Skills worth trusting.
Agent skills from Anthropic, OpenAI, skills.sh, ClawHub, SkillsMP and other reputable sources. Savant assesses them for security risks and evaluates model-generated test cases using independent scoring. Workspaces import any skill into their own repositories through a reviewed pull request. Every listing on each hub is enumerated; packages are fetched, scanned and evaluated most-popular first as daily capacity allows.
codex-plusplus-ios-simulator-tweak
Embed a headless iOS Simulator in Codex++ right panel with mirroring, touch input, and UI element annotations
competitor-experience-audit
Audit the brand, UX, and site design of the leading sites in a vertical as a set of observable cross-site patterns, producing the experience bar a new build must meet or beat. Use this skill whenever the user wants to assess the competitive design field, capture vertical conventions, identify the design and UX bar of a category, or set the experience standard before a build. Triggers on competitor experience audit, UX audit, site design audit, brand audit, design conventions, what makes these sites good, vertical conventions, storefront patterns, merchandising patterns, layout density, primary task, design bar, category conventions, retail vs marketing register, what does the field do. Also triggers when an audit of the competitive field has captured technical signals (SEO, accessibility) but never named the brand, UX, or design conventions, and the build downstream will read as off-vertical without that bar.
rag-agent-builder
Build Retrieval-Augmented Generation (RAG) applications that combine LLM capabilities with external knowledge sources. Covers vector databases, embeddings, retrieval strategies, and response generation. Use when building document Q&A systems, knowledge base applications, enterprise search, or combining LLMs with custom data.
wix-app
Build and review Wix CLI app extensions — dashboard pages, modals, plugins, menu plugins, custom element widgets, Editor React components, site plugins, embedded scripts, backend APIs, backend events, service plugins, data collections, and App Market readiness. Use when building ANY feature or extension for a Wix CLI app or preparing a Wix app for App Market review. Triggers on: add, build, create, implement, help me, dashboard, widget, plugin, backend, API, event, collection, embedded script, service plugin, Editor React component, checkout, shipping, tax, discount, SPI, CMS, schema, tracking, popup, admin panel, menu item, modal, validate, test, verify, register extension, App Market, app review, submission readiness.
never-split-difference
Master FBI hostage negotiation techniques adapted for business. Apply Chris Voss' proven methods to close deals, handle objections, and negotiate from a position of strength. Use when: **High-stakes negotiations** where outcomes matter significantly; **Difficult conversations** with clients, vendors, or partners; **Price negotiations** when you need to hold firm; **Conflict resolution** between team members or stakeholders; **Sales objections** that standard techniques don't resolve
supabase-ui-skills
Supabase's UI design system. Use when building interfaces inspired by Supabase's aesthetic - dark mode, Inter font, 4px grid.
alicloud-security-id-verification-cloudauth
Manage Alibaba Cloud ID Verification (Cloudauth) via OpenAPI/SDK. Use whenever the user is working on identity-verification resource operations, config updates, status checks, or troubleshooting Cloudauth API workflows.
agent-ready-codebase
This skill should be used when auditing a codebase for AI agent readiness, or when guiding improvements to make a codebase work well with agentic coding tools. It applies when users ask to evaluate test coverage, file structure, type system usage, dev environment speed, or automated enforcement -- the five pillars that determine how effectively coding agents can operate in a project. Triggers on "audit my codebase", "make this agent-ready", "improve for AI agents", "agent-friendly", or questions about why agents struggle with a codebase.
finnhub
API de datos financieros completa: stocks US/global, forex, crypto, fundamentales, noticias, earnings, recomendaciones, WebSocket. 60 calls/min gratis.
google-finance
Datos de Google Finance via batchexecute (API RPC interna sin auth ni API key). Quote, OHLC intraday 1-min y 5-min, OHLC daily, financials masivos (income/balance/cashflow), earnings, analyst recommendations + opinions, descripcion empresa, peers, news, indices globales (Dow/S&P/NASDAQ/VIX/DAX), sectors heatmap. Cobertura mercados US (NASDAQ/NYSE) y argentinos (BCBA). ⚠️ API NO oficial — leer LIMITATIONS_TROUBLESHOOTING.md antes de uso productivo.
sentry-setup-logging
Setup Sentry Logging in any project. Use when asked to add Sentry logs, enable structured logging, capture console logs, or integrate logging libraries (Consola, Loguru) with Sentry. Supports JavaScript, Python, and Ruby.
clinpgx-database
Access ClinPGx pharmacogenomics data (successor to PharmGKB). Query gene-drug interactions, CPIC guidelines, allele functions, for precision medicine and genotype-guided dosing decisions.
Pentest Commands
This skill should be used when the user asks to "run pentest commands", "scan with nmap", "use metasploit exploits", "crack passwords with hydra or john", "scan web vulnerabilities with nikto", "enumerate networks", or needs essential penetration testing command references.
reskin
Rebuild an existing site's pages with byte-faithful content on a separately-defined donor design system — another live site, or local static HTML prototypes (Figma donors are contract-defined, not yet implemented). