Skills worth trusting.
Agent skills from Anthropic, OpenAI, skills.sh, ClawHub, SkillsMP and other reputable sources. Savant assesses them for security risks and evaluates model-generated test cases using independent scoring. Workspaces import any skill into their own repositories through a reviewed pull request. Every listing on each hub is enumerated; packages are fetched, scanned and evaluated most-popular first as daily capacity allows.
analyzing-golang-malware-with-ghidra
Reverse engineer Go-compiled malware in Ghidra by parsing Go buildinfo and pclntab structures, recovering stripped/obfuscated function names (e.g. via GoResolver), and extracting embedded module/dependency strings and types from Go binaries. Use when analyzing a Go-language malware sample, deobfuscating a garble-packed Go binary, or recovering function names and third-party dependencies from a stripped Go executable.
longbridge-elliott-wave
Elliott Wave technical timing analysis for individual stocks. Identifies current wave cycle position (impulse 5-wave / corrective ABC), validates with Fibonacci ratios, confirms with momentum indicators (MACD, RSI, volume divergence), and evaluates market environment per market (HK / US / A-share / SGX). Outputs structured natural language report with Fibonacci price zones and actionable reference. Triggers on "波浪分析", "艾略特波浪", "Elliott Wave", "波浪周期", "wave analysis", "技术择时", "technical timing", stock ticker + wave/timing keywords, "现在是第几浪", "处于哪个波浪", "波浪判断", "波浪理论", "浪形分析", "波浪择时".
hubspot
Manage HubSpot CRM contacts, companies, deals, and CMS content via API. Use when the user says "add contact to HubSpot", "create deal", "search CRM", "HubSpot contacts", "update deal stage", "CRM report", "HubSpot pages", or asks about managing their sales pipeline, CRM data, or HubSpot content.
cloud-cost-management
Optimize and manage cloud costs across AWS, Azure, and GCP using reserved instances, spot pricing, and cost monitoring tools.
gitnexus-pr-review
Use when the user wants to review a pull request, understand what a PR changes, assess risk of merging, or check for missing test coverage. Examples: "Review this PR", "What does PR #42 change?", "Is this PR safe to merge?"
marketing-psychology
When the user wants to apply psychological principles, mental models, or behavioral science to marketing. Also use when the user mentions 'psychology,' 'mental models,' 'cognitive bias,' 'persuasion,' 'behavioral science,' 'why people buy,' 'decision-making,' or 'consumer behavior.' This skill provides 70+ mental models organized for marketing application.
gs-search
Search Google Scholar for academic papers by keywords. Returns results with title, authors, journal, year, citation count, and full-text links. Use when the user wants to search Google Scholar.
git:compare-worktrees
Compare files and directories between git worktrees or worktree and current branch
vercel-composition-patterns
React component API design with compound components.
kiro-skill
Interactive feature development workflow from idea to implementation. Creates requirements (EARS format), design documents, and task lists. Triggers: "kiro", ".kiro/specs/", "feature spec", "需求文档", "设计文档", "实现计划".
longbridge-ark-analysis
ARK-style single-stock disruptive-innovation diagnostic. Suitability gate on 4 dimensions (platform fit / innovation revenue / R&D intensity / management vision); if it passes, builds TAM (low/base/high), Wright's-Law cost curve with sourced learning rate, three-scenario 5-year target (Bull/Base/Bear, 15% discount), risks, conditional action frame. Data: Longbridge CLI first, MCP fallback, WebSearch only for TAM / learning rates / industry runway. Runs cross-statement reconciliation BEFORE analysis. Closes with a data-source appendix whose final row is the reconciliation summary. Independent implementation — not affiliated with ARK Invest. Triggers: "木头姐", "ARK", "ARKK", "颠覆式创新", "莱特定律", "TAM", "5年目标价", "情景分析", "AI 与大数据", "自动化与机器人", "能源存储", "基因革命", "区块链与金融科技", "木頭姐", "顛覆式創新", "萊特定律", "5年目標價", "Cathie Wood", "ARK Invest", "disruptive innovation", "Wright's Law", "learning rate", "bull base bear", "scenario analysis".
venmo-reconciler
Reconcile Venmo business transactions and separate personal from business.
netsuite-finance-analyst
Use this skill when the user needs NetSuite-based finance analysis, Director of Financial Analysis support, period-close guidance, variance review, reconciliation review, cash reporting, or executive-ready financial narrative generation. Apply it to requests involving income statements, balance sheets, cash flow, budget versus actuals, AR or AP aging, month-end close, SOX-oriented finance checks, journal entry review, and board or CFO reporting. Prefer it when the request clearly involves NetSuite financial data interpretation or finance operations, but do not use it for general NetSuite development or non-finance administration tasks.
