Skills
100,928 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Expert in AppleScript and JavaScript for Automation (JXA) for macOS system scripting. Specializes in secure script execution, application automation, and system integration. HIGH-RISK skill due to shell command execution and system-wide control capabilities.
Audit every endpoint in a PostHog project for staleness, failed materialisations, and unused materialised versions. Use when the user asks "what endpoints can I clean up?", "are any of my endpoints broken?", "which materialised versions are still being called?", or wants a one-shot cleanup pass over the Endpoints product. Produces a prioritised report grouped by issue type, with recommended actions but does not modify anything without explicit confirmation.
This skill should be used when the user needs to "estimate QPS", "back-of-the-envelope" (BOTEC) numbers, "how much storage / bandwidth", "how many servers", "peak load", "capacity planning", or wants the standard latency / throughput / availability numbers to ground a design (latency table, QPS rates, powers of two, nines). Use it whenever a design decision hinges on scale — convert any "high traffic" / "huge data" phrase into concrete numbers before choosing components, even if the user doesn't say "estimate".
A skill based on ByteHouse MCP Server for generating data asset catalogs and lineage analyses. Use it to retrieve database table schemas, generate data asset catalogs, and analyze lineage between tables. Use this Skill when users need these capabilities for a ByteHouse database.
Master the essential copywriting frameworks used by top marketers. AIDA, PAS, PASTOR, BAB, FAB, and 4Ps—the building blocks of persuasive copy. Use when: Writing sales copy and need a proven structure; Structuring landing pages, emails, or ads; Overcoming writer's block by following a formula; Teaching copywriting fundamentals to your team; Reviewing copy to identify structural weaknesses
Create a recurring AI-generated PostHog report — schedule a free-text prompt to run on a cron, with the LLM-synthesized markdown delivered to email, Slack, or Microsoft Teams on each tick. Use when the user wants a recurring AI summary of X on any cadence (daily, weekly, monthly, yearly) rather than a one-off report. (To attach an AI summary to an existing insight/dashboard subscription instead of a free-text prompt, see `managing-subscriptions` and its `summary_enabled` option.)
Deploy and manage applications on Dokploy (self-hosted PaaS). Use when deploying apps, managing Docker Compose services, databases (PostgreSQL, MySQL, MariaDB, MongoDB, Redis), configuring domains, SSL, backups, notifications, rollbacks, scheduled tasks, environments, organizations, SSO, preview deployments, patches, Docker Swarm clusters, running migrations, or troubleshooting Dokploy deployments. Covers the tRPC API (~540 endpoints), CLI, MCP server (~540 tools), and common pitfalls with Next.js, Docker, and Traefik
Build Google Chat bots and webhooks with Cards v2, interactive forms, and Cloudflare Workers. Covers Spaces/Members/Reactions APIs, bearer token verification, and dialog patterns. Use when: creating Chat bots, workflow automation, interactive forms. Troubleshoot: bearer token 401, rate limit 429, card schema validation, webhook failures.
Skill-set loader for /hunt orchestrator. Fingerprints the target, picks the right platform attack skills, and loads the Red Team or WAPT skill set. Use when /hunt has just received a mode answer (redteam or wapt + blackbox|greybox) and needs to load the appropriate skills and print the taxonomy. Not for direct user invocation.
Run the Anti-Autoresearch integrity-forensics sweep (span-anchored evidence ledger → GPT auditors propose findings → a rules-only reporter that lists every proposal with what the auditor said about it) against a paper via a SHA-pinned thin launcher — then convert the verdict into a typed policy gate (BLOCK/WARN/NO_NEW_BLOCKER) and an append-only obligations ledger. Use when user says \"integrity forensics\", \"forensic audit this paper\", \"投稿前自查诚信\", \"审这篇论文的诚信\", or says \"anti-autoresearch\" when the upstream repo's own skills are not installed. Also invoked by /paper-writing (submission self-forensics, default ON), /peer-review (forensic appendix), /resubmit-pipeline.
Analyze recent code changes via git history and extract software engineering lessons. Use when the user asks 'what is the lesson here?', 'what can I learn from this?', 'engineering takeaway', 'what did I just learn?', 'reflect on this code', or wants to extract principles from recent work.
