Skills
100,928 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Use when a Roblox game sells something or plans live ops: Developer Products, game passes, experience subscriptions, Roblox Plus perks, ProcessReceipt or BindReceiptHandler, "bought it but didn't get it", a purchase granted twice, shop UI prices, eggs, crates or loot boxes with odds (paid random items, PolicyService), rewarded video ads, AnalyticsService funnels, economy or custom events, ConfigService live config, A/B experiments, price optimization or regional pricing, game thumbnails and icons, play-through rate, Creator Rewards, Ads Manager campaigns, or a launch and update plan
Use when setting up or repairing a Roblox team project outside Studio: Rojo or Script Sync, Wally packages, Rokit pins, luau-lsp type checking, Selene, StyLua, unit tests in Lune or the engine, GitHub Actions CI on pull requests, Open Cloud place publishing, Luau Execution or API key scopes, merging builders' Team Create map with code from files, Studio plugins, or proving a pipeline works. Also when users say "set up Rojo", "CI for my Roblox game", "run tests in CI", "publish from GitHub", "Script Sync stopped syncing", "Rojo deleted my parts", "wally packages not found", "luau-lsp can't find ReplicatedStorage", "selene errors on types", "the release wiped the map" or "my LocalScript doesn't run".
Use when the user asks to "build a mobile app", "scaffold React Native project", "create SwiftUI views", "set up Jetpack Compose", "optimize mobile performance", "configure Expo Router navigation", "implement offline-first storage", "submit to App Store", or "profile mobile rendering". Expert mobile development covering iOS (Swift/SwiftUI), Android (Kotlin/Compose), React Native, and Flutter for native and cross-platform applications.
Ask the user yes/no, pick-one or A/B/C design questions on a local review board and read back their answers, using the sign-off-axi CLI. Use when you need a yes/no decision, a choice between a few options, a design pick between mocks, or approval from the user before going on, want the user to review or sign off on a plan or on proof of finished work (screenshots or a recording), need to read back the answers the user already gave, must explain a concept, design or trade-off to the user as an interactive report, want to track work as tickets the user can follow, or need the user to sign in to a service
Multi-cloud orchestration for ML workloads with automatic cost optimization. Use when you need to run training or batch jobs across multiple clouds, leverage spot instances with auto-recovery, or optimize GPU costs across providers.
Use when the user wants to add a new model, database table, or REST API endpoint to a Spree 6 project, or document custom endpoints in OpenAPI. Covers `spree:api_resource` (model + migration + Store/Admin controllers + serializers + factory + specs + rswag integration spec + routes + permission scope), `spree:model` (model + migration only), and generating `openapi/admin.yaml` / `store.yaml` with rswag (`admin_operation`, `request_body_for`, `filter_parameters_for`, `spree_dev_tools:openapi`, `spree task openapi:generate`) — the document behind MCP agent tools and `spree sdk generate`. Common phrasings include "add a Brand model", "create a new resource", "expose X as an API endpoint", "add an Admin API for Y", "scaffold a Spree resource", "model without an API", "make my model store-scoped", "OpenAPI for my endpoint", "swagger docs for custom API", "rswag", "openapi:generate".
Use when the user wants to upgrade Spree to a newer version, or asks how the upgrade machinery works. Common phrasings include “upgrade Spree”, “bump Spree”, “how do I upgrade”, “what's the upgrade process”, “run the Spree upgrade”, “spree upgrade --plan”, “rake spree:upgrade”, “re-run one upgrade step”, “upgrade in production / release phase”. Covers the version-agnostic flow for Spree 6 projects — the `spree upgrade` CLI, the `rake spree:upgrade` task and its manifests, retrying single steps, and running backfills in production. For the Spree 5.x → 6.0 major hop, also load spree-upgrade-5-to-6.
