Skills
100,928 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Perform a static, read-only code review of an Astro pull request or of a local branch, commit range, diff, patch, or working tree being prepared as a pull request. Determine whether the change satisfies its stated business requirements and is good enough to merge, using the PR description, linked requirement issues and roadmap items, and PR or issue discussions when available. Use this skill only for PR review or self-review, not issue triage or bug investigation. It reports only merge-relevant findings and never edits code or runs project code, tests, builds, checks, or scripts.
Manage Jira issues and Confluence wiki pages in Atlassian Cloud. Use when: (1) searching, creating, or updating Jira issues with JQL; (2) searching, reading, or creating Confluence pages with CQL; (3) managing Jira workflows, transitions, and comments; (4) browsing Confluence spaces and page hierarchies. Supports OAuth 2.1 via MCP server (recommended) or API token authentication (fallback).
Expert knowledge for Azure App Service development, including troubleshooting, best practices, decision-making, architecture and design patterns, limits and quotas, security, configuration, integrations and coding patterns, and deployment. Use when using deployment slots, ASE/VNet integration, managed identity/Key Vault, CI/CD, or OpenTelemetry sidecars, and for other Azure App Service development tasks. Not for Azure Functions (use azure-functions), Azure Container Apps (use azure-container-apps), Azure Kubernetes Service (AKS) (use azure-kubernetes-service), or Azure Static Web Apps (use azure-static-web-apps).
Apply and enforce brand voice, style guide, and messaging pillars across content. Use when reviewing content for brand consistency, documenting a brand voice, adapting tone for different audiences, or checking terminology and style guide compliance.
Bugcrowd-specific reporting tactics complementing report-writing: VRT category search-and-fallback strategy when no exact match exists, manual severity override when VRT defaults underrate impact, severity-request paragraph as first body section, OOS-clause rebuttal templates (rate limiting on auth-flow endpoints, debug-info framing, user-enumeration with sensitive PII, theoretical-issue counter), chained-finding cross-reference patterns, target selection for QA-vs-prod programs, researcher-side hygiene (Bugcrowdninja email alias, account state restoration, friendly-tester posture). Use when filing a Bugcrowd submission, when VRT default seems wrong, when triager closes as OOS or downgrades severity, when chaining linked submissions, or when scope distinguishes production from QA. Pairs with report-writing and triage-validation.
Student weekly assignment planner for Canvas LMS. Shows all due dates, submission status, grades, and peer reviews across all courses. Use when a student says "what's due", "plan my week", "weekly check", or wants to organize their coursework.
Your pathfinder for navigating unknown codebases. Investigates with precision, implements surgically, and never assumes — if it doesn't know, it says so. Maintains a .notebook/ knowledge base that grows across sessions, turning every discovery into lasting intelligence. Summons available skills, MCPs, and docs when the mission demands. Use when fixing bugs, implementing features, refactoring, investigating flows, or any development task in unfamiliar territory. Triggers on "fix this", "implement this", "how does this work", "investigate this flow", "help me with this code". Do NOT use for greenfield scaffolding, CI/CD, or infrastructure provisioning.
Customize the Trade Promotion Effectiveness (TPE) Analytics dashboards' generic KPI slots (Promotion Measure 1-3, Tactic Measure 1-2) with customer-chosen KPI measure codes and display names, without touching the shipped base model. Use when a customer/admin wants to \"customize TPE dashboards\", \"change the KPIs on the Promotion/Tactic Analysis dashboard\", or \"swap in our own measure codes on the TPE dashboard\"
When the user wants to edit, review, or improve existing marketing copy. Also use when the user mentions 'edit this copy,' 'review my copy,' 'copy feedback,' 'proofread,' 'polish this,' 'make this better,' or 'copy sweep.' This skill provides a systematic approach to editing marketing copy through multiple focused passes.
Generate structured decision-making tools — step-by-step guides, bias checkers, scenario explorers, and interactive dashboards. Use when facing significant choices requiring systematic analysis. Supports multiple cognitive styles and output formats.
