Skills worth trusting.
Agent skills from Anthropic, OpenAI, skills.sh, ClawHub, SkillsMP and other reputable sources. Savant assesses them for security risks and evaluates model-generated test cases using independent scoring. Workspaces import any skill into their own repositories through a reviewed pull request. Every listing on each hub is enumerated; packages are fetched, scanned and evaluated most-popular first as daily capacity allows.
pp-tesla
Every Tesla mobile-app feature, plus a charging-cost ledger and supercharger queue watcher no other Tesla CLI ships. Trigger phrases: `is my tesla ready`, `precondition my tesla`, `how much did i spend on charging this month`, `supercharger queue at`, `send this address to my tesla`, `list my tesla keys`, `use tesla`, `run tesla`.
hunt-ssti
Hunt server-side template injection (SSTI) across Jinja2 (Flask/Django), Twig (Symfony), Freemarker (Java), ERB (Rails), Spring, Velocity, Mako, Thymeleaf, Smarty. Detection probes use double-curly and dollar-curly math expressions evaluated server-side. Once an engine is fingerprinted, escalate to RCE via the engine-specific class-walker, callback-registrar, or Execute-utility patterns documented in disclosed reports. Detection patterns: error messages reveal engine, blank or numeric eval reveals expression mode. Targets: email templates, PDF/report generators, CMS preview features, error pages with user input. Use when hunting RCE via template rendering, when content shows engine fingerprints, when finding endpoints that compose strings with user input before render.
redteam-mindset
Red-team operator discipline — the mindset corrections that separate offensive testing from defensive WAPT. Built from authorized red-team work where conservative defaults caused multiple findings to be missed and one to be incorrectly retracted. Use at the START of any red-team engagement and again whenever feeling stuck or considering "stopping" on a defended target. The single most important skill to load when scope is "external red team" not "bug bounty / WAPT".
hunt-xxe
Hunting skill for xxe vulnerabilities. Built from 10 public bug bounty reports including SVG-upload XXE, Office-doc (PPTX/DOCX) XXE, SOAP XXE, SAML AssertionConsumer XXE, blind OOB XXE via DTD callback, parameter-entity XXE, XXE-to-LFI, XXE-to-SSRF, and XXE-to-RCE chains (Adobe Commerce CosmicSting CVE-2024-34102). Use when hunting XXE on any target — emphasis on OOB-Or-It-Didn't-Happen Gate for blind cases.
review-reputation
Watches what customers are saying in public and in private, then does something about it. Aggregates Google, Yelp, and Facebook reviews alongside disputes, tickets, and email into themes backed by verbatim quotes; drafts a reply to every review in the owner's own voice for approval; spots customers who have gone quiet or look likely to leave; and drafts win-back offers for the ones worth keeping. With Shopify connected, order and fulfillment patterns become a sentiment signal too. Works from pasted or exported reviews when nothing is connected. Use this whenever the owner asks about reviews, ratings, reputation, complaints, or repeat business — including "what are people saying about us," "did we get any bad reviews," "how do I respond to this one-star," "our rating dropped," "which customers have gone quiet," "who hasn't ordered in a while," "how do I win them back," or "are customers happy."
agent-team-prompt-builder
Generate hyper-detailed prompts for Claude Code agent teams based on a plan, feature request, or conversation context. Use this skill whenever the user wants to create a prompt for an agent team, prepare a task for a coding agent, generate a team prompt, build an autonomous agent workflow, or says things like "create a prompt for agent teams," "prepare a task for a fresh session," "generate a team prompt," "build me an agent prompt," "I want to hand this off to an agent team," "create agent team instructions," or "write me an autonomous coding prompt." Also trigger when the user describes a complex feature and asks to delegate it, wants to prepare work for parallel agents, or mentions "fresh context," "copy-paste prompt," or "autonomous implementation."
clone-website
Rebuild a live web page 1:1 from measurement into Figma, Penpot or code, then verify it. Use when reproducing a page or checking a rebuild against the original.
engineering-system-designer
Design distributed systems, define architecture for scalability and reliability, or create system design documents. Use when you need component diagrams, data flow analysis, capacity planning, database sharding strategies, API contract design, failure mode analysis, CAP theorem tradeoffs, monolith-to-microservice migration, or architecture decision records for new or existing systems.
