Skills worth trusting.
Agent skills from Anthropic, OpenAI, skills.sh, ClawHub, SkillsMP and other reputable sources. Savant assesses them for security risks and evaluates model-generated test cases using independent scoring. Workspaces import any skill into their own repositories through a reviewed pull request. Every listing on each hub is enumerated; packages are fetched, scanned and evaluated most-popular first as daily capacity allows.
linux-pentester-practical-commands
Practical Linux command reference and techniques for penetration testing operations covering reconnaissance, enumeration, exploitation, privilege escalation, and post-exploitation
qa-testing-mobile
Plans mobile QA automation for iOS and Android apps. Use when planning automation frameworks, device matrix, flake control, or CI/CD release gates.
agent-team
Auto-generate and run a per-repo Claude Code agent team. Probes the current repo (build/CI/env manifests, agent launchers, slash commands, spec dirs) and writes `.claude/agents/{role}.md` subagent definitions for the relevant roles from a library (coder, reviewer, auditor, tester, documenter, release, architect, researcher, spec-keeper, fact-checker, web-ux) plus a `.claude/agent-team.md` workflow doc. Use when (1) `/agent-team init` to create the team for the current repo, (2) `/agent-team update` to refresh after project shape changes, (3) `/agent-team {task}` to run a task with the team (spawn teammates plus drive orchestrator flow plus stop at user gates), (4) `/agent-team reflect` to review the session's agents and propose refactors plus new roles. Roles carry a frontmatter `version:` for staleness detection. Triggers include "/agent-team", "spin up a team", "auto-create agents", "agent team for this repo", "team-on-task", "reflect on the agents".
nestjs-best-practices
NestJS best practices and patterns for building scalable, maintainable backend applications. This skill should be used when writing, reviewing, or refactoring NestJS code to ensure proper architecture, security, performance, and code quality. Triggers on tasks involving NestJS modules, controllers, services, guards, pipes, middleware, Prisma database operations, authentication, or any NestJS-specific patterns.
code-quality
Review, refactor, and debug code with verification before claiming done. Use when responding to review feedback, requesting a review, refactoring or reducing technical debt, root-causing a bug or failing test, or checking work before a merge, commit, or completion claim.
fpl-copilot
Use when the user asks about Fantasy Premier League player stats, transfer advice, captain picks, fixture difficulty, gameweek strategy, or saved squad management.
dx-devops-project-manage
Use to list, view, or manage DevOps Center projects in a Salesforce org — show all projects, create a project, or update an existing project's name, description, or active status. Invoke to run sf devops project list on any listing request, or to create a project, set up a new pipeline foundation, initialize DevOps Center for a feature, update project settings, or activate/deactivate (archive) a project. Consolidates sf devops project list/create/update. DO NOT TRIGGER for work item, pipeline, promotion, or conflict operations — those are separate skills.
hunt-mfa-bypass
Hunt MFA / 2FA bypass — 7 distinct patterns. (1) MFA not enforced on sensitive endpoints (password change, email change accept without MFA challenge), (2) MFA-step skip via direct navigation to post-login URL, (3) MFA-token replay (same code accepted twice), (4) brute-force the 6-digit OTP without rate limit (10^6 attempts at server speed), (5) race condition on OTP validation, (6) recovery-code dump via /api/me, (7) backup factor downgrade (SMS factor with no rate limit). Plus the chain: cookie theft + password oracle + no step-up = ATO without MFA challenge. Detection: trace auth flow in Burp, find every state transition, check if MFA is middleware-gated vs per-endpoint, check OTP entropy and rate limit on OTP-validate. Validate: attacker session reaching post-MFA state. Use when hunting auth bypass, MFA flows, chaining primitives toward ATO.
