Skills
101,174 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Audit a website or web codebase for SEO and AI-search (GEO/AEO) — produces two independent 0-100 scores (Search SEO + AI Visibility) plus a prioritized, evidence-backed report persisted on disk. Read-only; never writes to the project. Use when the user asks to audit, analyze, check, or score a site's SEO, structured data/schema, meta tags, Core Web Vitals, robots.txt, sitemaps, or AI discovery files, or how it ranks in Google and is cited by AI engines (ChatGPT, Perplexity, Google AI Overviews, Gemini, Claude).
Use when writing any client-facing content, marketing copy, or communications. Use when AI output sounds generic, corporate, or lacks personality. Triggers on "sounds like AI", "lacks voice", "too generic", or when content could apply to any competitor.
Creates a complete Instagram carousel, from cover to last slide, ready to post as 1080x1350 PNGs. Use when someone asks for a carousel, a multi-slide post, saveable content, turning an idea, text, lesson or theme into a carousel, or improving the cover and copy of an existing carousel. Runs a short interview, picks the format, writes the copy slide by slide, and exports the images with Playwright.
Use when writing, reviewing, or refactoring TypeScript or React code with a focus on craftsmanship—naming, function and component shape, error handling, data modeling, tests, and abstraction. Translates Robert C. Martin's Clean Code principles into modern TS+React idioms (TS 5.x, React 19), with first-class “When NOT to apply” guidance and a Meta category for principle conflicts (DRY vs. SRP, small functions vs. deep modules, type safety vs. ergonomics). Triggers on code review, refactoring for clarity, naming, function/component design, “is this clean?”, “make this more readable,” “right abstraction?”—even when the user doesn't say “clean code.” Does NOT cover React-specific APIs (RSC, hooks API surface)—use the `react` skill. Does NOT cover TS compiler performance or tsconfig—use the `typescript` skill.
Build durable competitive advantage using Hamilton Helmer's "7 Powers" framework—the complete, mutually exclusive enumeration of all possible sources of sustainable business moats. Use when: **Evaluate your competitive position** and identify if you have true Power; **Choose strategic direction** for building durable advantage; **Analyze competitors** to understand their moats and vulnerabilities; **Advise on M&A** whether an acquisition target has defensible value; **Assess startup investmen...
Run a Karpathy-style LLM council (3-stage multi-agent evaluation) on top of the existing orca orchestration: N seats independently answer a question, the answers are BLIND peer-ranked (identities stripped so a model can't favour its own), and a chairman synthesizes the final answer. The orchestration makes the model calls; harness/scripts/council.py does the deterministic protocol math (anonymization, mean-rank aggregation, dissent, anchor guard, transcript). Use when the user says "run a council", "llm-council", "panel of models", "blind peer-rank these answers", "ensemble + chairman", or invokes /council. Stage-4 is a MANDATORY HTML report, rendered inside council.py itself (offline, no CDN, no external skill): every `rank` writes a NEW versioned self-contained report (llmwiki/html/council/council-report-NNN-seed<seed>.html) — opinion cards (persona name + lens), a blind-vote table, and a dashboard. Isolated in try/except so a render bug never kills the core transcript.
A consumer-oriented dating and matchmaking dashboard: left-side navigation, community-signal ticker, headline KPIs, a 30-day mutual-matches bar chart, and a match-rate trend block. Editorial typography with restrained accents. Use when the brief asks for a “dating site,” “matchmaking,” “community dashboard,” “social network dashboard,” or any consumer product where the data tells the story.
Remove the AI feel from a finished interface: take screenshots, check each item against a checklist, simplify, and record user corrections in DESIGN.md. Use when an interface feels AI-generated or looks obviously made by AI, before signing off on frontend changes.
Integrate the Didit AML Screening standalone API to screen people or companies against sanctions, PEP, warning and adverse-media watchlists. Use when the user wants to run AML or KYC/AML compliance checks, screen against OFAC/UN/EU sanctions lists, check PEP status, search adverse media, tune match and risk scoring, review AML hits (Confirmed Match, False Positive, Inconclusive), or turn on ongoing AML monitoring using Didit. Covers POST /v3/aml/ (1,300+ watchlists, fuzzy name matching, configurable weights and thresholds, idempotent retries) and the AML hit review endpoints.
