Skills worth trusting.
Agent skills from Anthropic, OpenAI, skills.sh, ClawHub, SkillsMP and other reputable sources. Savant assesses them for security risks and evaluates model-generated test cases using independent scoring. Workspaces import any skill into their own repositories through a reviewed pull request. Every listing on each hub is enumerated; packages are fetched, scanned and evaluated most-popular first as daily capacity allows.
code-review
Use when receiving code review feedback (especially if unclear or technically questionable), when completing tasks or major features requiring review before proceeding, or before making any completion/success claims. Covers three practices - receiving feedback with technical rigor over performative agreement, requesting reviews via code-reviewer subagent, and verification gates requiring evidence before any status claims. Essential for subagent-driven development, pull requests, and preventing false completion claims.
web-performance-optimization
Optimize website and web application performance including loading speed, Core Web Vitals, bundle size, caching strategies, and runtime performance
symfony:api-platform-filters
Implement API Platform filters - v4 Parameters API (QueryParameter) and legacy
metal-shader-expert
20 years Weta/Pixar experience in real-time graphics, Metal shaders, and visual effects. Expert in MSL shaders, PBR rendering, tile-based deferred rendering (TBDR), and GPU debugging. Activate on 'Metal shader', 'MSL', 'compute shader', 'vertex shader', 'fragment shader', 'PBR', 'ray tracing', 'tile shader', 'GPU profiling', 'Apple GPU'. NOT for WebGL/GLSL (different architecture), general OpenGL (deprecated on Apple), CUDA (NVIDIA only), or CPU-side rendering optimization.
creator-outreach
Build creator lead lists for TikTok, Instagram, and X by turning normalized platform datasets into outreach-ready leads with contact signals, shortlist logic, and draft outreach messages. Use this when the user wants creator discovery, contact extraction, shortlist building, or outreach prep.
wp-plugin-development
Use when developing WordPress plugins: architecture and hooks, activation/deactivation/uninstall, admin UI and Settings API, data storage, cron/tasks, security (nonces/capabilities/sanitization/escaping), and release packaging.
four-meme-ai
CLI tool for creating and trading meme tokens on Four.Meme (BSC), with structured JSON outputs for config, token details, pricing quotes, on-chain events, and TaxToken fee configuration.
conversion-psychology
Use when optimizing sponsored or affiliate video scripts to convert, diagnosing why content is not driving action, or choosing which persuasion lever fits an offer. Keywords - buyer psychology, emotional triggers, social proof, scarcity, urgency, authority, reciprocity, loss aversion, why people buy.
timing-principle-mastery
Use when determining animation durations, controlling pacing, establishing rhythm, or making motion feel appropriately weighted and emotionally resonant.
klaviyo
Klaviyo email/SMS marketing - profiles, events, flows, segmentation
longbridge-corporate-events
Corporate event-driven analysis via Longbridge Securities — captures and classifies events that create pricing dislocations: major-shareholder increases/decreases, equity incentives, private placements, rights issues, buybacks, M&A/restructuring, index rebalancing, and management changes. Combines filings, corporate actions, and shareholder data to produce event signals. Triggers: "公司事件", "事件驱动", "大股东增持", "大股东减持", "股权激励", "定增", "配股", "回购", "并购重组", "指数调整", "管理层变更", "公告分析", "公司事件", "事件驅動", "大股東增持", "大股東減持", "股權激勵", "定增", "配股", "回購", "並購重組", "指數調整", "corporate event", "event-driven", "share buyback", "equity incentive", "major shareholder increase", "rights issue", "M&A arbitrage", "index rebalancing", "insider buying", "corporate action analysis".
good-thinking
Diagnose thinking failures and maintain process-sovereignty by auditing cognitive orientation and operation balance.
upload-post
Upload content to social media platforms via Upload-Post API. Use when posting videos, photos, text, or documents to TikTok, Instagram, YouTube, LinkedIn, Facebook, X (Twitter), Threads, Pinterest, Reddit, or Bluesky. Supports scheduling, analytics, FFmpeg processing, and upload history.
upbit
Use upbit CLI for Upbit REST API — spot orders, market data, withdrawals, deposits, travel rule, account management. 업비트 CLI로 시세 조회, 주문, 잔고 확인, 입출금을 처리합니다. Trigger this skill whenever the user wants to query prices, place/cancel orders, check balances, withdraw or deposit assets, or interact with the Upbit exchange API — in any language. 사용자가 업비트 시세·주문·잔고·입출금을 언급하면 반드시 이 스킬을 사용하세요.