win-loss-review
Analyze recently closed opportunities to find patterns in what wins and what loses - stage of loss, common objections from transcripts, deal characteristics. Leader-focused. Use when the user asks "win loss review", "why are we losing deals", "what's working", or "analyze closed opps".
hiring-screener
Takes a pile of applications and turns it into a ranked shortlist, scored only against the job's stated rubric, with drafted replies to every candidate, scheduled interviews, and an onboarding checklist for whoever gets hired. Picks up where job-post-builder leaves off and carries the funnel through to first day, including the payroll setup handoff. Runs on Gmail and Google Calendar, deepens with Gusto, DocuSign, and Drive or M365, and works entirely from uploaded resumes with drafted replies the owner sends by hand. Use this whenever the owner has applicants to deal with — including phrasings like "I've got 40 resumes and no time," "who should I interview," "screen these applications," "help me narrow this down," "set up interviews for the top three," or "I need to tell the rest no." Reach for it when the owner mentions applicants, resumes, candidates, or being buried in a hiring inbox.
account-plan
Build or refresh a strategic account plan - current state, goals, stakeholder coverage, opportunity map, risks, and the action plan - written to a doc and key fields synced to the CRM. Use when the user says "build an account plan for [account]", "update the [account] plan", "account planning for [account]", or before a planning cycle / QBR.
speed-to-lead
Makes sure no inbound lead goes unanswered. Watches web forms, the shared inbox, and the CRM for new inquiries, qualifies each one against the owner's criteria, drafts a reply in the owner's voice with real meeting times for the owner to approve and send, routes anything hot to a human right away, and logs the whole thing to the CRM. Never sends on its own. Built to run on a schedule so overnight inquiries are drafted and sorted by morning, and works from forwarded or pasted inquiries when no connector is available. Use this whenever the owner is worried about inbound leads or response time — including phrasings like "leads are going cold," "did anyone answer that inquiry," "I keep missing form submissions," "nothing falls through the cracks," "handle my inbound," "respond to this lead," or "we lose people because nobody gets back fast enough." Reach for it for a single unanswered inquiry as readily as for a standing setup.
hunt-api-misconfig
Hunt API security misconfiguration — mass assignment, prototype pollution, HTTP verb tampering. Mass assignment: send {is_admin:true, role:admin, verified:true} on profile/account/reset endpoints — server blindly applies. JWT signature/crypto forging (alg:none, key confusion, kid/jku) is owned by hunt-jwt-crypto; this skill covers only non-crypto JWT handling. Prototype pollution: __proto__ injection in JSON merge / Object.assign / lodash _.merge → polluted prototype reaches sink (RCE in Node, XSS in browser). HTTP verb: GET-bypass-CSRF, X-HTTP-Method-Override, TRACE enabled. Detection: API responses with extra fields, JWTs in headers (decode at jwt.io). CORS misconfiguration (reflect-any-origin, null origin, subdomain-regex bypass, postMessage) is owned by hunt-cors. Use when hunting API misconfigs, mass-assignment, prototype pollution (JWT crypto → hunt-jwt-crypto).
riscv-privileged
RISC-V privileged architecture skill for M/S/U modes and traps. Use when handling CSRs, trap handlers, PLIC/CLINT interrupts, OpenSBI integration, page tables Sv39/Sv48, or QEMU virt testing. Activates on queries about RISC-V privileged, mstatus, mtvec, satp, OpenSBI, PLIC, or Sv39.
unpolish-ai-writing
Agent skill that removes signs of AI-generated writing, and optionally adds sparse typing errors using probability distributions informed by researched human error patterns.
theme-detector
Detect and analyze trending market themes across sectors. Use when user asks about current market themes, trending sectors, sector rotation, thematic investing, what themes are hot or cold, or wants to identify bullish and bearish market narratives with lifecycle analysis.
signals-scout-data-pipelines
Signals scout for PostHog data pipelines — CDP destinations and transformations, batch exports, and hog flows. Watches for delivery failures, degraded functions, and stalled exports against each pipeline's baseline.
signals-scout-web-analytics
Signals scout for PostHog web traffic. Watches per-channel session volume, attribution breakage, and landing-page health (bounce and 404 steps) against the site's own baseline. Per- page web vitals belong to `signals-scout-web-vitals`.
