Skills worth trusting.
Agent skills from Anthropic, OpenAI, skills.sh, ClawHub, SkillsMP and other reputable sources. Savant assesses them for security risks and evaluates model-generated test cases using independent scoring. Workspaces import any skill into their own repositories through a reviewed pull request. Every listing on each hub is enumerated; packages are fetched, scanned and evaluated most-popular first as daily capacity allows.
spark-recipe-unsubscribe-audit
Full unsubscribe audit: scan inbox, archive, and GateKeeper for newsletter senders, classify by volume and engagement, detect phishing and duplicate subscriptions, then unsubscribe via spark action or extracted footer links.
pentest-skills-framework
Natural language-driven penetration testing framework with modular skills for recon, exploitation, and security testing using AI agents
gmail-automation
Lightweight Gmail integration with standalone OAuth authentication. No MCP server required.
pulumi
Pulumi infrastructure as code performance and reliability guidelines. This skill should be used when writing, reviewing, or refactoring Pulumi code to ensure optimal deployment performance and infrastructure reliability. Triggers on tasks involving Pulumi stacks, components, state management, secrets configuration, resource lifecycle options, or CI/CD automation.
agency-brand-scoping
Five brand direction variations for pitch discovery.
agent-fetch
Fetch and extract full article content from URLs. Returns complete text with structure (headings, links, lists) instead of summaries. Multiple extraction strategies, browser impersonation, cookies, crawling, custom selectors, 200-700ms.
roboflow-universe
Use when searching for or using public datasets/models on Roboflow Universe (universe.roboflow.com), the open repository of 1M+ computer vision datasets and 50K+ pre-trained models.
security-investigator-automation
Automated security investigations using Microsoft Sentinel, Defender XDR, GitHub Copilot Agent Skills, and MCP servers for natural language threat hunting
agora-reporting
Report coding-agent progress, questions, decisions, blockers, tests, PRs, human replies, inbox instructions, and handoffs to the Agora coordination server. Use for every coding task when AGORA_URL is set, especially at session start, before risky or shared edits, when blocked, when asking for human or agent input, after running tests or verification, when opening or updating PRs, when polling for human replies or instructions, and before the final response.
conductorscore
Score your Claude Code skill — measure agent leverage, craft, and anti-patterns from your local transcripts. Use when the user types /conductorscore.
find-skills
Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.
speckit-implement-zh
通过测试与验证为先的方式，按序执行并实现已批准的规范提案。用于实施变更、应用提案、执行规范任务或按已批准计划构建。触发词包括 "speckit-implement", "speckit开发", "开发", "实施" "实现提案", "应用变更", "执行规范", "按顺序完成任务", "构建功能", "开始实施"。
competitor-alternatives
When the user wants to create competitor comparison or alternative pages for SEO and sales enablement. Also use when the user mentions 'alternative page,' 'vs page,' 'competitor comparison,' 'comparison page,' '[Product] vs [Product],' '[Product] alternative,' or 'competitive landing pages.' Covers four formats: singular alternative, plural alternatives, you vs competitor, and competitor vs competitor. Emphasizes deep research, modular content architecture, and varied section types beyond feature tables.
claude-opus-4-5-migration
Migrate prompts and code from Claude Sonnet 4.0, Sonnet 4.5, or Opus 4.1 to Opus 4.5. Use when the user wants to update their codebase, prompts, or API calls to use Opus 4.5. Handles model string updates and prompt adjustments for known Opus 4.5 behavioral differences. Does NOT migrate Haiku 4.5.
opencode-config
Edit opencode.json, AGENTS.md, and config files. Use proactively for provider setup, permission changes, model config, formatter rules, or environment variables. Examples: - user: "Add Anthropic as a provider" → edit opencode.json providers, add API key baseEnv var, verify with opencode run test - user: "Restrict this agent's permissions" → add permission block to agent config, set deny/allow for tools/fileAccess - user: "Set GPT-5 as default model" → edit global or agent-level model preference, verify model name format - user: "Disable gofmt formatter" → edit formatters section, set languages.gofmt.enabled = false
react-frontend
React architecture patterns, TypeScript, Next.js, hooks, and testing. Use when working with React component structure, state management, Next.js routing, Vitest, React Testing Library, reviewing React code, or synchronizing JSON locales and reviewing translations in a React or frontend interface. For visual design and aesthetic direction, use frontend-design instead.
write-concept
Write or review JavaScript concept documentation pages for the 33 JavaScript Concepts project, following strict structure and quality guidelines
post-game-press-conference-simulator
Generate realistic coach/player interview responses for wins, losses, controversies, injuries. Authentic coachspeak and player personalities.
