Skills
100,928 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Hare language skill for simple systems programming. Use when building with hare build/test/run, Hare stdlib, C FFI with @extern, tagged union error handling, or comparing Hare vs C/Zig. Activates on queries about Hare language, hare build, @extern, tagged union, or Hare stdlib.
Strip the tells of AI-generated writing from prose so it reads like a person wrote it. Use when asked to humanize text, remove AI-isms, make writing sound less like ChatGPT, edit out “AI slop,” or review a draft for robotic phrasing without rewriting it. Covers em-dash overuse, puffery, filler, and AI vocabulary words
Implement a plan, spec, or issue into working code in straight-through, tests-after, or TDD mode, then run the repo's test and build gate before declaring done. Use when the user says "implement this plan", "implement #42", "do this TDD", "build it, then add tests", "apply these review findings", or "make this failing test pass". It runs attended; the unattended issue-to-PR span is afkkit's.
Expert ISO 42001 AI Management System (AIMS) compliance advisor. Use this skill whenever a user asks about ISO/IEC 42001:2023, AI governance, AI management systems, AI risk assessment, AI system impact assessment, Annex A controls for AI, Statement of Applicability for AI systems, AI policy, responsible AI, AI lifecycle management, AI incident management, AI transparency, AI bias, AI certification readiness, or any topic related to implementing or auditing an AI Management System. Also trigger for questions like “how do I become ISO 42001 certified?”, “what controls does ISO 42001 require?”, “how do I assess AI risk under 42001?”, “what is an AIMS?”, or any request involving organisational governance of AI systems, responsible AI frameworks, or AI regulatory compliance aligned to an ISO standard
Ability to design, analyse, test, and maintain mechanical systems and components that meet defined functional, safety, and performance requirements. Includes applying engineering principles to materials, structures, thermodynamics, fluid mechanics, and motion systems; producing and interpreting technical designs and specifications; validating designs through analysis and testing; and supporting manufacture, operation, and lifecycle management. Applies across industrial, infrastructure, energy, manufacturing, and product contexts and is independent of specific tools or industries, with human accountability retained for safety, compliance, and outcomes.
Use the Nylas CLI to manage email, calendar, contacts, and Notetaker from the terminal. Use when the user asks about Nylas CLI commands, nylas init, nylas email, nylas calendar, nylas contacts, nylas auth, nylas agent, agent accounts, nylas mcp, nylas notetaker, nylas otp, nylas tui, nylas air, nylas audit, nylas doctor, or terminal-based email/calendar management. Do not use for Nylas API SDK integration.
Comprehensive OSINT methodology for external red-team operations and authorized attack-surface assessments. Covers the 5-stage recon pipeline (seed discovery, asset expansion, enrichment, exposure analysis, reporting), asset-graph discipline with 29 asset types, severity rubric (CRITICAL/HIGH/MEDIUM/LOW/INFO), confidence upgrade workflows, time budgeting, asset-level triage rules, scale-based tactics, identity-fabric mapping (Entra/Okta/ADFS/Google/SAML/M365 Teams+SharePoint+OAuth), API and auth-map methodology, JavaScript deep analysis, mobile attack surface, cloud attack surface, breach×identity correlation, detectability tagging, detection-aware probing (back-off, persona rotation), read-only validator discipline, WAF/CDN bypass + origin discovery, vulnerability prioritization (CVE/EPSS/KEV), phishing infrastructure planning + pretext development, bug bounty submission templates, client deliverable templates with risk translation, threat-actor investigation (incl. RU/CN pivots), cryptocurrency tracing, image/video forensics, chronolocation. Use when planning or executing reconnaissance against authorized targets, mapping an organization's external attack surface, investigating a person/entity, tracing crypto flows, geolocating media, or performing attribution work.
Set up Patrol end-to-end (E2E) testing in a Flutter project for the first time — configure the pubspec `patrol` block, wire native Android, and get a first minimal test passing on an Android emulator. Covers Android only (iOS and other platforms follow the same install doc). Use when adding Patrol to a project that does not have it yet.
Add official Railway database services (Postgres, Redis, MySQL, MongoDB). Use when user wants to add a database, says "add postgres", "add redis", "add database", "connect to database", or "wire up the database". For other templates (Ghost, Strapi, n8n), use the railway-templates skill.
React architecture patterns, TypeScript, Next.js, hooks, and testing. Use when working with React component structure, state management, Next.js routing, Vitest, React Testing Library, reviewing React code, or synchronizing JSON locales and reviewing translations in a React or frontend interface. For visual design and aesthetic direction, use frontend-design instead.
Configure a GitHub repo through gh in four modes: an inferred About description and topics, the workflow labels (issuekit's lifecycle and priority sets plus `ai-review`), a new-repo setup (house settings, baseline files, About, labels), and a docs/ renumbering into creation order. Use when the user says "set the repo description", "add topics", "provision the workflow labels", "set up this new repo", or "renumber the docs".
