Skills worth trusting.
Agent skills from Anthropic, OpenAI, skills.sh, ClawHub, SkillsMP and other reputable sources. Savant assesses them for security risks and evaluates model-generated test cases using independent scoring. Workspaces import any skill into their own repositories through a reviewed pull request. Every listing on each hub is enumerated; packages are fetched, scanned and evaluated most-popular first as daily capacity allows.
longbridge-news
Aggregated news, regulatory filings, and Longbridge-community discussion for a single stock — classified into catalyst / regulatory / strategic / financial / opinion / other, with a fact-only key-takeaway summary and a sentiment skew. Falls back to WebSearch only when data is sparse or stale, and labels the source. Triggers: "X 最近新闻", "X 公告", "市场对 X 财报怎么看", "X 社区讨论", "X 公司动态", "市场情绪", "最近怎么了", "X 最近新聞", "X 公告", "市場對 X 財報怎麼看", "X 社區討論", "recent news", "company filings", "market reaction", "what is everyone saying about X", "community sentiment", "8-K", "港交所披露", "earnings reaction".
rust-debugging
Rust debugging skill for systems programming. Use when debugging Rust binaries with GDB or LLDB, enabling Rust pretty-printers, interpreting panics and backtraces, debugging async/await with tokio-console, stepping through no_std code, or using dbg! and tracing macros effectively. Activates on queries about rust-gdb, rust-lldb, RUST_BACKTRACE, Rust panics, debugging async Rust, tokio-console, or pretty-printers.
pp-wikipedia
Printing Press CLI for Wikipedia. Wikipedia REST API. Get article summaries, search, browse related topics, and access on-this-day events. No...
flash-idf
当需要通过 ESP-IDF 工具链烧录固件到 ESP32 系列芯片，或启动调试会话时使用。
supabase-audit-auth-config
Analyze Supabase authentication configuration for security weaknesses and misconfigurations.
alphaear-signal-tracker
Track finance investment signal evolution and update logic based on new finance market information. Use when monitoring finance signals and determining if they are strengthened, weakened, or falsified.
cr-received
You MUST use this when findings from a code review, pull request comments, CI or static-analysis output, or reviewer suggestions need a decision before any fix - a cr-request result, a spec or plan review, or a reviewer's message - in any programming language. Verifies each finding against the current tree, decides accept, reject, partial, defer, or escalate with evidence, fixes only what holds up, records the decisions in the plan's execution record, and routes back to verify. Replaces devflow review-resolution.
skill-guard
Runtime security monitor for active OpenClaw skills. Watches file access, network calls, and shell commands. Flags anomalous behavior and enforces permission boundaries.
academic-deep-research
Transparent, rigorous research with full methodology — not a black-box API wrapper. Conducts exhaustive investigation through mandated 2-cycle research per theme, APA 7th citations, evidence hierarchy, and 3 user checkpoints. Self-contained using native OpenClaw tools (web_search, web_fetch, sessions_spawn). Use for literature reviews, competitive intelligence, or any research requiring academic rigor and reproducibility.
docker-compose
Define and run multi-container Docker applications using Docker Compose. Create compose files, manage service dependencies, configure networks and volumes, and orchestrate local development environments. Use when setting up multi-service applications or development environments.
git-workflow
Essential Git patterns for effective version control, eliminating redundant Git guidance per agent.
antfu-create-pr
Create a reviewable GitHub pull request from the current branch with a Conventional Commits title, a concise evidence-based body, and before/after screenshots for UI changes. Use when asked to open, create, publish, or prepare a PR.
comfyui-lora-training
Prepare datasets and configure LoRA training for character consistency. Covers FLUX (AI-Toolkit, SimpleTuner, FluxGym) and SDXL (Kohya_ss) training with step-by-step guidance. Use when training custom character LoRAs.
wordpress-plugin-core
Build secure WordPress plugins with hooks, database interactions, Settings API, custom post types, and REST API. Covers Simple, OOP, and PSR-4 architecture patterns plus the Security Trinity. Includes WordPress 6.7-6.9 breaking changes. Use when creating plugins or troubleshooting SQL injection, XSS, CSRF, REST API vulnerabilities, wpdb::prepare errors, nonce edge cases, or WordPress 6.8+ bcrypt migration.
prose-style
Diagnose sentence-level issues after structure is solid. Use when prose feels flat, sentences are monotonous, word choices are generic, or voice is inconsistent.
