Skills worth trusting.
Agent skills from Anthropic, OpenAI, skills.sh, ClawHub, SkillsMP and other reputable sources. Savant assesses them for security risks and evaluates model-generated test cases using independent scoring. Workspaces import any skill into their own repositories through a reviewed pull request. Every listing on each hub is enumerated; packages are fetched, scanned and evaluated most-popular first as daily capacity allows.
hunt-deserialization
Hunt Insecure Deserialization — Java gadget chains (ysoserial), PHP object injection (phpggc), Python pickle RCE, .NET BinaryFormatter, Ruby Marshal.load, JNDI/Log4Shell. RCE via deserialization is almost always Critical. Use when target runs Java, PHP serialization, Python pickle, .NET, or Ruby on Rails.
mckinsey-research
Run a full McKinsey-level market research and strategy analysis using 12 specialized prompts. USE WHEN: - market research, competitive analysis, business strategy, TAM analysis - customer personas, pricing strategy, go-to-market plan, financial modeling - risk assessment, SWOT analysis, market entry strategy, comprehensive business analysis - بحث سوق, تحليل استراتيجي, تحليل منافسين, دراسة جدوى, خطة عمل - "حلل لي السوق" for business entry or investment decisions DON'T USE WHEN: - User wants a quick opinion on a business idea → just answer directly - Product recommendations or shopping → use personal-shopper - Content strategy for social media → use viral-equation - Simple web search for company info → use web_search directly - Comparing products to buy → use personal-shopper - Analyzing a single competitor briefly → just answer directly EDGE CASES: - "حلل لي السوق" with a specific product to buy → personal-shopper (not this skill) - "حلل لي السوق" for business entry → this skill - "وش أفضل منتج" → personal-shopper - "وش حجم سوق X" → this skill - "قارن لي بين منتجين" → personal-shopper - "قارن لي بين شركتين" as competitors → this skill - "دراسة جدوى مشروع" → this skill - "أبغى أفتح مشروع" → this skill (full analysis) - "أبغى أشتري لابتوب" → personal-shopper (purchase, not business) INPUTS: Business description, industry, target customer, geography, financials (optional) TOOLS: sessions_spawn (sub-agents), web_search, web_fetch OUTPUT: Complete strategy report saved to artifacts/research/{date}-{slug}.html SUCCESS: User gets 12 consulting-grade analyses synthesized into one actionable report
solution-architect
Expert in designing high-level enterprise solutions. Specializes in TOGAF adaptation, trade-off analysis, and aligning technology with business strategy.
scientific-thinking-biology
Use when interpreting biological research findings, evaluating life science evidence, analyzing molecular or cellular mechanisms, comparing competing biological hypotheses, designing or critiquing experiments in biology, genetics, genomics, cell biology, immunology, neuroscience, ecology, or any life science domain. Triggers on questions about gene function, pathways, phenotypes, GWAS hits, single-cell data, animal models, clinical translation, evolutionary arguments, or any biology/life science reasoning task.
deck-strat
Generate a Strategy Guide for a finished Commander, Brawl, or Historic Brawl deck — explains how to pilot it, with rules-cited stack/timing/interaction notes. Read-only on the deck; for tuning, run /deck-wizard first.
gene-database
Query NCBI Gene via E-utilities/Datasets API. Search by symbol/ID, retrieve gene info (RefSeqs, GO, locations, phenotypes), batch lookups, for gene annotation and functional analysis.
django-cloud-sql-postgres
Deploy Django on Google App Engine Standard with Cloud SQL PostgreSQL. Covers Unix socket connections, Cloud SQL Auth Proxy for local dev, Gunicorn configuration, and production-ready settings. Use when: deploying Django to App Engine, configuring Cloud SQL PostgreSQL, setting up Unix socket connections, or troubleshooting "No such file or directory", "connection refused", or "FATAL: password authentication failed".