Implement and customize Syncfusion Angular Accumulation Charts (Pie, Doughnut, Pyramid, Funnel) with data binding, labels, legends, and tooltips. Use this when creating accumulation charts, configuring chart types, customizing data visualization, adding annotations, or handling interactive chart events in Angular applications
Implement the Syncfusion Angular Ribbon component. Use to create Microsoft Office-style ribbon interfaces, organize application commands into tabs and groups, implement file menus or backstage views, or build sophisticated command interfaces. Includes setup, configuration, event handling, layouts, and customization. Use for all Ribbon component implementation needs.
Routing-first reusable component architecture for shared frontend primitives, slots, controlled ownership, alternate-root composition, and docs/verification packets. Use when the user needs to decide what should become a shared primitive, how a component API should expose variants or subcomponents, when parent state should control the component, how to compose a button/link/dialog onto alternate element types, or what Storybook/example coverage is required. Route design-token or cross-product governance to `design-system`, accessibility-heavy remediation to `web-accessibility`, layout adaptation to `responsive-design`, app-level state ownership to `state-management`, and React performance work to `react-best-practices`.
Audit and safely clean Xcode-related developer storage on macOS. Use whenever a developer mentions low disk space, Xcode storage, DerivedData, simulator devices or runtimes, stale beta platforms in Xcode Settings, DeviceSupport, archives, dSYMs, CocoaPods caches, simulator dyld caches, project .build folders, downloaded Xcode DMGs/XIPs, duplicate Xcode installers, or old Xcode applications. Also use this skill proactively when you hit low storage during other work, such as a build, download, or install failing with an out-of-disk-space error. Always measure first, report recoverable GiB with evidence, and obtain explicit itemized approval before any mutation.
Use when needing to look up book content, find a book by title/author, download an ebook, or reference material from a published book. Triggers on book lookups, ebook downloads, "find the book", "get the PDF/EPUB of". Downloads produce PDF/EPUB/MOBI files - use ebook-extractor skill to convert to text.
SST v4 (Ion) expert for managing AWS resources as code with the Pulumi-backed framework. Use when writing or editing sst.config.ts, building infra/ modules (sst.aws.Function/Bucket/Dynamo/Cron/Service/Router, sst.Secret, sst.Linkable, raw aws.* Pulumi resources), wiring resource links, scoping IAM, or running sst deploy/dev/diff/remove. Essential when the user mentions SST, sst.config.ts, $config, $transform, $interpolate, sst.aws.*, sst.Secret, Pulumi/Ion, "sst deploy", a failed SST deploy (ConflictException on a resource-type change, "Identifier '__filename' has already been declared", MalformedPolicyDocument on an Output<T>), or wants to scaffold/troubleshoot AWS infrastructure with SST. Also use when a request to "deploy my AWS stack" or "add a Lambda/bucket/table" is made in a repo that already contains an sst.config.ts (using $config) or an sst dependency. Do NOT use when the task is primarily AWS CDK, Terraform, raw CloudFormation, or SAM with no SST present — those have their own tooling.
Use when selecting or evaluating brand colors, building a palette with primary, secondary, neutral, and accent roles, differentiating from competitor colors, or checking color contrast and accessibility. Keywords — color psychology, color palette, 60-30-10 rule, color harmony, archetype colors, cultural color meaning, WCAG contrast, hex and CMYK specifications.
Evidence-based due-diligence audit for BNB Smart Chain (chain 56) token contracts, NFT mints, and deposit-refund "lock-to-allocate" escrows — verification status, live privilege inventory (owner/pause/blacklist/hidden mint/upgrade/tax/maxTx/baseURI), sell-or-resell path, honeypot or mint simulation, holder distribution and LP lock, site-claim vs code diff, with the Binance Web3 security audit API as one input — then a 100-point score with an avoid/review/pass verdict. Use for "audit this contract", "is this token a scam or rug", "check this BSC token before buying", "is the LP locked", "did the owner renounce", "should I mint this NFT", "is this NFT drop legit", "should I lock BNB/USDT for this allocation", "is this 24h lock/refund legit". Trigger whenever the user supplies a BSC contract address (fungible token, NFT collection, or an active mint) and/or its site and wants a safety, investor-protection, anti-manipulation, transparency, or market-viability judgement — with or without a scoring rubric
Wire a PostHog endpoint into a client app or SDK. Covers fetching the OpenAPI spec, generating a typed client with openapi-generator or @hey-api/openapi-ts, sending the right auth header, shaping the variables payload (HogQL code_name vs insight breakdown property), handling rate-limit and materialised-endpoint error responses. Use when the user says "how do I call my endpoint", "generate a client for this", or "what auth header do I use".
