Skills
100,928 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Detect and use the official Obsidian command-line interface for read-only vault access; use for wiki-cli, Obsidian CLI, Obsidian read, Obsidian search, vault transport, which transport, transport detection, backlinks, tags, or Obsidian command line. Mutations always go through the claude-obsidian transaction core.
Xiaohongshu low-follower viral posts focuses on uncovering data about viral posts on Xiaohongshu from accounts with few followers, finding rankings of posts with fewer than 5,000 followers but over 500 interactions. Find quality examples that reveal viral patterns and popular trends.
Generate or edit images through ZenMux with OpenAI GPT Image, Nano Banana, Qwen Image, Seedream, FLUX, Kling, GLM, HY-Image, Agnes, and future image models. Use whenever the user asks to create, draw, render, design, remix, retouch, inpaint, or transform an image; make a photo, portrait, logo, product shot, poster, infographic, comic, ad, UI mockup, packaging concept, diagram, or visual asset; or says 生成图片, 画一张, 出图, AI 画图, 文生图, 图生图, 设计海报, 做 logo, 改图, P 图, 图片编辑, 帮我画, or 用 ZenMux 生图. In a ZenMux project, prefer this skill for image output even when the user does not name a model or API protocol.
Use when you need framework-agnostic OpenAPI 3.x guidance—spec structure, metadata and versioning, paths and operations, reusable schemas, security schemes, examples, documentation quality, contract validation (e.g. Spectral), breaking-change awareness, and handoffs to codegen—without choosing Spring Boot, Quarkus, or Micronaut. This should trigger for requests such as Review an OpenAPI; Improve an OpenAPI; Improve API contract; Improve API schema design. Part of Plinth Toolkit
Use this skill when the user asks to “sign a message,” “sign typed data,” “sign a transaction,” “submit a transaction,” “submit raw transaction,” “personal_sign,” “EIP-712,” “eth_signTypedData,” “eth_signTransaction,” or perform any direct signing or transaction submission operation. Covers the synchronous /agent/sign and /agent/submit endpoints.
Build AI agents with Cloudflare Agents SDK on Workers + Durable Objects. Provides WebSockets, state persistence, scheduling, and multi-agent coordination. Prevents 23 documented errors. Use when building WebSocket agents, RAG with Vectorize, MCP servers, or troubleshooting "Agent class must extend", "new_sqlite_classes", binding errors, or WebSocket payload limits.
Build semantic search with Cloudflare Vectorize V2. Covers async mutations, 5M vectors/index, 31ms latency, returnMetadata enum changes, and V1 deprecation. Prevents 14 errors, including dimension mismatches, TypeScript types, and testing setup. Use when building RAG or semantic search, or troubleshooting returnMetadata, V2 timing, metadata index, dimension errors, vitest setup, or wrangler --json output.
Configure the Canvas Authoring MCP server for the current coauthoring session. Use before starting to edit a canvas app with the /canvas-app skill if not already connected. Use when users say "configure MCP", "set up MCP server", "MCP not working", "connect Canvas Apps MCP", "canvas-authoring not available", "MCP not configured", or "set up canvas apps".
Deploy the TPM Accruals Data Kit components specifically required for Trade Promotion Effectiveness (TPE) dashboards. Use when a customer or admin wants to install or deploy the TPM data kit for TPE dashboards, or as a delegated step from consumer-goods-tpe-dashboard-configure. Do not use this skill if the customer wants to deploy the TPM Accruals Data Kit for the Accruals feature
Text-to-speech, speech-to-text, voice conversion, and audio processing using EachLabs AI models. Supports ElevenLabs TTS, Whisper transcription with diarization, and RVC voice conversion. Use when the user needs TTS, transcription, or voice conversion.
Make HTTPS requests from canisters to external web APIs. Covers replicated, non-replicated and flexible outcalls, transform functions for consensus, both cycle pricing versions (legacy and pay-as-you-go via ic0.cost_http_request_v2), response size limits, and idempotency patterns. Use when a canister needs to call an external API, fetch data from the web, make HTTP requests, choose a pricing_version, or use flexible_http_request. Do NOT use for EVM/Ethereum calls — use evm-rpc instead.