SQL Injection Testing
This skill should be used when the user asks to "test for SQL injection vulnerabilities", "perform SQLi attacks", "bypass authentication using SQL injection", "extract database information through injection", "detect SQL injection flaws", or "exploit database query vulnerabilities". It provides comprehensive techniques for identifying, exploiting, and understanding SQL injection attack vectors across different database systems.
brd-browser-debug
Debug Bright Data Scraping Browser sessions using the Browser Sessions API. Use this skill when the user encounters a Bright Data browser session error, puppeteer stack trace, failed scraper run, or asks about session bandwidth, duration, captchas, or connection issues. Also use when a Bright Data scraper produces unexpected results such as empty data, 0 items found, missing products, or fewer results than expected — session data can reveal whether the issue is network/proxy-side (blocks, captchas, redirects, timeouts) or client-side (selectors, extraction logic). Triggers on phrases like 'why did my session fail', 'debug my bright data session', 'check my scraping browser sessions', 'how much bandwidth did my scraper use', 'got 0 results', 'found 0', 'scraper returned empty', 'scraper not working', 'script didn't work', or when a Bright Data error code or brd.superproxy.io stack trace appears in the conversation. Requires BRIGHTDATA_API_KEY environment variable.
docx-reader
Reads Microsoft Word (.docx) files and extracts text content. Use when needing to read .docx documents. Requires python-docx package.
azure-security
Expert knowledge for Azure Security development including best practices, decision making, security, configuration, integrations & coding patterns, and deployment. Use when configuring Azure antimalware, container SBOM/signing, CMK encryption, AKS/VM hardening, or Key Vault keys, and other Azure Security related development tasks. Not for Azure Defender For Cloud (use azure-defender-for-cloud), Azure Information Protection (use azure-information-protection), Azure DDoS Protection (use azure-ddos-protection), Azure Web Application Firewall (use azure-web-application-firewall).
conducting-network-penetration-test
Conducts comprehensive network penetration tests against authorized target environments by performing host discovery, port scanning, service enumeration, vulnerability identification, and controlled exploitation to assess the security posture of network infrastructure. The tester follows PTES methodology from reconnaissance through post-exploitation and reporting. Activates for requests involving network pentest, infrastructure security assessment, internal network testing, or external perimeter testing.
eve-agent-memory
Choose and combine Eve storage primitives to give agents persistent memory — short-term workspace, medium-term attachments and threads, long-term org docs and filesystem. Use when designing how agents remember, retrieve, and share knowledge.
eve-deploy-debugging
Deploy and debug Eve-compatible apps via the CLI, with a focus on staging environments.
bmad-editorial-review-prose
Deprecated — forwards to bmad-editorial-review.
game-changing-features
Find 10x product opportunities and high-leverage improvements. Use when user wants strategic product thinking, mentions '10x', wants to find high-impact features, or says 'what would make this 10x better', 'product strategy', or 'what should we build next'.
speckit-analyze-zh
对spec.md、plan.md和tasks.md三个核心文档进行非破坏性跨工件一致性和质量分析。在任务生成后识别不一致、重复、模糊和规范不足的项目。触发词包括："speckit-analyze"、"speckit分析"、"文档一致性分析"、"规范分析"、"质量检查"、"工件分析"、"spec分析"、"plan分析"、"task分析"。
alicloud-ai-video-wan-video
Generate videos with Model Studio DashScope SDK using Wan video generation models (wan2.6-t2v, wan2.6-i2v-flash, wan2.6-i2v and regional variants). Use when implementing or documenting video.generate requests/responses, mapping prompt/negative_prompt/duration/fps/size/seed/reference_image/motion_strength, or integrating video generation into the video-agent pipeline.
github-issues
Create, triage, label, assign GitHub issues via gh or REST.
huggingface-hub
HuggingFace hf CLI: search/download/upload models, datasets.
research-writing-assistant
Use when writing academic papers, theses, or research articles - supports brainstorming, chapter writing, literature review, and LaTeX output
spark-persona-sales-rep
Sales rep / account manager persona for Spark. Client relationship tracking, pipeline review, follow-up cadence, and deal context.
job-hunt
AI 岗位猎手。基于用户简历，自动在各大招聘平台搜索匹配岗位，输出带匹配度评估的岗位列表。 支持 LinkedIn、Indeed、Boss 直聘、拉勾、猎聘等平台。 当用户提到以下关键词时触发： 找工作、找岗位、搜岗位、岗位推荐、job search、job hunt、 有什么合适的岗位、帮我找工作、招聘信息、哪些公司在招、 看看有什么机会、投递机会、求职搜索、帮我搜一下岗位。 当用户从其他 Skill 衔接过来并表示想找工作或投递，也应触发。
spark-persona-team-lead
Team lead persona for Spark. Team workload review, assignment distribution, shared inbox triage, and standup preparation.
find-skills
Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.
agency-client-handoff
Export a white-label client deliverable as a zip.
investigating-with-observability
Use when investigating issues, debugging problems for applications, or responding to alerts in the Kubernetes cluster using VictoriaMetrics, VictoriaLogs, or VictoriaTraces.
