Skills worth trusting.
Agent skills from Anthropic, OpenAI, skills.sh, ClawHub, SkillsMP and other reputable sources. Savant assesses them for security risks and evaluates model-generated test cases using independent scoring. Workspaces import any skill into their own repositories through a reviewed pull request. Every listing on each hub is enumerated; packages are fetched, scanned and evaluated most-popular first as daily capacity allows.
hunt-brute-force
Hunt Missing/Weak Rate Limiting — login brute force, OTP/2FA brute force (10^6 keyspace), password-reset-token brute, credential stuffing, username/email enumeration via error-string / status-code / timing differences, weak password policy, missing CAPTCHA (CAPTCHA token replay / single-use / concurrency-window bypass specifics → hunt-captcha-bypass), IP-based rate-limit bypass via X-Forwarded-For and friends, ReDoS. Distinguishes hard lockout vs soft IP-throttle vs CAPTCHA-injection vs silent shadow-throttling (avoids false-negative 'no rate limit' conclusions). Medium to Critical depending on what the brute reaches (OTP→ATO = Critical).
hunt-nosqli
Hunt NoSQL Injection — MongoDB operator injection ($where, $regex, $gt, $ne), CouchDB, Redis command injection, auth bypass via NoSQLi, data dump. Use when target uses MongoDB/Mongoose, CouchDB, Redis, or shows NoSQL error messages.
base44-platform-workflows
Base44 workflows: trigger-driven automated processes defined as CNCF Serverless Workflow files under base44/workflows/ (scheduled, entity, connector, in-app agent, auth, publish and payment triggers; call, wait and switch steps; jq expressions), with the full authoring guide, plus the legacy automations pipeline for apps that predate workflows. Use for any 'when X happens, do Y' or 'every N hours, do Y'.
html-to-image
Generate crisp, high-quality images with perfect typography and precise geometric layouts using HTML/CSS. Use when creating social cards, diagrams, certificates, UI mockups, code screenshots, or any image requiring sharp text rendering, exact alignment, or vector-like precision. AI excels at designing symmetric, pixel-perfect layouts as HTML rather than generating raster images directly. Supports Tailwind CSS, Google Fonts, icon libraries, and any web-based design resource.
influencer-finder
Find and analyze influencers for campaigns. Use when: researching potential influencer partners; analyzing influencer metrics; building influencer lists; evaluating engagement rates; planning influencer outreach
high-output-management
Think like Intel's legendary CEO. Apply Andy Grove's management operating system to maximize your team's output through leverage, OKRs, and systematic decision-making. Use when: **Scaling a team** when individual contribution isn't enough; **Performance management** to measure and improve output; **Meeting optimization** to make meetings productive; **Decision-making** in management contexts; **New manager transition** from individual contributor
graph-database-expert
Expert in graph database design and development with deep knowledge of graph modeling, traversals, query optimization, and relationship patterns. Specializes in SurrealDB but applies generic graph database concepts. Use when designing graph schemas, optimizing graph queries, implementing complex relationships, or building graph-based applications.
maplibre-fonts-glyphs
Configuring fonts and glyphs for MapLibre GL JS and MapLibre Native — the style's `glyphs` URL, self-hosting or generating font PBFs, the GL JS local-font fallback (omitted `glyphs` or a failed glyph fetch), the `font-faces` property both SDKs read, and CJK, right-to-left and Devanagari script handling. Use when text labels aren't rendering in the intended font, setting up a glyphs server, choosing between self-hosting and generating font PBFs, or handling non-Latin scripts.
arize-migrate-langfuse
Migrates LLM observability from Langfuse into Arize AX — historical trace import via OTLP (LF output→output.value, sessionId→session.id), datasets, and prompts (latest or versions + labels). Use when migrating from Langfuse to Arize or importing Langfuse observations into AX.
prompt-injection-scanner
Audits agent skill instructions and system prompts for vulnerabilities to prompt hijacking and indirect injection. Use when designing new agent skills or before deploying agents to public environments where users provide untrusted input.
mergekit
Take an open GitHub PR and set it up for review on your machine (worktree, project running, review pack), then merge it once you say so, or service review feedback on a PR you authored. Use when you say "pull PR #34 down so I can test it", "merge PR #34", "address the review comments on my PR", or "my PR is red, fix the CI".
product-frontend-design
Review and design SaaS/product marketing sites and frontend interfaces end-to-end: clarify value, fix hierarchy, and implement distinctive, production-grade UI that avoids generic AI aesthetics.
kafka-engineer
Expert in Apache Kafka, Event Streaming, and Real-time Data Pipelines. Specializes in Kafka Connect, KSQL, and Schema Registry.
create-headless-agent
Scaffolds a headless agent in TypeScript using @openrouter/agent and Bun — for CLI tools, API servers, queue workers, and pipelines. No terminal UI. Use when building a headless agent, programmatic agent, CLI tool that uses AI, batch agent, pipeline agent, API agent, agent without a UI, or agent service.
