Skills
101,174 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Make sure to use this skill whenever the user mentions anything related to job searching on Akademikernes Jobbank, jobbank.dk, or looking for academic or highly educated positions in Denmark—even if they don't mention jobbank.dk explicitly. Also invoke this skill for questions about Danish job listings, graduate trainee positions, Ph.D. jobs, or finding work in specific industries or regions in Denmark. Trigger phrases include: jobbank, akademikernes jobbank, jobs denmark, academic jobs denmark, find job denmark, highly educated jobs, graduate job denmark, trainee position denmark, ph.d. position denmark, postdoc denmark, studiejob, fuldtidsjob, deltidsjob, vikariat, freelance job, praktikplads, job søgning, jobsøgning, søg job, ledige stillinger, nye jobs, it jobs denmark, engineering jobs denmark, marketing jobs denmark, finance jobs denmark, healthcare jobs denmark, remote job denmark, fjernarbejde, job københavn, job aarhus, job odense, nyuddannede job, job til nyuddannede, international job denmark, jobbank søgning, find stilling, data scientist job, software developer job, projektleder stilling, konsulent job, data analyse job.
Make sure to use this skill whenever the user mentions anything related to Danish job listings, job search in Denmark, finding work in Denmark, or job vacancies on Jobdanmark — even if they don't explicitly mention jobdanmark.dk. Also invoke this skill for questions about specific Danish job categories, municipalities, job types, or salaries in a job-search context. Trigger phrases include: danish jobs, jobs in denmark, find job denmark, job search denmark, danish job listings, jobdanmark, job opslag, find job, jobsøgning, ledige stillinger, stillingsopslag, job i Danmark, fuldtidsjob, deltidsjob, studiejob, praktikplads, elev, fleksjob, IT job denmark, sygeplejersker job, håndværker job, ingeniør job, pædagog job, kontor job, leder job, salg job, hotel job, kirke job, job aarhus, job københavn, job odense, job aalborg, job sjælland, job jylland, job fyn, jobkategorier denmark, ledige job, ansøgningsfrist, søg job, job opslaget, jobopslag, danish vacancies, work in denmark, employment denmark, job denmark, jobs near me denmark, apprentice denmark, internship denmark, part-time denmark, full-time denmark
Make sure to use this skill whenever the user mentions anything related to Danish job searching, job listings, job vacancies, employment opportunities in Denmark, or the Danish government job portal — even if they don't mention jobnet.dk explicitly. Also invoke this skill for questions about specific job titles, occupations, employers, or regions in a Danish employment context. This skill covers the official Danish public job portal operated by STAR (Styrelsen for Arbejdsmarked og Rekruttering). Trigger phrases include: danish jobs, danish job search, jobnet, jobnet.dk, find job denmark, danish employment, job i danmark, job på jobnet, offentlige job, stillinger i det offentlige, public sector jobs denmark, government jobs denmark, STAR jobs, job ledige stillinger, ledig stilling, søg job, job opslag, job vacancy denmark, stillingopslag, jobopslag, sygepleje job, ingeniør job, lærer job, pædagog job, it-job denmark, jobs in copenhagen, jobs in aarhus, jobs in odense, deltidsjob, fuldtidsjob, fastansættelse, tidsbegrænset ansættelse, fleksjob, sygeplejerske job, social worker job denmark, occupation search denmark, esco occupation, job deadline, ansøgningsfrist, søg efter job, full time job denmark, part time job denmark.
Routes any Feishu/Lark/Doubao operation, including recording lookup by date (按日期找会议录音), through the version-matched lark-cli domain guide embedded in the installed CLI, then executes and verifies the task. Use for 飞书/Lark/Doubao docs, drive, sheets, Base, wiki, minutes, meetings, calendar, IM, mail, tasks, approval, apps, auth/scope, resource URLs or tokens, and lark-cli troubleshooting. This is the single Lark entry point; use ima-copilot instead for Tencent IMA.
