Skills worth trusting.
Agent skills from Anthropic, OpenAI, skills.sh, ClawHub, SkillsMP and other reputable sources. Savant assesses them for security risks and evaluates model-generated test cases using independent scoring. Workspaces import any skill into their own repositories through a reviewed pull request. Every listing on each hub is enumerated; packages are fetched, scanned and evaluated most-popular first as daily capacity allows.
upstash-box-remote-work
Do work in an Upstash Box, a sandboxed cloud container driven through the remote Upstash MCP server (mcp.upstash.com), instead of on the local machine. Use when the user asks to run, build, test, clone, or edit something remotely, in a sandbox, in the cloud, or in a box, when the deliverable is a pull request, a public preview URL, or a screenshot of a running app, when the local machine cannot deliver (no GitHub login for gh, no way to expose a port, a dirty or slow local checkout), when several independent tasks should run in parallel on separate machines, a code factory that turns a list of tasks into a list of pull requests, or when the deliverable is a video, screen recording, demo or timelapse of a browser, web app, terminal program or agent run. Applies whenever the session has the box_* and blob_* MCP tools, even when Upstash is not named.
release-checklist
Pre-release checklist — build verification, certification requirements, store metadata, launch readiness.
coding-standards
Universal coding standards, best practices, and patterns for TypeScript, JavaScript, React, and Node.js development.
manta-cli
Operate Manta-managed worktrees, folder contexts, terminals, repos, automations, artifacts, skill sharing, worktree comments, and Manta's embedded browser through the `manta` CLI. Use when the user says "$manta-cli", "Manta worktree", "child worktree", "spawn codex/claude in a worktree", "read/wait/send Manta terminal", "handoff" / "handover" / "give this to another agent", "Manta browser", "manta artifacts", or "share skills". Prefer it over raw git worktree, ad hoc PTYs, or Computer Use when Manta state is involved. Use Computer Use only when a visible window needs GUI control that a CLI, filesystem, or API cannot do.
longbridge-investment-proposal
Investment proposal generation via Longbridge Securities — produces a structured investment memo covering: executive summary, company overview, investment thesis (3–5 core points), financial analysis, valuation, catalysts and timeline, risk factors, and position recommendation. Triggers: "投资提案", "投资建议书", "投资报告", "投资摘要", "核心逻辑", "投资理由", "建仓建议", "投資提案", "投資建議書", "投資報告", "投資摘要", "核心邏輯", "建倉建議", "investment proposal", "investment memo", "investment summary", "investment rationale", "position recommendation", "investment case", "buy memo".
longbridge-post-investment
Post-investment monitoring via Longbridge Securities — tracks portfolio holdings vs plan on a quarterly / monthly basis, extracts key KPIs (revenue growth / gross margin / cash flow), flags deviations vs expectations, and generates a neutral monitoring report summarising KPI changes. For reference only — not investment advice. Triggers: "投后监控", "持仓监控", "定期复盘", "跟踪持仓", "持仓检视", "KPI跟踪", "业绩追踪", "投後監控", "持倉監控", "定期複盤", "追蹤持倉", "KPI追蹤", "post-investment monitoring", "position monitoring", "portfolio review", "KPI tracking", "performance tracking", "investment monitoring", "holding review".
api-documentation-generator
Generate comprehensive, developer-friendly API documentation from code, including endpoints, parameters, examples, and best practices
dependency-audit
Audit project dependencies, frameworks, languages, and dev tools for known vulnerabilities, CVEs, and security anti-patterns. Use when the user mentions 'dependency audit,' 'npm audit,' 'CVE,' 'vulnerable packages,' 'supply chain security,' 'outdated dependencies,' 'known vulnerabilities,' 'security advisory,' 'package security,' 'framework vulnerability,' 'is this package safe,' or needs to check whether their stack has known security issues.
longbridge-coverage-initiation
Initiating-coverage report framework — five-step workflow to generate an institutional-grade coverage initiation report: ① company overview ② industry positioning ③ financial modelling ④ valuation analysis ⑤ investment conclusion. Covers business description, competitive advantages, financial health, valuation multiples, price target, and risk factors. Triggers: "首次覆盖", "初始覆盖", "覆盖报告", "研报框架", "投资报告", "建立覆盖", "首次評級", "初始覆蓋", "覆蓋報告", "建立覆蓋", "initiate coverage", "coverage initiation", "first coverage", "equity research report", "investment report", "initiating coverage", "research initiation", "NVDA initiate coverage".
