Skills
100,928 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Use this skill when the user requests to generate, create, compose, or produce music or songs — background music, theme songs, jingles, or instrumental tracks. Generates a song from a style/mood prompt and optional lyrics via the MiniMax music API.
Create maintainer-friendly pull requests with clean code and professional communication. Prevents 16 common mistakes that cause PR rejection. Use when contributing to open source, submitting PRs, or troubleshooting PR rejection, CI failures, or personal artifacts in commits
Open-source AI observability platform for LLM tracing, evaluation, and monitoring. Use when debugging LLM applications with detailed traces, running evaluations on datasets, or monitoring production AI systems with real-time insights.
Turn a rough feature or change into a structured plan document (docs/plans/NNNN-plan-<slug>-YYYY-MM-DD.md) before any code: brainstorm the approach, settle the big decisions, and write a plan that can be hardened and turned into issues. Use when the user says "plan this feature" or "brainstorm a plan/PRD/spec", the front of the plan → grill → file workflow
Spec-driven feature work with traceable acceptance criteria, design, tasks, and user acceptance testing. Use when planning, designing, implementing, or validating a feature, or turning an existing input into a spec. Not for unknown-bug diagnosis, standalone product or technical documents, PR or commit mechanics, or backlog tracking
Implement approved specification proposals in sequence using a test- and verification-first approach. Use when implementing changes, applying proposals, executing specification tasks, or building according to an approved plan. Trigger phrases include "speckit-implement", "speckit开发", "开发", "实施" "实现提案", "应用变更", "执行规范", "按顺序完成任务", "构建功能", "开始实施"
Criar, revisar e depurar imagens Docker e ambientes Compose com builds reproduzíveis, segurança, saúde, configuração e eficiência. Use para Dockerfile, BuildKit, Compose, registries, containers ou imagens de uma aplicação; use `specsfy-specialist-docker-swarm` para orquestração multi-nó, deploy declarativo e rollout de serviços em produção.
Fast Python framework for building interactive web apps, dashboards, and data visualizations without HTML/CSS/JavaScript. Use when the user wants to create data apps, ML demos, dashboards, data exploration tools, or interactive visualizations. Transforms Python scripts into web apps in minutes with automatic UI updates.
Use when facing complex reasoning tasks — multi-step math, logic puzzles, decisions with tradeoffs, problems where direct answers fail, or when you need to show your work. Triggers on arithmetic errors, shallow analysis, or "I'm not sure" hedging.
React composition patterns that scale. Use when refactoring components with boolean prop proliferation, building flexible component libraries, or designing reusable APIs. Triggers on tasks involving compound components, render props, context providers, or component architecture. Includes React 19 API changes.
React and Next.js performance optimization guidelines from Vercel Engineering. This skill should be used when writing, reviewing, or refactoring React/Next.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements.
Report coding-agent progress, questions, decisions, blockers, tests, PRs, human replies, inbox instructions, and handoffs to the Agora coordination server. Use for every coding task when AGORA_URL is set, especially at session start, before risky or shared edits, when blocked, when asking for human or agent input, after running tests or verification, when opening or updating PRs, when polling for human replies or instructions, and before the final response.
Investigates what is happening in an AWS account from evidence already recorded there. Not for capturing new data from running code (snapshots of function arguments on a live service, Dynamic Instrumentation), questions answered from the CloudWatch Omni context graph or Application Signals service map, or building or changing infrastructure. Covers reading deployment records instead of the newest stored version (completed AppConfig deployments, the version an alias points to, a stack's current template), following a request through every service's own logs (exact per-layer fields, unique failed requests in an alarm's breach window, failure boundary per event), and answering questions from the account's data (exact counts and breakdowns, coverage of the requested range, exact filters and joins, the rule behind failed or unmatched records, verbatim values). Use to triage an alarm, error spike or failed request, trace a request across services, or count, break down, extract or join records.