Signals scout for PostHog web traffic. Watches per-channel session volume, attribution breakage, and landing-page health (bounce and 404 steps) against the site's own baseline. Per- page web vitals belong to `signals-scout-web-vitals`.
Evaluate Agent Skill design quality against official specifications and best practices. Use when reviewing, auditing, or improving SKILL.md files and skill packages. Provides multi-dimensional scoring and actionable improvement suggestions.
Opt-in recreation of the Bun + TypeScript framework used to build Vapi's landing-page voice agents from a ROUGH_DRAFT.md spec, including a scenario registry, language stacks, prompt composer, assistant builder, and idempotent bootstrap script. Use only when the user explicitly invokes vapi-bootstrap-framework or specifically asks to reproduce or experiment with the landing-page-agent architecture. Do not use for ordinary Vapi assistant builds; use create-assistant, create-tool, create-squad, and vapi-prompt-builder instead. Targets Bun + TypeScript + @vapi-ai/server-sdk.
Routing-first skill for repo-scoped recurring workflow automation: task-entrypoint design, bootstrap/onboarding commands, local-CI parity wrappers, hook guardrails, maintenance bots, and workflow-diagnosis cleanup. Use when the user needs one repeatable repo command surface, must choose between package scripts / Make / just / Task / hooks / CI wrappers / scheduled maintenance, or wants to replace README copy-paste rituals without drifting into environment provisioning, deployment architecture, Git history policy, or observability design
Use when you need to generate a checklist document with embedded agents inventory, following the embedded template exactly and producing INVENTORY-AGENTS-JAVA.md in the project root. This should trigger for requests such as Create embedded agents inventory checklist; Generate INVENTORY-AGENTS-JAVA.md; Use @002-agents-inventory; Inventory embedded Java agent definitions; List generated agent roles for Java development. Part of Plinth Toolkit
Create any visual design using Adobe Express templates: flyers, posters, social media posts (Instagram, Facebook, LinkedIn), business cards, invitations, greeting cards, resumes, cover letters, brochures, newsletters, certificates, presentations, YouTube thumbnails, email headers, logos, menus, and labels. Use this skill whenever the user wants to make, design, or build any visual, even if they just say "make me a flyer", "design a poster", "I need something for Instagram", "create an event invite", or "make a business card". Also handles browsing templates, editing text, replacing images, changing backgrounds, animating, and exporting designs. Access: Signed-In required | Gen AI: off by default — image replacement only where the surface permits generative AI (e.g. Codex); none on Claude
Use when adding cookie-based login, logout, or user profile to an ASP.NET Core MVC, Razor Pages, or Blazor Server web app. Integrates Auth0.AspNetCore.Authentication — use even if the user says "add login to my .NET web app" without naming the package.
Carbon language skill for C++ interop and toolchain. Use when evaluating Carbon syntax, bidirectional C++ interop, building carbon-toolchain, or comparing Carbon vs C++. Activates on queries about Carbon language, Carbon.h, carbon-toolchain, checked borrows, or C++ successor.
Spawn Codex subagents via background shell to offload context-heavy work. Use for: deep research (3+ searches), codebase exploration (8+ files), multi-step workflows, exploratory tasks, long-running operations, documentation generation, or any other task where the intermediate steps will use large numbers of tokens.
Integrate App Builder Database Storage (@adobe/aio-lib-db) into an Adobe Commerce app and scaffold a runtime action that reads and writes documents. Use when the user wants persistent, queryable storage backing a Commerce app — either from a web action (HTTP-invokable) or from an event/webhook handler. Requires a base app initialized with commerce-app-init.
Use when building a bookings, ARR, pipeline or NRR forecast, or a commit, best-case and pipeline board number. Forecasts with bookings_forecaster.py, projects cohorts with cohort_arr_projector.py and scores stage confidence with funnel_confidence_scorer.py, showing every conversion assumption.
Diagnose why a PostHog endpoint is slow or expensive and propose a concrete fix — bump the cache TTL, enable materialisation, restructure variables, or rewrite the query. Use when the user says “this endpoint is slow”, “my endpoint times out”, “we're hitting the cost cap on this one”, or asks “should I materialise this?”. Focuses on a single named endpoint, not a project-wide audit.
Write, review, and edit documentation files with consistent structure, tone, and technical accuracy. Use when creating docs, reviewing markdown files, writing READMEs, updating `/docs` directories, or when the user says "write documentation", "review this doc", "improve this README", "create a guide", or "edit markdown". Do NOT use for code comments, inline JSDoc, or API reference generation.
Writing clear, discoverable software documentation following the Eight Rules and Diataxis framework. Use when creating README files, API docs, tutorials, how-to guides, or any project documentation. Automatically enforces docs/ location, linking requirements, and runnable examples.
