Skills worth trusting.
Agent skills from Anthropic, OpenAI, skills.sh, ClawHub, SkillsMP and other reputable sources. Savant assesses them for security risks and evaluates model-generated test cases using independent scoring. Workspaces import any skill into their own repositories through a reviewed pull request. Every listing on each hub is enumerated; packages are fetched, scanned and evaluated most-popular first as daily capacity allows.
tab-accordion
Deprecated compatibility entry for Tabs and Accordion construction. This component is now maintained in Bricks; install and use component-builder to build a new Tabs and Accordion.
scipy-best-practices
Best practices for SciPy scientific computing, optimization, signal processing, and statistical analysis in Python
pdf-creator
Converts Markdown to print-ready PDF with proper Chinese typography, themes and a visual self-check. Use for Markdown → PDF, including documents formatted for printing or mobile reading. Not for Word/WPS files or Word output (use docx-creator).
tao-run-on-lepton
DGX Cloud Lepton managed GPU compute platform with run/status/cancel interface. Use when submitting TAO jobs to DGX Cloud, dispatching training/eval/inference to Lepton GPU resources, or managing Lepton workspace deployments. Trigger phrases include "run on Lepton", "submit to DGX Cloud", "Lepton job", "managed GPU on DGX Cloud".
momentum-planner
Use when the user asks to "keep the launch momentum going after launch week", "plan a changelog / release-notes cadence as GTM", or "is this update worth a relaunch"; produces a T+1→T+30 momentum plan — a launch-moment calendar (milestone / shipped-loop / badge moments only), announcement-tier routing (major = full-channel, medium = targeted, minor = changelog-only), a relaunch legitimacy call, spike-to-owned handoff briefs, and the next Tier-1 moment with launch-stacking spacing. Not for the 30-day content-reuse map or paid amplification execution — use content-amplifier; not for planning the next launch end to end — use launch-tier-planner. 抗第二周断崖/changelog-as-GTM/relaunch/下一发布时刻
huashu-md-html
md/html/docx/pdf/epub 多向流水线，落地「md 生产，多端消费」。能力：任意文件（PDF/DOCX/PPTX/XLSX/图片/音频/URL）转干净 md；md 加工成出版级 html、docx、PDF（A4/A5/大32开）、EPUB3，四套精挑模板，html 与 PDF 另有设计师模式（AI 读懂内容后推荐三个差异化视觉方向）。SKIP：需要新生成图片、或只做压缩截图的任务。
onlyfans-video-downloader
Download videos & images from Onlyfans profiles to backup media or enjoy offline
narrative-drift-monitor
Use when the user asks to "check if our surfaces have drifted from the canon", "watch for competitor repositioning", or "define when we should reposition"; produces a drift report — self-drift per flagship surface vs the narrative-registry canon over time (via wayback.py, change history Measured with as-of dates), competitor-repositioning alerts, an explicit repositioning-trigger condition set, and a D1/W1/M1 message-shift retro (intended vs actual pull-through, evidence-labeled) — feeding the TALE L drift-audit sub-items and the narrative-whiplash guardrail fact base. Not for the first-time consistency check before a surface ships — use narrative-cascade-planner; not for computing the TALE profile result or running the vetoes — use narrative-quality-auditor; not for echo-rate / AI-answer resonance measurement — use narrative-resonance-monitor. 自漂移监测/竞品重定位告警/重定位触发/叙事漂移复盘
agentmail-toolkit
Add AgentMail tools to agent frameworks with the TypeScript or Python AgentMail Toolkit. Use for Vercel AI SDK, LangChain, OpenAI Agents SDK, LiveKit Agents, or MCP adapters; do not use for direct mailbox operations, raw SDK implementation, CLI usage, or MCP client setup.