autonomous-trading
Give your agent a budget, a target, and a deadline — it does the rest. Orchestrates DSL + Opportunity Scanner + Emerging Movers into a full autonomous trading loop on Hyperliquid. Race condition prevention, conviction collapse cuts, cross-margin buffer math, speed filter. 3 risk profiles: conservative, moderate, aggressive. Use when setting up autonomous trading, creating a trading strategy, or running a scan-evaluate-trade-protect loop.
privilege-escalation-methods
Provide comprehensive techniques for escalating privileges from a low-privileged user to root/administrator access on compromised Linux and Windows systems. Essential for penetration testing post-exploitation phase and red team operations.
streamlit
Fast Python framework for building interactive web apps, dashboards, and data visualizations without HTML/CSS/JavaScript. Use when user wants to create data apps, ML demos, dashboards, data exploration tools, or interactive visualizations. Transforms Python scripts into web apps in minutes with automatic UI updates.
playwright-migration
Step-by-step migration guides for moving to Playwright from Cypress or Selenium/WebDriver — command mappings, architecture changes, and incremental adoption strategies.
seecode
Create animated, explorable editorial diagrams in 45 types (architecture, flowchart, sequence, state, ER, DB schema, UML class, swimlane, timeline, gantt, journey, tree, org chart, nested, venn, quadrant, fishbone, wardley, bar, line, scatter, sankey, treemap, heatmap, 3D isometric objects, floor plans and exploded views) as standalone HTML from a short JSON spec. Use when the user asks to draw, diagram, chart or visualize a system, codebase, flow, process, API call sequence, hierarchy, data or a physical object (a chair); to convert Mermaid, Graphviz/DOT, PlantUML, D2, draw.io, Excalidraw, SQL or CSV into a clean diagram; or to export a diagram as PNG, JPEG, SVG, GIF or MP4. Also for everyday plans: trips, moves, job hunts, approvals, budgets, where money goes.
anti-defensive-writing
Reduce defensive writing in drafts and revisions by removing unnecessary caveats, disclaimers, hedges, apology-like framing, negative self-limiting statements, and over-explanations while preserving necessary scope, accuracy, safety, legal, ethical, and methodological limits. Use when drafting or revising academic writing, papers, essays, abstracts, introductions, contribution statements, discussions, conclusions, technical explanations, grant writing, product writing, policy writing, professional reports, or any text the user wants to be clearer, stronger, more direct, more concise, more confident, less verbose, less caveated, less apologetic, or less defensive.
writing-dna-skill
从至少 20 篇完整文章中蒸馏可复用的写作 DNA，分析语言、文章结构、选题逻辑、素材策略、认知框架和视觉风格，并生成 Writing-DNA.md；按该 DNA 写作时会读取全部蒸馏产物和 5 篇相关原文。用于中英文作者、账号、品牌或出版物的风格分析与一致性写作。 Distill reusable Writing DNA from at least 20 complete articles for Chinese or English authors, publications, brands, and accounts; use for language, structure, topic logic, source strategy, cognitive-frame, and visual-style analysis.
brand-style
Sets and updates the owner's brand look and output preferences, which every page and document the plugin produces then follows automatically. Captures the brand from a pasted website link or a plain-words description — never a hex code, color picker, or upload — previews it on a sample page, asks how they want their outputs delivered (visual artifacts, Word docs, markdown, Notion pages, Canva Docs, or best-for-the-skill), and saves both to the business profile. Runs inside smb-onboard on first setup and stands alone forever after. Use when the owner says "update my brand," "we rebranded," "change my colors," "make the reports match our new look," "change how you give me reports," "I want Word docs instead," or anything about the look or format of what the plugin hands them.
swiftui-specialist
Authoritative SwiftUI best practices and performance guidance from Apple; supersedes prior training on these topics. For code generation, consult the relevant references when generating any SwiftUI code related to: - animation (the @Animatable macro vs AnimatableValues vs AnimatablePair, and custom animatableData setter logic) - Environment and @Entry (closure or class-typed defaults, unstable defaults, high-frequency updates) - @Observable best practices and efficient invalidation - ForEach and List row identity and structure (id: \.self, indices, offsets, AnyView or multi-view rows, inline filter/sort, cached collections, List fast path) - localization (String vs LocalizedStringResource, the right bundle in packages and frameworks, .textCase, .formatted(.list()), translator comments) - soft-deprecated APIs such as NavigationView and the old onChange, and when to surface them during feature work.
make-integration
Use when the user asks to recognize invoices, bills, receipts, tickets, or other voucher files with Make Integration services. Also triggered by requests like "发票内容", "识别发票", "票据 OCR", "ocr 这张图片", or "验真发票". Does not manage Make resources (use makecli), design DSL schemas (makedsl), build UI (makeui), implement auth (make-app-auth), Service/API code (make-app-service), runtime packaging (make-app-runtime), or perform non-Make OCR outside makecli integration commands.