Author, save, and edit email templates in the PostHog workflows library—compose email design JSON with Liquid personalization and create and round-trip edit templates over MCP. Use when asked to design, build, update, or fix an email template for workflows, broadcasts, or campaigns
Read and navigate external documentation efficiently. Invoke when the task requires checking how a specific function, endpoint, or configuration option works; when the user references an API, SDK, library, or third-party tool by name; when any docs URL or documentation site is mentioned; or when implementing something that depends on an external service or package.
Use this skill whenever the user wants to create, read, edit, or manipulate Word documents (.docx files) or Word templates (.dotx files). Triggers include: any mention of 'Word doc', 'word document', '.docx', '.dotx', or requests to produce professional documents with formatting like tables of contents, headings, page numbers, or letterheads. Also use when extracting or reorganizing content from .docx or .dotx files, inserting or replacing images in documents, performing find-and-replace in Word files, working with tracked changes or comments, or converting content into a polished Word document. If the user asks for a 'report', 'memo', 'letter', 'template', or similar deliverable as a Word or .docx file, use this skill. Do NOT use for PDFs, spreadsheets, Google Docs, or general coding tasks unrelated to document generation.
Use for diligence or meeting prep on a specific company, person or organization ('prep me for a meeting with X', 'due diligence on Y'). Tests the user's stated hypothesis with balanced evidence (disconfirming_evidence_balance.py) and writes a .docx dossier.
FiveM development best practices for any framework (vRP, QBCore, Qbox, ESX). Covers performance, security, client/server communication, cache (cacheaside + client-side cache §2.1.1), cerberus (load balance, SafeEvent, SetCooldown), view-cache audit (audit-passes.md §2.4), client-callable endpoint exposure & server auth (§5.1), input validation (§5.3), quality gates for implementation/refactor (quality-gates.md), asset discovery, framework auto-detection, and dynamic documentation fetching. Use when the user works with FiveM, Lua scripts, natives, resources, fxmanifest, optimization, /fxmind audit, or general server development without a specific framework context.
Hunt API security misconfiguration — mass assignment, prototype pollution, HTTP verb tampering. Mass assignment: send {is_admin:true, role:admin, verified:true} on profile/account/reset endpoints — server blindly applies. JWT signature/crypto forging (alg:none, key confusion, kid/jku) is owned by hunt-jwt-crypto; this skill covers only non-crypto JWT handling. Prototype pollution: __proto__ injection in JSON merge / Object.assign / lodash _.merge → polluted prototype reaches sink (RCE in Node, XSS in browser). HTTP verb: GET-bypass-CSRF, X-HTTP-Method-Override, TRACE enabled. Detection: API responses with extra fields, JWTs in headers (decode at jwt.io). CORS misconfiguration (reflect-any-origin, null origin, subdomain-regex bypass, postMessage) is owned by hunt-cors. Use when hunting API misconfigs, mass-assignment, prototype pollution (JWT crypto → hunt-jwt-crypto).
Guides design of comfortable, intuitive VR/MR experiences for Meta VR and Horizon OS — comfort guidelines, interaction patterns, spatial layout, accessibility. Use during UX design review or when evaluating comfort and accessibility. Build paths: Meta Spatial SDK, Unity, Unreal, native OpenXR, and WebXR; for 2D panel apps use hz-panel-designer if available. Use hz-quest-verify-first if the build path is unclear.
Temu US e-commerce Ads API, routed through the LinkFox gateway to Partner US Ads and related bg/temu ad-placement interfaces (campaigns, ad groups, creatives, reports, budgets, bids, etc.; interfaces will be integrated one by one according to Partner documentation). Trigger when the user mentions Temu US ads, Ads, ad placement, campaigns, ad groups, creatives, bids, budgets, ad reports, ad campaign, or product-inventory ads. For product management, use linkfox-temu-manage-product-us; for promotions, use linkfox-temu-promotion-us; for orders, use linkfox-temu-order-us.
Temu Europe order cancellation API for buyers and sellers, routed through the LinkFox gateway to Partner EU. Covers buyer after-sales cancellations (bg.aftersales.cancel.*), seller appeals and out-of-stock cancellations (temu.order.cancel.*), and more. Trigger when the user mentions Temu EU order cancellation, buyer cancellations on the Europe site, seller out-of-stock cancellations, afterSalesStatusGroup, applySn, or site=eu order-shipping. For orders, use linkfox-temu-order-eu; for the US site, use linkfox-temu-cancel-order-us; for the global site, use linkfox-temu-cancel-order-global.
