Skills
100,928 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn/ui). Use for complex artifacts requiring state management, routing, or shadcn/ui components—not for simple single-file HTML/JSX artifacts.
Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaining (IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth), bypass tables (SSRF IP bypass, open redirect bypass, file upload bypass), language-specific grep (JS prototype pollution, Python pickle, PHP type juggling, Go template.HTML, Ruby YAML.load, Rust unwrap), and reporting (7-Question Gate, 4 validation gates, human-tone writing, templates by vuln class, CVSS 3.1, PoC generation, always-rejected list, conditional chain table, submission checklist). Use for ANY bug bounty task — starting a new target, doing recon, hunting specific vulns, auditing source code, testing AI features, validating findings, or writing reports. 中文触发词：漏洞赏金、安全测试、渗透测试、漏洞挖掘、信息收集、子域名枚举、XSS测试、SQL注入、SSRF、安全审计、漏洞报告
Expert blueprint for digital card games (CCG/Deckbuilders) including card data structures (Resource-based), deck management (draw/discard/reshuffle), turn logic, hand layout (arcing), drag-and-drop UI, effect resolution (Command pattern), and visual polish (godot-tweening, shaders). Use for CCG, deckbuilders, or tactical card games. Trigger keywords: card_game, deck_manager, card_data, hand_layout, drag_drop_cards, effect_resolution, command_pattern, draw_pile, discard_pile.
Expert blueprint for desktop platforms (Windows/Linux/macOS) covering keyboard/mouse controls, settings menus, window management (fullscreen, resolution), keybind remapping, and Steam integration. Use when targeting PC platforms or implementing desktop-specific features. Keywords desktop, Windows, Linux, macOS, settings, keybinds, ConfigFile, DisplayServer, Steam, fullscreen.
Add Internet Identity sign-in to a frontend or canister: passkey and OpenID (Google, Apple, Microsoft) sign-in with @icp-sdk/auth, sending users to an organization's SSO with ssoDomain, the client lifecycle, and local development. Also covers the primary origin an app's principals are permanently tied to: electing it, setting derivationOrigin, the ii-alternative-origins and ii-derivation-origin documents, and the ii-app-metadata document that names the app on the sign-in screen. Use when adding sign-in, login, auth, passkeys or Internet Identity to an app, when an app gains a custom domain or a sibling app, or when the same user arrives as a different principal on two origins. For a verified email or name in the backend use internet-identity-attributes; for web push use internet-identity-notifications; to set up an organization's own SSO use internet-identity-sso. Do NOT use for wallet or ICRC signer flows (use wallet-integration) or for an agent or CLI signing in as a user (use agent-web-identity).
This skill should be used when the user wants to record bookkeeping entries (仕訳), import transaction data from CSV files, receipts, or invoices, or manage their general ledger. Trigger phrases include: "仕訳を入力", "仕訳登録", "CSVを取り込む", "レシートを読み込む", "請求書を取り込む", "帳簿を付ける", "経費を記録", "売上を記録", "仕訳を修正", "仕訳を検索", "仕訳を削除", "取引を登録", "帳簿の初期化"
Create, list, and manage macOS Calendar events via AppleScript. Use when the user asks to add a reminder, schedule an event, create a calendar entry, set a deadline, or anything involving Apple Calendar on macOS. Triggers on requests like "remind me in 3 days", "add to my calendar", "schedule a meeting next Monday at 2pm", "create a recurring weekly event". macOS only.
Use when handling any auth, API keys, tokens, OAuth, bearer tokens, basic auth, or secret values in n8n workflows. Triggers on "API key", "token", "bearer", "OAuth", "secret", "auth", "credentials", "Authorization header", "x-api-key", or any node configuration that mentions a third-party service.
NocoBase 2 only; never use in a NocoBase 3 project. Use when users need to inspect, create, update, copy, enable, or diagnose NocoBase workflows through `nb`, including version-safe edits, node changes, approval surfaces, and execution troubleshooting.
Reuse a running Chrome session for browser automation via Playwriter CLI + MCP. Use when the task depends on the browser the user already has open — existing logins, cookies, extensions, passkey-friendly flows, or live-tab continuity. Route repeatable fresh-browser or CI-style checks to `browser-harness` instead
Use when documenting an end-to-end business process (procurement, onboarding, handoffs) and finding where work waits. Maps it with process_documenter.py, measures stages with cycle_time_analyzer.py and finds bottlenecks with bottleneck_detector.py.
React performance optimization and best practices skill. Based on Vercel Engineering guides and framework-agnostic. Use when: (1) writing or modifying React components (.tsx, .jsx); (2) working on state management, hooks, or re-rendering optimization; (3) working on asynchronous data fetching or Suspense patterns; (4) optimizing bundle size or code splitting; (5) tasks include keywords such as 'react', 'useState', 'useEffect', 'useMemo', 'useCallback', 'memo', 'Suspense', or 'lazy'
Toolkit for creating animated GIFs optimized for Slack, with validators for size constraints and composable animation primitives. This skill applies when users request animated GIFs or emoji animations for Slack from descriptions like "make me a GIF for Slack of X doing Y".