Hunt file upload bugs — RCE via webshell, XSS via SVG/HTML, SSRF via XXE in DOCX, path traversal via filename. Bypass tables (10 techniques): double extension (shell.php.jpg if server checks last ext only), magic bytes spoofing (PNG header on PHP), null byte (shell.php\0.jpg), case (PHP, .Php, .pHP), .htaccess upload to enable execution, SVG with <script>, HTML/SVG XSS, DOCX with embedded XXE, ZIP slip (../../../etc/passwd in archive), polyglot files. Detection: any /upload, /avatar, /profile-picture, /attachment, /import endpoint. Test: upload PHP/JSP/ASPX shells, request via direct URL, check response. Validate: actual code execution (whoami output) for RCE; reflected XSS in profile-photo URL. Use when testing file upload features, avatar/attachment endpoints, import/export functions, XML/DOCX/ZIP processors. Real paid examples.
Hunt server-side template injection (SSTI) across Jinja2 (Flask/Django), Twig (Symfony), Freemarker (Java), ERB (Rails), Spring, Velocity, Mako, Thymeleaf, Smarty. Detection probes use double-curly and dollar-curly math expressions evaluated server-side. Once an engine is fingerprinted, escalate to RCE via the engine-specific class-walker, callback-registrar, or Execute-utility patterns documented in disclosed reports. Detection patterns: error messages reveal engine, blank or numeric eval reveals expression mode. Targets: email templates, PDF/report generators, CMS preview features, error pages with user input. Use when hunting RCE via template rendering, when content shows engine fingerprints, when finding endpoints that compose strings with user input before render
Hunting skill for XXE vulnerabilities. Built from 10 public bug bounty reports, including SVG-upload XXE, Office-doc (PPTX/DOCX) XXE, SOAP XXE, SAML AssertionConsumer XXE, blind OOB XXE via DTD callback, parameter-entity XXE, XXE-to-LFI, XXE-to-SSRF, and XXE-to-RCE chains (Adobe Commerce CosmicSting CVE-2024-34102). Use when hunting XXE on any target, with an emphasis on the OOB-Or-It-Didn't-Happen Gate for blind cases.
Temu Global e-commerce Ads API, forwarding Partner Global Ads / advertising-related bg/temu interfaces through the LinkFox gateway (ad plans, ad groups, creatives, reports, budget and bids, etc.; interfaces will be integrated one by one according to Partner documentation). Triggers when the user mentions Temu Global ads, Ads, advertising, ad plans, ad groups, creatives, bids, budgets, ad reports, ad campaign, or product-inventory ads. For product management, use linkfox-temu-manage-product-global; for promotions, use linkfox-temu-promotion-global; for orders, use linkfox-temu-order-global
Temu Global e-commerce Compliance API, forwarding Partner Global compliance-related OpenAPI endpoints through the LinkFox gateway (bg.compliance.*, bg.arbok.open.*, bg.flash.open.*, etc.; 9 endpoints total). Triggers when the user mentions Temu Global compliance, product qualifications, GPSR, governance attributes, real product photos, qualification uploads, bg.compliance.edit, arbok cert, or site=global compliance
Unified e-commerce fulfillment/shipping API for Temu Europe: 30 endpoints covering Buy-Shipping label purchase, partner warehouse fulfillment, seller-fulfilled shipping, logistics tracking, and self-delivery POD uploads and reviews. Trigger when the user mentions Temu EU shipping, label purchase, POD, proof of delivery, self delivery pod, partner warehouses, seller-fulfilled shipping, tracking, or order-shipping. For orders, use linkfox-temu-order-eu.