jira-communication
Use when handling Jira issues, sprints, boards, links, fields, worklogs, attachments, or users, or on any Jira intent without a key ("create/find a ticket", "pick a project"). Auto-triggers on Jira URLs and issue keys (PROJ-123). Also use when MCP Atlassian tools fail or are unavailable for Jira Server/DC.
feature-design-assistant
Turn ideas into fully formed designs and specs through natural collaborative dialogue. Use when planning new features, designing architecture, or making significant changes to the codebase.
integrate-whatsapp-calling
Connect voice agents to WhatsApp Calling through Kapso. Use for Calling setup, signed call webhooks, inbound answering, outbound permission and dialing, native recordings and transcripts, or debugging signaling and media with Pipecat, Pipecat Cloud, ElevenLabs Agents, or another provider.
webflow-mcp:compress-cms-image
Compress and convert CMS item image fields to webp or avif in a Webflow collection. Prompts for collection ID, item ID, image fields, quality, and target format, then downloads, converts, re-uploads via presigned S3, and publishes the updated item.
hive
Run the hive experiment loop — autonomous iteration on a shared task. Use when the agent is in a hive task directory and needs to run experiments, submit results, or participate in the swarm. Triggers on "hive", "run hive", "autoresearch", "start experimenting", "join the swarm", "start the loop", or when .hive/task file is detected.
cli-anything-godot
Agent-native CLI for Godot project management, scenes, exports, and script execution.
hf-cloud-python-env-setup
Set up an isolated Python environment for SageMaker / AWS work, with the right Python version and current boto3. Use this skill whenever Python code will be executed for a SageMaker deployment, training job, or any AWS automation — including when about to run `pip install`, when about to invoke `boto3`, when creating or activating a virtualenv, or when the user asks to "set up the environment". Never use system Python and never `pip install` into it. Always isolate. This skill prevents the most common failure modes: wrong Python version, dependency conflicts, and stale SDKs.
buttons-ctas
Use when animating buttons, CTAs, or clickable action elements to create satisfying, responsive interactions
agent-native-architecture
Build applications where agents are first-class citizens. Use this skill when designing autonomous agents, creating MCP tools, implementing self-modifying systems, or building apps where features are outcomes achieved by agents operating in a loop.
product-strategist
Strategic product leadership toolkit for Head of Product including OKR cascade generation, market analysis, vision setting, and team scaling. Use for strategic planning, goal alignment, competitive analysis, and organizational design.
expressjs-development
Comprehensive Express.js development skill covering routing, middleware, request/response handling, error handling, and building production-ready REST APIs
vscode-sftp-config
This skill should be used when setting up SFTP deployment for static websites to production servers, including converting projects from Docker/Express to static hosting, deploying Vue/React/Angular builds, setting up Slidev presentations, or configuring Hugo/Jekyll/Gatsby sites. Use this when the user asks to "setup SFTP deployment", "deploy static site to server", "configure Nginx for static files", "convert from Docker to static hosting", "deploy Vue build to production", "setup subdomain hosting", or "configure SFTP in VS Code". Provides SFTP configuration templates and production-ready Nginx configurations with security headers and caching.
nodejs-best-practices
Node.js development principles and decision-making. Framework selection, async patterns, security, and architecture. Teaches thinking, not copying.
planning-with-files
Implements Manus-style file-based planning for complex tasks. Creates task_plan.md, findings.md, and progress.md. Use when starting complex multi-step tasks, research projects, or any task requiring >5 tool calls.
accreditation-desk-review
Conduct an IPPF Member Association (MA) accreditation desk review against the IPPF EN Internal Guidelines Accreditation Review (Cycle 4 / ARV cycle, where ARV means Accreditation Review, NOT antiretroviral). Use when Ane assesses an MA self-assessment against accreditation principles, standards or checks, writes reviewer conclusions in the desk-review Word template, or prepares pre-interview document requests and interview questions, including on a bare principle, standard or check number ('do principle 8'). Not for literature reviews (evidence-synthesis), interview or survey guides (instrument-designer), indicator design (indicator-designer), or any clinical antiretroviral 'ARV' question.
figma-prototyping
Use when implementing Disney's 12 animation principles in Figma prototypes and Smart Animate
security-payloads
Essential exploitation payloads: anti-virus test files, file name exploits, malicious files. Curated for testing.