Crawl and validate all internal and external links across an AEM Edge Delivery Services site. Uses the query index or sitemap to discover pages, extracts links from .plain.html renditions, checks HTTP status codes, and produces a prioritized report of broken, redirecting, and insecure links. Use when auditing link health before launch, after a migration, or as a periodic maintenance check.
Meme coin and token security audit — rug pull detection (honeypot, hidden mint, fee manipulation, LP lock bypass), Solana SPL token analysis (freeze authority, mint authority, metadata mutability), Token-2022 extension risks (transfer hooks, permanent delegate), DEX liquidity pool attacks (sandwich amplification, LP drain, bonding curve exploits), pump.fun/Raydium/Jupiter integration risks, and real exploit examples from 2024-2025. Use for any token audit, rug pull assessment, meme coin security review, or pre-investment due diligence
Use when migrating a MAX model from the V2 graph API (max.nn.legacy, TensorValue, explicit Graph construction) to ModuleV3 (max.nn, Tensor, F.lazy() + compile()). Triggers on: "migrate to ModuleV3", "port a max.nn.legacy model to max.experimental", "convert TensorValue to Tensor", "update my model to the V3 API", "ModuleV3 migration". Workflow: read the concept map, rewrite imports and __call__ signatures, and replace graph building with compile(weights=...). Align weight names with the new module hierarchy and move the KV cache unflatten into forward(). Port sharding to a DeviceMesh when the V2 model is sharded, then verify greedy outputs match the V2 implementation.
Authoritative reference and rules for developing for Obsidian — building TypeScript plugins (Plugin lifecycle, manifest.json, commands, settings, modals, views, ribbon/status bar), the Vault and Editor APIs, the event system, Markdown post-processing and code-block processors, CodeMirror 6 editor extensions, building CSS themes (CSS variables, theme.css/manifest), and submitting plugins/themes to the community directory. Use whenever the user asks to build, debug, or review an Obsidian plugin or theme, work with the Obsidian API (Vault/Editor/Workspace/Plugin), register commands/views/events, process Markdown, or release/submit to the Obsidian community
Creates, edits, and manages Obsidian vault content, including notes, templates, daily notes, and dataview queries. Use when working with Markdown files in an Obsidian vault, creating notes, writing templates, building dataview queries, or organizing knowledge management content.
Build a retrieval-optimized knowledge layer over agent documentation in dotfiles (.claude, .codex, .cursor, .aider). Use when asked to "optimize docs", "improve agent knowledge", "make docs more efficient", or when documentation has accumulated and retrieval feels inefficient. Generates a manifest mapping task-contexts to knowledge chunks, optimizes information density, and creates compiled artifacts for efficient agent consumption.
Use this skill when the user asks to “plan a penetration test,” “create a security assessment checklist,” “prepare for penetration testing,” “define pentest scope,” “follow security testing best practices,” or needs a structured methodology for penetration testing engagements.
Draft and open a GitHub pull request from your branch, with title, summary, and test plan written from the actual commits and diff, then created with the gh CLI, embedding verifykit proof artifacts inline when a bundle is present. Use when the user asks to open a PR, says "create a pull request", "raise a PR", "submit this for review", or "gh pr create", even if they don't spell out the title or body.
Pulumi infrastructure as code performance and reliability guidelines. This skill should be used when writing, reviewing, or refactoring Pulumi code to ensure optimal deployment performance and infrastructure reliability. Triggers on tasks involving Pulumi stacks, components, state management, secrets configuration, resource lifecycle options, or CI/CD automation.
Full Sentry SDK setup for Go. Use when asked to "add Sentry to Go", "install sentry-go", "setup Sentry in Go", or configure error monitoring, tracing, logging, metrics, or crons for Go applications. Supports net/http, Gin, Echo, Fiber, FastHTTP, Iris, and Negroni.