Retrieve and analyze Amazon product reviews by ASIN across 15 marketplaces, including the US, with filtering by star rating. Triggers when users mention Amazon reviews, US reviews, Amazon.com reviews, product feedback, buyer complaints, negative or positive reviews, star ratings, review analysis or sentiment, product improvement suggestions, Vine reviews, verified purchase reviews, competitor review research, or customer feedback. Also trigger when a request involves reading, filtering, or analyzing Amazon product reviews, even if the user does not explicitly say “reviews”.
Xiyou keyword research (Xiyou Insights) for Amazon ASIN and keyword analysis, routed through the LinkFox gateway to the Xiyou OpenAPI. Covers 17 endpoints, including ASIN traffic scores, reverse keyword lookup, keyword ranking/traffic trends, BSR, ABA weekly trends, keyword competition, and suggested bids; supports 13 marketplaces, including US/UK/DE. Triggers when users mention 西柚找词, 西柚洞察, Xiyou, reverse ASIN keyword lookup, keyword analysis, ABA weekly search volume, traffic scores, keyword ranking trends, xiyou keyword research, ASIN traffic score, reverse ASIN lookup, or search term analysis. Trigger even if the user does not mention “西柚” when they want to use Xiyou keyword research to retrieve Amazon ASIN/keyword traffic and ranking data. Before use, configure LINKFOXAGENT_API_KEY and the XIYOU_CLIENT_ID and XIYOU_CLIENT_SECRET environment variables.
Generate a /goal mega prompt for Claude Code or Codex CLI by interviewing the user about their task. Use when the user wants to define a long-horizon autonomous goal—migration, refactor, feature build, optimization loop, test fixing, research project, learning system, or any task where the agent should run end-to-end without hand-holding. Trigger on: “help me write a goal”, “I want Claude to keep working until...”, “run this autonomously”, “set a /goal”, or any request that implies sustained agentic execution toward a non-trivial outcome. The skill conducts a structured interview (one question at a time) to extract outcome, context, success criteria, constraints, and quality bar—then outputs a filled-in mega prompt ready to paste into Claude Code or Codex.
Senior motion designer that turns any product website, story/topic, or song into short, shareable motion-graphics videos (15–90 s showreels, teasers, meme/parody shorts, data stories, and beat edits—fast, music-driven hype edits with giant words and no narration)—rendered as real MP4s sized for LinkedIn, Instagram, X, and Reels/TikTok, with optional sound design and narration. Starts with a short guided intake (language first—Portuguese, English, Spanish, or other—then product, story, or beat edit, each with its own questions; look, idea, versions, sound, narration, platform, duration, visuals, CTA, narration engine, voice, captions, quality level, hook, retention, pacing), extracts the brand straight from the site, generates several versions in parallel, reveals them in Finder, and asks which one is best. Use whenever the user wants a motion video, animated reel, promo/teaser clip, social video, animated explainer, or “showreel” for a product, website, story/topic, or a beat/hype edit on a song
Node.js backend patterns: layered architecture, TypeScript, validation, error handling, security, observability, logging, metrics, deployment. Use when building REST APIs, REST endpoints, middleware, Express/Fastify/Hono/NestJS/Koa servers, tRPC procedures, Bun servers, or server-side TypeScript.
Comprehensive methodology for auditing and exploiting TLS/SSL implementations and misconfigurations across network services and mobile applications. Covers protocol downgrade attacks including POODLE (CVE-2014-3566) against SSLv3 CBC padding, DROWN (CVE-2016-0800) cross-protocol attack leveraging SSLv2 export ciphers to decrypt TLS sessions, and FREAK (CVE-2015-0204) forcing RSA export-grade key exchange. Addresses BEAST (CVE-2011-3389) exploiting CBC IV predictability in TLS 1.0, CRIME (CVE-2012-4929) and BREACH targeting TLS-level and HTTP-level compression oracles respectively, and Heartbleed (CVE-2014-0160) for OpenSSL memory disclosure. Covers certificate validation bypass techniques for applications with improper hostname verification or chain validation, certificate pinning bypass using Frida and Objection for mobile application interception, HSTS bypass via NTP manipulation and subdomain exploitation, TLS 1.3 0-RTT replay attacks against non-idempotent endpoints, mutual TLS (mTLS) authentication attacks including client certificate theft and relay, and Certificate Transparency log monitoring for reconnaissance. Primary tooling includes testssl.sh for comprehensive TLS auditing, sslyze for Python-integrated scanning, sslscan for quick cipher enumeration, and tlsx for high-speed TLS probing at scale. Maps to CWE-295 (Improper Certificate Validation), CWE-319 (Cleartext Transmission of Sensitive Information), and CWE-757 (Selection of Less-Secure Algorithm During Negotiation).