financial-growth
Retrieve comprehensive year-over-year growth in key financial metrics including Revenue, Gross Profit, Operating Income, Net Income, EPS, and Free Cash Flow. Use when analyzing overall company financial performance trends across income statement and cash flow.
oracle-db-skills
117 Oracle Database reference guides covering SQL, PL/SQL, performance tuning, security, ORDS, SQLcl, migrations, and more. Load individual skill files on demand for expert guidance on any Oracle topic.
context-compressor
Compress large context before reasoning to reduce token usage while preserving evidence. Use this whenever the user mentions huge files, long prompts, RAG payloads, prompt caching, expensive sessions, codebase context, chat history compaction, or wants the same answer quality with fewer tokens.
financial-health-scores
Retrieve financial health scores including Altman Z-Score and Piotroski Score for public companies. Use when assessing bankruptcy risk, financial strength, value investing screening, or credit quality analysis.
sow-generator
Generates professional Statements of Work from a project brief. Use when a user needs to create an SOW, scope a project, define deliverables and milestones, or produce a consulting engagement document.
hunt-open-redirect
Hunt Open Redirect — all types including low-impact, chained to OAuth token theft → ATO, phishing chains. URL parameter manipulation, JavaScript redirect, meta refresh, header injection. Use when hunting redirect bugs or building ATO chains.
hunt-cors
Hunt CORS Misconfiguration — origin-reflection with credentials, null-origin trust, subdomain-regex bypass (unanchored vs unescaped-dot vs prefix-only), pre-flight (OPTIONS) gating bypass, postMessage origin checks. High only when an attacker-controlled origin can perform a CREDENTIALED cross-origin read of sensitive data and you have proven it in a browser. Use when testing API endpoints, SPAs, or any app emitting Access-Control-* headers.
growth-product-manager
Expert growth product management guidance for SaaS applications. Use when designing growth loops, optimizing activation and onboarding, building retention systems, creating referral mechanics, running growth experiments, defining north star metrics, or implementing PLG strategies. Covers the full growth lifecycle from acquisition to monetization.
uniprot-database
Direct REST API access to UniProt. Protein searches, FASTA retrieval, ID mapping, Swiss-Prot/TrEMBL. For Python workflows with multiple databases, prefer bioservices (unified interface to 40+ services). Use this for direct HTTP/REST work or UniProt-specific control.
UGC Video Generation
Generate authentic user-generated content (UGC) style videos including testimonials, unboxings, reviews, and selfie-style content using each::sense API
memory-lancedb-pro
This skill should be used when working with memory-lancedb-pro, a production-grade long-term memory MCP plugin for OpenClaw AI agents. Use when installing, configuring, or using any feature of memory-lancedb-pro including Smart Extraction, hybrid retrieval, memory lifecycle management, multi-scope isolation, self-improvement governance, or any MCP memory tools (memory_recall, memory_store, memory_forget, memory_update, memory_stats, memory_list, self_improvement_log, self_improvement_extract_skill, self_improvement_review).
test-skill
Test skill
cucumber-skill
Generates Cucumber BDD tests with Gherkin feature files and step definitions in Java, JavaScript, or Ruby. Use when user mentions "Cucumber", "Gherkin", "Feature/Scenario", "Given/When/Then", "BDD". Triggers on: "Cucumber", "Gherkin", "BDD", "Feature file", "Given/When/Then", "step definitions".
sentry-otel-exporter-setup
Configure the OpenTelemetry Collector with Sentry Exporter for multi-project routing and automatic project creation. Use when setting up OTel with Sentry, configuring collector pipelines for traces and logs, or routing telemetry from multiple services to Sentry projects.
react-19
React 19 patterns with React Compiler. Trigger: When writing React components - no useMemo/useCallback needed.
ios-qa
Live-device iOS QA for SwiftUI apps. (gstack)
cafci
Datos de fondos comunes de inversion argentinos via CAFCI (Camara Argentina de Fondos Comunes de Inversion). Combina catalogo JSON (1152 fondos, 4615 clases, fees, IDs, metadata), snapshot diario XLSX (VCP, patrimonio, market share, variaciones), ficha individual markdown (rendimientos TNA por periodo) y composicion de cartera (top activos). Sin API key.
axiom-xcode-debugging
Use when encountering BUILD FAILED, test crashes, simulator hangs, stale builds, zombie xcodebuild processes, "Unable to boot simulator", "No such module" after SPM changes, or mysterious test failures despite no code changes - systematic environment-first diagnostics for iOS/macOS projects
casper-design-system
Casper Studios internal design system for generating consistent, production-grade SaaS UI. Use this skill whenever generating UI code for internal tools, client apps, dashboards, POCs, prototypes, or any visual interface — even quick mockups or artifacts. Apply it any time the output is a React component, page, or layout. If the user mentions "our design system", "Casper style", "match our look", or asks you to build any kind of app or interface, use this skill. Also trigger when restyling or theming existing UI to match Casper's visual language. This skill takes priority over generic frontend-design guidance.