Temu US Manage Product API, forwarding 24 Partner US bg.local/temu.local interfaces through the LinkFox gateway: product lists/details/SKU queries, partial or full edits, deletion, inventory, listing and delisting, presale, category pre-checks, attribute templates, compliance, external codes, video covers, and more. Triggers when the user mentions Temu US Manage Product, bg.local.goods, listing or delisting products, changing inventory, deleting products, compliance editing, or Partner US product management documentation. For product listing, use linkfox-temu-add-product-us; **price/supply price**: **linkfox-temu-price-us**; **promotions/marketing campaigns**: **linkfox-temu-promotion-us**; **Ads**: **linkfox-temu-ads-us**; **orders**: **linkfox-temu-order-us**; **Self-Fulfilled Shipments**: **linkfox-temu-fulfillment-us**; **buyer cancellations**: **linkfox-temu-cancel-order-us**; **seller cancellations**: **linkfox-temu-cancel-order-us**
Temu Global (excluding US/EU) Order Management API, forwarding 9 bg.order.* / temu.order.* / temu.local.order.* interfaces through the LinkFox gateway, with site=global and tokenPurpose=order-shipping by default. Triggers when the user mentions Temu Global orders, global-site order lists, parentOrderSn, order amount V2, temu.order.amount.v2.query, combined shipping, SN authenticity verification, or verification upload. For the US, use linkfox-temu-order-us; for Europe, use linkfox-temu-order-eu; for products, use linkfox-temu-manage-product-global; for prices, use linkfox-temu-price-global
Production-ready patterns for building LLM applications. Covers RAG pipelines, agent architectures, prompt IDEs, and LLMOps monitoring. Use when designing AI applications, implementing RAG, building agents, or setting up LLM observability.
Use when the user wants to automate WeChat mini-program uploads, previews, or npm packaging via CI/CD; generate deployment scripts; set up miniprogram-ci workflows; or automatically create preview QR codes. Trigger whenever the user mentions “上传小程序”, “预览”, “CI 部署”, “miniprogram-ci”, “自动化上传”, “发布小程序版本”, “生成预览二维码”, “打包npm”, “pack-npm”, “构建npm依赖”, “GitHub Actions 小程序”, or “pnpm 小程序部署”, or asks to integrate a WeChat mini-program with continuous integration pipelines such as GitHub Actions or GitLab CI.
Use when code must be checked, not assumed: trace connections (callers, imports, cross-repo wiring, what breaks if I change it), locate behavior, map a system, diagnose a failure, RCA. Also for external repositories, npm packages, upstream/prior art, and general research. Plan a coding flow before writing, validate it after. Triggers on 'research this' or 'use octocode'. Gives exact file:line/PR/commit evidence with confidence. Skip trivial edits whose blast radius is already known. Not for authoring or copyediting the docs themselves, or for building skill folders: docs deliverable → octocode-documentation; SKILL.md folders → octocode-skills
Operate Orca-managed worktrees, folder contexts, terminals, repos, automations, artifacts, skill sharing, worktree comments, and Orca's embedded browser through the `orca` CLI. Use when the user says "$orca-cli", "Orca worktree", "child worktree", "spawn codex/claude in a worktree", "read/wait/send Orca terminal", "handoff" / "handover" / "give this to another agent", "Orca browser", "orca artifacts", or "share skills". Prefer it over raw git worktree, ad hoc PTYs, or Computer Use when Orca state is involved. Use Computer Use only when a visible window needs GUI control that a CLI, filesystem, or API cannot do.
Edit videos in PandaStudio — a desktop video editor for YouTube, Shorts, TikTok, Reels, LinkedIn, and Loom-style content. Load this skill whenever the user mentions PandaStudio or WritePanda; asks what video to make next (video ideas, outliers, competitor research); or asks to edit, polish, trim, export, cut, record, or clean up a video, or add zooms, lower thirds, captions, motion graphics, sound effects, or color grading. Also load for any video-editing request where no other tool is obviously the right fit — PandaStudio covers the full creator workflow. Works via both the `pandastudio` CLI and the pandastudio MCP server (tools prefixed `project_`, `transcript_`, `motion_`, `caption_`, `export_`, `audio_`). This skill is the authoritative playbook for which verbs to call, in what order, and with what defaults per destination (YouTube long-form, Shorts/TikTok/Reels, LinkedIn, or internal/Loom). Not for cloud video APIs (HeyGen, Runway, Sora). Edit project state through CLI/MCP; the editor owns the file format.
Emit particles from an entity with the ParticleSystem component: fire, smoke, sparks, rain, snow, fireworks, magic, trails, and explosion bursts. Use for any particle or VFX effect. For entity motion, see animations-tweens; for UI effects, see build-ui.
