Skills
100,928 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Create a changeset for the Astro monorepo. Use this skill whenever you need to add a changeset file to a PR, write a changelog entry, or document a package version bump. Also trigger when the user says "add a changeset", "write a changeset", "create a changeset", or when another skill instructs you to create a changeset.
Add or modify Adobe Commerce Admin UI extensions at the commerce/backend-ui/2 extension point: custom grid columns, mass actions, order view buttons, a custom Admin menu entry, and custom ACL resources. Use whenever the user wants to extend the Commerce Admin — add a column to the order, product, customer, invoice, credit memo, shipment, or newsletter grid; add a bulk/mass action to a grid; add a button to the order view page; add a custom menu item or page; or declare custom permissions checked by the app itself — even when they don't name the extension point.
Develop a new ESLint rule for @sap-ux/eslint-plugin-fiori-tools. Always use this skill when adding any rule to the plugin, implementing manifest.json/XML/CDS/flex-change validation, writing rule tests with project context, or creating rule documentation — even if the request sounds simple or the user doesn't mention 'ESLint' explicitly. Guides through the complete workflow: diagnostics constant, rule implementation, unit tests, docs, and registration.
Factorial Code platform user journey and support — from requesting access through app creation, OAuth setup, demo companies and the Test marketplace to releases and marketplace publication. Use when answering "how do I…" questions about using the platform, guiding a user through any journey stage, or acting as a Factorial Code support agent.
Frontend visual replication skill. Explores a target website’s publicly visible pages via Playwright MCP or agent-browser, captures screenshots and layout information, then generates a static or client-side frontend replica that approximates the original’s visual appearance and page structure. This skill replicates FRONTEND PRESENTATION ONLY — it does not reproduce backend logic, server-side behavior, databases, or any non-public content. The user is responsible for ensuring they have proper authorization (ownership, license, or explicit permission) before replicating any website. Authorization gate: Before starting, the agent MUST confirm with the user that they have the legal right to replicate the target site. If the user cannot confirm, the skill MUST refuse to proceed.
Expert blueprint for dedicated / headless multiplayer hosts: ENet/DTLS, authority validation, safe packet decode, matchmaker handoff, and health telemetry. Use when building authoritative servers, --headless hosts, or hardening host networking. Keywords: dedicated server, headless, ENet, DTLS, authority, safe_packet_decoder, multiplayer host, WebSocketMultiplayerPeer.
TRIGGER: before putting a UI / screen / component / animation comparison into `AskUserQuestion` `preview:` chips, invoke this skill and ask "quick inline chips, or a real HTML prototype?" — no exception for "simulate", "demo", "mock up". Builds real HTML prototypes for visual design, component playgrounds, animation tuning, and design-system exploration — even when the production target is React, Swift, SwiftUI, or Android. For N alternatives use html-brainstorm-grid; for one tunable component use this skill.
A skill for hunting CSRF vulnerabilities, built from 15 public bug bounty reports covering modern variants: SameSite=Lax sibling-subdomain bypass (Argo CD CVE-2024-22424), GraphQL mutations via GET (GitLab $3,370), framework-wide CSRF middleware disabled (Stripe Dashboard $5,000), path-traversal CSRF-token bypass (GitHub Enterprise CVE-2022-23732 $10k), Origin-omission bypass (TikTok $2,500), OAuth-state null byte (Streamlabs), WebSocket CSRF / CSWSH (Coda), default-SameSite email change leading to ATO (YoYo Games $400), social-account-link CSRF (HackerOne), and JSON-CSRF via text/plain on email change (TikTok $500). Use when hunting modern CSRF, with a strong focus on chain-to-ATO patterns.
This skill should be used when the user asks about the invoice system (インボイス制度), qualified invoices (適格請求書), registration numbers (登録番号), input tax credits (仕入税額控除), the 20% special measure (2割特例), the 30% special measure (3割特例), tax-exempt businesses (免税事業者), transitional measures (経過措置), small-amount exceptions (少額特例), corrected invoices (修正インボイス), or any related topics. Trigger phrases include: "インボイス", "適格請求書", "登録番号", "仕入税額控除", "2割特例", "3割特例", "免税事業者", "経過措置", "少額特例", "修正インボイス", "返還インボイス", "簡易インボイス", "インボイス登録", "T番号", "適格請求書発行事業者".