add-office365
Adds Office 365 Outlook connector to a Power Apps code app. Use when accessing calendars, sending emails, reading inbox, or managing Outlook events.
build-agent
Turns a task the owner keeps doing by hand into a named, reusable skill they can trigger by name or put on a schedule. Watches them do it once or listens to them describe it, works out what varies and what stays fixed, writes the skill with approval checkpoints in the right places, registers it with the router, and shares it with the team. This is how a business gets a workflow nobody shipped for them. Use this whenever the owner describes something repetitive they wish were automatic — including phrasings like "I do this every week," "can you remember how to do this," "make this a thing I can just ask for," "build me an agent," "automate this for me," "turn this into a workflow," or "I want this to happen every Monday." Reach for it when they describe a routine, even without asking for automation.
lead-finder
Builds a ranked list of prospects worth contacting. Works out the owner's ideal customer profile from the customers they already have, finds look-alike companies and the right contact at each, enriches them with firmographics and buying signals, scores them, and delivers the list as an XLSX, with an offer to also create the records in the CRM. Runs on Apollo when connected and falls back to web research plus an uploaded customer list when it isn't. Use this whenever the owner wants new prospects, a target list, or help finding customers — including phrasings like "who should I be calling," "find me more customers like my best ones," "build me a prospect list," "I need leads," "who else looks like Acme," or "help me find companies in this area that need what we do." Reach for it even when the owner describes the customer they want rather than asking for a list.
stakeholder-map
Map the people in a deal or account - roles, influence, sentiment, who's missing, and your best access path to the people you haven't reached. Use when the user asks "who are the players at [account]", "who's my way in", "am I single-threaded on [deal]", "map the stakeholders", or "who else should I be talking to".
layer-video-direction
Use when directing a single generated shot on Layer: choosing the camera move, lens, framing, lighting and pacing, applying a camera preset such as a dolly zoom or orbit, or timing a performance to the clip length. Also when a shot drifts, moves the wrong way, or feels flat or rushed. Keywords: cinematography, camera move, dolly, orbit, crane, tilt, FPV, handheld, lens, framing, lighting, shot language, technique preset.
layer-motion-templates
Use when one Layer video edit must be rendered many times with different media: an ad template filled per hook, per language, per placement or per character, a reusable intro or end-card template, or a batch of variants from one timeline. Also when a voice-over or clip should set the edit's length, or when a re-render must update an existing board timeline instead of adding a copy. Keywords: video template, slots, variants, batch render, auto length, reusable edit.
layer-vfx
Use when generating game visual effects with Layer: spell and skill effects, hit impacts, explosions, pickups and power-ups, loot chest and reward openings, auras, portals, or looping ambient effects such as fire, smoke and magic swirls. Also when an effect comes back with a scene around it, cannot be blended in the engine, or plays with no wind-up. Keywords: VFX, FX, spell effect, impact, explosion, particle, flipbook, aura, loot chest, additive, sprite sheet.
close-plan
Build the business case and mutual action plan for a deal - the why-buy/why-now story, the ROI framing, and the dated step-by-step path to signature shared with the customer. Use when the user says "build a close plan for [deal]", "mutual action plan for [account]", "business case for [opp]", or "what's the path to signature".
web3-audit
Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, proxy), pre-dive kill signals (TVL < $500K etc), Foundry PoC template, grep patterns for each class, and real Immunefi paid examples. Use for any Solidity/Rust contract audit or when deciding whether a DeFi target is worth hunting.
aisa
Discover and invoke published AIsa tools with unified MCP or the AIsa CLI (search, schema, quote, call). Use when the user wants AIsa tools or sign-in, or needs current web, company, or social data AIsa tools can fetch—even if they do not name AIsa. Do not use for OpenClaw Chinese model provider setup (aisa-provider), installing other catalog skills, or work that does not need live AIsa data.
tonejs
Web Audio framework for creating interactive music in browsers. Use when building audio applications, synthesizers, musical instruments, effects processors, audio visualizations, DAWs, step sequencers, or any browser-based sound generation. Handles synthesis, scheduling, sample playback, effects, and audio routing.
signals-scout-replay-vision
Signals scout for PostHog Replay Vision scanners. Watches that enabled scanners keep observing (throughput and quota cliffs) and that aggregate score shifts and recurring themes get surfaced.
