Skills
99,719 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Vulnerability and security scan (defensive, your own repo): dependency CVEs plus risky code patterns (secrets, injection, weak authz), severity x reachability triaged and remediated without suppressing. Complements the built-in /security-review. Triggers on "absolute audit", "security audit", "are we vulnerable", "scan for CVEs", "check for secrets/injection", "harden this".
Axelar General Message Passing (GMP) on Hedera. Use when sending or receiving cross-chain contract calls via Axelar Gateway (callContract, payNativeGasForContractCall), building AxelarExecutable receivers, wiring Hedera↔EVM destinations, or separating bridge transport from destination handlers (orchestrated / scheduled flows).
Configure and maintain the DeepSeek native sub-agent in the Codex desktop app, with support for model selection, routing verification, repair, deactivation, and uninstall. Use only when the user asks to configure or manage this integration; it is not triggered by ordinary API questions or by day-to-day coding tasks after configuration.
Design app, admin, and game interfaces as well as complete website landing pages, generating UI design mockups; restore designs or screenshots into HTML/CSS, existing frontend projects, or WeChat mini programs as needed. Use when users request page design, complete landing pages, screenshot restoration, or high-fidelity mini programs. Not for ordinary illustration, posters, storyboards, pure image editing, or business code changes without design tasks.
Define ideal customer profiles and buyer personas with structured frameworks. Use when the user asks about ideal customer profile, ICP, buyer persona, target audience definition, customer segmentation, customer research, user interviews, or persona creation. Trigger phrases include "ideal customer profile", "ICP", "buyer persona", "who is my customer", "target audience", "customer profile", "persona", "customer segmentation", "user research", "customer interview", "who should I target".
Full Sentry SDK setup for React Native and Expo. Use when asked to "add Sentry to React Native", "install @sentry/react-native", "setup Sentry in Expo", or configure error monitoring, tracing, profiling, session replay, or logging for React Native applications. Supports Expo managed, Expo bare, and vanilla React Native.
Upload content to social media platforms via Upload-Post API. Use when posting videos, photos, text, or documents to TikTok, Instagram, YouTube, LinkedIn, Facebook, X (Twitter), Threads, Pinterest, Reddit, or Bluesky. Supports scheduling, analytics, FFmpeg processing, and upload history.
Implements and debugs browser WebMCP integrations in JavaScript or TypeScript web apps. Use when exposing imperative tools through document.modelContext (with a navigator.modelContext fallback), annotating HTML forms for declarative tools, handling agent-invoked form flows, or validating WebMCP behavior in the current Chrome preview. Don't use for server-side MCP servers, REST tool backends, or non-browser providers.
Build, configure, and debug native Apple extension and target types (widgets, App Clips, share extensions, watchOS apps, Safari extensions, notification extensions, VPN/network extensions, and 40+ more) in an Expo app using the @bacons/apple-targets config plugin. Use when a user wants to add home screen presence, share sheets, custom keyboards, Siri/App Intents, push notification handling, AutoFill/passkeys, Screen Time controls, or any other Apple app extension to a React Native / Expo project.
Run a bounded, source-grounded research loop, draft a cited dossier, and optionally propose a separately reviewed canonical vault merge. Use when the user wants autonomous or deep research that may access the public web. Triggers: /autoresearch, autoresearch, research this topic, deep dive into, investigate, find everything about, research and file, go research, build a wiki on.
Distill a book into a coherent set of executable skills. Use when the user asks to "拆书" / "蒸馏一本书" / "把 XX 书做成 skill" / "turn a book into skills" — i.e. wants a book's frameworks, principles, and methodologies extracted into atomic, reusable Claude skills that an agent can invoke in real-world situations. NOT for simple summarization, book reviews, or role-playing as the author (that is nuwa-skill's job).
Build, optimize, and troubleshoot Docker containers and images. Create efficient Dockerfiles, manage container lifecycle, configure networking and volumes, and debug container issues. Use when working with Docker, containerization, or container troubleshooting.
Oracle Cloud Infrastructure guidance for designing, operating, and troubleshooting OCI services, including OCI Kubernetes Engine (OKE), OCI Internet of Things Platform, OCI Functions deployment and troubleshooting, OCI Exadata Database Service Terraform configuration, OCI IAM Terraform configuration, OCI networking Terraform configuration, OCI Security Zones Terraform configuration, and Enterprise AI workflows for OCI Generative AI models, Responses API agents, RAG, cost estimation, governance, private endpoints, hosted agentic applications, and Oracle platform integrations. Use when the user asks about OKE cluster design, Terraform or Resource Manager planning, OCI Security Zone recipes or Security Zones, OCI compartment hierarchy, classic IAM groups or group membership assignment, dynamic groups, IAM policies, OCI Identity Domains resources, Cloud Exadata Infrastructure, Cloud VM Clusters, DB Homes, Container Databases, Pluggable Databases, OCI VCNs, subnets, routes, gateways, security lists, NSGs, ZPR security-attribute assignments, OKE incident troubleshooting, Generic VNIC Attachment, Multus, pod networking, node pools, add-ons, ingress, load balancers, OCIR image pulls, Workload Identity, Kubernetes workloads on OCI, OCI IoT domains or digital twins, device publish flows, OCI Functions setup, deployment, invocation, or troubleshooting, OCI Generative AI, Enterprise AI Models, Enterprise AI Agents, governed GenAI applications, agentic workflows, RAG on Oracle Cloud, or OCI Generative AI pricing.