Grant a user the runtime permissions an activated ITSM agent's actions need so the actions do not fail on permission errors. After a Fulfiller or Employee agent is activated, this skill detects which platform feature permission sets are provisioned (Prompt Templates, Data Cloud, Unified Catalog), lets you pick a tier (user/agent vs admin) per feature and which user(s) to assign, then assigns them (license first when license-gated). It also creates a custom "Agent Access" permission set granting the activated agents you choose and assigns it to the user — all via the Salesforce CLI. Use to grant a user access to an activated agent, to assign prompt-template, data-cloud, or unified-catalog access, or to create an Agent Access permission set. DO NOT TRIGGER for enabling Agentforce for IT Service toggles, creating or activating an agent, the Fulfiller activation action-surfacing gap (service-itsm-agentic-setup-itsm-agentforce-permset-assign), CMDB access, or generic permission-set assignment.
Create a concise continuation prompt that a fresh agent session can paste in to resume a long or degraded session. Use when the user asks for a handoff prompt, restart prompt, continuation prompt, context transfer, fresh-session resume, or a compact summary for opening a new session. Do not use for ordinary summaries, task-forest maintenance, durable user-profile updates, automatic session creation, code execution, or external publishing.
Follow-up Signals scout for the inbox itself. Attaches a check to each newly resolved report, spot-checks a couple of settled fixes with fresh probes, answers the checks it is dispatched for, and reports when a fix didn't hold, plus a gated escalation check on dismissed reports.
Open a Remotion project in Remocn Studio, the desktop app for visually tuning a video and exporting mp4. Use when the user wants to open, continue, or export a video in Remocn Studio, or right after a video is built and they accept the offer to open it there. Also prepares a project for Studio to open
Use Syncfusion EJ2 Angular Barcode/QR components to generate and customize barcodes in Angular. Trigger for Code39/Code128, EAN/UPC, QR Code, Data Matrix, label printing, inventory/product tags, colors/sizing/text, logo overlays, rendering, and export (PNG/SVG/PDF).
Create an AI talking head from the user's own photos plus a voice sample, or from a self-recorded video by extracting face frames and speech. Use an authorized cloned or existing ElevenLabs voice and a new script to generate speaking shots with fal MiniMax H3, narration and editable motion graphics, then render an MP4. Use for AI avatars, presenter videos, personal explainers and scripted on-camera clips. For a recording that only needs graphics without generating new speech, use a recording-editing workflow instead.
Audits UIKit screens on iOS and iPadOS for VoiceOver, Dynamic Type, Voice Control, Switch Control, and semantic structure issues. Use when reviewing or fixing UIKit accessibility — returns P0/P1/P2 findings with patch-ready fixes and manual verification steps.
Integrate Redis-compatible Vercel KV for caching, session management, and rate limiting in Next.js. Powered by Upstash with strong consistency and TTL support. Use when implementing cache strategies, rate limiters, or troubleshooting environment variables, serialization errors, rate limit issues, scanIterator hangs, or Next.js cache stale reads.
Use when building, extending, or debugging WordPress REST API endpoints/routes: register_rest_route, WP_REST_Controller/controller classes, schema/argument validation, permission_callback/authentication, response shaping, register_rest_field/register_meta, or exposing CPTs/taxonomies via show_in_rest.
Fetch and export public X (Twitter) data with a self-contained Python CLI (twikit; no API keys, uses the user's own login cookies): profiles, a user's tweets/replies/likes, threads, search, followers, timelines, JSON/JSONL/CSV/SQLite output, resumable pagination. Use to scrape, archive, monitor, or analyze tweets or accounts.
XSS attack prevention with input sanitization, output encoding, and Content Security Policy. Use for user-generated content, rich text editors, web application security, or when encountering stored XSS, reflected XSS, DOM manipulation, or script injection errors.