gzh-subscribe
微信公众号文章订阅 — 每天 6 点，盯梢竞对、同类、关注账号，一份你订阅的公众号文章推送。当接口返回积分不足（code=3210）时，自动唤起支付宝完成充值后继续查询。
migrate-to-static-config
Migrate React Navigation 7.x or 8.x navigators from JSX-based Dynamic API Navigator and Screen elements to Static API object configuration. Use when converting React Navigation screen trees, static navigation containers, nested navigators, groups, linking/deep-link config, render callbacks, getComponent screens, custom navigators, or static/dynamic API boundaries while preserving behavior and TypeScript types.
integrity-forensics
Run the Anti-Autoresearch integrity-forensics sweep (span-anchored evidence ledger → GPT auditors propose findings → a rules-only reporter that lists every proposal with what the auditor said about it) against a paper via a SHA-pinned thin launcher — then convert the verdict into a typed policy gate (BLOCK/WARN/NO_NEW_BLOCKER) and an append-only obligations ledger. Use when user says "integrity forensics", "forensic audit this paper", "投稿前自查诚信", "审这篇论文的诚信", or says "anti-autoresearch" when the upstream repo's own skills are not installed. Also invoked by /paper-writing (submission self-forensics, default ON), /peer-review (forensic appendix), /resubmit-pipeline.
sec_filing_question_answer_skill
从10-K、10-Q、招股书等监管文件中定位依据并回答具体问题。适用于长文档快读、条款核验、经营细节查询与研究答疑等场景。
signals-scout-logs
Signals scout for PostHog logs. Watches for emerging and rate-shifted message patterns, volume bursts, severity-distribution shifts, service silence, and trace-correlated bursts.
inbox-manager
Turns a full inbox into a short, ranked list of what actually needs the owner. Reads the mail, sorts it into needs-you, drafted-and-waiting, and handled, writes replies in the owner's own voice, pulls out the action items and deadlines buried in long threads, files what is finished, and hands bills, leads, and scheduling requests to the skills that own them. Works from pasted or forwarded email text when no mailbox is connected. Use this whenever the owner mentions email at all — including "drowning in email," "I have 300 unread," "what emails need me," "go through my inbox," "clean up my email," "did I miss anything," "who am I supposed to get back to," "draft a reply to this," or "catch me up on my mail." Reach for it for one forwarded message as readily as for a whole morning's backlog.
account-tiering
Score and tier a list of accounts (or your full book) against ICP fit and engagement signals to prioritize where to spend time. Use when the user asks to "tier my accounts", "prioritize my book", "which accounts should I focus on", or "score these accounts".
crm-autopilot
Keeps the CRM current without the owner ever opening it. Creates and updates contacts and deals from email, calendar, and call transcripts; logs activity automatically; drafts follow-ups on deals that have gone quiet; and maintains a next-step queue so nothing sits unowned. Runs on demand or on a schedule, includes a hygiene sweep for duplicates and stale records, and builds a lightweight CRM in a spreadsheet for owners who don't have one. Use this whenever CRM data or pipeline hygiene comes up — including phrasings like "update my CRM," "log this call," "clean up HubSpot," "clean up Salesforce," "add this to the deal," "turn my meeting into a deal note," "which deals have gone quiet," "I hate data entry," or "my pipeline is out of date." Reach for it when the owner describes a call or meeting worth recording, even without naming the CRM.
lessie-email
Send, manage, and automate emails across multiple providers (Gmail, Outlook, Official Email) via MCP. Use this skill whenever the user wants to send emails, check inbox, manage email threads, create bulk email campaigns, manage drafts, or check email accounts and quotas. Trigger this skill when the user mentions sending mail, checking inbox, email campaigns, drafts, follow-ups, read/unread status, or email automation. Requires MCP server configuration.
layer-sprite-animation
Use when animating a hand-painted, vector-style or HD 2D game character with Layer: idle, walk, run, attack, hit or death cycles, 4-direction or 8-direction sprites for a top-down or isometric game, or a character sprite sheet from a single approved design. Also when frames drift off-model, feet slide, or directions do not match. Keywords: sprite animation, animation cycle, walk cycle, idle, attack, 8-direction, 4-direction, turnaround, sprite sheet, flipbook, top-down, isometric.