football-betting-analysis
Análisis pre-partido de fútbol en 8 capas. Recibe una consulta en lenguaje natural, descubre el partido en FlashScore MCP, ejecuta build_match_context.py para obtener un contexto normalizado en JSON, y produce un informe estructurado con lenguaje probabilístico. Solo para partidos notstarted. No inventa datos, no suple la predicción con modelos heurísticos.
gohighlevel
GoHighLevel integration. Manage Organizations. Use when the user wants to interact with GoHighLevel data.
greploop
Address Greptile feedback on a PR, MR, or shelved changelist through bounded review and fix cycles. Use when the task includes a Greptile review loop. Supports the alternate @greptile-apps trigger for large PRs.
validatekit
Validate a SaaS or startup idea before you build it, with a few forcing questions, an optional market and competitor scan, an honest verdict graded on the evidence you can actually produce, the narrowest wedge worth testing, and one real-world assignment. Use when the user says "validate my idea", "should I build this", "will anyone pay for this", or runs "/validatekit".
workflow-automator
Takes a manual business workflow description and designs the automated version. Maps current steps, handoffs, decision points, and bottlenecks. Designs automated flow with triggers, conditions, actions, and error handling. Outputs workflow-automation.md with before/after Mermaid diagrams, tool recommendations, implementation steps, and time savings estimate.
income-statement
Retrieve real-time income statement data including Revenue, Net Income, and EPS Diluted for public companies. Use when analyzing absolute financial figures, historical earnings, or comparing company scale across fiscal periods.
codex-pr-review
Run Codex validation on an existing GitHub PR. Use when waiting for Codex status, delegating review fixes to a sub-agent, investigating repeated feedback patterns, and repeating until Codex approves, blocks with evidence, or times out.
sentry-ruby-sdk
Full Sentry SDK setup for Ruby. Use when asked to add Sentry to Ruby, install sentry-ruby, setup Sentry in Rails/Sinatra/Rack, or configure error monitoring, tracing, logging, metrics, profiling, or crons for Ruby applications. Also handles migration from AppSignal, Honeybadger, Bugsnag, Rollbar, or Airbrake. Supports Rails, Sinatra, Rack, Sidekiq, and Resque.
alicloud-backup-hbr
Manage Alibaba Cloud Cloud Backup (HBR) via OpenAPI/SDK. Use whenever the user asks for backup lifecycle operations such as resource listing, policy/config updates, job status queries, and troubleshooting HBR backup or restore workflows.
alicloud-ai-image-zimage-turbo
Generate images with Alibaba Cloud Model Studio Z-Image Turbo (z-image-turbo) via DashScope multimodal-generation API. Use when creating text-to-image outputs, controlling size/seed/prompt_extend, or documenting request/response mapping for Z-Image.
clawteam
Route explicit ClawTeam runtime requests into one honest operator packet before touching commands: manual-team, template-launch, monitor-recover, or profile-setup. Use when the user specifically wants ClawTeam's team/task/inbox/worktree/board workflow for parallel developer work, product/ops research, content operations, or game-production coordination. Not for generic multi-agent routing, board-only governance, or lightweight subtask fan-out when jeo, harness, task-planning, or built-in delegation already fit.
cash-flow-growth
Retrieve year-over-year growth in cash flow metrics including Operating Cash Flow, Free Cash Flow, and Net Cash Flow. Use when analyzing company cash generation trends, capital allocation efficiency, or liquidity trajectory.
greploop-apps
Run the greploop workflow with the @greptile-apps trigger when the normal trigger refuses a large PR. Requires the greploop skill installed alongside this entrypoint.
gitkit
The shared git layer other skills borrow: the worktree path, name, and lifecycle, a worktree's declared setup and teardown, the base branch, rebase versus merge, branch sync, hotfix branches, merged-branch cleanup, lost-work recovery, and stacked branches. Use when the user says "make me a worktree for #42", "where's the worktree for this branch", "tear down this worktree", "set up this worktree", "make this worktree's dev database", "what's the base branch here", "should I rebase or merge", "sync this branch with main", "start a hotfix for the login crash", "backport this hotfix", "clean up my merged worktrees", "I lost a commit", "stack this on #43", or runs "/gitkit", and whenever another skill needs any of those answers.