vue-best-practices
Vue 3 and Vue.js best practices for TypeScript, vue-tsc, Volar, and component patterns. Use when writing, reviewing, or refactoring Vue 3 components with TypeScript, configuring Volar/vueCompilerOptions, extracting component types, working with defineModel/withDefaults, setting up Pinia store tests, or debugging Vue tooling issues. Triggers on Vue components, props extraction, wrapper components, template type checking, strictTemplates, vueCompilerOptions, Volar 3, CSS modules, fallthrough attributes, defineModel, withDefaults, deep watch, vue-router typed params, Pinia mocking, HMR SSR, moduleResolution bundler, useTemplateRef, onWatcherCleanup, useId, generic components, reactive props destructure.
write-spec
Break large features into independently verifiable, human-reviewable slices under a feature directory in specs/. Use for risky or multi-step feature work that needs upfront questioning, API seams, browser-playable checkpoints, HTML visualizations, screenshot gates, staged implementation plans, recursive fog-of-war reslicing, or proactive research into reference implementations/best practices before slicing. Pairs with your project's verification harness and screenshot gates (the browser checkpoints), [refactor-clean](../refactor-clean/SKILL.md) (review the materialized spec so the plan describes one-owner architecture, not the feature bolted on), [screenshot-critique](../../visual/screenshot-critique/SKILL.md) and [compare-screenshots](../../visual/compare-screenshots/SKILL.md) (the visual gates), and a code-review pass (audit each slice before it lands).
player-avatar
The live player in a Decentraland scene. Use when the user wants to read player position or profile, fetch avatar appearance for off-scene addresses (parcel owners, NFT holders), trigger emotes, read equipped wearables, attach items to players/avatar (cosmetic vs held gameplay items), show a custom label plate above a player's or NPC's nametag (AvatarNametag), hide avatars or disable passports in zones (AvatarModifierArea), adjust locomotion speed, teleport the player (movePlayerTo), or listen for scene entry/exit. Do NOT use for NPC characters (see npcs), wallet/blockchain checks (see nft-blockchain), freezing player movement (see advanced-input for InputModifier), or camera mode (see camera-control).
luau-type-expert
Use when adding or fixing Luau type annotations - luau-lsp/luau-analyze errors, --!strict compliance, "Type X could not be converted into Y", generics, union types, type narrowing/refinements, casts (::), typed metatables and OOP, .d.luau definitions, or .luaurc setup. Triggers include "type error", "strict mode", "luau-lsp", "type mismatch", "export type".
codex
Use the local Codex CLI as an independent second agent. Two branches — (1) proactively run `codex review` for a second opinion after completing a substantive change, before presenting it as done or committing; (2) delegate a well-defined implementation task via `codex exec`, ONLY when the user explicitly asks for Codex to do it. Also covers how to prompt Codex.
extract-my-action-items
Extract action items from a Fireflies call transcript. Default extracts for ALL attendees; specify a target person to extract only theirs. Use when the user wants to find commitments, assignments, and follow-ups from a recorded meeting.
pr-summary
Create a PR with dev as base using the pull request template. Use when opening a new PR.
skill-creator
Architect and refine OpenCode skills to extend agent capabilities. Handles directory scaffolding, SKILL.md authoring, frontmatter optimization, and resource organization (scripts/references/assets). Use proactively for creating new skills, updating existing workflows, or fixing skill discovery issues. Examples: - user: "Create a new skill for database management" → scaffold directory and initial SKILL.md - user: "My skill isn't triggering correctly" → analyze and refine frontmatter description - user: "Add a python script to the image-processing skill" → structure scripts/ directory - user: "How should I structure a skill for API docs?" → design references/ layout
ikuai-cli
CLI for managing iKuai routers via local v4.0 API. Use when the user asks to check router status, configure network/DNS/DHCP/VPN/firewall, manage users, view logs, or automate any iKuai router operation.
portfolio-audit
Audit a design portfolio website against what top design leaders actually look for when hiring. Use with /portfolio-audit <url>.
pytest
Pytest testing patterns for Python. Trigger: When writing Python tests - fixtures, mocking, markers.
auth0-ionic-vue
Use when adding Auth0 login, logout, or deep linking to an Ionic Vue app with Capacitor. Integrates @auth0/auth0-vue with Capacitor Browser and App plugins for native iOS/Android.