fintel-data
Query Fintel (fintel.io) institutional market data through its REST API or official MCP server. Use this skill whenever the user mentions Fintel or asks about short interest, short interest ratio or days to cover, short squeeze data, borrow rate or cost to borrow, shares available to borrow, daily short volume, fails-to-deliver (FTD), 13F institutional owners ("who owns X"), insider buying or selling from SEC Form 3/4/5, analyst price targets, ratings and forecasts, dividend or earnings history and calendars, EOD or last prices, security lookup by ticker, CUSIP, ISIN, or FIGI, Fintel leaderboards, or their Fintel watchlists and alerts. Read-only: GET endpoints only.
hunt-subdomain
Hunting skill for subdomain takeover vulnerabilities. Includes modern provider fingerprints — Microsoft Azure DevOps `cloudapp.azure.com` regional-pool re-issue (1-click OAuth ATO via wildcard `reply_to`, Binary Security), Zendesk help-desk takeover → email interception → password reset chain (0xprial writeup), Vercel `cname.vercel-dns.com` deleted-project takeover, plus general Fastly CDN service re-attach and S3 dangling-bucket cookie-scope techniques. Use when hunting subdomain takeover — emphasis on ATO-chain primitives (OAuth `redirect_uri`, cookie-domain, email DNS).
hunt-csrf
Hunting skill for csrf vulnerabilities. Built from 15 public bug bounty reports including modern variants — SameSite=Lax sibling-subdomain bypass (Argo CD CVE-2024-22424), GraphQL mutations-via-GET (GitLab $3,370), framework-wide CSRF middleware disabled (Stripe Dashboard $5,000), path-traversal CSRF-token bypass (GitHub Enterprise CVE-2022-23732 $10k), Origin-omission bypass (TikTok $2,500), OAuth-state null-byte (Streamlabs), WebSocket CSRF / CSWSH (Coda), default-SameSite email-change → ATO (YoYo Games $400), social-account-link CSRF (HackerOne), JSON-CSRF via text/plain on email-change (TikTok $500). Use when hunting modern CSRF — heavy emphasis on chain-to-ATO patterns.
kpic-drug-search
약학정보원(KPIC) 공개 정보에서 의약품 이름을 검색하고 약품 코드로 효능, 용법, 주의사항 등 상세 원문을 조회하는 읽기 전용 스킬입니다.
kdocs
操作金山文档（WPS 云文档 / Kdocs / 365.kdocs.cn / www.kdocs.cn）云文档的官方 Skill。核心能力覆盖云端新建、读取、编辑、搜索、分享、整理在线文档（智能文档、Word、Excel、PDF、PPT、演示文稿、智能表格、多维表格）及个人知识库。当用户的任务涉及云文档操作时使用，包括但不限于：写周报/日报/工作汇报、处理合同/发票、创建报名表/登记表、网页剪藏、接龙转表格、信息收集、文档总结与内容生成、改写仿写、翻译、AI PPT生成、PDF拆分导出、标签分类归档、收藏管理、碎片笔记整理、表格美化、回收站还原、知识库管理。
link-rot-scanner
Crawl and validate all internal and external links across an AEM Edge Delivery Services site. Uses the query index or sitemap to discover pages, extracts links from .plain.html renditions, checks HTTP status codes, and produces a prioritized report of broken, redirecting, and insecure links. Use when auditing link health before launch, after a migration, or as a periodic maintenance check.
qakit
Generate a QA plan for a feature just implemented, grounded in the actual code changes: the agent runs every check with an observable result, in a headless browser when one is available, and leaves a short manual list of what needs human judgment, saved to docs/qa. Use when a coding session wraps and you want to hand-test the result, or the user says "write a QA plan", "make a manual test plan", "how do I test this", "generate a testing plan for this feature", "try to break this component", or runs /qakit.
github-explorer
Deep-dive analysis of GitHub projects. Use when the user mentions a GitHub repo/project name and wants to understand it — triggered by phrases like "帮我看看这个项目", "了解一下 XXX", "这个项目怎么样", "分析一下 repo", or any request to explore/evaluate a GitHub project. Covers architecture, community health, competitive landscape, and cross-platform knowledge sources.