Skills worth trusting.
Agent skills from Anthropic, OpenAI, skills.sh, ClawHub, SkillsMP and other reputable sources. Savant assesses them for security risks and evaluates model-generated test cases using independent scoring. Workspaces import any skill into their own repositories through a reviewed pull request. Every listing on each hub is enumerated; packages are fetched, scanned and evaluated most-popular first as daily capacity allows.
inertia-rails-typescript
TypeScript type safety for Inertia Rails (React, Vue, Svelte): shared props, flash, and errors via InertiaConfig module augmentation in globals.d.ts. Use when setting up TypeScript types, configuring shared props typing, fixing TS2344 or TS2339 errors in Inertia components, or adding new shared data.
upstash-redis-kv
Read and write to Upstash Redis-compatible key-value store via REST API. Use when there is a need to save or retrieve key-value data, use Redis features (caching, counters, lists, sets, hashes, sorted sets, etc.) for the current interaction, or when the user explicitly asks to use Upstash or Redis.
reflexion:memorize
Curates insights from reflections and critiques into CLAUDE.md using Agentic Context Engineering
pandas
Expert data analysis and manipulation for customer support operations using pandas
jackin-research
Use only when the user explicitly requests this skill. Produces a standalone multi-page research dossier on the jackin❯ docs site, drawing on web and codebase evidence.
jackin-release-notes
Use only when the user explicitly requests this skill. Classifies every PR merged since the last tag into Keep a Changelog categories and writes the [Unreleased] section of CHANGELOG.md.
jackin-refresh-pr
Use only when the user explicitly requests this skill. Reconciles an open jackin❯ pull request's title and body against the current diff — regenerates the Verify-locally block selection and rewrites prose that has drifted.
agent-browser
Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking screenshots, extracting data, testing web apps, or automating any browser task. Triggers include requests to "open a website", "fill out a form", "click a button", "take a screenshot", "scrape data from a page", "test this web app", "login to a site", "automate browser actions", or any task requiring programmatic web interaction.
industrial-ai-research
Industrial AI literature research with mandatory intake questions, venue-aware source prioritization, structured report outputs, and survey draft generation. Use when the user needs up-to-date research on predictive maintenance, intelligent scheduling, industrial anomaly detection, smart manufacturing, cyber-physical systems, edge AI for automation, or crossover robotics-for-industry topics. Also trigger for adjacent terms: "digital twin", "industrial IoT", "Industry 4.0", "manufacturing AI", "factory automation", "process optimization", or "survey draft" in industrial contexts.
express-oauth2-jwt-bearer
Use when protecting Express or Node.js API endpoints with JWT Bearer token validation, scope-based access control, or DPoP binding. Integrates express-oauth2-jwt-bearer — use even if the user says "validate tokens in my Express API" or "protect my Node.js API endpoints".
security-scanning-security-hardening
Coordinate multi-layer security scanning and hardening across application, infrastructure, and compliance controls.
code-review
Review a pull request or a set of code changes for bugs, logic errors, and project-convention violations using a confidence-filtered, multi-agent process. Use this skill when the user asks to review a PR, audit pending changes, or inspect a diff for problems before merging.
bouncer-feed-filter
AI-powered browser extension that filters unwanted posts from Twitter/X feeds using natural language rules and multiple AI backends
reverse-engineer-marketing
When the user wants to reverse engineer how another company grew and copy what worked. Also use when the user mentions 'reverse engineer,' 'how did X grow,' 'how does X get customers,' 'growth teardown,' 'marketing teardown,' 'GTM teardown,' 'growth blueprint,' 'what is X doing for marketing,' 'what made X take off,' 'copy X's playbook,' 'X's distribution strategy,' 'what content works for X,' 'funnel hack,' 'map their funnel,' or 'watch what X is doing.' Builds a dated log of a company's moves against its traffic curve from public data, sign-ups and demos, team interviews, and hidden signals (DNS, certificate logs, archives, sponsorships), compares it with the user's own data, and turns what lined up with growth into plays routed to the skill that runs each one. For a snapshot profile of a competitor's positioning, pricing, and features, see competitor-profiling. For comparison pages, see competitors. For why a single post went viral, see social.