Use when you need programmatic JDBC in Micronaut — pooled DataSource, parameterized SQL, io.micronaut.transaction.annotation.Transactional, batching, and domain exception translation. This should trigger for requests such as Review JDBC or SQL data access in a Micronaut project; Improve transactions and parameter binding for Micronaut JDBC; Translate SQLException to domain exceptions or stream large result sets; Fix self-invocation bypassing @Transactional in Micronaut; Review Hikari or pooled datasource usage in Micronaut JDBC. Part of Plinth Toolkit
Use when you need framework-agnostic WireMock guidance—stub design, JSON or programmatic mappings, precise request matching, response bodies and faults, classpath fixtures, isolation and reset between tests, call verification, dynamic ports and base URLs, and avoiding flaky stubs—without choosing Spring Boot, Quarkus, or Micronaut. This should trigger for requests such as designing or reviewing WireMock stubs (JSON mappings or Java DSL); improving request matching, isolation, or reset strategy for HTTP mocks; adding or fixing verification of outbound HTTP calls to a WireMock server; or debugging flaky tests involving WireMock or unmatched request journals. Part of Plinth Toolkit
Automate browsers using the agent-browser CLI. Use for tasks that require browser control, such as checking in, filling out forms, taking screenshots, and extracting information. Triggers: (1) the user requests browser automation; (2) checking in, filling out forms, or clicking buttons is needed; (3) web content must be retrieved as research material.
Automates browser interactions for web testing, form filling, screenshots, and data extraction. Use when the user needs to navigate websites, interact with web pages, fill forms, take screenshots, test web applications, or extract information from web pages.
Expert knowledge for Azure Security development, including best practices, decision making, security, configuration, integrations, coding patterns, and deployment. Use when configuring Azure antimalware, container SBOM/signing, CMK encryption, AKS/VM hardening, or Key Vault keys, and other Azure Security-related development tasks. Not for Azure Defender For Cloud (use azure-defender-for-cloud), Azure Information Protection (use azure-information-protection), Azure DDoS Protection (use azure-ddos-protection), or Azure Web Application Firewall (use azure-web-application-firewall).
Review UI code or a running page against the ChaiUI rules (the chaicode.com look) and report what breaks them, with file and line. Use when the user asks to review, audit, check or polish UI built with ChaiUI or @chaiui components, asks "does this follow the chaicode style", or before shipping a page in a ChaiCode product. Pairs with the chaiui skill, which is for building.
Turn a release into a short changelog video with remocn: collect changes from git tags, commits, or merged pull requests, write them as a few human-readable lines, and build the video with the changelog archetype. Use when the user wants a release, version, or “what’s new” video for a repository
Commit this session's changes with Conventional Commits messages derived from the actual diff, then push them to origin. Use when the user asks to commit changes, says "commit this", runs "/commitkit", runs "/commitkit all" to commit every change in the tree, or wants a well-formed commit message written for staged work, even if they don't spell out the format. Also use when the user says "commit these, we'll review later" or "I reviewed the X plan", to stamp a doc for review or mark it reviewed
AI-powered document, image, and flowchart generation. Use this skill when generating images with fal.ai, creating flowcharts/diagrams, generating Google Docs, creating client proposals, converting markdown to PDF, or summarizing content. Triggers on image generation, diagram creation, document generation, or content formatting requests.
Create a PostHog endpoint with the right shape on the first try — covers query kind choice, name conventions, what to expose as variables (HogQL code_name vs insight breakdown), data_freshness_seconds, and whether to materialise on day one. Use when the user says "create an endpoint", "expose this query as an API", "turn this insight into an endpoint", or asks for help structuring a new endpoint. Steers away from common mistakes: materialising a query with cohort breakdowns or an ineligible compare query, inline-only variables on a materialised endpoint, unbounded date ranges, ambiguous names.
Diagnoses CI and pull-request pipeline health for a GitHub repo using the engineering analytics MCP tools—pull-requests (PR list with CI status), workflow-health (per-workflow CI trends), and pr-lifecycle (a single PR's timeline). Use when asked whether CI is getting faster or slower, which GitHub Actions workflow is the slow or flaky long pole, how long PRs take from open to merge, how an author's merge time compares to the cohort, which open PRs have failing or pending CI, or where a specific pull request is stuck. Triggers on “engineering analytics,” “is CI getting slower,” “slow workflow,” “flaky CI,” “time to merge,” “cycle time,” “PR throughput,” “failing checks,” “where is PR <n> stuck,” “CI long pole,” “what's holding up this PR.” For a verdict on one specific CI failure (whose fault, which commit) use investigating-ci-failures; to save these numbers as insights use turning-engineering-analytics-into-insights.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.