deep-research
Async deep research via Gemini Interactions API (no Gemini CLI dependency). RAG-ground queries on local files (--context), preview costs (--dry-run), structured JSON output, adaptive polling. Universal skill for 30+ AI agents including Claude Code, Amp, Codex, and Gemini CLI.
vibe-kanban
Run a coding-board control plane when the real job is managing bounded coding cards, isolated workspaces/worktrees, review queues, retries, and PR handoff — not just prompting one agent once. Use when the user needs a visual board or tracker-linked workspace loop for parallel coding tasks, agent comparison, or review-heavy handoff. Triggers on: kanban board, coding board, workspace board, review queue, tracker sync for coding tasks, worktree board, parallel coding agents, card-based agent workflow, and vibe-kanban. Route planning-only requests to `task-planning` / `survey` / `plannotator`, browser/UI execution to `agentation` / `browser-harness` / `playwriter`, and non-code PM / marketing / game-production coordination to their domain skills.
langfuse
Expert in Langfuse - the open-source LLM observability platform. Covers tracing, prompt management, evaluation, datasets, and integration with LangChain, LlamaIndex, and OpenAI. Essential for debugging, monitoring, and improving LLM applications in production. Use when: langfuse, llm observability, llm tracing, prompt management, llm evaluation.
commit-work
Create high-quality git commits: review/stage intended changes, split into logical commits, and write clear commit messages (including Conventional Commits). Use when the user asks to commit, craft a commit message, stage changes, or split work into multiple commits.
customer-discovery
Systematically validate your business hypotheses before building anything. Master Steve Blank's Customer Development methodology that became the foundation of Lean Startup and YC's approach. Use when: **Starting a new venture** to avoid building something nobody wants; **Before writing a line of code** to validate problem-solution fit; **Pivoting decisions** to systematically test new directions; **Early-stage fundraising** to prove market validation; **Product roadmap planning** to prioritiz...
tool-design
This skill should be used for the tool-interface layer of an agent system specifically: writing tool descriptions agents can route on, designing tool schemas and response formats, naming conventions, actionable error recovery messages, MCP server design, tool-set consolidation, and deciding when to add or remove an individual tool. Use this when the unit of work is a single tool or a set of tools. Route project-shape, pipeline architecture, and task-model-fit decisions to project-development; route deciding whether to introduce sub-agents to multi-agent-patterns.
pp-docker-hub
Printing Press CLI for Docker Hub. Docker Hub public API. Search container images, browse tags, check sizes, inspect Dockerfiles, and explore the...
laravel-api
Build production-grade Laravel REST APIs using opinionated architecture patterns with Laravel best practices. Use when building, scaffoling, or reviewing Laravel APIs with specifications for stateless design, versioned endpoints, invokable controllers, Form Request DTOs, Action classes, JWT authentication, and PSR-12 code quality standards. Triggers on "build a Laravel API", "create Laravel endpoints", "add API authentication", "review Laravel API code", "refactor Laravel API", or "improve Laravel code quality".
nft-blockchain
NFTs and Web3 in Decentraland scenes: NftShape picture frames, wallet and token-gating checks, MANA/ERC20/NFT payments and marketplace orders (dcl-crypto-toolkit), and smart-contract calls (eth-connect). Use for anything wallet, token or chain related.
tdd-workflow
Test-Driven Development workflow principles. RED-GREEN-REFACTOR cycle.
omc
Route Claude Code–first orchestration to the truthful OMC install topology and runtime before giving commands. Use when the user wants oh-my-claudecode / OMC in Claude Code, needs to choose between marketplace plugin, shell-side `omc` CLI, or local-checkout `--plugin-dir` usage, or needs accurate guidance on `/team`, `/autopilot`, `/ralph`, `/ultrawork`, `/ultraqa`, `omc setup`, `omc team`, `omc ask`, updates, HUD/hooks, duplicate installs, worktree/state drift, or mapping Claude workflows to Codex/OMX and Gemini/Antigravity/OMA. Triggers on: omc, oh-my-claudecode, Claude Code team mode, autopilot, /team, ralph, ultrawork, ultraqa, ccg, omc team, omc ask, omc setup, plugin-dir, OMC HUD, OMC hooks.