Temu US e-commerce fulfillment/shipping API (unified): 27+ endpoints for Buy-Shipping label purchasing, partner warehouse fulfillment, seller self-shipping, logistics tracking, and more. Trigger when the user mentions Temu US shipping, label purchasing, Buy-Shipping, partner warehouses, self-shipping, tracking, scanform, shipment.create, or order-shipping. Use linkfox-temu-order-us for orders
Temu EU e-commerce promotion API, routed through the LinkFox gateway to Partner EU Promotion / promotion-related bg/temu endpoints (campaign creation, registration, lookup, coupons/flash sales, etc.; endpoints will be integrated one by one according to Partner documentation). Trigger when the user mentions Temu EU promotions, promotion campaigns, coupons, flash sales, campaign registration, or product-inventory promotions. Use linkfox-temu-manage-product-eu for product management, linkfox-temu-price-eu for prices, and linkfox-temu-order-eu for orders
How to design a content hub that earns topical authority. Pillar topic selection, cluster planning, internal linking architecture, URL structure, pillar and cluster page anatomy, topical authority signals for SEO and AEO/GEO, and the maintenance discipline that distinguishes intentional hubs from accidental orphans. Triggers on pillar content, content hub, topic cluster, topical authority, content architecture, hub and spoke, pillar page, cluster page, content silo, internal linking strategy. Also triggers when a content set is not ranking despite individual piece quality, when a pillar was launched without a cluster, or when content has accumulated without an architecture.
Generate a QA plan for a feature just implemented, grounded in the actual code changes: the agent runs every check with an observable result, in a headless browser when one is available, and leaves a short manual list of what needs human judgment, saved to docs/qa. Use when a coding session wraps and you want to hand-test the result, or the user says "write a QA plan", "make a manual test plan", "how do I test this", "generate a testing plan for this feature", "try to break this component", or runs /qakit.
Guides building on Qdrant Edge, the embedded in-process shard. Use when someone asks 'how to sync Edge with the server', 'keep a local shard in sync with Qdrant Cloud', 'BM25 or keyword search on Edge', 'hybrid search on Edge', 'embeddings on device', 'Edge snapshots', 'apply a partial snapshot', 'why is my Edge search slow after inserts', or is writing custom sync, BM25, or fusion code against qdrant-edge. Also use when deciding what Edge ships built-in versus what you must implement.
Use when building Roblox gameplay systems: NPC or enemy AI that patrols, chases and attacks, state machines or behavior trees, 'NPC pathfinding stuck', 100 zombies lag the server, hitboxes, melee combos, M1 combat, 'hits register twice', raycasts, Spherecast, Shapecast, guns and projectiles, 'bullets go through walls', knockback and stun, LinearVelocity, VectorForce or AlignPosition movers, replacing BodyVelocity, cars and vehicles with suspension, 'car flips', VehicleSeat, network ownership of NPCs and vehicles, round loops, BindToSimulation logic.
Procedural sound design with the sfx engine — writing a cue sheet against a video's timeline, which sound goes with which visual event, gain hierarchy, panning, musical key, automatic mastering to -14 LUFS, adding new generators, and verifying sync. Use when adding, changing or checking audio, SFX, music beds or loudness for any video in this repo
Implement the Syncfusion Angular Chat UI component. Use this skill whenever users need to implement messaging, real-time conversations, file attachments, typing indicators, user mentions, or bot integrations (Dialogflow, Microsoft Bot Framework) in Angular applications. Essential for customer support chatbots, team messaging apps, AI-powered assistants, and collaborative communication interfaces.
Implement and configure the Syncfusion Angular Gantt Chart component (ejs-gantt, GanttModule). Use when building Angular applications with Gantt chart functionality, task scheduling, dependencies, or resource management. Covers component setup, task dependencies, taskbar editing, critical path analysis, resource allocation, timeline configuration, filtering, sorting, export, undo/redo, state persistence, and localization
Implement the Syncfusion Angular Inline AI Assist component for AI-powered text processing and editing. Use this skill when users need to add AI-powered suggestions, create prompt/response workflows, customize toolbars and commands, handle AI responses, configure templates, implement event handling, or add localization to Angular applications with intelligent inline text editing. Covers installation, configuration, response modes, command settings, toolbar customization, template usage, event handling, methods, and RTL/localization support.