Toolkit for styling artifacts with a theme. These artifacts can be slides, docs, reportings, HTML landing pages, etc. There are 10 pre-set themes with colors/fonts that you can apply to any artifact that has been creating, or can generate a new theme on-the-fly.
Single-cell RNA-seq analysis with scanpy/anndata—h5ad data loading, scRNA-seq quality control and QC gating (n_genes_by_counts, total_counts, mitochondrial percent / pct_counts_mt, pct_counts_ribo, doublet detection with Scrublet/scDblFinder, ambient RNA / SoupX awareness, empty-droplet filtering, MAD-based thresholds), normalization, dimensionality reduction (PCA, UMAP, t-SNE), clustering (Leiden, Louvain), marker gene identification, cell-type annotation, pseudotime/trajectory analysis. Use for any scRNA-seq workflow, including deciding which cells to filter, flag, or investigate before downstream analysis.
Guide for Vercel AI SDK v5 implementation patterns including generateText, streamText, useChat hook, tool calling, embeddings, and MCP integration. Use when implementing AI chat interfaces, streaming responses, tool/function calling, text embeddings, or working with convertToModelMessages and toUIMessageStreamResponse. Activates for AI SDK integration, useChat hook usage, message streaming, or tool calling tasks.
Audit recent work in a folder and produce a forward-looking self-improvement report. Reviews files modified in the past week, git activity, file-type distribution, and recurring task patterns; writes a 5-section weekly-setup-improvements.md with concrete updates for context files, ideas for new skills, workflow gaps to close, files to clean up, and what's working well enough to leave alone. Cross-platform; safe to schedule weekly via /schedule. Use when: 'weekly review', 'weekly self audit', 'improve my setup', 'what should I clean up', 'suggest new skills', 'self improvement loop', 'weekly setup improvements', or before a planning week.
Guides the creation of detailed agile feature documentation from an existing epic. Use when the user wants to split an epic into feature files, derive features with scope and acceptance criteria, or plan feature documentation for stakeholders or engineering. This should trigger for requests such as Create features from an epic; Split epic into features; Feature files from epic; Derive features from epic; Break down an agile epic into deliverable features. Part of Plinth Toolkit
Use when you need to generate an AGENTS.md file for a Java repository—covering project conventions, tech stack, file structure, commands, Git workflow, and contributor boundaries—through a modular, step-based interactive process that adapts to your specific project needs. This should trigger for requests such as Create AGENTS.md; Update AGENTS.md file; Add agent instructions; Generate contributor instructions for Java agents; Document repository conventions in AGENTS.md. Part of Plinth Toolkit
Use when you need to use Spring Data JDBC with Java records — including entity design with records, repository pattern, immutable updates, aggregate relationships, custom queries, transaction management, and avoiding N+1 problems. This should trigger for requests such as Review Java code for Spring Data JDBC; Apply best practices for Spring Data JDBC in Java code; Model Spring Data JDBC aggregates with Java records; Review Spring Data JDBC repositories and aggregate boundaries; Improve optimistic locking or domain events in Spring Data JDBC. Part of Plinth Toolkit
Use when the user runs /add-read-aloud or wants the app to speak text with Grok text-to-speech: read-aloud button on assistant replies, auto-speak, TTS, voice output, narration, IVR prompts, speech tags, voice_id. For a two-way voice agent use /add-voice. For speech-to-text use /add-dictation.
Write copy that converts and doesn’t sound like a robot. Two jobs in one skill: a reader-first copywriter for clickbait titles, headlines, short descriptions, microcopy, CTAs, error messages, subject lines, viral LinkedIn posts, and category-defining strategic blog posts. It asks for the ICP, category, and story before writing, helps sharpen the story until it is worth telling, names the feeling of the person on the other end, and finds the simplest way to explain the concept. It also humanizes text using Wikipedia’s comprehensive Signs of AI writing guide, detecting and fixing inflated symbolism, promotional language, superficial -ing analyses, vague attributions, overused em dashes, the rule of three, AI vocabulary, passive voice, negative parallelisms, and filler phrases. Use when writing or improving marketing copy, UI text, titles, LinkedIn posts, or strategic blog posts, or editing text to sound natural and human-written
Migrates LLM observability from LangSmith into Arize AX — historical trace import via OTLP (LS outputs→output.value, session/thread→session.id), datasets, and Prompt Hub prompts (latest or versions). Use when migrating from LangSmith to Arize, importing LangSmith runs into AX, or replacing LangSmith with Arize.
