Skills worth trusting.

migrate-radix-to-base

Migrates React projects and components from Radix UI to Base UI. Use when asked to migrate from radix, move to base-ui, convert radix primitives, or switch a shadcn project's base library. Handles single components ("migrate accordion") and whole projects.

Plugin Settings

This skill should be used when the user asks about "plugin settings", "store plugin configuration", "user-configurable plugin", ".local.md files", "plugin state files", "read YAML frontmatter", "per-project plugin settings", or wants to make plugin behavior configurable. Documents the .claude/plugin-name.local.md pattern for storing plugin-specific configuration with YAML frontmatter and markdown content.

parallel-web-extract

CLI-backed URL extraction. Use when the user explicitly invokes this skill, needs CLI-only controls or saved JSON output, or no Parallel web_fetch MCP tool is available. When the bundled Parallel Search MCP is available, prefer its web_fetch tool for ordinary webpages, articles, PDFs, and JavaScript-heavy sites.

create-specification

Create a new specification file for the solution, optimized for Generative AI consumption.

parallel-data-enrichment

Bulk data enrichment. Adds web-sourced fields (CEO names, funding, contact info) to lists of companies, people, or products. Use for enriching CSV files or inline data. Supports multi-turn: pass --previous-interaction-id from a prior research task to carry context forward.

nano-banana-2

Create or edit images with Pilio Nano Banana 2 through the unified Pilio developer API. Use when the user wants Nano Banana 2 text-to-image generation, reference-image editing, product posters, or image composition from local inputs.

stripe-integration

Implement Stripe payment processing for robust, PCI-compliant payment flows including checkout, subscriptions, and webhooks. Use when integrating Stripe payments, building subscription systems, or implementing secure checkout flows.

status

Check running research task status by run ID

turborepo

Turborepo monorepo build system guidance. Triggers on: turbo.json, task pipelines, dependsOn, caching, remote cache, the "turbo" CLI, --filter, --affected, CI optimization, environment variables, internal packages, monorepo structure/best practices, and boundaries. Use when user: configures tasks/workflows/pipelines, creates packages, sets up monorepo, shares code between apps, runs changed/affected packages, debugs cache, or has apps/packages directories.

kami

Typeset professional documents with Kami templates: resumes, one-pagers, white papers, letters, portfolios, and slide decks. Use when asked to 做 PDF / 排版 / 简历 / 一页纸 / PPT / slides, or to create a Kami landing page. Not for auditing or restyling an existing product site.

learn

Runs a six-phase research workflow from source bundle to publish-ready output. Use when researching an unfamiliar domain or compiling materials into one reference. Not for quick lookups or single-file reads.

javascript-typescript-jest

Best practices for writing JavaScript/TypeScript tests using Jest, including mocking strategies, test structure, and common patterns.

create-agentsmd

Prompt for generating an AGENTS.md file for a repository

refactor-plan

Create a concrete plan before starting a multi-file refactor. Use when the user asks to plan, sequence, scope, or safely execute a refactor across multiple files; always investigate first, output the plan, and wait for confirmation before making code changes.

shopify-liquid

Liquid is an open-source templating language created by Shopify. It is the backbone of Shopify themes and is used to load dynamic content on storefronts. Keywords: liquid, theme, shopify-theme, liquid-component, liquid-block, liquid-section, liquid-snippet, liquid-schemas, shopify-theme-schemas

affiliate-payout-audit

Audit an affiliate or partner commission payout run for accuracy before money is disbursed - per-line rate and tier recomputation, double-counted conversions, clawback and validation windows, period cutoff, currency, rounding, and tax-form status, delivered as an audit report with severities and recommended holds. Covers B2B SaaS recurring revenue-share and B2C ecommerce order-level CPA programs. Use whenever the user mentions an affiliate payout audit, commission accuracy, payout reconciliation, overpaid or underpaid affiliates, or a pre-disbursement review, even if they never say audit. Do NOT use for spotting fraudulent affiliates - use mbfinotti/partnerships-skills@affiliate-fraud-detection instead.