PM Skills Marketplace — product-management skills and chained workflows across nine plugins: product discovery, product strategy, execution (PRDs, OKRs, roadmaps, sprints, retros, release notes), market research, data analytics (SQL, cohort analysis, A/B testing), go-to-market, marketing & growth, a PM toolkit, and an AI shipping kit. Encodes proven frameworks for discovery → strategy → execution → launch → growth.
Use to integrate an external service delivered as a Docker image from a standalone repository into the XGENT portal or review deliverables. Covers manifest, registration, authentication, MCP OAuth discovery, member clients and end-user identities, /svc routing, health checks, and end-to-end integration in one box.
Qualify and draft outreach for PostHog product-led leads who are hitting a billing transition—either startup program customers rolling off free credits, or users whose first invoice will be >= $2K. Use this skill when a TAE needs to work a startup rolloff lead, a high first-invoice alert, or any lead where the matching criteria mentions 'startup rolloff', 'credit spend', 'first invoice', 'credits expiring', or 'high usage transition'. Also trigger when a TAE pastes Salesforce lead details with matching criteria like 'Startup rolloff + high credit spend' or 'First invoice >= $2K'.
Modern PowerShell security practices for 2025 — SecretManagement, JEA, WDAC, credential protection. PROACTIVELY activate for: (1) Microsoft.PowerShell.SecretManagement and SecretStore for credential storage, (2) Just Enough Administration (JEA) endpoints, (3) Windows Defender Application Control (WDAC) for PowerShell, (4) credential protection (PSCredential, SecureString, DPAPI), (5) module signing and Authenticode signatures, (6) ConstrainedLanguage mode, (7) audit logging (transcription, ScriptBlock logging, module logging), (8) AMSI integration, (9) AppLocker rules for PowerShell, (10) supply-chain security (PSGallery trust, package hash verification). Provides: SecretManagement setup, JEA configuration, WDAC policy templates, signing workflow, and audit-logging configuration.
Every Allrecipes recipe in your terminal — cached as data, with pantry-aware search, Bayesian-smoothed ranking, and one-line grocery lists. Trigger phrases: `search Allrecipes for X`, `find a recipe for brownies`, `scale this Allrecipes recipe`, `build a grocery list from these recipes`, `what can I cook with what I have`, `use allrecipes-pp-cli`, `run allrecipes`.
Product management frameworks for business cases, market analysis, strategy, prioritization, OKRs/KPIs, personas, requirements, and user research. Use when building ROI projections, competitive analysis, RICE scoring, OKR trees, user personas, PRDs, or usability testing plans.
Full-stack PlantUML expert: create PUML from descriptions, convert images to PUML (vision reverse engineering), and render locally (PNG/SVG/PDF) without internet. Supports macOS/Windows/Linux; automatically installs PlantUML, Java, and Python. Covers all 27 chapters of the PlantUML Language Reference Guide v1.2025.0 (607 pages): Sequence, Use Case, Class, Object, Activity (legacy+new), Component, Deployment, State, Timing, JSON, YAML, nwdiag, Salt/Wireframe, Archimate, Gantt, MindMap, WBS, Maths, ER, Common Commands, Creole, Sprites, Skinparam, Preprocessing, Unicode, and StdLib (C4/AWS/Azure/K8s/ArchiMate). Use for drawing diagrams, creating PUML, converting images to PUML, rendering .puml, debugging PUML, explaining PlantUML syntax, or any UML task
This skill should be used when the user asks to optimize slow T-SQL queries, fix SQL Server performance regressions, improve SARGability, rewrite joins, prove whether joins can be removed, compare temp-table data types, select rewrite templates, diagnose parameter sniffing, evaluate query hints, inspect statistics/cardinality estimates, reduce spills or memory grants, use Query Store, or interpret plan evidence. PROACTIVELY activate for slow queries, scans vs seeks, implicit conversions, bad joins, tempdb spills, query rewrites, partition predicate safety, and before recommending indexes or hints. Provides: evidence-first workflow, rewrite templates, parameter-sniffing playbook, and gating rules before recommending indexes or hints.