A tool for querying the daily hottest Douyin works. Collects works from across Douyin daily and outputs the day's top 50 by likes. Supports category-based searches, historical lookups (up to 30 days), and personalized subscription notifications. Use when users search for Douyin hot rankings, daily rankings, viral works, category rankings, creator rankings, or popular content. Trigger terms: Douyin hot ranking, Douyin daily ranking, Douyin ranking, Douyin viral hits, Douyin hottest, Douyin TOP ranking, Douyin category ranking. If the API returns insufficient credits (code=3210), automatically open Alipay to top up and continue the search.
Use this skill whenever a task involves a document file (PDF, DOCX, PPTX, XLSX, or image) and you need to read it or pull text, tables, or specific values out of it — to answer a question about its contents, look up a figure, or extract data. Provides fast, local, model-free extraction via the `lit` CLI with disciplined, low-cost search patterns.
Hunt MFA / 2FA bypasses across 7 patterns: (1) MFA not enforced on sensitive endpoints (password changes or email-change acceptance without an MFA challenge), (2) skipping the MFA step by navigating directly to a post-login URL, (3) MFA-token replay (the same code is accepted twice), (4) brute-forcing the 6-digit OTP without rate limiting (10^6 attempts at server speed), (5) race conditions in OTP validation, (6) recovery-code exposure via /api/me, and (7) backup-factor downgrade (SMS factor without rate limiting). Also covers the chain: cookie theft + password oracle + no step-up = ATO without an MFA challenge. Detection: trace the auth flow in Burp, find every state transition, check whether MFA is middleware-gated or enforced per endpoint, and check OTP entropy and rate limits on OTP validation. Validate that an attacker session can reach the post-MFA state. Use when hunting auth bypasses, MFA flows, or chaining primitives toward ATO.
Use when the user wants full metadata for a paper — from a DOI, PMID, arXiv id, OpenAlex id, or title. Returns title, author list, first author, corresponding author(s), publication date, journal name + ISO-4 abbreviation, impact factor, volume/issue/pages, DOI/PMID, citation count, and abstract in one record. Triggers on "paper metadata", "who is the corresponding author", "first author of", "what journal / impact factor for this DOI/PMID", "cite this paper", "文献元数据", "通讯作者", "第一作者", "影响因子". PROACTIVELY USE when the user pastes a DOI/PMID/arXiv id or paper title and asks about its authors, venue, or impact.
Large Language and Vision Assistant. Enables visual instruction tuning and image-based conversations. Combines CLIP vision encoder with Vicuna/LLaMA language models. Supports multi-turn image chat, visual question answering, and instruction following. Use for vision-language chatbots or image understanding tasks. Best for conversational image analysis.
EU MDR 2017/745 regulation specialist and consultant for medical device requirement management. Provides comprehensive MDR compliance expertise, gap analysis, technical documentation guidance, clinical evidence requirements, and post-market surveillance implementation. Use for MDR compliance assessment, classification decisions, technical file preparation, and regulatory requirement interpretation.
Ingest meeting transcripts from ANY meeting recorder into brain pages with attendee enrichment, entity propagation, and timeline merge. One unified pipeline: normalize the source into a standard transcript record, split multi-meeting recordings, resolve speakers by evidence, create the page, pass every surprising claim through the consistency check (transcript + brain + plausibility), enrich every entity, then run the verification checklist — substance AND sequence. A meeting is NOT fully ingested until the enrich skill has processed every entity AND the verification checklist passes, including the sequence verify (PASS or explicit user waive).