Temu global (non-US/EU) order cancellation API for buyers and sellers, routed through the LinkFox gateway to six interfaces: buyer after-sales cancellations (bg.aftersales.cancel.*), seller appeals and out-of-stock cancellations (temu.order.cancel.*), and more. Defaults to site=global and tokenPurpose=order-shipping. Trigger when the user mentions Temu Global order cancellation, buyer cancellations on the global site, seller out-of-stock cancellations, afterSalesStatusGroup, or applySn. For the US site, use linkfox-temu-cancel-order-us; for Europe, use linkfox-temu-cancel-order-eu; for orders, use linkfox-temu-order-global.
Temu global (non-US/EU) e-commerce fulfillment and shipping API: 23 interfaces covering Buy-Shipping label purchasing, partner warehouse fulfillment, seller-fulfilled shipping, and tracking (excluding Scan Form). Trigger when the user mentions Temu Global shipping, label purchasing, Buy-Shipping, partner warehouses, seller-fulfilled shipping, tracking, shipment.create, or site=global order-shipping. For orders, use linkfox-temu-order-global. For Scan Form, use linkfox-temu-fulfillment-us.
Temu Europe Manage Product API, routed through the LinkFox gateway to 24 Partner EU bg.local/temu.local interfaces: product lists/details/SKU lookup, partial or full edits, deletion, inventory, listing/unlisting, presales, category prechecks, attribute templates, compliance, external codes, video covers, and more. Trigger when the user mentions Temu EU Manage Product, Temu Europe product management, bg.local.goods, Partner EU, listing or unlisting products on site=eu, inventory updates, product deletion, or compliance edits. For promotions, use linkfox-temu-promotion-eu; for ads, use linkfox-temu-ads-eu; for pricing, use linkfox-temu-price-eu.
Temu global e-commerce promotion API, routed through the LinkFox gateway to Partner Global Promotion and related bg/temu interfaces (campaign creation, enrollment, lookup, coupons, flash sales, etc.; interfaces will be integrated one by one according to Partner documentation). Trigger when the user mentions Temu Global promotions, promotional campaigns, coupons, flash sales, campaign enrollment, promotion campaign, or product-inventory promotions. For product management, use linkfox-temu-manage-product-global; for pricing, use linkfox-temu-price-global; for orders, use linkfox-temu-order-global.
Build and maintain a persistent markdown wiki that an LLM updates on the user's behalf, usually inside an Obsidian vault or git-tracked notes repo. Use when raw sources such as web articles, papers, meeting notes, transcripts, screenshots, or past analyses need to be turned into an interlinked knowledge base with immutable source files, LLM-written wiki pages, `index.md`, `log.md`, schema rules in `AGENTS.md` or `CLAUDE.md`, source summaries, query notes, and recurring lint passes. Triggers on: llm-wiki, personal wiki, obsidian wiki, research vault, knowledge base, source ingest, persistent notes, wiki maintenance, source summaries, query filing
Use when generating, refactoring, reviewing, or debugging Make App project runtime structure, workspace manifests, Service runtime, local/dev scripts, build outputs, Docker/K8s image entrypoints, publish readiness, or packaging errors such as missing `apps/service/dist/server.js`. Covers `apps/` workspace contracts, `apps/ui/dist`, `apps/service` port/build/start contracts, runtime config file location, runtime artifact tests, forwarded host/proto header preservation, and publish gates that include auth, default Trace ID, and applicable permission audits. Does not cover UI layout, authentication implementation, Trace behavior, permission logic, Make adapter env semantics, DSL modeling, Make CLI resource deployment, or canvas-table internals.
Designing forms with multiple steps, progress indicators, conditional logic, and save-and-resume mechanics. The discipline of breaking complex data collection into stages that respect cognitive load while maintaining completion intent. Honest about kitchen-sink-single-page (overwhelms before the user starts), progress-theater (steps without genuine staging), and genuinely-staged (each step earns its own page) patterns. Triggers on multi-step form, multi-page form, form wizard, signup wizard, lead form, application form, intake form, configurator, onboarding form. Also triggers when a long form is converting poorly, when an audience is dropping off mid-form, or when a multi-step form is being scoped for the first time.