participation-warmup-planner
Use when the user asks to "plan the participation ramp before we promote", "how much account history or karma do we need in this community", or "design entry incentives and member lifecycle for our own Discord"; produces the per-community pre-promotion warming plan — account-history/tenure expectations (Estimated, named sources), a give-before-ask ledger spec, a per-community etiquette + rule digest with last-verified dates, and the warming → active graduation criteria that channel-registry requires as state-transition evidence — plus the owned-community variant (entry paths + member lifecycle for your own Discord/Slack/forum/企业微信私域). Not for launch-day submissions or T-0 threads — use community-launch-runner. 社区预热/先给后取/账号养成/毕业标准
narrative-resonance-monitor
Use when the user asks to "measure how our narrative is landing", "track echo rate against our canon lexicon", or "check how AI answer engines describe our brand"; produces a resonance report — echo rate (overlap of market language with the narrative-registry canon lexicon, method declared), AI-answer perception via tavily.py --answer (proxy-labeled), share-of-voice on a locked competitor panel (reusing share-of-voice-tracker), and resonance signals from bluesky.py / gdelt.py / pageviews.py — every number labeled Measured / proxy / User-provided, feeding the TALE E dimension and the upstream of the E1 evidence-integrity veto. Not for rebuilding share-of-voice machinery — use share-of-voice-tracker; not for own-site GA4/GSC analytics — use performance-monitor; not for scoring TALE profile result — use narrative-quality-auditor; not for adjudicating claims — use offer-claims-registry. 回声率/AI回答感知/份额之声/共鸣信号
qiaomu-opencli-explorer
Use when creating a new OpenCLI adapter from scratch, adding support for a new website or platform, exploring a site's API endpoints via browser DevTools, or when a user asks to automatically generate a CLI for a website (e.g. "帮我生成 xxx.com 的 cli"). Covers automated generation, API discovery workflow, authentication strategy selection, TS adapter writing, and testing.
sf-datacloud
Salesforce Data Cloud product orchestrator for connect→prepare→harmonize→segment→act workflows. TRIGGER when: user needs a multi-step Data Cloud pipeline, asks to set up or troubleshoot Data Cloud across phases, manages data spaces or data kits, or wants a cross-phase `sf data360` workflow. DO NOT TRIGGER when: work is isolated to a single phase (use the matching sf-datacloud-* skill), the task is STDM/session tracing/parquet telemetry (use sf-ai-agentforce-observability), standard CRM SOQL (use sf-soql), or Apex implementation (use sf-apex).
elasticsearch-best-practices
Elasticsearch development best practices for indexing, querying, and search optimization
youtube-downloader
Download YouTube videos to your computer so you can watch them offline
seo-content-marketing-skill-factory
SEO & content marketing command suite with keyword research, content audits, SERP analysis, technical SEO and workflow automation
browser-control
Drive the user's existing Chromium-family browser with deterministic Playwright. Use when asked to inspect, automate, test, or interact with a visible browser tab; continue an authenticated browser workflow; handle 2FA, passkeys, CAPTCHAs, or payment confirmation; record browser behavior; or capture an authenticated network flow.
stripe-integration
Implement and verify Stripe checkout, subscriptions, webhooks and refunds with explicit server-side authorization and retry boundaries.
autoresearch
Orchestrates end-to-end autonomous AI research projects using a two-loop architecture. The inner loop runs rapid experiment iterations with clear optimization targets. The outer loop synthesizes results, identifies patterns, and steers research direction. Routes to domain-specific skills for execution, supports continuous agent operation via Claude Code /loop and OpenClaw heartbeat, and produces research presentations and papers. Use when starting a research project, running autonomous experiments, or managing a multi-hypothesis research effort.
webflow-cli:devlink
Export Webflow Designer components to React/Next.js code for external projects. Configure devlink settings in webflow.json, sync design updates with devlink sync, validate generated code, show diffs, and provide integration examples. Use when building with Webflow designs in React/Next.js.
product-manager-toolkit
Comprehensive toolkit for product managers including RICE prioritization, customer interview analysis, PRD templates, discovery frameworks, and go-to-market strategies. Use when prioritizing features, synthesizing user research, writing requirement documentation, or developing product strategy.
cli-providers
Manage provider connections from the CLI: list available/configured providers, add, test, test-all, validate, rotate API keys, and view per-provider metrics.
laravel-owasp-security
OWASP Top 10 security audit and secure coding guidelines for Laravel + React/Inertia.js applications. Use when auditing for vulnerabilities ("run OWASP audit", "security review", "check my app security") or writing secure Laravel code involving auth, payments, file uploads, or API design. Triggers on security-related tasks, payment handling, authentication, or any request to audit a Laravel codebase.
cyrus-setup-launch
Print a summary of the Cyrus setup and offer to start the agent.
crawl4ai-skill
Web crawling and scraping tool with LLM-optimized output. 网页爬虫爬取工具 | Web crawler, web scraper, spider. DuckDuckGo search, site crawling, dynamic page scraping. 智能搜索爬取 | Free, no API key required.
