Skills
101,174 packaged capabilities and playbooks for agents. Install any of them with one command.
All
NEAR AI Cloud private inference and verification. Use when integrating NEAR AI Cloud API for verifiable private AI inference, verifying model or gateway TEE attestation (NVIDIA NRAS, Intel TDX), verifying chat message signatures, implementing end-to-end encrypted chat, using specialized TEE endpoints (embeddings, reranking, images, audio, PII redaction), or using the OpenAI-compatible API with NEAR AI Cloud.
Comprehensive security audit skill for NEAR Protocol smart contracts written in Rust. Use when auditing NEAR contracts, reviewing security vulnerabilities, or analyzing contract code for issues like reentrancy, unhandled promises, unsafe math, access control flaws, and callback security.
UX agency skill for user journey mapping with emotional tracking. Includes Playwright testing (happy path, cognitive walkthrough, accessibility, synthetic user), a library of proven UX patterns, synthetic personas, Nielsen heuristics scoring, and anti-generic-AI guardrails.
Use this skill when the user asks to “set up a web server”, “configure HTTP or HTTPS”, “perform SNMP enumeration”, “configure SMB shares”, “test network services”, or needs guidance on configuring and testing network services for penetration testing labs.
Use when the user explicitly asks to “write/polish an NSFC proposal abstract,” “generate Chinese and English abstracts,” or “translate a Chinese abstract into an English abstract.” Output Chinese and English versions (the English must be a faithful translation of the Chinese), along with title suggestions (1 recommended title + 5 candidate titles with reasons). The Chinese abstract defaults to ≤400 characters and the English abstract to ≤4000 characters. Output method: write the results to `NSFC-ABSTRACTS.md` in the working directory. ⚠️ Not applicable: the user only wants a general text unrelated to a proposal translated (translate it directly); the user only wants to write the main text for the rationale, research content, or research foundation (use the corresponding nsfc series skill).
Deep-dive offensive methodology for dependency confusion and namespace attacks across all major package ecosystems. Covers npm scope confusion exploiting the gap between public and private scoped packages and .npmrc misconfigurations where registry mappings fail to pin internal scopes exclusively. Addresses PyPI namespace attacks through --extra-index-url resolution ordering, NuGet feed priority exploitation when multiple package sources are configured without clear directives, Maven and Gradle repository ordering where artifact resolution traverses repositories sequentially, Go module proxy abuse through GOPROXY misconfiguration, Ruby gems namespace squatting, and Docker image tag confusion with unqualified image references. Provides complete proof-of-concept methodology using safe callbacks including DNS canary via interactsh or Burp Collaborator and HTTP beacon with no destructive payload. Covers reconnaissance techniques for discovering internal package names through GitHub repository analysis, error message harvesting, JavaScript source map extraction, lock file parsing, job postings mentioning internal tools, and package manifest inspection. Directly references and builds upon Alex Birsan's seminal 2021 dependency confusion research. Each ecosystem section includes registry-specific exploitation mechanics, configuration vulnerabilities, and defensive countermeasures for engagement reporting.
Comprehensive offensive methodology for software supply chain attacks covering the full kill chain from reconnaissance through exploitation. Addresses dependency confusion across npm, PyPI, and NuGet ecosystems where internal registry override allows an attacker to inject malicious packages that shadow private dependencies. Covers typosquatting techniques for popular packages, compromised package injection via maintainer account takeover or social engineering, and build system attacks through Makefile injection, setup.py install hooks, and npm postinstall scripts. Extends into CI/CD artifact tampering where build outputs are replaced or modified in transit, code signing abuse through stolen or self-signed certificates, upstream repository compromise via commit injection or force-push to trusted repos, and container image supply chain attacks including base image trojaning and registry confusion. Maps to MITRE ATT&CK T1195.001 (Supply Chain Compromise: Compromise Software Dependencies and Development Tools) and T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain). Integrates tooling such as confused for dependency confusion scanning and dependency-check for known vulnerable component detection. Each technique section provides reproducible proof-of-concept patterns, detection guidance for defenders, and engagement-safe execution notes for authorized red team operations.
OpenTofu (Terraform open-source fork) guide and migration. PROACTIVELY activate for: (1) OpenTofu installation and tofu CLI usage, (2) migrating from Terraform CLI to OpenTofu, (3) provider compatibility between Terraform and OpenTofu, (4) state file compatibility, (5) OpenTofu-specific features (encrypted state, dynamic provider config), (6) Terraform Registry vs OpenTofu Registry, (7) CI/CD with OpenTofu (GitHub Actions, Azure DevOps), (8) HashiCorp BSL license vs OpenTofu MPL, (9) using OpenTofu with Terragrunt. Provides: migration checklist, CLI command mapping, encrypted state setup, registry comparison, and CI YAML templates.