Use whenever code will build, return, fetch, or execute SQL that runs against a user's real Postgres database—even when the request reads like an ordinary feature or bug fix and never says "security," "injection," or "SafeSqlFragment." This covers: writing or editing any pg-meta function, query builder, or endpoint that builds/returns SQL for database objects (tables, views, functions, DB triggers, indexes, RLS policies); interpolating a schema/table/column/search/route-param value into SQL text; storing, fetching, or re-running SQL that round-trips from the database (a policy's definition, a function/view definition, a snippet's saved content); and any "Run"/"Apply"/"Execute" action that sends SQL to a project's database (SQL editor run-selection, policy editor apply, snippet runner). Load this BEFORE writing such code, not only when reviewing a finished diff. Skip only for changes that never touch SQL text or execution—styling, unrelated data hooks, non-SQL form validation, or UI layout work.
Library of battle-tested security prompt templates for secure feature implementation. Use when implementing forms, endpoints, authentication, authorization, file uploads, or conducting security reviews. Triggers include "security prompt", "secure form", "RBAC", "threat model", "STRIDE", "admin endpoint", "file upload", "security testing", "code review", "OWASP".
Signals scout for warehouse imports. Watches external data sources, sync schemas, webhook push channels, and materialized views for failures, silent staleness, and row-volume cliffs, and suggests materialization candidates from recurring query-log hot spots.
Lift a proven skill from a host repo (e.g. your OpenClaw fork) back into gbrain's bundle so other clients can scaffold it. Editorial workflow: the CLI does the file copy + privacy lint; this skill drives the judgment-heavy genericization (scrub real names, generalize triggers, lift fork-specific conventions to references)
Professional-grade Solidity smart contract security auditor. Performs comprehensive audits or targeted reviews (security vulnerabilities, gas optimization, storage optimization, code architecture, DeFi protocol analysis). Use this skill when users request smart contract audits, security reviews, vulnerability assessments, gas/storage optimization analysis, code quality reviews, or when analyzing Solidity code for any security or quality concerns. Supports all Solidity versions with version-specific vulnerability detection. Based on OWASP Smart Contract Top 10 (2025) and real-world exploit patterns.
Provides comprehensive guidance for Spring Cloud Alibaba including Nacos, Sentinel, RocketMQ, and Alibaba Cloud integration. Use when the user asks about Spring Cloud Alibaba, needs to use Alibaba Cloud services, implement service discovery with Nacos, or work with Spring Cloud Alibaba components.
Mainland-Chinese TV-series craft, documents and production chain (国产剧创作体系与制片链) — the China layer parallel to the Japanese and Korean/French skills. Distilled from Yao Kougen 姚扣根《电视剧写作概论》(2016; series taxonomy, four Chinese script formats, the 3-minute/15-minute/episode-end suspense law, 36 situations), Zhang Wei 张巍《电视剧改编教程》(2014; five source types, sell-point migration, six case studies), Zhang Mingzhi & Song Peiyi《电视剧出品人与制片人教程》(2016; running-time rules, two-stage censorship, scene-breakdown sheet, contracts), Zhao Binbin《影视剧片段改编教程》(2016; film to stage fragment), plus official Chinese renderings of US TV terms from the translated Douglas and Blum textbooks. Use when writing or judging a 国产剧, turning a novel or IP into a 30–50 episode drama, writing a 策划书 / 分集梗概 / 人物小传, formatting a Chinese teleplay, sizing episode count and word count, checking content red lines and the 立项/备案/审查 chain, reading a Chinese screenwriter contract, or mapping US series vocabulary onto Chinese usage.
Complete Switchboard Oracle Protocol SDK for Solana - the permissionless oracle solution for price feeds, on-demand data, VRF randomness, and real-time streaming via Surge. Covers TypeScript SDK, Rust integration, Oracle Quotes, and all Switchboard tools.