Use when wiring up authentication in a Meteor 3 app. Triggers on accounts-password, accounts-base, OAuth (Google, Facebook, GitHub, Apple, Twitter, Meetup, Weibo), accounts-2fa, accounts-passwordless, ServiceConfiguration.configurations.upsertAsync, Accounts.createUserAsync, Accounts.setPasswordAsync, Accounts.forgotPassword, Accounts.resetPassword, Accounts.verifyEmail, useHttpOnlyCookies, clientStorage, Meteor.loginWithPasswordAnd2faCode, and email verification. Use this skill when the user asks about signups, signins, or token storage vs. HttpOnly cookies
Edit opencode.json, AGENTS.md, and config files. Use proactively for provider setup, permission changes, model config, formatter rules, or environment variables. Examples: - user: "Add Anthropic as a provider" → edit opencode.json providers, add API key baseEnv var, verify with opencode run test - user: "Restrict this agent's permissions" → add permission block to agent config, set deny/allow for tools/fileAccess - user: "Set GPT-5 as default model" → edit global or agent-level model preference, verify model name format - user: "Disable gofmt formatter" → edit formatters section, set languages.gofmt.enabled = false
Use this skill whenever the user wants to do anything with PDF files. This includes reading or extracting text/tables from PDFs, combining or merging multiple PDFs into one, splitting PDFs apart, rotating pages, adding watermarks, creating new PDFs, filling PDF forms, encrypting/decrypting PDFs, extracting images, and OCR on scanned PDFs to make them searchable. If the user mentions a .pdf file or asks to produce one, use this skill.
Use when writing E2E tests with Playwright, setting up test infrastructure, or debugging flaky browser tests. Invoke to write test scripts, create page objects, configure test fixtures, set up reporters, add CI integration, implement API mocking, or perform visual regression testing. Trigger terms: Playwright, E2E test, end-to-end, browser testing, automation, UI testing, visual testing, Page Object Model, test flakiness.
Generates structured literature survey reports from collected papers using a multi-stage pipeline: outline generation (query-type adaptive) → draft survey → section-by-section expansion → summary section refinement → final assembly. Produces survey-grade output with taxonomy-based method analysis, LaTeX formalizations, comparative tables, and dense citations. Use when: user wants a literature review, research survey, field overview, or systematic synthesis of multiple papers. Do NOT use for finding/searching papers (use paper-navigator), generating research ideas (use research-ideation), or writing a paper's Related Work section (use paper-writing).
Use when structuring Roblox game code: where scripts go (ServerScriptService, ReplicatedStorage, StarterPlayerScripts), Script vs LocalScript and RunContext, a module loader or framework (Knit or none), services and controllers, how systems talk (signals, BindableEvents, attributes), CollectionService tags, cleanup with Trove or Janitor, Rojo project layout, or a round-based game core. Also when code is spaghetti, a script runs twice, require errors with 'required recursively', a module is nil on the client, a tool stops working after respawn, or memory climbs from leaked connections.
Use when a Roblox game saves or loads player data, or when players report data not saving, lost progress, rollbacks, duplicated items or a purchase granted twice. Triggers: DataStoreService, UpdateAsync, SetAsync, BindToClose, ProfileStore, ProfileService, DataStore2, session locking, data schema or migration, Developer Product ProcessReceipt, player trading, OrderedDataStore leaderboards, MemoryStore, MessagingService, TeleportService and reserved servers, DataStore budgets and throttling (errors 301 to 306), 'You must publish this place to the web to access DataStore', and testing data code in an unpublished place.