gsd-sketch
Sketch UI/design ideas with throwaway HTML mockups, or propose what to sketch next (frontier mode)
gsd-ship
Create PR, run review, and prepare for merge after verification passes
gsd-quick
Execute a quick task with GSD guarantees (atomic commits, state tracking) but skip optional agents
creative-direction
Walk the user through four directional axes (tone register, aesthetic philosophy, audience relationship, sensory ambition) and produce a structured aesthetic brief that downstream content, copy, design, and art-direction skills consume as required input. The aesthetic depth layer, distinct from `creative-brief` (operational kickoff: scope, audience, deliverables, constraints). Use when a project needs aesthetic coherence across many small decisions and the user has only a vague feeling, or when multiple downstream aesthetic-producing skills need a shared brief. Triggers on creative direction, aesthetic direction, set the aesthetic, define the visual direction, what's the vibe, what's the tone, the four axes. Does NOT fire for a general kickoff brief (use `creative-brief`), tactical single-piece work, already-documented direction, purely functional output, or locked production-stage work.
crud-rest-controller
Creates a Spring REST controller with CRUD endpoints backed by a Spring Data repository. Use this skill when a CRUD controller needs to be created, either standalone or as part of a larger task.
motherduck-build-cfa-app
Build MotherDuck analytics into customer-facing applications with tenant isolation, backend routing, and serving APIs.
assetseeker
Search free commercial-use creative assets across multiple online sources — photos, illustrations, icons, video footage, music, sound effects, and fonts. Use when the user needs to find assets for videos, PPTs, articles, or any content creation. Trigger on phrases like "find me a photo of", "search for icons", "I need background music", "find video footage", "search fonts", "找一张图片", "搜素材", "帮我找图标/视频/音乐/字体". Covers Pexels, Unsplash, Pixabay, Iconify, Freesound, Google Fonts and more — with API-backed search where available.
gsd-progress
Check progress, advance workflow, or dispatch freeform intent — the unified GSD situational command
shredstream
Pre-execution Solana transaction streaming via Jito ShredStream, Shyft RabbitStream, and Triton Deshred
supabase-audit-authenticated
Create a test user (with explicit permission) to audit what authenticated users can access vs anonymous users. Detects IDOR, cross-user access, and privilege escalation.
measuring-pmf
Help users objectively assess where their product stands on the PMF spectrum by triangulating qualitative feedback, quantitative retention benchmarks, and organic growth signals.
encore-webhook
Receive inbound webhooks from external services (Stripe, GitHub, Slack, Twilio, etc.) using `api.raw(...)` from `encore.dev/api`. The right skill any time the user names a third-party provider that POSTs events to a URL you own.
tanstack-frontend
React and TanStack Start frontends with Feature-Sliced Design, Fowler's component layers, and query and mutation factories. Use for routes, pages, components, hooks, or data access.
llm-wiki-setup
Co-creates a personal investment-research LLM Wiki (Karpathy's pattern) by interviewing the user for THEIR OWN analysis framework, not a template — a living CLAUDE.md of pure markdown + wikilinks, no RAG in place of compilation. Use to build a compounding 投研第二大脑 / 投研知识库 / 个人投研 wiki, ingest research reports / earnings calls into an existing wiki, or run post-earnings prediction→fulfillment reviews.
source-verification
Verify sources, claims, images, video, documents, interviews, and synthetic media with SIFT and a durable evidence trail. Use before relying on uncertain material.
make-scenario-building
Use when creating a new Make scenario or editing an existing one — finding modules, connections and account-dependent values, wiring the flow, saving through scenario_create or scenario_patch. Not for explaining, running or debugging a scenario, or for API-call shells.
frontend-security
Audit frontend codebases for security vulnerabilities and bad practices. Use when performing security reviews, auditing code for XSS/CSRF/DOM vulnerabilities, checking Content Security Policy configurations, validating input handling, reviewing file upload security, or examining Node.js/NPM dependencies. Target frameworks include web platform (vanilla HTML/CSS/JS), React, Astro, Twig templates, Node.js, and Bun. Based on OWASP security guidelines.
anime-avatar-generation
Generate anime-style avatars and characters using each::sense AI. Transform photos into anime, create Ghibli-style portraits, manga characters, chibi avatars, and full character sheets with multiple angles.