skill-selection
どのスキルを導入するか決める。全員が入れる既定のスキル、作業に応じて追加するスキル、npx skills によるホームへの導入と削除、統合済みの旧スキルを入れない判断、リポジトリ固有のスキルを置くかどうかの判断を定義する。スキルを初めて導入するとき、philtzjp/skills に新しいスキルが追加されたとき、作業に必要なスキルが入っていないとき、不要になったスキルを外すときに使う。
quarkclouddrive
夸克网盘官方(Quark Drive)Skill，用于文件上传/下载（支持断点续传）、文件分享与转存、转存分享更新查询、网盘文件搜索、批量重命名与整批撤销、文件归类移动与撤回、相册整理、AI助手（文件总结与知识问答，支持万级文件）、获取会员开通链接。当用户要求将当前搜索结果批量重命名、一句话说明范围与命名规则后重命名、整批撤销刚才的重命名、开通或续费夸克网盘会员，或需要其他夸克网盘操作与身份验证时使用。
moda-automate
Recurring Moda work — scheduled posts, weekly reports, sync jobs: a host-side scheduler drives the Moda command line; the artifact itself still routes to its format skill. Use for: "every week/day…", "auto-post X", "keep this updated".
workflows-install
Install the Zapier SDK CLI for Zapier Workflows Early Access and bootstrap the workflows companion skills. Use when the user wants to set up Zapier Workflows, get started building durable workflows, install workflow skills, or configure the Zapier SDK CLI.
wallet-profiling
Behavioral classification, performance analysis, and trading style detection for Solana wallets
fal-recipes
Use-case-driven multi-step pipelines on fal.ai. Trigger when the user asks for a specific kind of content production rather than a single endpoint call: "make a commercial", "ad creative", "product photography", "cinematic shot", "film look", "character design", "consistent character", "anchor system", "storyboard", "multi-shot", "narrative video", "talking head", "lip sync", "make this person talk", "virtual try-on", "garment transfer", "restore image", "deblur", "denoise", "fix face", "old photo restore", "add audio to video", "video sound effects", "product shot", "photoreal", "realistic photo", "candid photo", "editorial portrait", "documentary photo", "looks like a real photograph", "iPhone-style photo", "film photo", "archival photo". Each recipe describes inputs, the genmedia call sequence, and quality checks.
openrouter-typescript-sdk
Complete reference for integrating with 300+ AI models through the OpenRouter TypeScript SDK and Agent packages using the callModel pattern
spring-security-configuration
Creates a Spring Security configuration class with authentication, authorization, and HTTP protection setup. Use this skill when a security configuration needs to be created, either standalone or as part of a larger task (e.g. adding authentication to a REST API, configuring OAuth2/OIDC login, setting up JWT resource server).
exa-search
AI-powered web search via Exa with content extraction. Use when user says "exa search", "web search with content", "find similar pages", or needs broad web results beyond academic databases (arXiv, Semantic Scholar).
experiment-queue
SSH job queue for multi-seed/multi-config ML experiments with OOM-aware retry, stale-screen cleanup, and wave-transition race prevention. Use when user says "batch experiments", "队列实验", "run grid", "multi-seed sweep", "auto-chain experiments", or when /run-experiment is insufficient for 10+ jobs that need orchestration.
overleaf-sync
Two-way sync between a local paper directory and an Overleaf project, so ARIS audit/edit workflows stay on the local copy while collaborators edit in the Overleaf web UI. Use when user says "同步 overleaf", "overleaf sync", "推送到 overleaf", "connect overleaf", "Overleaf 桥接", "pull overleaf", "push overleaf", or wants to bridge their ARIS paper directory with an Overleaf project.