affiliate-disclosure-compliance

Check a specific piece of affiliate or influencer content (caption, video script, transcript, screenshot, or live URL) against disclosure regulations and return a pass/fail compliance review with placement, wording, and per-format fixes. Covers FTC affiliate disclosure (16 CFR 255 and 465), UK CAP/CMA rules, EU UCPD and DSA, and German, French and Italian overlays, pre-publication or already live. Use whenever the user mentions affiliate disclosure, FTC disclosure, paid partnership labeling, sponsored content, ad tags, or a partner post that may be missing or burying its disclosure, even if they never say compliance. Reviews content only - for disclosure clauses inside program terms use mbfinotti/partnerships-skills@affiliate-program-terms.

gemini-watermark-remover

Remove visible Gemini image watermarks from local image files by calling the project's CLI. Use when the user wants an agent to clean one or more local Gemini-generated images and save de-watermarked output files.

memory-merger

Merges mature lessons from a domain memory file into its instruction file. Syntax: `/memory-merger >domain [scope]` where scope is `global` (default), `user`, `workspace`, or `ws`.

affiliate-recruitment-outreach

Draft the outreach copy and sequence plan used to recruit new affiliates into a commission-based affiliate program - prospect qualification and tiering, pitch angle, first-touch recruitment email, follow-up sequence with a breakup touch, channel mix, and outreach tracking. Covers B2B SaaS and B2C ecommerce/DTC programs. Use whenever the user mentions recruiting affiliates, affiliate sourcing, or pitching content and review sites, coupon and cashback partners, newsletter operators, communities, podcasters, or agencies to join a program, even if they never say recruitment. Do NOT use for pitching one individually vetted creator - use mbfinotti/partnerships-skills@influencer-outreach instead.

pytest-coverage

Run pytest tests with coverage, discover lines missing coverage, and increase coverage to 100%.

affiliate-commission-structure

penpot-uiux-design

Comprehensive guide for creating professional UI/UX designs in Penpot using MCP tools. Use this skill when: (1) Creating new UI/UX designs for web, mobile, or desktop applications, (2) Building design systems with components and tokens, (3) Designing dashboards, forms, navigation, or landing pages, (4) Applying accessibility standards and best practices, (5) Following platform guidelines (iOS, Android, Material Design), (6) Reviewing or improving existing Penpot designs for usability. Triggers: "design a UI", "create interface", "build layout", "design dashboard", "create form", "design landing page", "make it accessible", "design system", "component library".

shopify-dev

Search Shopify developer documentation across all APIs. Use only when no API-specific skill applies.

hono

Use when building Hono web applications or when the user asks about Hono APIs, routing, middleware, JSX, validation, testing, or streaming. TRIGGER when code imports from 'hono' or 'hono/*', or user mentions Hono. Use `npx hono request` to test endpoints.

api-security-testing

Security-test a REST, GraphQL, or gRPC API with Strix — autonomous agents that enumerate endpoints from an OpenAPI/GraphQL schema (or by crawling), then actually exploit the API-specific vulnerability classes in the OWASP API Security Top 10 (2023) — broken object-level authorization (BOLA/IDOR), broken object property level authorization (excessive data exposure and mass assignment), broken function-level authorization, unrestricted resource consumption, SSRF, injection, and auth/token flaws. Every finding comes with a working proof-of-concept request. Use when the user asks to pentest, security-test, audit, or find vulnerabilities in an API, endpoint, or backend service.

influencer-discovery-brief

Define creator sourcing criteria and produce the discovery brief used to shortlist candidate influencers and creators - weighted criteria for audience fit, engagement quality, niche consistency and brand safety, knockout screens, and a ranked shortlist scoring template with evidence per score. Covers B2C brand campaigns and B2B creator and thought-leader programs. Use whenever the user mentions finding creators, vetting influencers, audience fit, creator shortlists, or deciding which creators to approach, even if they never say discovery. Runs before any contact. Do NOT use for writing the pitch message itself - use mbfinotti/partnerships-skills@influencer-outreach instead.