Use this skill when the user mentions "Taro" in any technical context, asks about "Taro API", "Taro components", "Taro configuration", "Taro development", "Taro project", "mini program with Taro", "WeChat mini program", uses Taro methods (like "Taro.request", "Taro.navigateTo"), or discusses multi-platform development with Taro framework. Provides comprehensive Taro framework documentation including APIs, components, configuration, and development guides.
Use when a task may benefit from a bounded subagent for implementation, large-codebase discovery at task start, independent review, requested or pre-commit code simplification, or expert work on complex decisions, modeling, automation, or repeated failures. The main agent decides whether to delegate and accepts the result. Do not use for simple questions or short tasks that do not need meaningful review or delegation.
Zero-shot time series forecasting with Google's TimesFM foundation model. Use this skill when forecasting ANY univariate time series—sales, sensor readings, stock prices, energy demand, patient vitals, weather, or scientific measurements—without training a custom model. Supports both basic forecasting and advanced covariate forecasting (XReg) with dynamic and static exogenous variables. Automatically checks system RAM/GPU before loading the model, validates dataset fit before processing, supports CSV/DataFrame/array inputs, and returns point forecasts with calibrated prediction intervals. Includes a preflight system checker script that MUST be run before first use to verify the machine can load the model and handle your specific dataset.
Typography for web and UI: modular type scales, font pairing, heading hierarchy, readable body text, fluid clamp() sizing, variable fonts, font loading, and text effects. Use when the task is about fonts or text styling. Trigger phrases: "typography", "font pairing", "type scale", "heading sizes", "responsive text", "font combination", "text style", "variable fonts", "fluid typography", "google fonts", "line height", "font loading". For a full token system (spacing, color, components) use design-system, which consumes the scale defined here.
Extract frames from video files using ffmpeg for AI/LLM analysis. Use when (1) the user asks to analyze, describe, or summarize a video file, (2) the user wants to extract frames or screenshots from a video, (3) the user provides a video file (.mp4, .mov, .avi, .mkv, .webm, etc.) and asks questions about its visual content, (4) the user wants to identify scenes, objects, or events in a video, (5) the user wants timestamps overlaid on extracted frames for temporal reference. Converts video into JPEG frames that can be attached to LLM prompts as images. Requires ffmpeg on PATH. Supports scene-change detection, model-aware optimization (Claude/OpenAI/Gemini), quality presets (efficient/balanced/detailed/ocr), grayscale and high-contrast OCR mode, and automatic FPS calculation via --max-frames.
Use for any operation on WPS 365 / AirPage / 智能文档 / kdocs online documents: creating documents, reading or searching block structures, inserting or editing paragraphs and headings, operating tables (merging cells, inserting rows), uploading images, adding or querying comments, or converting Markdown/HTML into blocks. Triggered by natural Chinese requests mentioning kdocs, AirPage, 智能文档, or 365.kdocs.cn—for example, “帮我在那个 kdocs 文档里加一段”, “查一下文档的块结构”, “创建一个新的 AirPage 文档”, “把这段 markdown 插进去”, “合并表格单元格”, or “往文档里加评论”. Do NOT use for local .docx/.xlsx files, WPS desktop app issues, Notion, Google Docs, or generic browser/script automation.
Research YouTube topics, analyze competitor videos, deconstruct viral content, and query the YouTube Data API. Use when researching a video topic before planning, analyzing video transcripts for viral patterns, searching competitor channels, or fetching video and channel stats via the YouTube Data API v3.
Write the AI SEO Tracker report brief from live MCP data. Use when the user wants a TL;DR of AI search visibility, a weekly recap, or the same brief as the in-app Report page. Trigger on "tldr the report", "AI SEO brief", "why am I missing in ChatGPT", or fetch https://aiseotracker.com/ai-seo-report/SKILL.md.
Design and implement automation workflows to save time and scale operations as a solopreneur. Use when identifying repetitive tasks to automate, building workflows across tools, setting up triggers and actions, or optimizing existing automations. Covers automation opportunity identification, workflow design, tool selection (Zapier, Make, n8n), testing, and maintenance. Trigger on "automate", "automation", "workflow automation", "save time", "reduce manual work", "automate my business", "no-code automation"
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.