earnings-analysis
Create professional equity research earnings update reports (8-12 pages, 3,000-5,000 words) analyzing quarterly results for companies already under coverage. Fast-turnaround format focusing on beat/miss analysis, key metrics, updated estimates, and revised thesis. Includes 1-3 summary tables and 8-12 charts. Use when user requests "earnings update", "quarterly update", "earnings analysis", "Q1/Q2/Q3/Q4 results", or post-earnings report.
edu-chem-reaction
把一个化学反应做成自包含的微观 3D 交互演示网页：左/上为 Three.js 可交互分子动画 （拖滑块看断键·成键·原子重组，分步高亮），右为 KaTeX 反应方程 + 分步讲解 + 原子守恒计数 + 可选能量-反应进程曲线。支持三入口——给定文字反应/方程、随机出题、上传图片识别后演示。 覆盖燃烧、化合/分解/置换/复分解、氧化还原（电子转移可视化）、有机机理（酯化等含催化剂·过渡态）。 统一由 sympy 精确驱动：自动配平方程、校验原子守恒与原子映射、推导键的断/成，答案与几何同源一致。 内置两套引擎并自动选择：morph（原子变形，展示原子守恒）与 mechanism（机理关键帧，展示催化/过渡态）。 混合几何：默认自建 VSEPR 分子库，环境装有 RDKit 则可用其由 SMILES 生成构象（绝不自动安装）。 其他 agent 也可调用本技能生成此类网页。形态与 edu-solid-geometry / edu-analytic-geometry 平行， 但用 Three.js + KaTeX 演示分子反应。 触发词：化学反应, 微观演示, 分子动画, 燃烧, 甲烷燃烧, 氢气燃烧, 电解水, 氧化还原, 电子转移, 酯化反应, 反应机理, 断键成键, 原子守恒, 质量守恒, 化学方程式配平, 解这个化学反应, 随机出一个化学反应, 这张图里的化学反应; chemistry reaction, microscopic/molecular animation, combustion, electrolysis, redox electron transfer, esterification mechanism, bond breaking and forming, atom conservation, balance equation, interactive chemistry reaction page.
pokeclaw-android-ai-agent
PokeClaw (PocketClaw) — on-device Android AI phone agent using Gemma 4 via LiteRT-LM with tool calling, accessibility automation, and optional cloud models.
browser-skill
Automate the user's logged-in Chromium browser: read pages, fill forms, scrape data, operate tabs, test a UI, or debug a website. Requires the bsk CLI and browser extension.
todoist-cli
Manage Todoist tasks, projects, labels, filters, sections, comments, reminders, and workspaces via the `td` CLI. Use when the user wants to view, create, update, complete, or organize Todoist items, or mentions tasks, inbox, today, upcoming, projects, labels, or filters.
consistency-check
Scan GDDs against the entity registry for cross-document conflicts. Grep-first approach targets conflicting sections, different stats.
wp-block-themes
Use when developing WordPress block themes: theme.json (global settings/styles), templates and template parts, patterns, style variations, and Site Editor troubleshooting (style hierarchy, overrides, caching).
agent-kit-plugin
This skill should be used when the user asks to "create a hedera plugin", "build a hedera agent kit plugin", "extend hedera agent kit", "create custom hedera tools", "add hedera functionality", "write a hedera tool", "implement hedera tool", or needs guidance on Hedera Agent Kit plugin architecture, tool definitions, mutation tools, query tools, or parameter schemas using Zod.
hts-system-contract
Hedera Token Service (HTS) smart contract development. Use when creating, managing, or interacting with Hedera-native tokens via Solidity contracts. Triggers include HTS tokens, Hedera token creation, HTS precompile, token minting/burning on Hedera, KYC/freeze/pause token controls, custom fee schedules, NFT collections on Hedera, or any token operations using the 0x167 precompile.