create-implementation-plan

Create a new implementation plan file for new features, refactoring existing code or upgrading packages, design, architecture or infrastructure.

partner-marketplace-strategy

Decide which third-party marketplaces to list on, how much to invest in each, what ROI to expect, and when to delist - marketplace prioritization for partner teams. Covers cloud marketplace listing strategy, SaaS app store and integration directory prioritization, and retail marketplace selection for ecommerce (1P vs 3P vs hybrid), with a readiness gate, weighted scorecard, and provenance-flagged ROI expectations. Use whenever the user mentions AWS, Azure or GCP marketplaces, an app store listing, an integration directory, or asks whether a marketplace listing is worth it, even if they never say marketplace strategy. Do NOT use for choosing which partner category to launch next - use mbfinotti/partnerships-skills@partner-ecosystem-expansion instead.

china-stock-analysis

A股价值投资分析工具，提供股票筛选、个股深度分析、行业对比和估值计算功能。基于价值投资理论，使用akshare获取公开财务数据，适合低频交易的普通投资者。

owasp-top-10-testing

Test an application against the OWASP Top 10 with Strix — autonomous AI agents that attempt real exploits for each category of the current OWASP Top 10:2025 (broken access control including SSRF, security misconfiguration, software supply chain failures, cryptographic failures, injection, insecure design, authentication failures, integrity failures, logging and alerting failures, mishandling of exceptional conditions) and report only what they could actually prove, mapped back to the category with a proof-of-concept. Also covers the OWASP API Security Top 10 (2023). Use when the user asks for an OWASP Top 10 assessment, OWASP compliance testing, or a security review mapped to OWASP categories.

partner-ecosystem

Map a company's partner and channel ecosystem as a strategy exercise - an inventory of every partner type (resellers, distributors, MSPs, ISVs, SIs, affiliates, marketplaces, plus retail, creator, licensing and co-branding partners for consumer brands), partner account overlap analysis, channel coverage gaps and conflict zones, a weighted partner scorecard, and a prioritization 2x2. Use whenever the user mentions partner ecosystem mapping, a partner landscape, channel coverage, partner type classification, ecosystem whitespace, or which partner categories deserve investment, even if they never say ecosystem. Do NOT use for sequencing which category to launch next - use mbfinotti/partnerships-skills@partner-ecosystem-expansion instead.

co-selling-strategy

Design the operating model for how direct sales and partner sellers collaborate on shared deals - deal registration policy (protection windows, approval SLA, rejection grounds), deal credit and attribution split (partner-sourced vs partner-influenced, comp neutrality), and channel rules of engagement between direct and partner sellers. Covers B2B co-sell motions at the policy level. Use whenever the user mentions co-selling, partner deal registration, deal credit splits, partner attribution policy, or reps and partners working the same account, even if they never say co-sell. Do NOT use for adjudicating a live contested deal - use mbfinotti/partnerships-skills@partner-channel-conflict instead.

application-security-testing

Application security testing (AppSec) across a whole product with Strix — decide which asset needs which test (source code, running web app, API, CI pipeline), run it, and turn the results into a ranked remediation plan. Autonomous agents exploit and prove each issue instead of emitting static-analysis alerts, so the plan is ordered by what is actually reachable. Use when the user asks for an application security review or audit, an appsec assessment, vulnerability scanning across their stack, a security review before a launch or a customer security questionnaire, or does not yet know which kind of security test they need.

influencer-outreach

Draft the personalized first-touch pitch message and follow-up plan used to propose a partnership to one already-vetted influencer or creator - personalization angle, the compensation stated on offer, a message fitted to the channel the creator actually lists (email, DM, or their manager), and a bounded follow-up cadence. Covers B2C brand collabs and B2B creator programs (newsletter writers, podcasters, industry experts). Use whenever the user mentions pitching a creator, DMing an influencer, a collab proposal, or a creator outreach message, even if they never say outreach. Stops at the first positive reply. Do NOT use for list-scale affiliate recruitment - use mbfinotti/partnerships-skills@affiliate-recruitment-outreach instead.