Syntax reference for Backlog notation (Backlog記法), one of the two per-project text formatting rules on Nulab Backlog — the other, and the default for new projects, is Markdown. Use when posting or editing formatted text on Backlog — issue descriptions (課題の説明), comments (コメント), wiki pages, pull requests — via the bee CLI or Backlog API; when converting Markdown to Backlog notation (Markdown から Backlog記法への変換); when asked how to write headings, bold, tables (表), checklists, colored text, links, or code blocks in Backlog記法; or when the project's rule is unknown (this skill shows how to check textFormattingRule first — text posted in the wrong rule renders as literal characters). Do not use for projects confirmed to use Markdown, for Markdown files outside Backlog, or for Backlog operations with no text to format (status changes, assignees, listing data).
Debug Bright Data Scraping Browser sessions using the Browser Sessions API. Use this skill when the user encounters a Bright Data browser session error, puppeteer stack trace, failed scraper run, or asks about session bandwidth, duration, captchas, or connection issues. Also use when a Bright Data scraper produces unexpected results such as empty data, 0 items found, missing products, or fewer results than expected — session data can reveal whether the issue is network/proxy-side (blocks, captchas, redirects, timeouts) or client-side (selectors, extraction logic). Triggers on phrases like 'why did my session fail', 'debug my bright data session', 'check my scraping browser sessions', 'how much bandwidth did my scraper use', 'got 0 results', 'found 0', 'scraper returned empty', 'scraper not working', 'script didn't work', or when a Bright Data error code or brd.superproxy.io stack trace appears in the conversation. Requires BRIGHTDATA_API_KEY environment variable
Migrate prompts and code from Claude Sonnet 4.0, Sonnet 4.5, or Opus 4.1 to Opus 4.5. Use when the user wants to update their codebase, prompts, or API calls to use Opus 4.5. Handles model string updates and prompt adjustments for known Opus 4.5 behavioral differences. Does NOT migrate Haiku 4.5.
When the user wants to create competitor comparison or alternative pages for SEO and sales enablement. Also use when the user mentions 'alternative page,' 'vs page,' 'competitor comparison,' 'comparison page,' '[Product] vs [Product],' '[Product] alternative,' or 'competitive landing pages.' Covers four formats: singular alternative, plural alternatives, you vs competitor, and competitor vs competitor. Emphasizes deep research, modular content architecture, and varied section types beyond feature tables.
Conducts structured requirements workshops to produce feature specifications, user stories, EARS-format functional requirements, acceptance criteria, and implementation checklists. Use when defining new features, gathering requirements, or writing specifications. Invoke for feature definition, requirements gathering, user stories, EARS format specs, PRDs, acceptance criteria, or requirement matrices.
Find 10x product opportunities and high-leverage improvements. Use when user wants strategic product thinking, mentions '10x', wants to find high-impact features, or says 'what would make this 10x better', 'product strategy', or 'what should we build next'.
Condenses the current conversation into a handoff document that another agent or session can pick up without prior context: goal, status, next steps, key artifacts by reference, and constraints. Use when deliberately running “/handoffkit” (optionally with a focus argument) to hand off work, write a handoff document, or summarize the session for the next agent.
Hunt ASP.NET-specific attack surfaces: ViewState deserialization (signed-only vs. encrypted), machineKey recovery, dual-parser MAC-bypass anti-patterns, request-validator bypass, trace.axd/elmah.axd disclosure, load-balanced ViewState cross-node failures, SafeControl enumeration via reflection, customErrors mode=Off stack-trace leaks, and the classic Webforms .aspx/.asmx/.svc surface. Built for ASP.NET Webforms, WCF, and SharePoint farms.
Launch Code OSS (VS Code from sources) into an isolated throwaway profile with unique debug ports so you can drive it with @playwright/cli AND attach a Node debugger via dap-cli in the same session. Use when working on VS Code itself and you want to interact with the running workbench, automate chat or UI flows, test UI features, take screenshots, set breakpoints in the renderer / extension host / main process, or combine UI driving with debugging.
Generate LinkedIn posts from meeting transcripts, Slack dumps, and other source material in the user's personal writing style. Use when generating LinkedIn posts, creating social content from internal material, ghostwriting LinkedIn content, or when the user mentions LinkedIn, social posts, or content generation from transcripts or notes. Supports personal style profiles stored locally per user. Can automatically pull source material from Fireflies.ai, Slack channels, and Google Drive.