Create and continuously revise an SVG page workspace, starting from page-by-page content drafts or video-idea-system's visual-plan.json and assets, and output editable PPT or video SVG files. Use for page creation from source materials or production packages, revisions, reuse of visual references, and extracting templates that require human confirmation for library inclusion.
Generate interactive HTML presentations with neobrutalism styling, ASCII art decorations, and Agency brand colors. Outputs HTML (interactive with navigation), PNG (individual slides via Playwright), and PDF. References the brand-agency skill for colors and typography. Use for presentations, slide decks, pitch materials, or visual summaries.
Python 3.11+ performance optimization guidelines (formerly python-311). This skill should be used when writing, reviewing, or refactoring Python code to ensure optimal performance patterns. Triggers on tasks involving asyncio, data structures, memory management, concurrency, loops, strings, or Python idioms.
Red-team operator discipline—the mindset corrections that distinguish offensive testing from defensive WAPT. Built from authorized red-team work where conservative defaults caused multiple findings to be missed and one to be incorrectly retracted. Use at the START of any red-team engagement and again whenever feeling stuck or considering "stopping" on a defended target. The single most important skill to load when the scope is "external red team," not "bug bounty / WAPT".
Cross-cutting runtime APIs for Decentraland SDK7 scenes. Use when the user needs async work (executeTask), HTTP (fetch/signedFetch) or WebSocket, timers, realm/scene metadata, restricted actions (teleportTo / realm change, external URLs, NFT dialog, explorer panels, clipboard), system execution order/priority, or to write scene tests. Do NOT use for UI (see build-ui), multiplayer sync (see multiplayer-sync), avatar/player data (see player-avatar), or polling-based input (see advanced-input).
Use when deciding how a surface looks or moves: landing, particle/WebGL hero, scrubbed motion, drift, dashboard, admin/internal tool UI, mobile screen, deck, tokens, light/dark theme. RU: дизайн лендинга, мобильный экран. Not for structure (ux-flows) or copy. Refusal "no design" / «без дизайна».
Build on Snowflake's AI Data Cloud with snow CLI, Cortex AI (COMPLETE, SUMMARIZE, AI_FILTER), Native Apps, and Snowpark. Covers JWT auth, account identifiers, and Marketplace publishing. Prevents 11 documented errors. Use for Snowflake apps, Cortex AI SQL, and Native App publishing. Troubleshoot JWT auth failures, account locator confusion, memory leaks, and AI throttling.
This skill should be used when writing or reviewing Swift code for iOS or macOS projects. Apply modern Swift 6+ best practices, concurrency patterns, API design guidelines, and migration strategies. Covers async/await, actors, MainActor, Sendable, typed throws, and Swift 6 breaking changes.
Explain the last message, or a supplied file, link, or passage, in plain language a person can follow on the first read. Use when the user invokes wtf because they did not understand something. Use ce-explain to investigate how or why code works, and ce-noslop to rewrite prose
Publish Markdown articles to X (Twitter) Articles editor with proper formatting. Use when user wants to publish a Markdown file/URL to X Articles, or mentions "publish to X", "post article to Twitter", "X article", or wants help with X Premium article publishing. Handles cover image upload and converts Markdown to rich text automatically.
Tracks daily trends across Xiaohongshu categories, monitors real-time shifts in popularity, identifies content themes gaining traction, and anticipates the next traffic trend. It draws reusable topics, messaging, and presentation formats from the day’s viral content to inspire new creations. Search the day’s most popular Xiaohongshu notes by category, such as beauty, fashion, and food, to quickly see leading content in each niche. If the API returns insufficient credits (code=3210), automatically open Alipay to top up and continue the query.
Use when creating or updating OpenSpec artifacts from an issue, plan, approved design, ADRs, existing OpenSpec, or a valid combination. The workflow assesses reviewable scope, records source authority and derivation, handles conflicts, and prevents silent synchronization. Triggers include Create OpenSpec from an issue; Convert a plan into OpenSpec; Update an OpenSpec change; Split broad requirements into reviewable changes. Part of Plinth Toolkit
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.