tapd
TAPD 敏捷研发管理平台集成。使用脚本调用 TAPD API，实现需求、缺陷、任务、迭代、测试用例、Wiki 等实体管理。使用场景包括：(1) 查询/创建/更新需求、缺陷、任务、迭代 (2) 管理测试用例和 Wiki (3) 管理评论和工时 (4) 关联需求与缺陷 (5) 获取源码提交关键字
rep-context
Leader's prep on a single rep before a 1:1 - their pipeline, recent activity, what they've been working on per chat and calendar, and where they might need help. Use when the user asks "prep for my 1:1 with [rep]" (a rep you manage), "how is [rep] doing", or "what's [rep] working on".
bd-cuj
Set up Critical User Journey (CUJ) monitoring in bitdrift. Deploys a complete observability stack: path discovery (sankey), conversion funnel, completion rate SLO, key step duration alerting, session capture, and a two-tab dashboard. Trigger when a user wants to monitor a journey end-to-end, track conversion and drop-off, measure step duration, or set up SLOs on a business-critical flow such as checkout, onboarding, login, or search.
playwright-skill
Complete browser automation with Playwright. Auto-detects dev servers, writes clean test scripts to /tmp. Test pages, fill forms, take screenshots, check responsive design, validate UX, test login flows, check links, automate any browser task. Use when user wants to test websites, automate browser interactions, validate web functionality, or perform any browser-based testing. Do NOT use for quick page debugging or network inspection (use chrome-devtools instead).
filesystem
Advanced filesystem operations - listing, searching, batch processing, and directory analysis for Clawdbot
xiaohongshu-note-analyzer
小红书笔记优化助手工具，基于全网爆款数据对用户文案进行多维度评分并给出改进建议；当用户需要评估文案质量、获取优化建议时使用
ios-ui-refactor
Principal-level SwiftUI UI review and refactoring patterns for iOS 26 / Swift 6.2 clinic-architecture apps, grounded in Rams, Segall, and Edson principles. Use when auditing or improving existing SwiftUI screens, transitions, animations, and visual systems while preserving brand identity and respecting clinic Domain/Data/App boundaries.
java-maven-gradle
Master Maven and Gradle - build configuration, dependencies, plugins, CI/CD
strapi-docs-mcp
Query the official Strapi documentation through the strapi-docs MCP server (powered by Kapa). Use for any Strapi question — API syntax, configuration, features, plugins, upgrades, CLI. If the server is missing, instruct the user how to install it.
prd-done
Complete PRD implementation workflow - create branch, push changes, create PR, merge, and close issue
prd-update-decisions
Update PRD based on design decisions and strategic changes made during conversations
prd-full
Run a PRD end-to-end autonomously — start, iterate until done, then create a PR. Stops after PR creation for manual review.
alertmanager-query
Query AlertManager via curl using the v2 API. Use when listing active/silenced alerts, creating/managing silences, or checking alert inhibition state. Triggers on: alertmanager, silences, silence alerts, alert filters, alert inhibition, alertmanager API, create silence, delete silence.
linux-pentesting-commands
Practical Linux command reference for penetration testing, reconnaissance, enumeration, exploitation, and privilege escalation.
xianyu-publish
闲鱼（goofish.com）网页端运营自动化。用于“发闲置、编辑在架商品、上架/下架、删除宝贝、汇总买家消息、批量发布模板化”场景；重点处理表单填写、图片上传、发布与结果核验、失败重试与风控拦截提示。
zod4
Comprehensive guide for Zod 4 schema validation library. This skill should be used when migrating from Zod 3, learning Zod 4 idioms, or building new validation schemas. Covers breaking changes, new features, and migration patterns.
shopify-webhooks
Receive and verify Shopify webhooks. Use when setting up Shopify webhook handlers, debugging signature verification, or handling store events like orders/create, products/update, or customers/create.