Microsoft 365 / Entra ID red-team attack chain — current 2026 reality. Includes AADSTS code reference, user enumeration vectors (with hardening status), Smart Lockout math, Conditional Access bypass options, ROPC + SAML SSO browser flow, and Burp/Playwright templates. Built from authorized red-team work where ROPC spray surfaced pre-existing lockouts and CA-blocked credentials, plus real-time external attacker activity correlation. Use for any M365/Entra credential attack, password spray, user enumeration, CA-bypass exploration, or active-attacker-detection scenario.
Configures monitoring systems, implements structured logging pipelines, creates Prometheus/Grafana dashboards, defines alerting rules and instruments distributed tracing. Implements Prometheus/Grafana stacks, conducts load testing, performs application profiling and plans infrastructure capacity. Use when setting up application monitoring, adding observability to services, debugging production issues with logs/metrics/traces, running load tests with k6 or Artillery, profiling CPU/memory bottlenecks or forecasting capacity needs.
Expert NIST Cybersecurity Framework (CSF) advisor covering CSF 2.0 and CSF 1.1. Use this skill whenever a user asks about NIST CSF, cybersecurity risk management, the six CSF functions (Govern, Identify, Protect, Detect, Respond, Recover), CSF profiles, implementation tiers, gap assessments, organizational profiles, community profiles, CSF core subcategories, informative references, or mapping to other frameworks (NIST SP 800-53, ISO 27001, CIS Controls, COBIT). Also trigger for questions like "how do I implement NIST CSF?", "what does CSF 2.0 change?", "help me build a CSF profile", "how do I assess my cybersecurity posture?", or any request involving organizational cybersecurity risk strategy or framework alignment.
Build and publish npx-executable CLI tools using Bun as the primary toolchain with npm-compatible output. Use when the user wants to create a new CLI tool, set up a command-line package for npx execution, configure argument parsing and terminal output, or publish a CLI to npm. Covers scaffolding, citty argument parsing, subcommands, terminal UX, strict TypeScript, Biome + ESLint linting, Vitest testing, Bunup bundling, and publishing workflows. Keywords: npx, cli, command-line, binary, bin, tool, bun, citty, commander, terminal, publish, typescript, biome, vitest.
Visual self-review loop for motion graphics — render a draft, build contact sheets at every timeline beat, look at them, critique against a checklist, fix, repeat. Use after any change to a video's visuals or timing, and before calling a video done
Review plans and code changes. Walks Architecture → Code Quality → Tests → Performance, numbering issues with tradeoff options. Triggers: "review", "review this", "code review", "look over this", "check my changes", "audit", "critique", "what do you think", "sanity check".
Reviews code implemented by AI agents in four ordered passes (convention fit, agent-slop signatures, requirement completeness, correctness) against the working tree or branch diff. Findings are ranked by severity and supported by quoted evidence. Use when the user says “review this code,” “review my changes,” or “check the agent's work” before a commit or PR.
Performs non-destructive cross-artifact consistency and quality analysis of the three core documents: spec.md, plan.md, and tasks.md. Identifies inconsistencies, duplication, ambiguity, and underspecified items after task generation. Trigger phrases include: "speckit-analyze", "speckit analysis", "document consistency analysis", "specification analysis", "quality check", "artifact analysis", "spec analysis", "plan analysis", and "task analysis".
Design and review visual interfaces for systems, dashboards, and applications, including hierarchy, layout, tokens, components, density, states, and responsiveness. Use for screens, dashboards, design systems, layouts, tables, forms, and navigation; combine with UX and accessibility when flows or interactions are involved.
This skill should be used when the user asks to "test for SQL injection vulnerabilities", "perform SQLi attacks", "bypass authentication using SQL injection", "extract database information through injection", "detect SQL injection flaws", or "exploit database query vulnerabilities". It provides comprehensive techniques for identifying, exploiting, and understanding SQL injection attack vectors across different database systems
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.