deepxiv
Search and progressively read open-access academic papers through DeepXiv. Use when the user wants layered paper access, section-level reading, trending papers, or DeepXiv-backed literature retrieval.
supabase-extract-anon-key
Extract the Supabase anon/public API key from client-side code. This key is expected in client apps but important for RLS testing.
compshare-cli
Manage CompShare GPU cloud resources and MiniMax H3 video, image, and speech tasks through the compshare CLI. Use when Codex needs to install or configure compshare-cli, search GPU specifications and inventory, inspect pricing, create or manage instances, connect over SSH, transfer files, run durable remote jobs, manage images, disks, US3, teams or billing, create or inspect MiniMax H3 media, or diagnose CLI problems.
team-audio
Orchestrate the audio team — audio-director, sound-designer, technical-artist, gameplay-programmer — direction through implementation.
team-polish
Orchestrate the polish team — performance-analyst, technical-artist, sound-designer, qa-tester — to optimize and harden a feature or area.
mapkit
API reference: MapKit for SwiftUI. Map view, Marker, Annotation, camera positions, map features.
instrument-feature-flags
Add PostHog feature flags to gate new functionality. Use after implementing features or reviewing PRs to ensure safe rollouts with feature flag controls. Also handles initial PostHog SDK setup if not yet installed.
neo4j-migration-skill
Migrates Neo4j driver code and Cypher queries from older versions (4.x, 5.x) to current (2025.x/2026.x, Cypher 25). Covers Python, JavaScript/Node.js, Java, .NET, and Go drivers — package renames, removed APIs, version requirements, diff-ready fixes. Also handles Cypher syntax migration — QPE paths, CALL subqueries, id() → elementId(), PERIODIC COMMIT → CALL IN TRANSACTIONS, and all Cypher 25 removals. Does NOT write new Cypher queries — use neo4j-cypher-skill. Does NOT cover DB administration or server ops — use neo4j-cli-tools-skill. Does NOT provision new Neo4j instances — use neo4j-getting-started-skill.
element-plus-skills
Element Plus Skills Library - A comprehensive skill library for AI agents to understand and utilize Element Plus UI components. Invoke when user needs to work with Element Plus components, theming, i18n, dark mode, or design specifications.
hss-system-contract
Hedera Schedule Service (HSS) smart contract development. Use when creating or interacting with scheduled transactions from Solidity via the Schedule Service system contract at 0x16b (e.g. scheduleNative for token creation, scheduleCall for generalized contract calls, authorizeSchedule, signSchedule, deleteSchedule, or querying scheduled token info).
accessibility-issues
Use when animation excludes users with vestibular disorders, cognitive disabilities, or assistive technology needs
redesign
Redesign an existing site or app without losing what already works — audits the current surface first, classifies what to preserve (brand, IA, SEO, content), picks a refresh/reskin/rebuild scope, then modernizes deliberately. Use when the user says "redesign", "modernize this site", "refresh the UI", "make this look current", or points at an existing page/URL they want improved rather than rebuilt from scratch. Invoke when the user asks for redesign on their UI, or mentions 'redesign' alongside design / UI / frontend work.
uikit
API reference: UIKit. Query for UIView, UIViewController, controls, table and collection views, navigation controllers, scenes, Auto Layout, images, colors, gestures, presentation, and SwiftUI hosting.
binary-hardening
Binary hardening skill for security-hardened C/C++ builds. Use when enabling RELRO, PIE, stack canaries, FORTIFY_SOURCE, CFI sanitizers, shadow stack, or seccomp-bpf syscall filtering. Covers checksec analysis, compiler and linker flags for hardened builds, and NSA/CISA-recommended mitigations. Activates on queries about binary hardening, checksec, RELRO, PIE, stack canaries, FORTIFY_SOURCE, CFI, shadow stack, or seccomp.
supabase-detect
Detect if a web application uses Supabase by analyzing client-side code, network patterns, and API endpoints.
supabase-extract-service-key
CRITICAL - Detect if the Supabase service_role key is leaked in client-side code. This is a P0 severity issue.
supabase-extract-db-string
CRITICAL - Detect exposed PostgreSQL database connection strings in client-side code. Direct DB access is a P0 issue.