joint-gtm-planning

Plan one joint go-to-market motion with one already-chosen partner - the joint value proposition, co-marketing campaign shape, launch sequencing, budget and market-development funds, the lead-sharing and attribution agreement, and the closing debrief. Covers B2B vendor-to-vendor co-marketing, consumer co-branding, and creator collaborations. Use whenever the user mentions a joint GTM plan, partner co-marketing, a joint webinar or integration launch, or a better-together story with a named partner, even if they never say GTM. Macro strategy only, no ad copy, email bodies, or asset production. Do NOT use for direct-vs-partner deal policy - use mbfinotti/partnerships-skills@co-selling-strategy instead.

golang-pkg-go-dev

Golang package and module lookup via `godig`, a pkg.go.dev API client (CLI + MCP server). Use for any Go/Golang library's documentation, API signatures, symbols, usage examples, which versions exist, licenses, whether a dependency has CVEs, or who imports a package — prefer this over Context7 for any Go package or module. Read-only, no auth. Not for upgrading dependencies (→ See `samber/cc-skills-golang@golang-dependency-management` skill), choosing a library (→ See `samber/cc-skills-golang@golang-popular-libraries` skill), or local symbols and an already-used dependency's resolved source, call sites, and generic instantiations (→ See `samber/cc-skills-golang@golang-gopls` skill).

seeker-genesis-token

Verify Seeker device ownership by checking for the Seeker Genesis Token (SGT) with Sign-in-with-Solana and server-side token verification. Use when gating content or rewards to Seeker owners, verifying a user holds an SGT, adding anti-Sybil checks to a Solana mobile app, or implementing one-claim-per-device logic.

seo

Use and read this skill immediately if the user request is in any way related to SEO or a site's organic search or AI search presence. That includes site audits, rankings, keyword research, competitors, backlinks, click or traffic changes, indexing problems, crawling, redirects, sitemaps, metadata, structured data, Core Web Vitals, internal links, content opportunities, programmatic SEO, local search, Search Console, Google Analytics or Clicky questions, Google update impact, llms.txt, AI search visibility in ChatGPT, Claude, Perplexity, or Google AI Overviews, and client SEO reporting. Routes to evidence-backed local reports through the SEO CLI and MCP server.

golang-refactoring

Golang refactoring — safe, at-scale restructuring of existing Go code: a coverage-adaptive safety net, behavior-preserving transforms (gopls Rename/Extract, `gofmt -r`, `gopatch`), the Fowler catalog mapped to Go, breaking import cycles, and small stacked PRs. Apply when a function or type has grown too large, a code smell blocks a feature, or the user asks to refactor Go code — also for renaming at scale, extracting functions or interfaces, moving code between packages, or planning a multi-step refactor. Target styles owned elsewhere → See `samber/cc-skills-golang@golang-naming` (renames), `samber/cc-skills-golang@golang-project-layout` (splits), `samber/cc-skills-golang@golang-modernize` (idioms), `samber/cc-skills-golang@golang-code-style` (control flow), `samber/cc-skills-golang@golang-design-patterns` (patterns/DI).

connector-twilio

EXPERIMENTAL, NOT YET VERIFIED AGAINST LIVE TWILIO, and it spends real money — every message is billed, and a US-bound production number additionally needs A2P 10DLC registration (fees, weeks of lead time). Say both things to the user before building. That said, if a Caffeine build does send SMS or MMS, or configures Twilio messaging, from a canister, the `twilio-client` mops package (Twilio REST API) with a canister-held HTTP Basic credential is the only supported path. Hand-rolling `ic.http_request` calls to `api.twilio.com` or `messaging.twilio.com` is a FORBIDDEN anti-pattern — it bypasses the typed bindings, the per-operation host routing, the Basic-Auth header construction, and above all the non-replicated outcall default that stops one `send` from becoming ~13 billed messages. Load this skill whenever the user, spec, or any prior task mentions SMS, MMS, "text message", "send a text", phone numbers, Twilio, a Messaging Service, A2P 10DLC, toll-free verification, short codes, or an alphanumeric sender — and BEFORE writing any code that touches a Twilio endpoint.