Map opportunities using Teresa Torres' Opportunity Solution Trees. Use when asked to identify opportunities, find product gaps, explore new areas, map the solution space, or connect business outcomes to customer needs and testable solutions.
Entry point for reading PANews cryptocurrency/blockchain news, market narratives, and Polymarket smart money leaderboards. Triggers: today’s headlines, breaking news, trending rankings, article search, reading specific articles, browsing columns/series/community topics, industry events and conferences, event calendar, platform hot searches and editorial picks, latest smart money boards, board highlights, and board comparisons.
Pino high-performance JSON logger for Node.js with worker thread transports, child loggers, redaction, and framework integrations. Use when setting up structured logging, configuring log transports, adding request correlation IDs, redacting sensitive data, or integrating with Fastify, Hono, or Express. Use for pino, logging, structured-logs, request-id, correlation, redaction, transports, pino-http, pino-pretty.
Use when product or feature work starts, or a PDR-worthy decision (scope, persona, monetization) emerges — injects the PDR index (docs/adlc/memory/pdr/, legacy .adlc/memory/pdr/ fallback) as session context and suggests the decision for capture via /product-specify (never writes drafts itself); invoked from team-boot's Class Boots catalog
Refine.dev headless React framework for CRUD apps: data providers, resources, routing, authentication, hooks, and forms. Use when building admin panels, dashboards, or internal tools with React and various backends (REST, GraphQL, Supabase, Strapi), or configuring Refine data providers and authentication. Keywords: Refine, CRUD, admin panel, data provider, React.
Single-file horizontal-swipe HTML deck in the style of Replit Slides's landing-page template gallery. Eight distinct themes (helix, holm, vance, bevel, world-dark, world-mint, atlas, bluehouse) — each a complete visual system (palette + type + accent) captured from replit.com/slides. Pick one theme, do not mix. For pitch decks, board reports, brand memos, campaign reveals — when the user explicitly wants "Replit Slides style".
Signals scout for PostHog web traffic. Watches per-channel session volume, attribution breakage, and landing-page health (bounce and 404 steps) against the site's own baseline. Per- page web vitals belong to `signals-scout-web-vitals`.
Import, host, qualify, and text-enable phone numbers for Sinch SMS using the Imported Numbers and Hosting Orders API. Use when importing non-Sinch numbers as DCA, creating hosting orders, qualifying numbers for text-enablement, managing LOA workflows, or checking hosting order status.
Know the metrics that matter at each stage and what investors actually look for. Master the A16Z and YC frameworks for measuring startup progress. Use when: **Fundraising prep** to know which metrics to highlight; **Board meetings** to report on the right KPIs; **Strategic planning** to set goals that matter; **Product decisions** to understand what to optimize; **Diagnosing problems** to find what's broken
Implements Syncfusion® .NET MAUI Sunburst Chart (SfSunburstChart) for hierarchical data visualization using a radial, multi-level circular layout. Use this for sunburst charts, radial hierarchical charts, multi-level pie charts, or hierarchical data visualization with drill-down capabilities. Ideal for visualizing organizational structures, file systems, or nested categorical data.
Implements Syncfusion .NET MAUI TimePicker (SfTimePicker) control. Use when implementing time selection, time picker controls, or time input UI in .NET MAUI. This skill covers installation, configuration, time formats (14 predefined formats), picker modes (Dialog/RelativeDialog), intervals, time restrictions, looping, events, and customization.
Expert guidance for implementing UUID primary keys in Rails applications. Use when setting up UUIDs as primary keys, choosing between UUIDv4 and UUIDv7, configuring generators for UUID defaults, writing migrations with id colon uuid, adding UUID foreign keys, implementing base36 encoding for URL-friendly IDs, configuring PostgreSQL pgcrypto or gen_random_uuid, implementing SQLite binary UUID storage, choosing a primary key type, using non-sequential IDs, secure IDs, random IDs, or any ID generation strategy beyond auto-increment integers.
This skill should be used when the user asks to “pentest WordPress sites”, “scan WordPress for vulnerabilities”, “enumerate WordPress users, themes, or plugins”, “exploit WordPress vulnerabilities”, or “use WPScan”. It provides comprehensive WordPress security assessment methodologies.