Captures before/after screenshots of web pages or elements for visual comparison. Use when user says "take before and after", "screenshot comparison", "visual diff", "PR screenshots", "compare old and new", or needs to document UI changes. Accepts two URLs (file://, http://, https://) or two image paths.
Create and manage agentic wallets with Cobo. Use for autonomous onchain operations via the caw CLI: token transfers, contract calls, pact creation and approval, DeFi execution (Uniswap, Aave, Jupiter), and wallet onboarding on EVM chains and Solana. Triggers on requests involving caw, MPC wallet, TSS node, agent wallet, Cobo, pact, or any crypto wallet operation for AI agents. NOT for fiat payments or bank transfers.
Write and run Contentful content model migration scripts using the contentful-migration library and the Contentful CLI. Covers creating, editing, and deleting content types and fields, validations, editor interface configuration, editor layouts, sidebar widgets, entry transformations, tags, annotations, and the migration context object. Use when asked to write a migration, create or add a content type, add, rename, or delete fields, change or update a content model, transform entries, derive linked entries, configure editor controls, or run a migration script. Also triggers on "migration script", "contentful-migration", "schema migration", "content model migration", "field validation", "editor interface", "editor layout", "sidebar widget", "moveField", "changeFieldId", "rich text field", "reference field", "link field". Not for SDK client setup or Next.js integration (contentful-nextjs). Not for Contentful terminology or API routing (contentful-guide).
Generate a copy-paste Grafana data source provisioning file (YAML or Terraform) for any plugin from its standardized settings schema on the plugins CDN. Use when the user wants to provision or configure a data source as code — e.g. "provision infinity", "datasource yaml for clickhouse", "terraform for the github datasource" — even when they only name the plugin and not the word "provisioning".
Use this skill when the user wants to file their tax return electronically via the 確定申告書等作成コーナー (NTA Tax Return Preparation Corner) using Claude in Chrome, Antigravity Browser Sub-Agent, or Playwright CLI (fallback). It guides browser-based entry of calculated tax data. Trigger phrases include: “e-Tax提出”, “電子申告”, “e-Taxで申告”, “作成コーナーに入力”, “確定申告書等作成コーナー”, “作成コーナー”, “申告書を提出”.
Evolution API integration for WhatsApp messaging, instance management, webhooks, and chatbot orchestration. Use when: (1) Creating or managing WhatsApp instances via Evolution API, (2) Sending messages (text, media, audio, lists, buttons, reactions), (3) Configuring webhooks or event listeners, (4) Managing groups or contacts, (5) Integrating with Typebot, Chatwoot, Dify, or OpenAI through Evolution API. Triggers on: evolution-api, evolution api, whatsapp api, baileys, whatsapp integration, send whatsapp, whatsapp webhook.
Routing-first Fabric operator skill for reusable named AI transforms over stdin, files, transcripts, notes, logs, and cleaned web text. Use when the user wants Fabric patterns, custom pattern packs, shell-pipe composition, or `fabric --serve` workflows — not generic one-off chat prompting, repo-aware coding, or fully deterministic automation.
Interact with Google Chat - send, read, edit, delete and react to messages, share images and files, reply in threads, and manage spaces and DMs. Use when user asks to: send a message on Google Chat, read chat messages, list chat spaces, find a chat room, send a DM, share a screenshot or file, edit or delete something already sent, or create a new space. Lightweight alternative to full Google Workspace MCP server with standalone OAuth authentication.
Consolidate PostHog error tracking issues that are the same actual error reported under different fingerprints. Use when the user asks "why do I have so many TypeError issues that look the same?", "merge these duplicates", "stop splitting this error into new issues", or wants to clean up fingerprint sprawl. Decides between a one-shot merge of existing issues and a durable grouping rule that keeps future events from creating new fingerprints. Does NOT group conceptually similar bugs across different runtimes, SDKs, or call sites.
Use when asked to "define our core action", "North Star metric", "accruing benefits", "improve retention mechanics", "hierarchy of engagement", or "Sarah Tavel framework". Helps consumer products identify the actions and benefits that drive long-term retention. The Hierarchy of Engagement framework (created by Sarah Tavel at Benchmark) maps progression from core action to mounting loss.
Assumption Inversion — list the assumptions behind the current approach and flip each one, then ask where the flipped version could actually be true. Use when requirements encode beliefs nobody has questioned, when a design feels inevitable, or when incumbents all share one blind spot. Triggers include "invert", "flip it", "flip the assumption", "reverse the premise", "what if the opposite were true", "challenge the assumption". Do NOT use for analytical work like debugging, code review, or implementation tasks.
Feishu Markdown: view, create, upload, edit, and compare native Markdown files in Feishu. Use when users need to operate on Feishu Markdown files or compare their remote versions with local drafts. Purely local Markdown file operations do not trigger this skill. Does not handle importing Markdown as Feishu online documents or cloud storage management such as file search, permissions, comments, moving, or deleting.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.