shiplight
Shiplight QA toolkit — the single entry point for all Shiplight test/QA work. Use ONLY when the user explicitly says 'shiplight' (e.g. 'write a shiplight test', 'use shiplight to verify X', 'shiplight cover') or invokes /shiplight. Routes to subcommands: init, setup-test-auth, update, create-yaml-tests, create-agent-verification, cover, fix, verify, review, ci, cloud, support, help.
excalidraw-skill
Excalidraw canvas toolkit for creating, editing, and refining diagrams on a live canvas. Use when an agent needs to (1) draw or lay out diagrams, (2) iteratively refine them by describing the scene and screenshotting its own work, (3) export/import .excalidraw files or PNG/SVG images, (4) save/restore canvas snapshots, (5) convert Mermaid to Excalidraw, or (6) perform element-level CRUD, alignment, distribution, grouping, duplication, and locking. Primary interface is the bundled CLI (npx -y mcp-excalidraw-server <command>) which auto-starts the canvas server; MCP tools and a REST API are equivalent alternatives.
release-review
Senior developer-level release review for macOS/iOS apps. Identifies security, privacy, UX, and distribution issues with actionable fixes. Use when preparing an app for release, want a critical review, or before App Store submission.
security-headers-configuration
Configure HTTP security headers including CSP, HSTS, X-Frame-Options, and XSS protection. Use when hardening web applications against common attacks.
setup-fa
Set up Font Awesome in a project from scratch, including Kit download and package configuration
Writing Skills
TDD for process documentation - test with subagents before writing, iterate until bulletproof
Remembering Conversations
Search previous Claude Code conversations for facts, patterns, decisions, and context using semantic or text search
exploiting-sql-injection-vulnerabilities
Identifies and exploits SQL injection vulnerabilities in web applications during authorized penetration tests using manual techniques and automated tools like sqlmap. The tester detects injection points through error-based, union-based, blind boolean, and time-based blind techniques across all major database engines (MySQL, PostgreSQL, MSSQL, Oracle) to demonstrate data extraction, authentication bypass, and potential remote code execution. Activates for requests involving SQL injection testing, SQLi exploitation, database security assessment, or injection vulnerability verification.
notion-knowledge-capture
Capture conversations and decisions into structured Notion pages; use when turning chats/notes into wiki entries, how-tos, decisions, or FAQs with proper linking.
research-integration
Research a vendor, product, or feature to collect all information needed before building an Elastic integration. Investigates data collection methods, API or log documentation, sample data formats, field schemas, ECS mapping candidates, and configuration requirements. Outputs a structured research brief to research_results/<product>/. Invoke manually with /research-integration.
tauri-solidjs
Tauri 2.x + SolidJS stack for OpenWork native app
forms-inputs
Use when animating form fields, inputs, textareas, selects, or interactive form elements to improve usability and feedback
orchestrated-sequences
Use when building multi-part animation sequences - staggered reveals, choreographed UI, coordinated motion where multiple elements work together
apify-ecommerce
Scrape e-commerce data for pricing, reviews, bestsellers, and seller discovery across 30+ platforms including Amazon, Walmart, eBay, Shopify, WooCommerce, and more. Use when user asks about product prices, competitor analysis, store scraping, tech stack detection, food delivery, real estate, or marketplace intelligence.
subagent-driven-development
Use when executing implementation plans with independent tasks in the current session
arduino-project-builder
Build complete Arduino and embedded projects across Arduino IDE, Arduino CLI, PlatformIO, and vendor-specific toolchains. Use when users request an application combining firmware, sensors, actuators, networking, power, or deployment rather than a code snippet. The bundled scaffold targets UNO, ESP32, and Raspberry Pi Pico; use the board profile and document limitations for other targets.
scene-structure-techniques
Use when structuring scenes or planning chapter content - provides scene-sequel framework, tension management, and beat-by-beat structure for compelling scenes
idea-discovery-robot
Workflow 1 adaptation for robotics and embodied AI. Orchestrates robotics-aware literature survey, idea generation, novelty check, and critical review to go from a broad robotics direction to benchmark-grounded, simulation-first ideas. Use when user says "robotics idea discovery", "机器人找idea", "embodied AI idea", "机器人方向探索", "sim2real 选题", or wants ideas for manipulation, locomotion, navigation, drones, humanoids, or general robot learning.
rebuttal
Workflow 4: Submission rebuttal pipeline. Parses external reviews, enforces coverage and grounding, drafts a safe text-only rebuttal under venue limits, and manages follow-up rounds. Use when user says "rebuttal", "reply to reviewers", "ICML rebuttal", "OpenReview response", or wants to answer external reviews safely.