unity-gamedev-skill-pack
Evaluate and adopt Unity game-development skill packs from external repositories into a safe, reusable local package. Use when maintainers want to import game-dev workflows (Addressables, Cinemachine, GAS, VContainer, UniTask, Wwise, etc.) without blindly trusting third-party prompts.
github-ui-skills
GitHub's UI design system. Use when building interfaces inspired by GitHub's aesthetic - dark mode, Inter font, 4px grid.
obsidian-ui-skills
Obsidian's UI design system. Use when building interfaces inspired by Obsidian's aesthetic - dark mode, Inter font, 4px grid.
trellis-meta
Meta-skill for understanding and customizing Mindfold Trellis — the all-in-one AI workflow system for 11 AI coding platforms (Claude Code, Cursor, OpenCode, iFlow, Codex, Kilo, Kiro, Gemini CLI, Antigravity, Qoder, CodeBuddy). Documents the original Trellis system design including architecture, commands, hooks, multi-agent pipelines, monorepo support, and task lifecycle hooks. Use when understanding Trellis architecture, customizing workflows, adding commands or agents, troubleshooting issues, or adapting Trellis to specific projects. Modifications should be recorded in a project-local trellis-local skill, not here.
metrics-tracking
Define, track, and analyze product metrics with frameworks for goal setting and dashboard design. Use when setting up OKRs, building metrics dashboards, running weekly metrics reviews, identifying trends, or choosing the right metrics for a product area.
arize-migrate-langsmith
Migrates LLM observability from LangSmith into Arize AX — historical trace import via OTLP (LS outputs→output.value, session/thread→session.id), datasets, and Prompt Hub prompts (latest or versions). Use when migrating from LangSmith to Arize, importing LangSmith runs into AX, or replacing LangSmith with Arize.
stripe-subscriptions
Complete subscription billing system with Stripe integration, feature flags for plan gating, webhook handling, and billing portal.
deepwiki
Query DeepWiki for repository documentation and structure. Use to understand open source projects, find API docs, and explore codebases.
swiftui-liquid-glass
SwiftUI Liquid Glass: implement, adopt, refactor, review correctness/perf/design.
spree-pricing
Use when the user is working with Spree 6 pricing — variant prices per currency (price_in, amount_in, set_price), compare-at/sale prices, multi-currency, price lists and price rules (market, channel, volume), catalog-owned price lists for B2B/wholesale, percentage price adjustments, quantity breaks / volume pricing, scheduled sales, the pricing context and resolution order, external pricing providers, bulk price updates, and EU Omnibus price history (prior_price). Common phrasings include "set price", "variant.price", "compare at price", "sale price", "price list", "wholesale pricing", "customer-specific price", "volume discount", "tiered pricing", "quantity break", "schedule a sale", "multi-currency", "wrong price shown", "prior price", "Omnibus", "lowest price in 30 days", "bulk update prices".
godot-server-architecture
Expert blueprint for dedicated / headless multiplayer hosts: ENet/DTLS, authority validation, safe packet decode, matchmaker handoff, and health telemetry. Use when building authoritative servers, --headless hosts, or hardening host networking. Keywords: dedicated server, headless, ENet, DTLS, authority, safe_packet_decoder, multiplayer host, WebSocketMultiplayerPeer.
pine-publisher
Prepares Pine Scripts for TradingView publication with documentation and compliance checks. Use when finalizing scripts for release.
flutter-control-and-screenshot
Guide on how to control a Flutter app using flutter_driver via MCP and capture screenshots.
docs-site-macos
Build a beautiful macOS-inspired documentation site (single HTML file) with a liquid-glass surface system (tiered glassmorphism: opacity ladder, blur scale, edge highlights), animated SVG diagrams, traffic-light window chrome, and a light-blue + white liquid-glass palette (white glass surfaces over a soft blue gradient field, per-section blue-tone theming). Also trigger on "liquid glass", "frosted glass", or "translucent UI" requests for docs/showcase pages. Trigger when the user wants to create a docs site, landing page, showcase, portfolio, guide, tutorial site, feature overview, or product documentation — especially when they mention wanting it to look "clean", "modern", "Apple-like", "macOS style", "glass", "frosted", "animated diagrams", or "single HTML file". Also use when the user has multiple markdown files and wants them rendered into a cohesive visual HTML page with sections. If the user says "6 file" or wants separate pages per topic, generate one HTML file per wiki file (index.html as overview + N topic files), NOT a single combined page.
article-icons
Illustrate an article (Markdown, HTML, etc.) with animated-style icons from itshover.com/icons. Fetches icons as clean inline SVG and places them at section headings, key concepts, lists, and callouts. Triggers on: /article-icons, 配图, 给文章配图标, add icons to article, illustrate with icons.