local-llm-ops
Local LLM operations with Ollama on Apple Silicon, including setup, model pulls, chat launchers, benchmarks, and diagnostics.
birdeye-api
Solana token market data via Birdeye — prices, OHLCV, trades, token metadata, security checks, and trader activity
outliers
Finds the outlier reels of Instagram accounts or videos of TikTok accounts (3x their own account's median views or more) through Treg and turns the 5 best into remake scripts in the creator's voice. Two modes - /outliers @handle digs one account; /outliers with no account starts from the creator's own reels, uses and grows a competitor watchlist (video-agent/competitors.json, 70 % main language / 30 % second language when they watch two), ranks every account's outliers against its own median and writes 5 scripts into video-agent/scripts/. Use when the user says outliers, find outliers, what blew up for my competitors, what works in my niche, find me videos to remake, ideas from @someone, what blew up on TikTok.
sybil-detection
Coordinated wallet cluster detection, wash trading identification, and fake activity analysis for Solana tokens
helium-mcp
Search real-time news with bias scoring, get live stock/ETF/crypto data with AI analysis, ML options pricing, balanced news synthesis, and meme search via the Helium MCP server.
context-retrospective
Analyze agent-user interaction transcripts to identify context network maintenance needs and guidance improvements. Use after significant agent interactions or to improve context networks.
deployment-documentation
Document deployment processes, infrastructure setup, CI/CD pipelines, and configuration management. Use when creating deployment guides, infrastructure docs, or CI/CD documentation.
token-economics
Token supply dynamics, vesting analysis, inflation modeling, and valuation frameworks for crypto tokens
liquidity-analysis
DEX liquidity depth assessment, slippage estimation, and pool composition analysis for Solana tokens
devcontainers-best-practices
Expert reference for the Dev Container ecosystem. Consult this skill whenever the user is setting up a dev container, configuring or debugging devcontainer.json, working in a Docker-based development environment, or asking about dev containers, GitHub Codespaces, DevPod, or Zed — even if they don't say "devcontainer" explicitly. Covers the full Dev Container spec, schema validation, tool-specific behaviors and limitations (VS Code, Cursor, Zed, Codespaces, CodeSandbox, Podman), Features and Templates (choosing, authoring, publishing), lifecycle scripts, environment variables, port forwarding, multi-container setups, and official best practices from containers.dev and devcontainers.github.io. Also use when the user is confused by container behavior that differs between tools, wants to write or publish a custom Feature, or needs to validate or debug a devcontainer.json.
mineru
An AI-Native skill for parsing PDF / Office / image files into clean Markdown with MinerU — a fast, zero-config document parser for AI agents. Works with NO token via the lightweight Agent API and auto-upgrades to the Standard API (token) for large files, batches, and DOCX/HTML/LaTeX export. Use when: (1) Converting PDF/Word/PPT/Excel/image to Markdown, (2) Extracting text, tables, formulas, or running OCR on scanned docs, (3) Batch-parsing a folder in parallel, (4) Piping parsed Markdown straight back to an agent or into Obsidian.
landing-page-design
World-class landing page expertise combining conversion rate optimization science, persuasive design psychology, and the craft of pages that turn visitors into customers. Landing pages are where marketing meets reality—the moment of truth where visitors decide. Great landing pages aren't just pretty—they're conversion machines. The best landing page designers understand that every element must earn its place, that friction is the enemy, and that the goal isn't to impress—it's to convert. Speed, clarity, and persuasion in perfect balance. Use when "landing page, conversion page, lead capture, signup page, pricing page, hero section, above the fold, CTA design, conversion rate, page optimization, lead gen page, squeeze page, sales page, landing-pages, conversion, CRO, design, optimization, lead-generation, signups, forms" mentioned.
tanstack-router
TanStack Router type-safe file-based routing for React. Use for SPAs, TanStack Query integration, Cloudflare Workers, or encountering devtools, type safety, loader, Vite bundling errors.