Open Source Computer Vision Library (OpenCV) for real-time image processing, video analysis, object detection, face recognition, and camera calibration. Use when working with images, videos, cameras, edge detection, contours, feature detection, image transformations, object tracking, optical flow, or any computer vision task.
Use this skill whenever the user wants to use AI agents to work with Penpot design files via the Penpot MCP Server. Triggers include: using Penpot through an AI agent, design files, design systems, design tokens, Penpot MCP, design-to-code, generating UI from design, auditing a design system, creating components/variants, renaming layers, exporting assets from Penpot, adding flows, interactions, animations, overlays, or prototyping in Penpot, or prompting an AI agent to read/modify a Penpot file. Also triggers when the user wants to set up Penpot MCP, connect any MCP-compatible AI agent or IDE to Penpot, or produce production-ready HTML/CSS/React from a Penpot design. Use this skill for Penpot-agent workflows — design, code, audit, prototyping, or setup.
Write .ts script files for the Creator Hub Script component — self-contained classes attached to individual entities. Use when the user wants to create a custom smart item, a reusable scripted entity, or write code that runs on a Creator Hub Script component. Do NOT use for regular scene index.ts code or global systems (see scene-runtime, add-interactivity).
Captures and maintains learnings, errors, and corrections. Use when a command fails, the user corrects an assumption, a capability is missing, knowledge is outdated, or a better approach is found. Review relevant saved guidance before major tasks, reuse, and promotion; revalidate it according to what could change and how quickly.
Use when the user is working with the Spree 6 product catalog — products, variants, option types/values, the default variant, product types (templates), categories vs collections, custom fields, media (images, video, media library), channel publications, search providers (database, spree_meilisearch, custom), digital assets, or catalog imports/exports. Common phrasings include "create a product", "add variants", "size and color options", "product type", "category tree", "collection", "brand", "custom field on products", "product images", "product video", "primary_media", "product not showing in store", "publish product on channel", "Meilisearch", "reindex", "custom search provider", "digital download", "master variant". Covers the catalog graph and how to read/write it from Ruby, the Admin SDK and `spree api`
Tavily API integration with managed API key authentication. Perform AI-powered web search, extract content from URLs, crawl websites, map site structure, and run research tasks. Use this skill when users want to search the web, extract page content, crawl websites, discover URLs, or conduct in-depth research with citations. For other third-party apps, use the api-gateway skill (https://clawhub.ai/byungkyu/api-gateway). Requires network access and a valid Maton API key.
Fetch brand SVG logos and cloud architecture icons (AWS, Azure, GCP) from theSVG. Use when the user asks for a brand logo, company icon, framework mark, service icon, or any "icon/logo for X" where X is a real brand or cloud service. Returns ready-to-use CDN URLs or raw SVG markup
Write high-engagement tweets and X/Twitter threads, grounded in live research of what's currently working in the user's niche: researches viral examples via web search, then drafts hook variants, a single-tweet version, and a thread version with alternates to test. Use when the user says 'write a tweet about X', 'turn this into a thread', 'help me go viral', 'grow my X/Twitter account', 'my tweets get no engagement', or shares an idea/article to tweet — any X/Twitter content request. Produces a Tweet Package: 3 hook options, final single tweet, full thread, and posting notes.
ALWAYS use when writing code that imports "vue-router", "vue-router/vite", "vue-router/auto-routes", or "vue-router/experimental". Consult for debugging, best practices, or modifying vue-router, vue router, router, file-based routing, typed routes, data loaders.
Comprehensive security audit and vulnerability detection for JavaScript/TypeScript applications following OWASP Top 10. Use when (1) users say 'audit security', 'check for vulnerabilities', 'security review', 'implement authentication', or 'secure this code'; (2) adding authentication, API endpoints, file uploads, or handling user input; (3) working with secrets, credentials, or sensitive data; (4) implementing payment features or blockchain integrations; (5) conducting pre-deployment security checks. Audits for hardcoded secrets, injection vulnerabilities, XSS/CSRF, broken access control, insecure authentication, rate limiting, dependency vulnerabilities, and sensitive data exposure.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.