External SSL VPN / remote-access appliance attack matrix — Cisco ASA/AnyConnect, Fortinet FortiGate/FortiOS, Citrix NetScaler/ADC, Palo Alto GlobalProtect, Pulse Secure / Ivanti Connect Secure, SonicWall, F5 Big-IP. Covers version fingerprinting, CVE matrix (2018-2026), AAA backend identification, default credentials, configuration-disclosure paths, pre-auth RCE/SSRF/path-traversal exploits where applicable. Built from authorized-engagement Cisco ASA testing plus 2024-2026 enterprise VPN CVE landscape. Use whenever the target's perimeter exposes any SSL VPN appliance or remote-access gateway — these are the most common initial-access points in 2024-2026 actor TTPs.
Fuzz React Doctor rules for crashes, slowness, false positives, and mutation-sensitive diagnostics with @react-doctor/fuzz. Use after rule tests pass, when investigating a fuzz finding, or whenever an eval, review, or user report confirms a new false positive.
Expert architectural standards for scalable Godot Apps, Tools, EditorPlugins, and Control-heavy UIs using Composition (Has-A Orchestrator + components). Use when building dashboards, tool windows, forms, settings panels, or EditorPlugin UIs. Do NOT use for gameplay entities (Player/Enemy/Weapon/Hitbox) — route those to godot-composition. Trigger keywords: Control, EditorPlugin, tool UI, Orchestrator, VLS, rock test, AuthComponent, ThemeManager, Saveable component, dependency injection.
Weekly engineering retrospective. Analyzes commit history, work patterns, and code quality metrics with persistent history and trend tracking. Team-aware with per-person contributions, praise, and growth areas. Use when asked for weekly retro, what shipped this week, or engineering retrospective.
Set up or update the agent-first engineering harness for any repository. Implements the complete scaffolding that makes AI coding agents effective: knowledge maps (AGENTS.md as a concise TOC), structured documentation, architecture boundaries, enforcement rules (.harness/*.yml specs), quality scoring, and process patterns for agent-driven development. Use this skill whenever someone wants to make a repo agent-ready, set up AGENTS.md or docs/ structure, define domain boundaries or golden principles, generate .harness/ configuration, audit agent readiness, or update an existing harness. Also trigger when a user reports problems with agent effectiveness, context management, or architectural drift — these are symptoms of a missing or stale harness. Trigger on: "harness this repo", "set up harness", "agent-first setup", "make this agent-ready", "update the harness", "assess agent readiness", "set up AGENTS.md", "organize for agents", or any discussion about structuring a codebase for AI agent workflows.
Add PostHog AI Observability to trace AI model usage. Use after implementing LLM features or reviewing PRs to ensure all generations are captured with token counts, latency, and costs. Also handles initial PostHog SDK setup if not yet installed.
AI job hunter. Uses the user's résumé to automatically search major job platforms for matching roles and returns a list of openings with match assessments. Supports platforms including LinkedIn, Indeed, Boss 直聘, 拉勾, and 猎聘. Trigger when the user mentions keywords such as: job search, job hunt, finding a job or role, job recommendations, suitable openings, job listings, companies hiring, opportunities, applying for jobs, or searching for work. Also trigger when the user transitions from another Skill and says they want to find or apply for a job.
MariaDB-specific features and capabilities that go beyond standard MySQL. Use when evaluating MariaDB, optimizing an existing MariaDB application, reviewing code or schema for MariaDB improvements, asking what MariaDB can do that other databases cannot, or migrating from Oracle to MariaDB. Also use when the user asks what could be improved in how a codebase uses MariaDB, or asks about MariaDB advantages over MySQL or PostgreSQL
Use when deploying a Meteor 3 application. Triggers on meteor build, meteor deploy, Galaxy Push to Deploy, Galaxy Mode, Repository Mode, DEPLOY_HOSTNAME, Docker, Kubernetes, settings.json, METEOR_SETTINGS, MONGO_URL, MONGO_OPLOG_URL, ROOT_URL, PORT, HTTP_FORWARDED_COUNT, NODE_OPTIONS, health checks, pre-deploy commands, hot code push, --architecture os.linux.x86_64, --server-only, or a deployed Node.js version mismatch. Use this skill when the user asks about shipping the app, asks about production config, or asks about containerizing. For Cordova Android/iOS artifacts, signing, and native HCP compatibility use meteor-native; this skill owns the backend deployment.
Design and deploy multi-canister dapps. Covers inter-canister calls, canister factory pattern, async messaging pitfalls, bounded vs unbounded wait, and 2MB payload limits. Use when splitting an app across canisters, making inter-canister or cross-canister calls, or designing canister-to-canister communication. Do NOT use for single-canister apps.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.