lemonsqueezy-ui-skills
Lemonsqueezy's UI design system. Use when building interfaces inspired by Lemonsqueezy's aesthetic - light mode, Inter font, 4px grid.
analyzing-security-logs-with-splunk
Leverages Splunk Enterprise Security and SPL (Search Processing Language) to investigate security incidents through log correlation, timeline reconstruction, and anomaly detection. Covers Windows event logs, firewall logs, proxy logs, and authentication data analysis. Activates for requests involving Splunk investigation, SPL queries, SIEM log analysis, security event correlation, or log-based incident investigation.
kling-video
Generate AI videos using Kling video generation models. Use when you need to: (1) create videos from text prompts, (2) animate images into videos, (3) transform existing videos with AI, or (4) create AI avatar videos with speech.
hyperliquid-trading-bot
Configurable grid trading bot for Hyperliquid DEX with TypeScript/Node.js primary implementation, supporting perpetuals and spot markets with risk management features.
gpt-image-playground
AI coding agent skill for GPT Image Playground — a React/TypeScript web app for OpenAI image generation and editing using gpt-image-1 and related APIs.
autonomous-agent-gaming
Build autonomous game-playing agents using AI and reinforcement learning. Covers game environments, agent decision-making, strategy development, and performance optimization. Use when creating game-playing bots, testing game AI, strategic decision-making systems, or game theory applications.
orca-onboard
Parallel codebase onboarding — distilled understand-anything pipeline (scan + git history + batch analyze + layers/tour, no plugin), then domain enrichment (Claude), wiki + HTML via opencode+DeepSeek Flash v4.
scenario-maya-fx
Use when a Maya task involves simulation or procedural effects: nCloth or Nucleus (a cape, skirt, flag or garment on an animated character, cloth through the body, jittery or stretchy cloth), nParticles, Bifrost graphs (Aero smoke, dust puff, mist, fire, liquids, MPM cloth, snow, sand, "Bifrost smoke"), MASH scattering or motion graphics, sim caches (nCache, Alembic, OpenVDB, file_cache, USD) or FX delivered to lighting or a game engine (flipbook sprites).
scenario-godot-3d-world
Use when building 3D levels and worlds in Godot 4.7: third-person or FPS controller, player stuck on stairs, spring arm camera clipping, blockout with CSG, GridMap and MeshLibrary, terrain (heightmap, HeightMapShape3D, Terrain3D regions, textures, painting), scattering trees with MultiMesh, streaming a big world, procedural meshes with SurfaceTool, Jolt physics settings, importing GLB or glTF from Blender or AI generators (Scenario, Tripo, Meshy, Hitem3D), import scripts, name suffixes, model facing, collision generation, LODs.
cheat-init
cheat-on-content 的首次 onboarding 与脚手架创建器。统一流程——所有用户都走相同 5 阶段闭环，唯一区别是"发过视频的人"会在 init 时多一步：抓取已有视频建立历史 context（用于后续 cheat-seed 给更贴合的选题、更准的 baseline）。触发词："初始化"/"init"/"首次使用"/"我是新用户"/"setup cheat-on-content"。**必须在用户第一次会话执行；其他子 skill 在 .cheat-state.json 不存在时自动路由到此。**
design-spec-extraction
Extract comprehensive, production-ready JSON design specifications from visual inputs using a 7-pass serial architecture with cross-validation. Use when converting screenshots, mockups, or design exports into structured design tokens, component specs, accessibility analysis, and developer handoff artifacts.
pw-redbook-image
将文章内容拆解为小红书风格的系列配图。支持从 URL、文件或文本生成封面图、内容图和结尾图，自动创建提示词并调用图片生成工具。
reticle
Install, instrument and verify this running web app from the inside (DOM, network, routing, console and framework state) instead of screenshots or guessing. Drives one real flow end to end and returns a verdict with the file:line to fix. Use when the user asks to set up or install Reticle, when a user-facing change needs proving before you call it done, when a test passes but the UI is broken, or when the user types /reticle.