Reference for the Opik SDK — tracing, span types, framework integrations, threads, and the prompt library (Python, TypeScript, REST). Use for questions like "what span types exist", "how do I flush", "track_openai", "add OpikTracer", "version a prompt". To instrument a repo end to end, use the opik-instrument skill.
Comprehensive security vulnerability scanner for Python projects including Flask, Django, and FastAPI applications. Detects OWASP Top 10 vulnerabilities, injection flaws, insecure deserialization, authentication issues, hardcoded secrets, and framework-specific security problems. Audits dependencies for known CVEs and generates actionable security reports.
This skill should be used when the user asks to "brainstorm research ideas", "use 5W1H framework", "identify research gaps", "conduct gap analysis", "start research project", "conduct literature review", "define research question", "select research method", "plan research", or mentions research project initiation phase. Provides comprehensive guidance for research startup workflow from idea generation to planning.
Use when exporting a model, character or animation from Blender to a game engine, the web or a 3D printer: FBX, glTF/GLB, USD/USDZ or STL for Unity, Unreal Engine, Godot, Roblox, three.js or Apple AR Quick Look. Also when an export arrives at the wrong scale (100x, 0.01), rotated 90 degrees, facing backwards, with extra leaf bones, without its animation, blend shapes or textures; when an FBX loses its metallic or roughness map; when a generated model needs its real size and its pivot on the floor; when making LODs or collision meshes (UCX_, -colonly) for an engine; when converting a folder of models in batch; or when checking an exported file by re-importing it.
Create a durable Zapier workflow from natural language using @zapier/zapier-durable and the Zapier SDK CLI. Use when the user wants to build a Zapier workflow, create an automation, write a durable workflow, build me a Zap that, create a durable that, or automate a multi-step process involving Zapier-connected apps
Optimize Apple App Store metadata in store.config.json for ASO (App Store Optimization). Use when working with store.config.json, App Store keywords, titles, subtitles, descriptions, or localizing app metadata. Helps maximize app visibility and downloads.
Generate pixel-art self-portrait, profile card (自画像卡), emoji GIFs, and meme stickers. Use when: "生成形象", "画头像", "avatar", "self-portrait", "表情包", "梗图", "贴纸", "sticker", "换一个", "重新生成", "不喜欢", "regenerate". Also use when Cola wakes up — display existing avatar or prompt user to generate. Also use when repairing sticker behavior — if ~/.cola/avatar/ has sticker files but AGENT.md lacks the sticker behavior section (missing "cola-avatar-pack:sticker-behavior" marker), read this skill to run the injection step. Do NOT use when discussing third-party platform avatar settings or searching for external stickers.
Orchestrates implementation of a plan file by delegating work to subagents in parallel. Verifies git branch state, tracks progress, and ensures high-quality implementation. Invoke with a plan file path and optional model override: /implement plans/my-plan.md [--model sonnet]
Audit and rewrite your LinkedIn profile to attract the right people. Scores each section, rewrites headline and about copy, and includes an AI visibility checklist so you show up in ChatGPT, Perplexity, and Claude search. Use when someone says "optimize my LinkedIn," "LinkedIn profile help," "rewrite my about section," or "how do I show up in AI search."
Run Facebook and Instagram ads end-to-end: Meta ads strategy, ad creative, copy, campaign structure, targeting, budgeting, ROAS tracking, and Pixel setup. Includes a built-in ad brief workflow. Use when the user wants to plan, create, launch, or optimize Meta ads, or when they need to understand how the platform works before spending money. Not for Google Ads, TikTok Ads, LinkedIn Ads, or general marketing strategy outside Meta.
Final craft pass applying the compound details from the polish checklist — micro-typography, spacing rhythm, hover states, and a signature detail — directly to code. Use when the surface is functionally complete but feels unfinished, or when the user says "polish this" / "it looks generic" / "add the final touches". Invoke when the user asks for polish on their UI, or mentions 'polish' alongside design / UI / frontend work.
Update the current Remotion branch with the latest canonical main branch. Use when asked to update or sync from upstream main, merge the latest main into a feature branch, fast-forward local main, or bring a pull request branch up to date without rewriting published history.
Explain why code looks the way it does by tracing the latest change for a file range or pasted snippet through `git blame` and deduplicated `entire checkpoint explain` lookups. Use when the user asks what happened, says "tell me why" about a code block, is confused about a section of code, asks "wtf is going on", "why is this like this", "why was this changed", or wants provenance for a specific file block.
Apifox import/export and quality gates: import native OpenAPI/Postman/Apifox formats and export native OpenAPI/HTML/Markdown/Postman/Apifox formats; validate spec completeness, tags grouping, and schema/body coverage before import, then verify counts, modules, and resource visibility afterward.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.