make-pr
Open a pull request for the current feature
ai-model-nodejs
Use this skill for Node.js backend AI via @cloudbase/node-sdk (>=3.16.0) — cloud functions, CloudRun, Express/Koa/NestJS, serverless APIs, scheduled jobs, LLM proxies, agent orchestration. The only SDK supporting image generation (ai.createImageModel + generateImage). Text via ai.createModel with groups cloudbase, hunyuan-exp, or custom-*; model ids (e.g. deepseek-v4-flash, glm-5, kimi-k2.6) go in the `model` field of generateText/streamText. MUST run two-step preflight before code — see body. NOT for browser/Web (use ai-model-web) or Mini Program (use ai-model-wechat).
upstash-box-py
Work with the upstash-box Python SDK for sandboxed cloud containers with AI agents, shell, filesystem, git, cron schedules, snapshots, and a headless browser. Use when building with Upstash Box in Python, creating a sandbox or isolated environment to run untrusted or agent-generated code, running AI coding agents in containers, giving an agent a cloud dev environment with a shell and repository, browser automation from a box, scheduling recurring jobs inside a box, saving and restoring snapshots, or orchestrating parallel boxes.
numpy-best-practices
Best practices for NumPy array programming, numerical computing, and performance optimization in Python
nba-data
NBA data via ESPN public endpoints, the NBA live CDN, and NBA Stats (stats.nba.com) — scores, standings, rosters, schedules, game summaries, play-by-play, injuries, futures, depth charts, leaders, and news, plus an analytics backend: advanced ratings, per-shot court coordinates, career splits, and history to 1946. Zero config, no API keys. Use when: user asks about NBA scores, standings, team rosters, schedules, game stats, box scores, play-by-play, injuries, transactions, betting futures, depth charts, team/player statistics, NBA news, shot charts, advanced ratings/pace, career stats, or historical NBA seasons. Don't use when: user asks about WNBA (use wnba-data), college basketball (use cbb-data), or other sports.
seo-agentic
Audit and fix agent readiness: the Lighthouse Agentic Browsing fraction, accessibility tree for agents, robots.txt and Content-Signal for AI agents, WAF treatment of agent traffic, llms.txt, Markdown delivery, ai-catalog.json, /.well-known discovery files, and WebMCP tools. Exclude AI citability and brand signals (seo-geo) and commerce protocol depth (seo-ecommerce).
docs-cleaner
Consolidates redundant documentation while preserving all valuable content; keeps a doc set truthful after things change. Modes: (1) POST-CHANGE GOVERNANCE — when code, scripts, config, env vars, ports, paths, deployment, auth, tests, or a documented procedure changed; also "which docs are now wrong", "check docs for inconsistencies", "过时的命令/路径", "文档同步". Use it even when the user mentions only the change and never the docs — updating them is part of the change, not optional cleanup. (2) CONSOLIDATION — "clean up docs", "documentation bloat", "reduce documentation sprawl", "consolidate documentation", "too many doc files", "merge redundant docs", "merge these docs", "文档太多/太乱", multiple files covering the same topic, or documentation exceeding 500 lines across multiple files on similar topics. Finds stale copies of a fact changed in only one place, values that should never have been persisted (counts, totals, "N items", restated summaries), rival definitions that drift apart, and orphaned cross-references.
game-research-websearch
Research a game, engine or modding technique on the open web with archive-aware, rate-limit-safe searches — Wayback Machine/archive.today for dead forums (XeNTaX, Zenhax, old threads), GitHub code/repo search, Nexus/Steam Workshop/Thunderstore APIs, Reddit JSON, YouTube transcripts, plus archive snapshots as evidence. Use when starting work on a game ("how did people mod X before?"), when a documented tool/link is dead, when forum threads are login-gated (semi-auto handoff to the human), and before writing a field note so claims carry source URLs.
pp-hackernews
Hacker News from your terminal — with a local SQLite store, snapshot history, and agent-native output no other HN tool has. Trigger phrases: `check hacker news`, `search hn`, `what is hn saying about`, `diff the hn front page`, `pulse on hn`, `look up hn user`, `hn who is hiring`, `hn top stories`, `use hackernews`, `run hackernews`.
