Skills
101,174 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Produce and publish the next entry in Ane's personal AI Field Notes series on LinkedIn, end to end: topic proposal from the series ledger, a dictation interview, the article plus short post, the companion toolkit, then publication via claude-in-chrome after per-artifact approval. Runs on Ane's personal Wine & Slate brand, never IPPF branding. Use for any personal AI/MEL thought-leadership piece for LinkedIn. Not for IPPF-branded MA-facing learning products (learning-product), meeting notes (meeting-notes), voice audits of existing text (ane-voice), or LinkedIn profile edits
Guide for creating high-quality MCP (Model Context Protocol) servers that enable LLMs to interact with external services through well-designed tools. Use when building MCP servers to integrate external APIs or services, whether in Python (FastMCP) or Node/TypeScript (MCP SDK).
Cross-session memory for AI. ALWAYS load this skill at session start to read SOUL.md and USER.md. This skill should be loaded for EVERY conversation to maintain continuity. Also triggers on "save memory", "end session", "update memory" for saving. Handles session history creation, memory consolidation, and USER.md/SOUL.md updates. Memory stored in ~/.learnwy/ai/memory/.
Captures conversations and supplied notes as Notion wiki pages, how-to guides, FAQs, decision records, or retrospectives. Use when saving or updating durable knowledge from existing context; use research-documentation when new source discovery and synthesis is the main task
Offensive methodology for attacking GraphQL APIs during penetration tests and bug bounty engagements. Covers the full attack lifecycle: endpoint discovery, introspection abuse and blind schema reconstruction when introspection is disabled, authentication and authorization bypass through Relay node IDs and nested object traversal, injection via variables and directives, query batching for brute force and OTP bypass, denial of service through depth bombs and alias amplification, WebSocket subscription hijacking, information disclosure through verbose errors and field suggestion oracles, and file upload abuse via the multipart GraphQL specification. Includes tool-specific guidance for InQL, graphql-cop, CrackQL, BatchQL, Altair, GraphQL Voyager, and clairvoyance. Trigger on: GraphQL, graphql, introspection query, batching attack, query depth, GraphQL injection, GraphQL IDOR, field suggestion, GraphQL auth bypass, GraphQL DoS, GraphQL security, graphql-cop, InQL, CrackQL, BatchQL, Relay node, alias amplification, subscription abuse, multipart upload GraphQL, schema enumeration, __schema, __type.
WPA/WPA2/WPA3-Enterprise (802.1X / EAP) attack methodology — EAP method identification (PEAP-MSCHAPv2, EAP-TTLS, EAP-TLS, EAP-GTC, EAP-PWD, EAP-FAST), evil-twin RADIUS attacks with eaphammer for credential capture, MSCHAPv2 challenge-response cracking, EAP-TLS client certificate theft paths (DPAPI, NDES, AD CS auto-enrollment), supplicant validation bypass (missing server cert validation, missing CN pinning, BYOD misconfigurations), and post-capture pivots into AD via cracked domain credentials. Use for corporate Wi-Fi engagements where the network is 802.1X authenticated.
Z-Wave attack methodology — sniffing with Z-Force / EZ-Wave / RTL-SDR + ZniffMobile, S0 (legacy) network-key derivation flaw and key reuse, S2 (modern) ECDH commissioning analysis, replay/injection on unauthenticated nodes, default-key brute-force on test deployments, and home-automation hub pivots. Use when targeting Z-Wave smart home devices (door locks, sensors, garage controllers) — common in mid-2010s smart home deployments still in production.
Define the smallest viable experiment and MVP for a selected one-person company opportunity. Use when Codex needs to explain what MVP means when needed, verify prerequisites, ask one question at a time, present multiple MVP options, and write user-confirmed outputs into `opc-doc/`.
Orchestrate the full one-person company workflow across all OPC skills. Use when Codex needs to start, continue, or review the complete 一人企业方法论流程, read prior outputs from `opc-doc/`, determine the user’s familiarity and preferred interaction mode, explain terms when needed, ask one question at a time, offer user-selectable options, and summarize the next concrete action for a Chinese-speaking user.
