Skills worth trusting.
Agent skills from Anthropic, OpenAI, skills.sh, ClawHub, SkillsMP and other reputable sources. Savant assesses them for security risks and evaluates model-generated test cases using independent scoring. Workspaces import any skill into their own repositories through a reviewed pull request. Every listing on each hub is enumerated; packages are fetched, scanned and evaluated most-popular first as daily capacity allows.
daily-news-60s
获取每天60秒读懂世界的每日新闻，包含15条精选国内外新闻和每日微语。Use when users need daily news summaries, current events, or want to stay informed about world news in Chinese.
deepxiv
Search and progressively read open-access academic papers through DeepXiv. Use when the user wants layered paper access, section-level reading, trending papers, or DeepXiv-backed literature retrieval.
neo4j-migration-skill
Migrates Neo4j driver code and Cypher queries from older versions (4.x, 5.x) to current (2025.x/2026.x, Cypher 25). Covers Python, JavaScript/Node.js, Java, .NET, and Go drivers — package renames, removed APIs, version requirements, diff-ready fixes. Also handles Cypher syntax migration — QPE paths, CALL subqueries, id() → elementId(), PERIODIC COMMIT → CALL IN TRANSACTIONS, and all Cypher 25 removals. Does NOT write new Cypher queries — use neo4j-cypher-skill. Does NOT cover DB administration or server ops — use neo4j-cli-tools-skill. Does NOT provision new Neo4j instances — use neo4j-getting-started-skill.
longbridge-investment-proposal
Investment proposal generation via Longbridge Securities — produces a structured investment memo covering: executive summary, company overview, investment thesis (3–5 core points), financial analysis, valuation, catalysts and timeline, risk factors, and position recommendation. Triggers: "投资提案", "投资建议书", "投资报告", "投资摘要", "核心逻辑", "投资理由", "建仓建议", "投資提案", "投資建議書", "投資報告", "投資摘要", "核心邏輯", "建倉建議", "investment proposal", "investment memo", "investment summary", "investment rationale", "position recommendation", "investment case", "buy memo".
manta-cli
Operate Manta-managed worktrees, folder contexts, terminals, repos, automations, artifacts, skill sharing, worktree comments, and Manta's embedded browser through the `manta` CLI. Use when the user says "$manta-cli", "Manta worktree", "child worktree", "spawn codex/claude in a worktree", "read/wait/send Manta terminal", "handoff" / "handover" / "give this to another agent", "Manta browser", "manta artifacts", or "share skills". Prefer it over raw git worktree, ad hoc PTYs, or Computer Use when Manta state is involved. Use Computer Use only when a visible window needs GUI control that a CLI, filesystem, or API cannot do.
wp-block-themes
Use when developing WordPress block themes: theme.json (global settings/styles), templates and template parts, patterns, style variations, and Site Editor troubleshooting (style hierarchy, overrides, caching).
coding-standards
Universal coding standards, best practices, and patterns for TypeScript, JavaScript, React, and Node.js development.
api-documentation-generator
Generate comprehensive, developer-friendly API documentation from code, including endpoints, parameters, examples, and best practices
longbridge-coverage-initiation
Initiating-coverage report framework — five-step workflow to generate an institutional-grade coverage initiation report: ① company overview ② industry positioning ③ financial modelling ④ valuation analysis ⑤ investment conclusion. Covers business description, competitive advantages, financial health, valuation multiples, price target, and risk factors. Triggers: "首次覆盖", "初始覆盖", "覆盖报告", "研报框架", "投资报告", "建立覆盖", "首次評級", "初始覆蓋", "覆蓋報告", "建立覆蓋", "initiate coverage", "coverage initiation", "first coverage", "equity research report", "investment report", "initiating coverage", "research initiation", "NVDA initiate coverage".
longbridge-post-investment
Post-investment monitoring via Longbridge Securities — tracks portfolio holdings vs plan on a quarterly / monthly basis, extracts key KPIs (revenue growth / gross margin / cash flow), flags deviations vs expectations, and generates a neutral monitoring report summarising KPI changes. For reference only — not investment advice. Triggers: "投后监控", "持仓监控", "定期复盘", "跟踪持仓", "持仓检视", "KPI跟踪", "业绩追踪", "投後監控", "持倉監控", "定期複盤", "追蹤持倉", "KPI追蹤", "post-investment monitoring", "position monitoring", "portfolio review", "KPI tracking", "performance tracking", "investment monitoring", "holding review".
layerzero-messaging
LayerZero V2 messaging on Hedera. Use when building OFT / OApp bridges between Hedera and EVM chains, configuring Endpoint V2 peers and ULN/DVN/executor wiring, sending with quoteSend + send, implementing HTS-backed OFT connectors (mint/burn via 0x167), or relaying educational lzReceive flows on testnet.