mo-user
墨问用户。当搜索用户、查找 UID、获取用户信息、用户简介、描绘用户画像时触发。
opencode-qa
QA opencode itself, per case: verify the CLI/terminal (opencode run, db, serve, export), prove a specific plugin hook/action/event fired via the SSE event stream, smoke-test the TUI under tmux, and investigate sessions in opencode's SQLite DB by id, title/name, or message text. Ships tested helper scripts (each with a --self-test) plus per-domain references. Use whenever someone wants to QA, smoke-test, verify, or debug opencode's CLI, HTTP server, plugin hooks/events, or TUI, or to find/inspect opencode sessions in the database. Triggers: opencode qa, qa opencode, test opencode, verify opencode hook, opencode session db, find opencode session by id/name/text, opencode tui test, opencode server health, opencode event stream.
abusing-dpapi-for-credential-access
Extract and decrypt Windows DPAPI-protected secrets (Credential Manager, browser logins/cookies, Wi-Fi credentials, KeePass keys) online or offline using SharpDPAPI, SharpChrome, Mimikatz, or Impacket's dpapi.py, including domain-wide decryption via the DPAPI backup key. Use during authorized red-team credential-access engagements after gaining a foothold or when triaging DPAPI blobs pulled from a host.
token-dashboard
Answers what a past session cost ("the Garden session yesterday", a session id) with a priced number, and opens the Token Optimizer dashboard when asked to see it.
get-job
实习.skill / get-job.skill：从岗位调研、简历改写到分轮次面试准备的全流程求职 skill。适合找工作、投实习、校招、秋招、春招、暑期实习、社招、跳槽、转行、跨专业求职、留学生求职，以及产品经理、运营、市场、咨询、AI 产品、AI Coding、数据分析、技术岗等目标岗位准备。 核心能力：① WebSearch 调研公司、岗位 JD、业务线、竞品、面经、招聘流程和隐性门槛；② 按目标岗位反向定位简历，做 JD 匹配、ATS 关键词、经历筛选、STAR/CAR 改写、可迁移能力翻译、docx 简历生成；③ 按真实轮次准备面试，覆盖一面/业务面/专业面/主管面/HR 面/recruiter screen 等已确认或高置信轮次，逐条深挖简历 bullet、项目逐字稿、自我介绍、表达训练、模拟面试、反问清单、面后复盘题库。 适用于「改简历」「简历优化」「简历润色」「简历匹配 JD」「求职简历」「投递前改简历」「按岗位改简历」「准备面试」「面试准备」「面经分析」「模拟面试」「自我介绍」「项目经历怎么讲」「简历被追问怎么办」「双非拿大厂 offer」「背景不对口怎么办」「AI 产品实习」「运营实习」「产品经理校招」等场景。 质量保障：不编造经历、不改背调硬信息；所有强 claim 做证据化审计；搜索源按市场和 A/B/C/D 分级；轮次不写死；最终交付前必须跑质量闸门和覆盖矩阵，避免漏 bullet、标签泄漏和过度包装。
security-documentation
Create security policies, guidelines, compliance documentation, and security best practices. Use when documenting security policies, compliance requirements, or security guidelines.
dex-pool-analysis
AMM pool mechanics comparison across Raydium, Orca, and Meteora including fee structures, pool types, creation patterns, and volume efficiency
product-marketing
Build product marketing strategy including positioning, messaging, and go-to-market. Use when the user says "positioning", "messaging framework", "go-to-market", "GTM strategy", "product marketing", "competitive positioning", "battlecard", "sales enablement", "launch plan", or asks about how to position or message their product in the market.
langchain-orchestration
Comprehensive guide for building production-grade LLM applications using LangChain's chains, agents, memory systems, RAG patterns, and advanced orchestration
fastapi-development
Modern Python API development with FastAPI covering async patterns, Pydantic validation, dependency injection, and production deployment