Generate AI sound effects from text descriptions with ElevenLabs via inference.sh CLI. Capabilities: text-to-sound-effect, custom duration, royalty-free audio. Use for: video production, game audio, podcasts, films, presentations, social media. Triggers: sound effects, sfx, sound generation, ai sound effects, generate sound, foley, audio effects, sound design, text to sound, elevenlabs sound, eleven labs sfx, ambient sound, cinematic sound, game sound effects
Front-door on-demand cho phát triển framework HOẶC distill/author một skill — SELF-CONTAINED, chạy được ở BẤT KỲ project nào (không phụ thuộc file repo-local). Gọi khi đang sửa chính framework, hoặc đang viết/chưng cất một skill trong phiên của dự án khác. KHÔNG dùng cho dev tính năng dự án thường (đó là phần lớn phiên — ADR-004).
Go error handling patterns, wrapping, sentinel errors, custom error types, and the errors package. Grounded in Effective Go, Go Code Review Comments, and production-proven idioms. Use when implementing error handling, designing error types, debugging error chains, or reviewing error handling patterns. Trigger examples: "handle errors", "error wrapping", "custom error type", "sentinel errors", "errors.Is", "errors.As". Not for: panic/recover in middleware (go-api-design), test assertions (go-test-quality).
Google Ads account audit and business context setup. Use for account-health audits and business-context setup. Trigger on "audit my ads", "ads audit", "set up my ads", "onboard", "account overview", "how's my account", "ads health check", "what should I fix in my ads", or when the user is new to NotFair and hasn't run an audit before
Create rich HTML documents for project specs, implementation plans, design exploration, RFCs, and proposals. Use whenever the user asks for a spec, plan, RFC, design doc, or proposal, or wants to explore approaches, options, or alternatives—even when they don’t explicitly say “HTML.” Strongly prefer HTML over markdown for any planning artifact longer than a screen, especially when it will be shared with reviewers or fed back to the agent for implementation.
Automate batch creation and management of Huawei Cloud CES alarm rules for ECS instances using hcloud CLI v7.2.2+. Use this skill to: (1) batch create alarms with templates (web/database), (2) update SMN notifications, (3) query ECS metrics and alarm lists
Use this skill when users want to run any workload on Hugging Face Jobs infrastructure. Covers UV scripts, Docker-based jobs, hardware selection, cost estimation, token authentication, secrets management, timeout configuration, and result persistence. Designed for general-purpose compute workloads, including data processing, inference, experiments, batch jobs, and any Python-based tasks. Invoke for tasks involving cloud compute, GPU workloads, or when users mention running jobs on Hugging Face infrastructure without local setup.
Hunt mishandling of exceptional conditions — feed an endpoint malformed/unexpected input (wrong type, broken JSON, oversized field, null byte) and make it fail OPEN or leak internals: a verbose stack-trace / framework error page that discloses ORM internals, server file paths, library versions, or a language traceback. Use on any input-accepting endpoint (JSON APIs, forms, query params). Medium-High when the leak exposes internal structure that arms a deeper attack.
Hunt HTML injection — user-supplied input is rendered as raw HTML in the response without sanitisation, allowing an attacker to inject arbitrary HTML tags (but not necessarily JavaScript). Lower severity than XSS but enables phishing, UI manipulation, and credential harvesting via injected forms. Use when testing text-display surfaces (search results, profile fields, comments, error messages, feedback forms). For markup that executes JavaScript, escalate to hunt-xss.
Handle Hotwire form workflows: form submission lifecycle, inline editing, validation errors, typeahead/autocomplete, modal forms, and external form controls. Prefer this skill when the core problem is correctness and UX of form interaction. Use hwc-navigation-content for pagination/tabs/filter navigation, hwc-realtime-streaming for WebSocket/Turbo Stream broadcasting, hwc-media-content for image/video/audio behavior, hwc-ux-feedback for generic loading/transition polish, and hwc-stimulus-fundamentals for framework-level Stimulus APIs not tied to forms.
Guide for configuring Infisical Secret Rotation — automatically rotating credentials that already exist in a third-party system on a fixed interval, writing the new values back into Infisical secrets. Covers all 28 rotation providers (PostgreSQL, MySQL, MSSQL, OracleDB, MongoDB, Redis, AWS IAM user secrets, Azure/Okta/Auth0 client secrets, LDAP passwords, Unix/Linux and Windows local accounts, Cloudflare, Datadog, Snowflake key pairs, OpenAI/OpenRouter/LiteLLM/Fireworks API keys, and more), the dual-phase vs single-phase rotation models, rotation intervals and rotateAtUtc scheduling, parameters and secretsMapping, and the two-user pattern for SQL databases. Use this skill when someone asks about: secret rotation, rotating credentials, automatic credential rotation, rotating a database password on a schedule, expiring API keys, rotationInterval, or 'how do I rotate my database password automatically'. For changing an EXISTING credential on a timer. Not for creating brand-new ephemeral credentials per request (infisical-dynamic-secrets), nor for App Connection credential rotation (infisical-app-connections).
