and browse databases/schemas/tables. Use this whenever the user wants to query Redshift (provisioned cluster or Serverless), ask "what tables are in this schema", check a query's status, or mentions `redshift-data`, a Redshift cluster identifier / workgroup name, or a `redshift-data.{region}.amazonaws.com` endpoint. Always start from this skill when interacting with this service — its bundled scripts and recipes are the fastest path.
Red-team operator discipline—the mindset corrections that distinguish offensive testing from defensive WAPT. Built from authorized red-team work where conservative defaults caused multiple findings to be missed and one to be incorrectly retracted. Use at the START of any red-team engagement and again whenever feeling stuck or considering "stopping" on a defended target. The single most important skill to load when the scope is "external red team," not "bug bounty / WAPT".
Refactor Angular code to improve maintainability, readability, and adherence to best practices. Transforms large components, nested subscriptions, and outdated patterns into clean, modern Angular code. Applies signals, standalone components, OnPush change detection, proper RxJS patterns, and Angular Style Guide conventions. Identifies and fixes memory leaks, function calls in templates, fat components, and missing lazy loading.
Find related research papers, citations, references, and research lineages using an OpenAlex-based workflow. Use when the user asks for related work, literature search, citation mapping, reference chasing, prior art, seed-paper expansion, or research context around a paper or idea.
Memory consolidation and defragmentation for long-term memory maintenance. Use when asked to consolidate memories, defrag memory, run REM sleep, clean up memory files, or process session logs into durable memory. Also use periodically during heartbeats for memory maintenance.
Elite motion design studio for creating broadcast-quality animated videos in Remotion (React + TypeScript). Use this skill whenever the user wants to create video animations, motion graphics, animated brand reveals, title sequences, product demos, data visualizations, kinetic typography, promotional videos, or any programmatic video content using Remotion. Also triggers for requests mentioning Remotion, video animations, motion design, animated explainers, product launch videos, social media video content, Three.js video compositions, audio-reactive visuals, spring animations for video, or cinematic transitions. Even if the user just says "make me a video" or "animate this" or "create a promo clip", this skill applies. Handles everything from 5-second social clips to 60-second brand films.
Surface contracts with upcoming cancellation deadlines, warn before the notice window closes, running on a maintained renewal register. Use when the user asks "what's coming up for renewal," "which renewals are due soon," "did we miss the cancellation window," "add this to the renewal tracker," or on a schedule. Receives handoff data from saas-msa-review.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.