bug-bounty
Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaining (IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth), bypass tables (SSRF IP bypass, open redirect bypass, file upload bypass), language-specific grep (JS prototype pollution, Python pickle, PHP type juggling, Go template.HTML, Ruby YAML.load, Rust unwrap), and reporting (7-Question Gate, 4 validation gates, human-tone writing, templates by vuln class, CVSS 3.1, PoC generation, always-rejected list, conditional chain table, submission checklist). Use for ANY bug bounty task — starting a new target, doing recon, hunting specific vulns, auditing source code, testing AI features, validating findings, or writing reports. 中文触发词：漏洞赏金、安全测试、渗透测试、漏洞挖掘、信息收集、子域名枚举、XSS测试、SQL注入、SSRF、安全审计、漏洞报告
uikit
API reference: UIKit. Query for UIView, UIViewController, controls, table and collection views, navigation controllers, scenes, Auto Layout, images, colors, gestures, presentation, and SwiftUI hosting.
pokeclaw-android-ai-agent
PokeClaw (PocketClaw) — on-device Android AI phone agent using Gemma 4 via LiteRT-LM with tool calling, accessibility automation, and optional cloud models.
supabase-extract-anon-key
Extract the Supabase anon/public API key from client-side code. This key is expected in client apps but important for RLS testing.
intel-vtune-amd-uprof
Intel VTune and AMD uProf profiling skill for microarchitecture analysis. Use when analyzing hotspots, microarchitecture bottlenecks, memory access patterns, pipeline stalls, or using the roofline model. Covers VTune Community Edition (free) and AMD uProf as a free alternative. Activates on queries about VTune, uProf, microarchitecture analysis, pipeline stalls, memory bandwidth, roofline model, or hardware performance analysis.
implement_lenis_scroll
Instructions for implementing Lenis smooth scrolling in a Next.js or React application.
accessibility-issues
Use when animation excludes users with vestibular disorders, cognitive disabilities, or assistive technology needs
instant-0-100ms
Use when building instantaneous UI feedback under 100ms - button presses, toggles, state changes that feel immediate and responsive
create-epics
Turns the GDDs and architecture into epics, one per architectural module. Use when the user wants to break the game into epics or plan the work before writing stories. Not for splitting one epic into stories.
universal-fallback
Use when the animation domain is unclear or spans multiple contexts—provides general-purpose Disney animation principle guidance.
data-migration
データベースの一括変換、スキーマ移行、既存レコードの修正など、データマイグレーションを実装・実行するときに参照する。このスキルは db スキルに統合した。内容は db スキルを使う。
commit-and-git
コミット、プッシュ、ブランチ作成や切り替え、マージ、リベース、gh pr merge など Git / GitHub の操作を行うときに参照する。このスキルは github スキルに統合した。内容は github スキルを使う。
cli-anything-iterm2-ctl
Provides the cli-anything-iterm2 commands — the only way to actually send text to iTerm2 sessions, read live terminal output and scrollback history, manage windows/tabs/split panes, run tmux -CC workflows, broadcast to multiple panes, show macOS dialogs, and read/write iTerm2 preferences. Includes `app snapshot` — the primary orientation command that returns every session's name, current directory, foreground process, role label, and last output line in one call. Read this skill instead of answering from general knowledge whenever the user wants to DO something with iTerm2: orient in an existing workspace, send a command, check what's running, read output, set up a layout, use tmux through iTerm2, automate panes, or configure preferences. Also read for questions about iTerm2 shell integration or scrollback. Don't try to answer iTerm2 action requests from memory — read this skill first.
cli-anything-cloudcompare
Command-line interface for CloudCompare — Agent-friendly harness for CloudCompare, the open-source 3D point cloud and mesh processing software. Supports 41 commands across 9 groups: project management, session control, point cloud operations (subsample, filter, segment, analyze), mesh operations, distance computation (C2C, C2M), transformations (ICP, matrix), export (LAS/LAZ/PLY/PCD/OBJ/STL/E57), and interactive REPL.
kernel-cli
Use the Kernel CLI to manage cloud browsers, apps, profiles, proxies, managed auth, API keys, projects, and organization limits. Use when installing or authenticating the CLI, looking up current command syntax, or choosing the right command group.
element-plus-skills
Element Plus Skills Library - A comprehensive skill library for AI agents to understand and utilize Element Plus UI components. Invoke when user needs to work with Element Plus components, theming, i18n, dark mode, or design specifications.
slippage-modeling
Execution cost estimation, slippage curve modeling, and optimal trade sizing based on AMM liquidity depth
supabase-detect
Detect if a web application uses Supabase by analyzing client-side code, network patterns, and API endpoints.