Use when you need to add or review Mongock MongoDB data migrations in a Micronaut application — including Mongock runner/driver selection, Micronaut bean wiring, migration scan packages, @ChangeUnit classes, lock/transaction settings, and Testcontainers verification. This should trigger for requests such as Add Mongock migrations in Micronaut; Review Micronaut MongoDB data migrations; Configure Mongock change units with Micronaut Data MongoDB; Create Mongock change units for Micronaut MongoDB; Review Mongock migration ordering in a Micronaut service. Part of Plinth Toolkit
Use when reviewing, designing, or modifying Java enterprise systems that may support financial entities, critical ICT services, third-party ICT provider integrations, or operational resilience obligations under DORA. This should trigger for requests such as Review a Java platform for DORA ICT risk controls; Design operational resilience evidence for a financial service; Add incident, continuity, backup, recovery, or third-party ICT controls; Assess resilience testing and monitoring before production release. Part of Plinth Toolkit
Use when reviewing, designing, or modifying Java enterprise systems that process personal data and need GDPR-aware engineering controls. This should trigger for requests such as Review a Java service for GDPR privacy controls; Design data-subject rights workflows; Add retention, deletion, pseudonymization, or privacy-safe logging; Assess data transfer, DPIA, breach evidence, or processor/controller boundary concerns before production release. Part of Plinth Toolkit
Use when reviewing, designing, or modifying Java enterprise systems that may support EU Digital Markets Act gatekeeper-platform concerns, core platform services, interoperability, business-user data access, consent-dependent data combination, ranking, self-preferencing, advertising transparency, or anti-circumvention controls. This should trigger for requests such as Review a Java platform for DMA controls; Design interoperability and business-user data access evidence; Add ranking, consent, preference, or anti-circumvention audit controls; Assess gatekeeper-platform engineering evidence before production release. Part of Plinth Toolkit
WCAG 2.2 AA enforcement as a package of Agent Skills: router skills for web UI, full-site audits, Office/PDF/ePub documents, markdown, desktop and Python tooling, and GitHub workflows dispatch specialist, helper and reference skills by name.
Expert guidance for receiving and processing inbound emails with Action Mailbox in Rails. Use when setting up inbound email processing, routing emails to mailboxes, configuring ingress providers (Mailgun, SendGrid, Postfix, etc.), handling attachments, bouncing emails, or testing with fixtures. Covers "action mailbox", "inbound email", "receive email", "process email", "email routing", "mailbox", "incoming email", "email processing", "ingress", "InboundEmail".
Expert guidance for Active Record callbacks — lifecycle hooks, ordering, conditional execution, transaction callbacks, and halting. VERY opinionated about when NOT to use callbacks. Use when working with callbacks, before_save, after_create, after_commit, lifecycle hooks, before_validation, around_save, after_update, before_destroy, or when deciding whether logic belongs in a callback vs a service object.
Expert guidance for encrypting sensitive data at rest using Active Record Encryption in Rails. Use when adding encryption to model attributes, rotating keys, migrating unencrypted data, querying encrypted fields, or protecting PII. Triggers on "encryption", "encrypt", "encrypts", "encrypted attribute", "at-rest encryption", "field encryption", "key rotation", "deterministic encryption", "PII", "sensitive data", "encrypt column", "encrypts macro".
Use when a user wants to integrate Adapty SDK into a mobile app, set up in-app purchases with Adapty, add a paywall to their app, or move to Adapty from another purchase system. Triggers include "integrate Adapty", "add Adapty to my app", "set up subscriptions", "add a paywall", "migrate from RevenueCat", "replace RevenueCat with Adapty", "move off Superwall", or similar.
Design and generate AI voices for your videos using ElevenLabs or Qwen3-TTS, with voice cloning, description-based design, and lip-sync. Use when: **Creating a brand voice** — define the vocal tone for a campaign; **Cloning an existing voice** — reproduce a voice with permission; **Designing an original voice** — create a voice from a description; **Multiple characters** — manage several voices in one video; **AI video lip-sync** — synchronize voices…
Verify and configure SAP AI Core credentials, retrieve auth tokens, and manage resource groups. WHEN: user wants to check if AI Core is set up, configure credentials, get a Bearer token, fix authentication errors, run a setup health check, or list, create, update, or delete resource groups. DO NOT USE FOR: managing deployments — use `aicore-lifecycle-management`; listing foundation models — use `genai-hub-foundation-models`.
MaxCompute Quota Management Skill. Use for managing MaxCompute/ODPS quota resources including pay-as-you-go quota creation, query, and listing operations. Triggers: "MaxCompute quota", "ODPS quota", "create quota", "list quotas", "quota management", "CU management"
Use when architecture work starts or a tech-stack or pattern decision emerges — injects the project ADR index (docs/adlc/memory/adr/, legacy .adlc/memory/adr/ fallback) as session context and suggests the decision for capture via /architect-specify (never writes drafts itself); invoked from team-boot's Class Boots catalog
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.