Guide for Infisical Secret Scanning — detecting leaked credentials in source code and developer systems. Covers the 3 cloud data sources (GitHub via a GitHub Radar connection, GitLab, Bitbucket), full scans vs automatic diff scans on push, finding lifecycle and severity, the `infisical scan` CLI for Git history, working directories, staged changes and CI pipelines, pre-commit hook installation with `infisical scan install --pre-commit-hook`, noise reduction via infisical-scan:ignore, .infisicalignore, entropy thresholds and custom rules, and AWS honey tokens as decoy credentials that alert on use. Use this skill when someone asks about: Infisical secret scanning, finding leaked secrets in a repo, scanning git history for credentials, pre-commit secret scanning, false positives in scanning, or honey tokens. Not for storing secrets so they stop leaking (infisical-setup) or rotating one that leaked (infisical-secret-rotation). GitHub scanning needs a github-radar App Connection, not a github one.
Analyzes and correlates live Infrahub data via the MCP server — answers operational questions, detects drift, and investigates impact. TRIGGER when: querying infrastructure data, checking compliance, investigating change impact, producing ad-hoc reports. DO NOT TRIGGER when: writing automated checks, building transforms, designing schemas, populating data files, planning an Infrahub version upgrade (use infrahub-planning-upgrades). ALWAYS pass the user's question verbatim as args — this skill runs in a forked context and cannot see the parent conversation. Invoking without args will fail.
Apply Justin's detailed Git and pull-request workflow. Use when planning or performing branches, commits, rebases, history cleanup, pushes, pull requests, or GitHub work. Do not use for read-only Git inspection or when a repository's own workflow documentation already covers the task.
Optimize landing pages for maximum conversions using proven frameworks from Unbounce and Oli Gardner—apply the "one goal, one message, one action" principle with data-driven design, copy, and CTA best practices. Use when: **Create a new landing page** for a campaign; **Optimize an existing landing page** that isn't converting; **Review landing page design** before launch; **Improve form conversion rates** on lead gen pages; **A/B test landing page elements** systematically
Writes the caption for an Instagram post, carousel or reel, with a first line built for what shows before "more", an easy-to-scan body, a single CTA and niche hashtags. Use when the person asks for a caption, post text, "what should I write in the caption", or wants to improve an existing caption. Delivers 3 first-line options with different angles.
Discover popular new products in 16 TikTok Shop regional markets using EchoTik new product ranking data. Trigger this skill when users mention TikTok new product rankings, TikTok best-selling products, TikTok Shop hits, short-video e-commerce product selection, TikTok new product discovery, cross-border TikTok product selection, TikTok new product rankings, TikTok bestsellers, short-video product selection, TikTok viral products, new product ranking, or TikTok product trends. Trigger it even if the user does not explicitly mention “EchoTik” or “new product rankings”, as long as their request involves finding hot new products or emerging product trends on TikTok Shop.
Detect potential design patent infringement using Ruiguan, with image-based patent searches across 25+ countries and regions. Trigger for design patent detection, patent infringement checks, patent risk analysis, TRO case lookups, design patent searches or similarity checks, product patent screening, or related requests. Also trigger when users want to check whether a product image may infringe an existing design patent, or mention infringement, patents, TRO, or design patents, even if “design patent” is not explicitly stated.
Retrieve translated patent claims from the 智慧芽 patent database. Trigger this skill when the user asks about patent claims or claim translations, wants to view claims in a specific language (Chinese, English, or Japanese), looks up patent claims by patent ID or publication number, analyzes claim text, or mentions claim translation, patent claim translation, PatSnap, or patent translation. Trigger it even if the user does not explicitly mention “patent claim translation,” as long as they need patent claims in a specific language.
Bootstrap evaluators from production traces — by default propose online LLM-judge evaluators and, after you confirm, create them in Datadog as disabled drafts (never auto-enabled); on request emit Python SDK code or a framework-agnostic JSON spec instead. Use when user says "bootstrap evaluators", "generate evaluators", "create evals from traces", "eval bootstrap", "write evaluators", "build eval suite", "publish evaluators", or wants to generate BaseEvaluator/LLMJudge code or online judge configs from production LLM trace data. Works with ml_app and optional RCA report or failure hypothesis.
Analyze LLM experiment results. Handles single or comparative experiments, exploratory or Q&A modes. Use when user says "analyze experiment", "compare experiments", "analyze against baseline", or provides one or two experiment IDs for analysis.
Deterministic guardrailed agent-loop driver — wrap any step with propose → deterministic-verify → (critique → revise) and enforce hard termination guards (max_iter, wall-clock budget, no-progress via state-hash, escalate-to-human). The control loop + guards + progress detection are deterministic; the LLM critique/revise step is the one quarantined adapter. Trigger when an agent fix-loop must not spin forever and must not be able to argue its way around a failing test.