Security payloads, bypass tables, wordlists, gf pattern names, always-rejected bug list, and conditionally-valid-with-chain table. Use when you need specific payloads for XSS/SSRF/SQLi/XXE/NoSQLi/command injection/SSTI/IDOR/path-traversal/HTTP smuggling/WebSocket/MFA bypass, or bypass techniques. Submittability and the always-rejected / what-NOT-to-submit decision are owned by triage-validation.
Use when auditing a live site for search and AI visibility, then planning fixes. Triggers: "technical SEO audit" / "технический аудит сайта", "сделай SEO-аудит", "SEO brief before launch" / "SEO-бриф до запуска сайта", "почему упал трафик". Not for logged-in panels. Refusal "no SEO" / «без SEO».
Expert SOC 2 compliance assistant covering all five Trust Services Criteria (Security/CC, Availability/A, Confidentiality/C, Processing Integrity/PI, Privacy/P). Use this skill whenever a user mentions SOC 2, Trust Services Criteria, SOC 2 Type 1 or Type 2, audit readiness, compliance gaps, control documentation, evidence collection, vendor risk questionnaires, or anything related to AICPA service organization controls. Trigger even for adjacent topics like “we need to get audited”, “a customer asked for our security report”, “writing an information security policy”, or “preparing for an audit”. Covers gap analysis, policy writing, control documentation, audit evidence preparation, and vendor risk reviews for organizations at any maturity level — from first-time startups to seasoned compliance teams
Use when installing a Spree gem (spree_stripe, spree_easypost, spree_meilisearch, spree_opentelemetry, spree_i18n, spree_adyen, spree_multi_store…) or building a reusable Spree 6 extension — a gem (Rails engine) for models, API endpoints, permissions, hooks, and providers, paired with a dashboard plugin (npm package) for admin screens. Common phrasings: "add Stripe", "install spree_X", "create a Spree extension", "build a gem for Spree", "spree-extension create", "share this across apps", "register a provider from my gem", "engine initializer", "after_initialize vs to_prepare", "extension migrations", "ship openapi.yaml in my gem", "agent tools from my extension", "npm client for my extension". For single-app customization, start with spree-customization — most work doesn't need a gem.
Use when the user is working with Spree 6 promotions and discounts — creating promotions (automatic or coupon code), bulk/multi-use coupon codes, promotion rules and actions, calculators, how competing promotions are resolved, manual discounts, writing a custom promotion rule, action or calculator, or a custom adjuster. Common phrasings include “create promotion”, “coupon code”, “discount code”, “generate 1000 codes”, “BOGO”, “free shipping promotion”, “10% off category”, “promotion not applying”, “custom promotion rule”, “custom promotion action”, “custom calculator”, “stack promotions”, “best discount wins”, “manual discount”, “goodwill discount”, “Spree::Discount”, “Taxon rule”.
Implement the Syncfusion Angular Block Editor component. Use for block-based editing with advanced formatting, custom menus, event handling, content management, security features, real-time collaboration, globalization, and extensive customization in Angular applications.
Search the web using the Brave Search API for fast, privacy-respecting results with localization, freshness filtering, and extra snippets. Use when you need web search results with country/language targeting or time-based filtering. Requires BRAVE_API_KEY. Keywords: brave, web search, localized search, privacy search, freshness filtering.
How to write JSDoc (/** */) and inline (//) comments in the Astro codebase, for contributors reading the source — not end users. Use whenever writing or editing comments in .ts/.js source, including comments added incidentally while fixing bugs or building features. Does not cover the @docs-generated config/error reference.
Generate human-like speech audio with Model Studio DashScope Qwen TTS models (qwen3-tts-flash, qwen3-tts-instruct-flash). Use when converting text to speech, producing voice lines for short drama/news videos, or documenting TTS request/response fields for DashScope.
Execute deterministic, reproducible historical backtests from a start date, end date, and strategy concept using the Alpaca CLI plus agent-written workspace code. Use when the user wants to backtest a strategy, simulate historical trades, or return trades, diagnostics, and reproducibility artifacts.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.