golang-cli-cobra-viper
Building production-quality CLI tools with Cobra command framework and Viper configuration management
comfyui-prompt-interview
Guided conversational interview to understand a user's creative vision before generating model-appropriate image prompts. Asks clarifying questions about subject, mood, style, and technical preferences (4-7 exchanges), then synthesizes positive prompt, negative prompt, recommended settings table, and pipeline recommendation. Formats prompts for the target model (SDXL tag-style, FLUX natural language, SD1.5 weighted tokens). Triggers on "I want to create...", "help me make an image of...", "I have an idea for...", "help me craft a prompt", "write me a prompt for...", or any request for help describing a creative vision. Does NOT cover workflow building, prompt debugging/fixing, technical explanations, model training, code generation, or identity-preserving character generation.
motherduck-build-data-pipeline
Build ingestion-to-serving pipelines on MotherDuck, including stage boundaries, transformations, and publication. Use for any recurring ingestion from an API, SaaS app, or database into MotherDuck.
ssl-tls-management
Manage SSL/TLS certificates with Let's Encrypt and internal PKI. Configure secure HTTPS, certificate renewal, and cipher suites. Use when implementing secure communications.
book-marketing
Diagnose book marketing copy problems and generate platform-optimized blurbs, descriptions, taglines, and query pitches. Use when marketing copy feels weak, when descriptions aren't converting, or when starting marketing from scratch.
seo-keyword-cluster-builder
SEO keyword clustering with topic organization, content hub architecture, internal linking strategies. Use for content strategy, keyword research, pillar page structures, or encountering cluster organization, hub architecture, internal linking errors.
app-store-deployment
Publishes mobile applications to iOS App Store and Google Play with code signing, versioning, and CI/CD automation. Use when preparing app releases, configuring signing certificates, or setting up automated deployment pipelines.
product-analysis
Diagnose competitive product analysis state and guide through systematic market evaluation. Use when analyzing a product category, building feature comparisons, understanding competitive landscape, building personas, or deciding build vs. buy. Routes to 6 interconnected frameworks based on current analysis state.
skill-creator
Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Claude's capabilities with specialized knowledge, workflows, or tool integrations.
dependency-audit
Dependency audit and cleanup workflow for maintaining healthy project dependencies. Use for regular maintenance, security updates, and removing unused packages.
postgresql
Administer PostgreSQL databases. Configure replication, backups, and performance tuning. Use when managing PostgreSQL deployments.
multi-tenant-safety-checker
Ensures tenant isolation at query and policy level using Row Level Security, automated testing, and security audits. Prevents data leakage between tenants. Use for "multi-tenancy", "tenant isolation", "RLS", or "data security".
linkedin-ads
Create LinkedIn ad campaigns, write sponsored content, define professional audiences, and plan B2B advertising budgets. Use when the user asks about LinkedIn Ads, sponsored content, LinkedIn Campaign Manager, InMail ads, lead gen forms, B2B advertising, professional targeting, or LinkedIn retargeting. Trigger phrases include "LinkedIn Ads", "LinkedIn campaign", "sponsored content", "InMail ad", "LinkedIn lead gen", "B2B ads", "LinkedIn retargeting", "LinkedIn audience", "LinkedIn ad copy", "LinkedIn Campaign Manager".
api-response-optimization
Optimizes API performance through payload reduction, caching strategies, and compression techniques. Use when improving API response times, reducing bandwidth usage, or implementing efficient caching.
drizzle-orm-d1
| Type-safe ORM for Cloudflare D1 databases using Drizzle. Use when: building D1 database schemas, writing type-safe SQL queries, managing migrations with Drizzle Kit, defining table relations, implementing prepared statements, using D1 batch API, or encountering D1_ERROR, transaction errors, foreign key constraint failures, or schema inference issues.
ios-design
SwiftUI interface implementation patterns aligned with the iOS 26 / Swift 6.2 clinic modular MVVM-C architecture, grounded in Creative Selection and Design Like Apple principles. Use when building new SwiftUI views/screens while respecting Domain/Data boundaries, App-target route-shell navigation, and production-grade accessibility/interaction standards.
mermaid-diagram-generator
Converts architecture descriptions, module specs, or workflow docs into Mermaid diagrams. Use when visualizing brick module relationships, workflows (DDD, investigation), or system architecture. Supports: flowcharts, sequence diagrams, class diagrams, state machines, entity relationship diagrams, and Gantt charts. Generates valid Mermaid syntax for embedding in markdown docs.