kernel-cli
Use the Kernel CLI to manage cloud browsers, apps, profiles, proxies, managed auth, API keys, projects, and organization limits. Use when installing or authenticating the CLI, looking up current command syntax, or choosing the right command group.
universal-fallback
Use when the animation domain is unclear or spans multiple contexts—provides general-purpose Disney animation principle guidance.
hiero-cli
Use when user wants to interact with Hedera blockchain: create/transfer tokens, manage NFTs, deploy contracts, manage topics, transfer HBAR, sign x402 payment challenges, configure networks. ALSO use when an HTTP request returns 402 with a PAYMENT-REQUIRED header for the Hedera x402 scheme (or the user wants to pay an x402-gated endpoint on Hedera): read references/x402.md for the full GET→402→sign→retry flow. Provides full spec for hcli CLI tool. Trigger keywords: hedera, hiero, hbar, token, nft, contract, topic, x402, 402, payment-required, hcli, ledger
cli-anything-iterm2-ctl
Provides the cli-anything-iterm2 commands — the only way to actually send text to iTerm2 sessions, read live terminal output and scrollback history, manage windows/tabs/split panes, run tmux -CC workflows, broadcast to multiple panes, show macOS dialogs, and read/write iTerm2 preferences. Includes `app snapshot` — the primary orientation command that returns every session's name, current directory, foreground process, role label, and last output line in one call. Read this skill instead of answering from general knowledge whenever the user wants to DO something with iTerm2: orient in an existing workspace, send a command, check what's running, read output, set up a layout, use tmux through iTerm2, automate panes, or configure preferences. Also read for questions about iTerm2 shell integration or scrollback. Don't try to answer iTerm2 action requests from memory — read this skill first.
cli-anything-cloudcompare
Command-line interface for CloudCompare — Agent-friendly harness for CloudCompare, the open-source 3D point cloud and mesh processing software. Supports 41 commands across 9 groups: project management, session control, point cloud operations (subsample, filter, segment, analyze), mesh operations, distance computation (C2C, C2M), transformations (ICP, matrix), export (LAS/LAZ/PLY/PCD/OBJ/STL/E57), and interactive REPL.
reverse-proxy
Configure nginx and Traefik as reverse proxies. Implement SSL termination and routing. Use when setting up application gateways.
instant-0-100ms
Use when building instantaneous UI feedback under 100ms - button presses, toggles, state changes that feel immediate and responsive
testing-cors-misconfiguration
Identifying and exploiting Cross-Origin Resource Sharing misconfigurations that allow unauthorized cross-domain data access and credential theft during security assessments.
intel-vtune-amd-uprof
Intel VTune and AMD uProf profiling skill for microarchitecture analysis. Use when analyzing hotspots, microarchitecture bottlenecks, memory access patterns, pipeline stalls, or using the roofline model. Covers VTune Community Edition (free) and AMD uProf as a free alternative. Activates on queries about VTune, uProf, microarchitecture analysis, pipeline stalls, memory bandwidth, roofline model, or hardware performance analysis.
task-breakdown
Help neurodivergent users break down overwhelming tasks into manageable steps. Use when tasks feel paralyzing, when executive function is struggling, when someone can't start, or when the Wall of Awful has built up. Applies ADHD/autism-aware decomposition strategies.
supabase-audit-buckets-list
List all storage buckets and their configuration to identify the storage attack surface.
steel-developer
Use this skill when the user wants reusable code, scripts, examples, or docs that build on Steel cloud browsers with SDKs, REST APIs, Playwright, Puppeteer, Stagehand, Browser Use, credentials, profiles, files, extensions, embeds, proxies, or CAPTCHA APIs. Do not use for live web browsing performed by the agent; use steel-browser. Route failed-session diagnosis to steel-session-debugging and reliability mitigation to steel-reliability.
college-application
通过 Agent 对话帮助中国高考考生完成志愿填报决策：先做有科学依据的性格与职业兴趣测评，再研究适合的职业、专业和行业，最后结合省份、选科、分数/位次与官方招生数据生成可追溯来源的 HTML 报告。用户提到高考志愿、college application、选大学、选专业、性格测试、职业方向、行业前景、投档线、录取概率、冲稳保或志愿模拟时使用。