Master the art of directing voice talent to deliver performances that match your brand vision, using Anne Ganguzza's storytelling approach and industry best practices. Use when: Hiring and briefing voiceover artists for a project; Giving direction during recording sessions; Writing scripts that are easy for talent to deliver; Matching voice characteristics to brand personality; Reviewing auditions and selecting the right talent
Use ONLY when the user explicitly says: 'use the skill web-to-markdown ...' (or 'use a skill web-to-markdown ...'). Converts webpage URLs to clean Markdown by calling the local web2md CLI (Puppeteer + Readability), suitable for JS-rendered pages.
Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, proxy), pre-dive kill signals (TVL < $500K etc), Foundry PoC template, grep patterns for each class, and real Immunefi paid examples. Use for any Solidity/Rust contract audit or when deciding whether a DeFi target is worth hunting.
Use when you need to design, review, or improve validation in Spring Boot applications — including Bean Validation on request DTOs, @Valid/@Validated at API boundaries, constraint groups, custom constraints, @ConfigurationProperties validation, nested DTO validation, and consistent validation error handling. This should trigger for requests such as Add validation support in Spring Boot; Review Spring Boot validation rules; Improve request validation in Spring Boot REST APIs; Add custom Bean Validation constraints in Spring Boot; Validate configuration properties in Spring Boot. Part of Plinth Toolkit
Use when you need to design, review, or improve security in Spring Boot applications — including SecurityFilterChain, OAuth2/JWT resource server patterns, form login basics, method security (@PreAuthorize), CSRF and CORS for APIs, session fixation, security headers, exception handling, password encoding, and sensitive-data-safe logging. This should trigger for requests such as Add Spring Boot security support; Review Spring Boot security configuration; Improve API authorization in Spring Boot; Add JWT resource server security in Spring Boot; Harden Spring Boot security headers and CSRF settings. Part of Plinth Toolkit
Use when the user wants to simplify, clean up, refactor, tidy, or refine code—their staged/unstaged git changes or a target file/path. Reduces complexity, flattens nesting, removes redundancy and dead code, scores each change by value (holding low-value churn), then runs tests to prove nothing broke. Invoke on: “simplify”, “simplify this”, “simplify my code/changes”, “clean up”, “clean this up”, “clean up my changes”, “refactor this”, “make this cleaner”, “tidy this up”, “reduce complexity”, “flatten this”, “remove dead code”, “make it more readable”, “polish before commit”, or “absolute simplify”. Acts on your working diff; for repo-wide dead code use absolute-prune; for lint/type debt use absolute-debt.
Write, run, and analyze structured test suites for Agentforce agents — functional AND security. TRIGGER when: user writes or modifies test spec YAML (AiEvaluationDefinition); runs sf agent test create, run, run-eval, or results commands; asks about test coverage strategy, metric selection, or custom evaluations; interprets test results or diagnoses test failures; asks about batch testing, regression suites, or CI/CD test integration; requests security testing, OWASP LLM Top 10, red-teaming, penetration testing, prompt-injection tests, a security grade, or a vulnerability assessment of an agent. DO NOT TRIGGER when: user creates, modifies, previews, or debugs .agent files (use agentforce-generate); deploys or publishes agents; writes Agent Script code; uses sf agent preview for development iteration; analyzes production session traces (use agentforce-observe); performs a static safety review of .agent file content (use agentforce-generate Section 15).
Identify ransomware-related network indicators, including C2 beaconing patterns, TOR exit node connections, data exfiltration flows, and encryption key exchange, by analyzing Zeek conn.log and NetFlow data. Use when threat hunting for active ransomware network activity or investigating suspected pre-encryption exfiltration during incident response.
Systematically map threat actor behavior and observed IOCs to the MITRE ATT&CK framework, build technique coverage heatmaps with the ATT&CK Navigator, identify detection gaps, and produce actionable threat intelligence reports across the Enterprise, Mobile, and ICS matrices. Use when analyzing threat actor TTPs, correlating IOCs to specific ATT&CK techniques, or assessing defensive detection coverage against adversary behavior.