reelary
Reelary, the 100% local AI media library for your own videos and photos on Mac and Windows: install and connect it, index folders and external drives, check indexing progress, remove folders, fix errors. Use when the reelary_* tools are missing or fail, or the user wants to organize footage. Trigger on "Reelary", "media library", "index my videos", "organize my footage", "catalog my clips", "scan my drive", "make my footage searchable", "video library app", "digital asset management for video", "local video search app". Not for cloud storage or renaming files.
godot-input-handling
Expert patterns for input handling covering InputMap actions, InputEvent processing, controller support, rebinding, deadzones, and input buffering. Use when setting up player controls, implementing input systems, or adding gamepad/accessibility features. Keywords InputMap, InputEvent, gamepad, controller, rebinding, deadzone, input buffer.
setup-timescaledb-hypertables
Use this skill when creating database schemas or tables for Timescale, TimescaleDB, TigerData, or Tiger Cloud, especially for time-series, IoT, metrics, events, or log data. Use this to improve the performance of any insert-heavy table. **Trigger when user asks to:** - Create or design SQL schemas/tables AND Timescale/TimescaleDB/TigerData/Tiger Cloud is available - Set up hypertables, compression, retention policies, or continuous aggregates - Configure partition columns, segment_by, order_by, or chunk intervals - Optimize time-series database performance or storage - Create tables for sensors, metrics, telemetry, events, or transaction logs **Keywords:** CREATE TABLE, hypertable, Timescale, TimescaleDB, time-series, IoT, metrics, sensor data, compression policy, continuous aggregates, columnstore, retention policy, chunk interval, segment_by, order_by Step-by-step instructions for hypertable creation, column selection, compression policies, retention, continuous aggregates, and indexes.
qa-testing-strategy
Designs risk-based test strategy for software delivery. Use when defining coverage, setting CI gates, managing flaky tests, choosing test layers, or establishing release criteria.
skill-security-audit
Detect malicious patterns in AI Agent skills — 13 detectors for backdoors, credential theft, data exfiltration, and supply-chain attacks. Based on SlowMist's ClawHub threat intelligence (472+ malicious skills). Pure Python, zero dependencies.
codex-review
Professional code review with auto CHANGELOG generation, integrated with Codex AI. Use when you want professional code review before commits, you need automatic CHANGELOG generation, or reviewing large-scale refactoring.
voice-ai-integration
Integrate Shengwang products: ConvoAI voice agents, RTC audio/video, RTM messaging, Cloud Recording, and token generation. Use when the user mentions Shengwang, 声网, ConvoAI, RTC, RTM, voice agent, AI agent, video call, live streaming, recording, token, or any Shengwang product task.
blitzreels-video-editing
Edit a BlitzReels project through REST. Use for timeline, captions, media, previews, or exports.
cli-anything-chromadb
Command-line interface for ChromaDB - A stateless CLI for managing vector database collections, documents, and semantic search. Designed for AI agents and automation via the ChromaDB HTTP API v2.
prototype
Concept prototype before GDDs — throwaway HTML, Engine or Paper build, PROCEED/PIVOT/KILL/NOT ASSESSED. After /brainstorm and /setup-engine.
loaders-spinners
Use when creating loading indicators, spinners, progress bars, or skeleton screens to communicate system status
lyric-diagnostic
Diagnose lyric problems across prosody, rhyme, meaning, register, sound, and structure. Use when AI-generated or human lyrics feel flat, cliched, awkward, or mismatched.
skill-creation-guide
Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Claude's capabilities with specialized knowledge, workflows, or tool integrations.
reddit-insights
Search and analyze Reddit content using semantic AI search via reddit-insights.com MCP server. Use when you need to: (1) Find user pain points and frustrations for product ideas, (2) Discover niche markets or underserved needs, (3) Research what people really think about products/topics, (4) Find content inspiration from real discussions, (5) Analyze sentiment and trends on Reddit, (6) Validate business ideas with real user feedback. Triggers: reddit search, find pain points, market research, user feedback, what do people think about, reddit trends, niche discovery, product validation.
pp-google-search-console
Every Google Search Console feature you'd reach for, plus an offline SQLite cache that powers period compare, quick... Trigger phrases: `search console performance for example.com`, `quick wins for sc-domain:example.com`, `cannibalization audit on this site`, `compare last 28 days to prior period in GSC`, `why did traffic drop on this property`, `which pages are decaying`, `use google-search-console`, `run gsc`.