dtctl-release
Explain and operate the dtctl release process, which is automated by release-please. Use this skill whenever the user says "release", "ship it", "cut a release", "new version", "bump version", "publish", or asks how dtctl releases work, why a release PR exists, or how to trigger/finish a release.
groove-daily-end
End the workday: write memory, analyse tasks, run end hook. Use when wrapping up the day.
team-communications
Write internal company communications — 3P updates (Progress/Plans/Problems), company-wide newsletters, FAQ roundups, incident reports, leadership updates, status reports, project updates, and general internal comms. Use this skill any time the user asks to draft, edit, or format something meant for internal audiences. Trigger on keywords like "3P", "weekly update", "newsletter", "FAQ", "internal comms", "status report", "company update", "team update", "incident report", or any request to summarize work for leadership, teammates, or the broader company. Even casual requests like "write my update" or "summarize what my team did this week" should trigger this skill.
google-docs
Interact with Google Docs - create documents, search by title, read content, and edit text. Use when user asks to: create a Google Doc, find a document, read doc content, add text to a doc, or replace text in a document. Lightweight alternative to full Google Workspace MCP server with standalone OAuth authentication.
solid-principles
Use during implementation when designing modules, functions, and components requiring SOLID principles for maintainable, flexible architecture.
natural-dialogue-techniques
Use when writing dialogue scenes or when user asks about character conversations - provides techniques for natural, character-consistent dialogue that reveals character and advances plot
bluehammer-vulnerability-poc
Skill for working with the BlueHammer vulnerability proof-of-concept repository, covering build, usage, and code patterns.
webgl
WebGL shaders and effects for JARVIS 3D HUD
minimax-image-understanding
Analyze images using AI with the understand_image tool
codex-review
Run an independent code review using the OpenAI Codex CLI in headless mode. Gets a second opinion from a different model family (the current Codex models) on recent changes, a PR, a commit, or the whole app — covering bugs, regressions, security, data consistency, UX/state bugs, performance risks, and testing gaps. Saves a severity-prioritised report to .jez/reviews/. Triggers: 'codex review', 'review with codex', 'independent code review', 'what does codex think', 'get codex to review'.
home-assistant-awtrix
Manage AWTRIX 3 devices via HTTP filesystem and utility endpoints. Use when listing/uploading/renaming/deleting files, checking flash usage, configuring Wi-Fi, controlling LiveView, or importing LaMetric icons.
expo
Expo React Native performance optimization guidelines. This skill should be used when writing, reviewing, or refactoring Expo React Native code to ensure optimal performance patterns. Triggers on tasks involving React Native components, navigation, lists, images, animations, bundle optimization, or mobile performance improvements.
auth0-fastify
Use when adding session-based login, logout, or protected routes to a Fastify web application. Integrates @auth0/auth0-fastify — use even if the user says "add login to my Fastify app". For Fastify APIs validating Bearer tokens, use auth0-fastify-api instead.
auth0-expo
Use when adding Auth0 login, logout, or session management to an Expo app. Integrates react-native-auth0 with the Expo Config Plugin for native iOS/Android builds — use even if the user says "add login to my Expo app" without mentioning the SDK. Do not use for bare React Native CLI projects.
indicator-setup
Set up the Python environment for OpenAlgo indicator analysis. Installs openalgo, plotly, dash, streamlit, yfinance, matplotlib, seaborn, and creates the project folder structure.
hf-cloud-serving-image-selection
Pick the right serving container for a SageMaker model deployment and find its current image URI. Use this skill whenever about to deploy a model to a SageMaker endpoint and an image URI needs to be chosen — including when the user says "deploy this LLM", "host this HuggingFace model", "serve this fine-tuned model", "deploy this embedding model", "host a reranker", "serve a sentence-transformers model", or when about to hardcode any container URI in deployment code. HuggingFace-curated Deep Learning Containers are ALWAYS preferred: HuggingFace vLLM (LLMs and generative rerankers), HuggingFace vLLM-Omni (multimodal), TEI (embeddings/cross-encoder rerankers), HF Inference Toolkit (other transformers). Generic images (AWS vLLM, DJL-LMI, SGLang) are used only when no HuggingFace image is compatible — never merely because they carry a newer version. Never hardcode a container URI from memory and never default to TGI. Prevents stale-image failures and wrong-region URIs.