etsy-offsite-ads
Offsite Ads analysis — when to opt out, ROI tracking, fee impact on margins, attribution
gmgn-callout-score
Decide whether to act on a caller's (喊单人) calls. Scores one call-out wallet on two axes — SELECTION (do the coins he calls actually run) and POST-CALL CONDUCT (does he sell into the attention his own call created) — then returns a follow / don't-follow verdict. The conduct axis is proved from the caller's own per-trade ledger, not from any self-reported field: for each sampled coin it compares the first buy, the call timestamp, and every sell after it, so "he dumped on his followers" is a measured sequence rather than an inference. USE THIS SKILL WHEN the user asks whether a caller is worth following: 这个喊单的能不能跟, 这个喊单号靠不靠谱, 喊单信誉分, 喊单评分, 他喊完会不会砸盘, 他是不是喊完就卖, 跟他的单能不能吃到, caller 评分, is this caller trustworthy, can I follow this caller's calls, does he dump after calling, call-out credibility score, score this caller. Accepts either a GMGN profile handle (twitter_username, e.g. the last path segment of a gmgn.ai/profile/<handle> link) or a wallet address; a handle is resolved to one (chain, wallet) pair in Step 0 and the resolution is always echoed. The same questions in any other language route here — match on meaning, not wording. DO NOT USE THIS SKILL for raw call-out data — "这个钱包 喊过什么单", "最新喊单", "谁在喊这个币", "KOL 在喊什么", the feed, the field dump, the 30d summary card — that is gmgn-callout, which owns every read of the callout endpoints and returns them untouched; this skill calls it and adds a verdict. Nor for a caller judged as a trader rather than as a caller ("这个钱包能不能跟单", "跟单评分", copy-trade backtest) — that is gmgn-wallet-analysis / gmgn-wallet-score, which read his trades and know nothing about his calls. Nor for a token the caller mentioned ("他喊的那个币安全吗", 尽调, rug check) — that is gmgn-contract-dd. Nor for a token creator's next launch ("这个 dev 的新盘能不能买") — that is gmgn-dev-score. A bare wallet address with no call-out intent stays with gmgn-wallet-analysis; a bare token address stays with gmgn-contract-dd. This skill needs the word 喊单 / caller / call-out in the ask to
checkout-integration
Guide for starting hosted Checkout Sessions, payment links, and overlay or inline checkout for one-time and recurring products; use subscription-integration for post-checkout lifecycle management.
pixabay-downloader
Access Pixabay's free stock photos
twilio-communications
Build communication features with Twilio: SMS messaging, voice calls, WhatsApp Business API, and user verification (2FA). Covers the full spectrum from simple notifications to complex IVR systems and multi-channel authentication.
pinterest-downloader
Download videos and images from Pinterest
avatar-video
Create AI avatar videos with precise control over avatars, voices, scripts, and backgrounds using HeyGen's v3 API (POST /v3/videos). Two modes: type="avatar" with avatar_id, or type="image" with an image AssetInput (Avatar IV). Use when: (1) Choosing a specific avatar and voice for a video, (2) Writing exact scripts for an avatar to speak, (3) Animating a photo into a speaking video (type="image"), (4) Transparent background videos with remove_background, (5) Integrating HeyGen avatars with Remotion, (6) Batch video generation with exact specs, (7) Brand-consistent production videos with precise control.
openclaw-security-watchdog
OpenClaw security scanning skill that performs comprehensive system security audits and generates human-friendly reports
audiocraft-audio-generation
PyTorch library for audio generation including text-to-music (MusicGen) and text-to-sound (AudioGen). Use when you need to generate music from text descriptions, create sound effects, or perform melody-conditioned music generation.
malware-analysis-dragonflyTomb-avast
Analyze and understand malware distribution techniques disguised as legitimate security software installers
dodo-best-practices
Guide for initial Dodo Payments setup, including SDK installation, test and live environments, API keys, and the canonical checkout-to-webhook architecture.
huashu-douyin-script
抖音爆款脚本创作工作流。从竞品视频拆解到脚本生成的完整流程：下载抖音视频→Gemini视频分析→爆款公式提炼→脚本+分镜生成→AI味审校。 当用户提到"抖音脚本"、"爆款拆解"、"竞品分析"、"带货脚本"、"千川素材"、"种草脚本"、"视频拆解"、"抖音视频分析"时使用此技能。
gdpr-dsgvo-expert
GDPR and German DSGVO compliance automation. Scans codebases for privacy risks, generates DPIA documentation, tracks data subject rights requests with Art. 12(3) one-month deadlines. Use when running GDPR compliance assessments, privacy audits, data protection planning, DPIA generation, or data subject rights (DSAR) management (e.g., 'check this service for GDPR risks', 'track an access request deadline'). Final compliance determinations route to the DPO or legal counsel.
omni-cli-tools
Manage CLI tool integrations exposed via the API. List, configure, and invoke CLI tool plugins that extend OmniRoute's automation surface.