supabase-extract-service-key
CRITICAL - Detect if the Supabase service_role key is leaked in client-side code. This is a P0 severity issue.
college-application
通过 Agent 对话帮助中国高考考生完成志愿填报决策：先做有科学依据的性格与职业兴趣测评，再研究适合的职业、专业和行业，最后结合省份、选科、分数/位次与官方招生数据生成可追溯来源的 HTML 报告。用户提到高考志愿、college application、选大学、选专业、性格测试、职业方向、行业前景、投档线、录取概率、冲稳保或志愿模拟时使用。
moda-deck
Create a real, editable slide deck on Moda — slide pages on a live canvas, exporting native PPTX with real shapes and text layers, or a text-layer PDF — not screenshots in python-pptx. Use for: deck, slides, presentation, pitch, keynote, QBR, board update, "turn this doc/repo/notes into slides". NOT: an existing .pptx in hand → moda-deck-pptx; "animate these slides" or a motion version → moda-video.
supabase-extract-db-string
CRITICAL - Detect exposed PostgreSQL database connection strings in client-side code. Direct DB access is a P0 issue.
e2e-testing
新しいユーザー向け主要フロー、重要な UI 変更、既存フローの成功条件を変更したときに参照する。このスキルは e2etest スキルに統合した。内容は e2etest スキルを使う。
e2etest
E2E テストを作成・実行する。agent-browser を主に使い、対応できないインタラクションに限って Playwright にフォールバックする。テストを書く条件と書かない条件、sleep によるタイミング依存の禁止、明示的な待機条件。ユーザー向け主要フローの追加、重要な UI 変更、既存フローの成功条件を変えたときに使う。
reverse-proxy
Configure nginx and Traefik as reverse proxies. Implement SSL termination and routing. Use when setting up application gateways.
bmod-tea
Required bmod metadata. Never invoke this skill.
rust-build-times
Rust build time optimization skill for reducing slow compilation. Use when using cargo-timings to profile builds, configuring sccache for Rust, using the Cranelift backend, splitting workspaces for parallelism, choosing between thin LTO and fat LTO, or using the mold linker with Rust. Activates on queries about slow Rust compilation, cargo-timings, sccache Rust, cranelift backend, Rust workspace splitting, LTO tradeoffs, or mold linker with Rust.
launch-planning
Help users plan, coordinate, and execute product launches that cut through market noise. This guide covers everything from internal alignment and GACCS briefs to community engagement and viral mechanics.
tipkit
API reference: TipKit. Tip protocol, TipView, PopoverTipView, Tips.configure, inline and popover tips.
scenario-blender-hard-surface
Use when modeling hard-surface objects in Blender (sci-fi panels, props, weapons, vehicles, robots, machined or product parts) with booleans and cutters, bevel modifiers, weighted normals, or subdivision with support loops or creases. Also when shading is broken (smears on flat faces, stretching near a cut, pinching), a bevel shrinks or vanishes after a boolean, a boolean empties the mesh or leaves holes, choosing n-gons vs quads, or making a game-ready mid-poly.
steel-developer
Use this skill when the user wants reusable code, scripts, examples, or docs that build on Steel cloud browsers with SDKs, REST APIs, Playwright, Puppeteer, Stagehand, Browser Use, credentials, profiles, files, extensions, embeds, proxies, or CAPTCHA APIs. Do not use for live web browsing performed by the agent; use steel-browser. Route failed-session diagnosis to steel-session-debugging and reliability mitigation to steel-reliability.
supabase-audit-buckets-list
List all storage buckets and their configuration to identify the storage attack surface.
issue-tracker
Read and set work state on the CLHbid Delivery board — the delivery language, issues via gh, the Status field, the board query recipes, cycles, epics, issue types, labels, the commit convention and the decomposition rules. Use for any GitHub issue or project-board operation in a clhbid repo, and for what a cycle, epic or slipped issue means.
sentiment-analysis
Market sentiment extraction from social media, news, and on-chain data including mention velocity, fear and greed indices, and influencer tracking
html-visual
Generate an interactive single-file HTML visualization — mockup, wireframe, ERD, flowchart, chart, slides, architecture diagram, dashboard, timeline, mindmap, kanban, or table. Use when the user wants something rendered rather than described: a UI mockup or wireframe, a database schema as an ERD, business logic as a flowchart, data as a chart, or content as slides. Also use when they point at a file (schema, spec, data) and ask to see it visualized.
media-publishing
Use when designing animations for news sites, content platforms, publishing apps, or media consumption experiences
slow-800-1200ms
Use when building deliberate motion between 800-1200ms - dramatic reveals, loading sequences, storytelling moments where users should pause and absorb