Meeting notes page: title bar with attendees, agenda checklist, decisions block, action-items table with owners and dates, and a “next meeting” footer. Use when the brief mentions “meeting notes,” “minutes,” “1:1 notes,” “all-hands recap,” or “会议纪要.”
Participate in moltbook.com — the social network for AI agents. Read feeds, post, comment, upvote, search semantically, send DMs, and manage submolts. Use when asked about Moltbook, checking agent social feeds, posting updates, messaging other agents, or engaging with the molty community. Triggers: "moltbook", "molty", "submolt", "check moltbook", "post to moltbook".
Design ObjectStack AI skills, tools, knowledge sources, and the open-edition MCP server surface. Use when the user is adding `*.skill.ts` / `*.tool.ts`, configuring an LLM provider, wiring the tools a skill grants, or indexing ObjectStack data as a knowledge source for RAG. Agents themselves are platform-internal (`ask` / `build`) — third parties extend them via skills, not by authoring `*.agent.ts`. Do not use for general LLM prompting questions unrelated to ObjectStack metadata.
Design ObjectStack automation — Flows (visual logic), Triggers, Approvals, state machines, and the `jobs` (`defineJob`) / `webhooks` (`defineWebhook`) stack collections. Use when the user is adding `*.flow.ts`, wiring an event-driven rule, modelling an approval chain, or building an interactive screen flow / wizard (objectstack-ui routes those here). Do not use for data lifecycle hooks at the object layer (see objectstack-data) or for kernel / plugin events (see objectstack-platform). CEL expressions in flow conditions / edge guards: load objectstack-formula alongside.
Author ObjectStack translation bundles — object/field labels, view text, app navigation strings, automation messages — and configure locale fallback, coverage reporting, and the source layout. Use when the user is adding `*.translation.ts` files, authoring a `translation` metadata item in the Studio or through the metadata API, shipping a generated bundle from a package or plugin, wiring a new locale, or resolving missing-translation warnings. Do not use for general i18n library questions unrelated to ObjectStack bundles.
Construct ObjectQL queries — filters, sorting, pagination, aggregation, relation expansion, and full-text search. Use when the user is writing a query DSL expression or picking a pagination strategy. Do not use for defining objects / fields / relationships (see objectstack-data), for designing the API endpoint that exposes a query (see objectstack-api), or for a list view's filter rules / dashboard datasets (see objectstack-ui).
Cloud security attack methodology covering AWS, Azure, and GCP. Includes credential harvesting (IMDS, ~/.aws, env vars, leaked CI secrets, instance roles), enumeration with cloud-specific tools (pacu, ScoutSuite, Prowler, ROADtools, gcp_enum), privilege escalation paths (IAM PassRole, AssumeRole chains, Lambda/Functions privilege flips, Azure Owner-on-self, GCP serviceAccountTokenCreator), persistence techniques (IAM user/key creation, AAD app registration, GCP svc account key creation, EventBridge/Logic Apps backdoors), data exfiltration (S3/Blob/GCS, snapshot share, RDS/CosmosDB/Cloud SQL exfil), cloud-native lateral movement (cross-account assume, Azure AD multi-tenant, GCP project hierarchy), serverless attacks (Lambda env vars, layer hijack, Step Functions), Kubernetes-on-cloud (EKS/AKS/GKE-specific paths to node and AWS metadata), and CSPM evasion (CloudTrail blind spots, GuardDuty mute, Sentinel rule shaping). Use when the engagement scope is cloud accounts, when you've stolen cloud credentials, or when assessing cloud posture.
Audits an Instagram profile and rewrites the bio. Use when the person asks for a profile analysis, a bio review, "my profile doesn't convert", "what can I improve on my Instagram", or pastes a bio, name, link, highlights or posts (or a screenshot) asking for an opinion. Scores seven criteria from 0 to 10, rewrites the bio in 3 versions of up to 150 characters, and lists the 3 highest-impact changes, in order.
Review candidate trades item by item before market open, covering catalysts, liquidity, plan completeness, suitability to market conditions, and risk exposure. Outputs an actionable checklist and conditions for standing aside. Suitable for pre-market preparation, team morning meetings, and reducing mistakes during live trading.
Closeout pass on a finished substantive change — sequence refactor-change (shape), code-review (diff), and write-docs (docs) so all three run, in the order where each feeds the next. Use after implementing a slice or feature and before calling it done or committing; when the user asks for a final review, a cleanup-and-document pass, or to “review everything.” For a diff-only audit, reach code-review directly.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.