redis-expert
Expert-level Redis for caching, pub/sub, data structures, and high-performance applications. Use when the user mentions cache, pub/sub, in-memory stores, key-value stores, or NoSQL, or when the task involves Data Structures, Basic Operations, Advanced Patterns, or Redis Streams.
next-forge
Expert assistance for next-forge — a production-grade Turborepo template for Next.js SaaS apps. Triggers on questions about next-forge installation, setup, architecture, packages, customization, deployment, and development workflows.
codex-plusplus-tweak-system
Expert in developing, installing, and managing tweaks for the Codex++ desktop app extension system
instagram-post
Use when the user wants to post or schedule to Instagram through Publora: a single image, a 2-10 image carousel, a Reel or a Story. Requires a Business account and an image or video; text-only posts are rejected by the API. Not for Threads (use threads-post).
awesome-codex-skills-curator
Curate, install, and manage Codex skills from the awesome-codex-skills collection for AI coding agents.
seo-keyword
Run keyword research, classify by search intent, cluster into topical groups, and prioritize for content production. Use this skill whenever the user asks to do keyword research, find target keywords, identify ranking opportunities, classify search intent, build a topical map, or plan a content strategy around what people search for. Triggers on keyword research, keyword strategy, search intent, keyword clustering, topic clusters, keyword difficulty, search volume, ranking opportunity, content gap, what should I write about, target keyword, primary keyword, secondary keyword, long-tail. Also triggers when planning a content calendar or new site without keywords yet defined.
superlog-debug
Pull production observability context from the Superlog MCP to ground debugging, incident response, and 'how is this behaving in prod right now?' questions. Triggers whenever the user is investigating a bug, regression, or incident; asking about real traffic, error rates, latency, or throughput; validating a deploy; or wants the recent history of a service.
disk-hygiene
macOS disk cleanup, cache pruning, stale file detection, and Downloads triage. TRIGGERS - disk space, cleanup, disk usage
make-a-video
Beginner-friendly end-to-end video creator for HyperFrames. Use when the user says "make a video", "create a video", "new video", "build a video", "video from scratch", "I want to make a video", "help me create a video", or when someone who's never used HyperFrames before arrives with a concept, script, or rough idea and wants a finished MP4. Interviews the user in one pass, then builds the full video with mandatory preview and visual-verification gates.
analyzing-tls-certificate-transparency-logs
Queries Certificate Transparency logs via crt.sh and pycrtsh to detect phishing domains, unauthorized certificate issuance, and shadow IT. Monitors newly issued certificates for typosquatting and brand impersonation using Levenshtein distance. Use for proactive phishing domain detection and certificate monitoring.
alicloud-network-dns-cli
Alibaba Cloud DNS (Alidns) CLI skill. Use to query, add, and update DNS records via aliyun-cli, including CNAME setup for Function Compute custom domains.
alicloud-ai-search-dashvector
Build vector retrieval with DashVector using the Python SDK. Use when creating collections, upserting docs, and running similarity search with filters in Claude Code/Codex.
alicloud-compute-fc-serverless-devs
Alibaba Cloud Function Compute (FC 3.0) skill for installing and using Serverless Devs to create, deploy, invoke, and remove a Python function. Use when users need CLI-based FC quick start or Serverless Devs setup guidance.
linkfox-amazon-reviews-list
按ASIN获取并分析亚马逊商品评论，支持15个站点(含美国站)，按星级筛选评论。当用户提到亚马逊评论、美国站评论、商品评价、买家投诉、差评、好评、星级评分、评论分析、评论情感、产品改良建议、Vine评论、已验证购买评论、竞品评论研究、Amazon reviews, US reviews, Amazon.com reviews, product feedback, negative review analysis, positive review analysis, star rating filter, review sentiment analysis, product improvement insights, Vine reviews, competitor reviews, customer feedback时触发此技能。即使用户未明确说"评论"，只要其需求涉及读取、筛选或分析亚马逊商品的买家评论，也应触发此技能。