base44-cli

The base44 CLI is used for EVERYTHING related to base44 projects: resource configuration (entities, backend functions, realtime actors, ai agents), initialization and actions (resource creation, deployment). This skill is the place for learning about how to configure resources, including actors — the realtime/WebSocket primitive behind multiplayer, collaborative boards, presence and live cursors, in-room chat, and live auctions. When you plan or implement a feature, you must learn this skill

reddit-research

Do market research, user research, and product validation on Reddit with semantic search across 50K+ subreddits, 20M+ posts, and 40M+ comments via reddapi.dev - search by meaning, not keywords, no Reddit OAuth or app registration needed. Use when the user wants to research what people say on Reddit, find user pain points and complaints, validate a product or niche idea, do competitor and market research, track subreddit trends over a date range, or discover which subreddits discuss a topic. Also use when the user mentions 'Reddit research', 'Reddit 调研', 'search Reddit', 'subreddit discovery', 'niche validation', 'pain points', 'user complaints', or 'Reddit trends'. Requires REDDAPI_API_KEY. For B2B lead scoring, see reddit-leads; for a bare API reference, see reddit-search-api.

reddit-search-api

Pure API reference for reddapi.dev - authentication, all endpoints (vector search, semantic search, trends, subreddit lookup), request parameters, response schemas, and error codes, with no research-workflow framing. Use when the user wants raw endpoint documentation, is debugging a reddapi.dev integration, needs exact request/response field names, or asks for 'reddapi API reference', 'reddapi.dev endpoints', or 'reddapi error codes'. For guided research workflows and query playbooks, see reddit-research. For B2B lead scoring, see reddit-leads.

reverse-engineer-anything

Reverse engineer native, managed, Electron/JavaScript, packaged, firmware, and browser targets with REA. Use shipped-artifact or requested runtime evidence to explain features, compare versions, decompile code, or guide a reconstruction. Skip REA for ordinary source-repository architecture analysis.

devrel-content-calendar

Plans a quarter of developer-relations content as a dated slot plan with named owners and reviewers - fixed anchors (releases, launches, CFP deadlines, conferences), a surface, pillar, journey and shelf-life mix, and sizing against real writing and review capacity. Use whenever the user asks for a devrel content calendar, an editorial calendar or content plan for a developer audience, what to publish next quarter, how to balance evergreen against launch-tied content, how many pieces a small team can ship, or says their content plan keeps slipping - even if they only say "we publish randomly". Plans the quarter only; individual pieces go to the per-format skills such as samber/developer-relations-skills@engineering-blog-post.

devrel-analytics

Builds the tracking plan that instruments developer-relations surfaces - docs, blog, repositories, package registries, community venues, and off-web appearances - with an event taxonomy, an identity spine, link-tagging discipline, source-confidence labelling, and funnel views. Use when the user says "devrel tracking plan", "docs analytics", "utm discipline", "event taxonomy for our docs", "our GitHub numbers don't match analytics", "how do we instrument the developer funnel", "join docs traffic to signups", or wants to know why devrel numbers disagree between tools. Instrumentation layer only - which KPIs deserve a target belongs to samber/developer-relations-skills@devrel-metrics.

tech-podcast-interview-prep

Prepares a guest for someone else's technical podcast, YouTube interview, livestream or panel - show reconnaissance, the angle, an ABT message spine backed by evidence and stories, a self-contained opening answer, clip-safe sound bites, depth calibration, recording-day mechanics, and the post-publication promotion loop. Use whenever someone says "podcast guest prep", "I'm going on a podcast next week", "youtube interview prep", "devrel media training", "prep my talking points", "sound bites", "I'm on a panel", or "what do I say when they ask about competitors" - even if they only mention an upcoming recording. Not running your own show - use samber/dev-event-organizer-skills@tech-podcast-youtube-channel.