Use this skill whenever the user wants to monitor, watch, or track Polymarket prediction market prices over time. This includes setting up price alerts, watching for significant price movements, tracking spread changes, monitoring volume spikes, or getting notified about market activity. Trigger on: monitor prices, price alert, watch market, track prices, notify me, price change, polymarket alerts, market watch, price movement, volume spike, spread monitoring, track odds, prediction market alerts, continuous monitoring, price tracker, market surveillance.
When the user wants to create or optimize popups, modals, overlays, slide-ins, or banners for conversion purposes. Also use when the user mentions "exit intent," "popup conversions," "modal optimization," "lead capture popup," "email popup," "announcement banner," or "overlay." For forms outside of popups, see form-cro. For general page conversion optimization, see page-cro.
Expert product specification and documentation writer. Use when creating PRDs, user stories, acceptance criteria, technical specifications, API documentation, edge case analysis, design handoff docs, feature flag plans, or success metrics. Covers the full spectrum from high-level requirements to implementation-ready specifications.
Create QA artifacts from requirements: test plans, test conditions/cases, bug reports, regression suites, traceability, and exploratory charters. Use for test planning, test design, defects, coverage, or QA deliverables. Applies ISTQB risk-based techniques and loads templates only when needed. Keywords: test plan, test case, bug report, traceability, regression suite, QA artifact.
Use this skill when building, modifying, or debugging a react-admin application — including creating resources, lists, forms, data fetching, authentication, relationships between entities, custom pages, or any CRUD admin interface built with react-admin.
Use for foundational Roblox experience development: deciding what runs on the client or server, where scripts and modules belong, how to structure reusable code, and how to handle everyday services, attributes, bindables, workspace objects, input, camera, raycasts, collisions, and CFrame-based gameplay scripting in Studio.
Use when connecting cloud storage (AWS S3 / S3-compatible or Google Cloud Storage) to Roboflow to mirror images into a workspace — creating storage credentials, defining datasources (bucket-mirror configs), selecting objects with glob rules, validating access, and running/scheduling mirror jobs.
Define, review, or update SECURITY_MODEL.md files that tell security review tools a repository's threat model, trust boundaries, invariants, reportable finding classes, and exclusions. Use when asked to "write a security model", "threat model this repo for scanners", "define security review scope", "what counts as a vulnerability here", "update SECURITY_MODEL.md", "why did the scanner flag or miss this", or to check whether existing security guidance still matches the code. Not for running a security review or editing the SECURITY.md disclosure policy.
Provisions SIP trunks, endpoints, ACLs, credential lists, and phone numbers via the Sinch Elastic SIP Trunking REST API. Use when the user needs SIP connectivity, trunk provisioning, inbound/outbound PSTN voice routing, PBX integration, or SIP-to-PSTN bridging.
Review writing for its intended reader, check common AI writing patterns, revise, request a second pass from a different model family, and check again. Trigger on /slopmonster, "humanize this", "de-slop this", "does this sound like AI", "fix this copy".
Methodology playbook for analyzing stablecoin volume, supply, holders, and geographic usage on Allium — USDC, USDT, DAI, USDS, RLUSD, USDG, JPYC, and other fiat/crypto/algorithmic-backed stablecoins. Use whenever a question touches stablecoin transfer volume, circulating supply, wallet/holder counts, geographic breakdowns, or cross-chain deployments—even if the user just names a specific stablecoin, asks for "adoption" or "usage" figures, or asks to compare volume with a chart/number they already have. Covers raw vs. adjusted volume, chain-specific double-counting mechanics, and address/case-sensitivity pitfalls that commonly arise before writing SQL
Implements Syncfusion .NET MAUI Cards (SfCards) - dismissible card views and swipeable card stacks. Use when working with cards, card views, card layouts, swipeable cards, dismissible cards, or card stacks in .NET MAUI. Covers card customization, card events, card data binding, and interactive card components with swipe functionality.