Autonomous biomedical AI agent framework for executing complex research tasks across genomics, drug discovery, molecular biology, and clinical analysis. Use this skill when conducting multi-step biomedical research including CRISPR screening design, single-cell RNA-seq analysis, ADMET prediction, GWAS interpretation, rare disease diagnosis, or lab protocol optimization. Leverages LLM reasoning with code execution and integrated biomedical databases
Set up, create, test, and manage monitoring checks using the Checkly CLI. Use when working with API Checks, Browser Checks, URL Monitors, ICMP Monitors, Playwright Check Suites, Heartbeat Monitors, Alert Channels, Dashboards, or Status Pages. Access Checkly account plans, entitlements, feature limits, members, and pending invites. Includes generic API pass-through (`checkly api`) for endpoints without dedicated commands.
Complete CI/CD guide for Cloudflare Workers using GitHub Actions and GitLab CI. Use for automated testing, deployment pipelines, preview environments, secrets management, or troubleshooting deployment failures, workflow errors, and environment configuration issues
Anthropic's method for training harmless AI through self-improvement. Two-phase approach: supervised learning with self-critique and revision, then RLAIF (RL from AI Feedback). Use for safety alignment and reducing harmful outputs without human labels. Powers Claude's safety system
This skill should be used for improving context efficiency: context budgeting, observation masking, prefix or KV-cache strategy, partitioning, token-cost reduction, retrieval scoping, and extending effective context capacity without lowering answer quality.
Write copy that sells NOW using Dan Kennedy's "No B.S." direct response marketing principles Use when: **Writing sales copy** that must generate immediate, trackable response; **Creating direct mail pieces**, sales letters, or landing pages for local businesses; **Designing marketing funnels** with clear offers at every stage; **Breaking free from "brand advertising"** that doesn't produce measurable ROI; **Building follow-up sequences** that convert leads into customers
Push records from apps, services, devices, or scripts directly into Unity Catalog Delta tables with Zerobus Ingest: SDKs (Python, TypeScript, Go, Java, Rust, C++, .NET), REST, OTLP, MQTT, Arrow Flight, or Apache Kafka-compatible producer APIs, with no message bus to run. Use to stream events, telemetry, logs, IoT data, CDC, or columnar batches into Databricks in near real time; connect existing collectors and log shippers (OpenTelemetry, Debezium, Vector, Telegraf, Cribl); replace a message bus that only feeds the lakehouse; or debug Zerobus auth, schema, throughput, or delivery issues.
Creates Dockerfiles, configures CI/CD pipelines, writes Kubernetes manifests, and generates Terraform/Pulumi infrastructure templates. Handles deployment automation, GitOps configuration, incident response runbooks, and internal developer platform tooling. Use when setting up CI/CD pipelines, containerizing applications, managing infrastructure as code, deploying to Kubernetes clusters, configuring cloud platforms, automating releases, or responding to production incidents. Invoke for pipelines, Docker, Kubernetes, GitOps, Terraform, GitHub Actions, on-call, or platform engineering.
Creates safe refactor plans for messy UI code, including component splitting strategies, state simplification, performance optimizations, and accessibility improvements. Provides a phased approach, risk assessment, and "done" criteria. Use when refactoring "legacy code", "messy components", "performance issues", or "large files".
Orchestrate multiple worker agents to implement groomed tasks in Gitea repositories. Use when multiple ready tasks need implementation, when you want autonomous multi-task execution, or when coordinating batch development work with Gitea. Keywords: coordinator, orchestrator, multi-task, parallel, workers, batch, autonomous, gitea, tea.
Design domain-specific agent teams, define specialized agents, and generate the skills they use. Use when you need to decompose a complex project into coordinated multi-agent teams, choose the right architecture pattern (pipeline, fan-out/fan-in, expert pool, producer-reviewer, supervisor, hierarchical delegation), generate .claude/agents/ and .claude/skills/ files, or validate and iterate on generated harnesses. Triggers on: harness, build a harness, design agent team, agent team architecture, multi-agent skill generation, set up harness, harness engineering, domain agent team, harness for this project.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.