Implements Syncfusion® .NET MAUI Maps (SfMaps) control. Use when implementing maps, visualizing geographic data, or displaying shape layers and tile layers (OpenStreetMap, Azure maps, Google Maps, Bing Maps). Covers markers, bubbles, legends, data labels, tooltips, sublayers, zoom and pan features, or spatial data visualization in .NET MAUI applications.
Use when building or auditing a Telegram Mini App: server-side initData verification, sendData, in-app Stars payments, viewport and safe areas. Not for the bot (telegram-bots) or user accounts (telegram-userbots). Opt out: no telegram, без телеграма. Triggers - "mini app", "initData", "мини-апп".
Plan and create TikTok advertising campaigns end-to-end via the Hyper MCP, with strict parameter validation for objective-specific requirements. Use when the user wants to launch TikTok ads, set up TikTok traffic or reach campaigns, configure conversions or app-promotion campaigns, upload TikTok video creatives, or analyze TikTok ad performance. Also triggers on tiktok marketing, tiktok campaign, tiktok ppc, or tiktok ads manager
Spec-driven feature work that freezes obligations instead of the plan: one human-reviewed plan with EARS criteria, path, entities, interface and one-way doors, then proof-backed checks, then build, then an independent Verifier. Use when the user says "tlc-spec-lean", "plan feature", "specify feature", "write the checks", "build this plan", or "verify work". Do NOT use for standalone design documents unattached to a feature, architecture decomposition analysis, or work that already has a task list or checklist to execute.
Full type inference philosophy (never cast, never annotate inferred values), Register module declaration, from narrowing on hooks and Link, strict:false for shared components, getRouteApi for code-split typed access, addChildren with object syntax for TS perf, LinkProps and ValidateLinkOptions type utilities, as const satisfies pattern
Guide for creating VS Code extensions and plugins from scratch through Marketplace publication. Use when developing a VS Code extension/plugin, adding commands or keybindings, building TreeView or Webview UI, publishing to Marketplace, or troubleshooting activation and packaging issues.
This skill should be used when analyzing Wispr Flow voice dictation history for self-reflection, work patterns, mental health insights, or productivity analytics AND when managing the Wispr Flow dictionary (adding terms, fixing mishears, exporting/importing, suggesting improvements). Triggered by requests like "/wispr-analytics", "analyze my dictations", "what did I dictate today", "wispr reflection", "add to wispr dictionary", "improve dictation", "wispr suggest", "export wispr dictionary", or any request to review voice dictation patterns or manage dictation quality. Also use for live Wispr Flow meeting transcription or completed-dictation capture into separate Obsidian talk folders, with a default 30-second capture target.
Wix Design System component reference. Use when building UI with @wix/design-system, choosing components, checking props and examples, or writing tests with component testkits. Triggers on "what component", "how do I make", "WDS", "show me props", "testkit", "driver", or component names like Button, Card, Modal, Box, Text.
Creates durable, resumable workflows using Vercel's Workflow DevKit. Use when building workflows that need to survive restarts, pause for external events, retry on failure, or coordinate multi-step operations over time. Triggers on mentions of "workflow", "durable functions", "resumable", "workflow devkit", or step-based orchestration
Export, list, dump, and locate Wuji device logs using `wuji logs`. Use when you need to collect support bundles including hand model calibration recordings, collect a device-side diagnostic snapshot and flash history, inspect log files, or locate the log directory. Supports date/source filtering, device dumps, private-data redaction, and JSON output.
Apply opinionated rules and security patterns to JavaScript and TypeScript code that uses the xrpl.js client library to interact with the XRP Ledger. Use when users want to write a new XRPL integration with xrpl.js, review or refactor existing xrpl.js code, sign or submit a transaction, construct or credit a payment, work with issued currencies, AMM, NFToken, escrow, or payment channels, query account or ledger state, or audit an XRPL integration for security issues such as partial-payment inflation, missing LastLedgerSequence, missing DestinationTag, or unsafe key management.
Assess whether a profitable position is suitable for further additions, and provide the prerequisites, timing, protection rules, and limits for stopping expansion. For trend continuation, scaling core positions, and second advances by strong stocks.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.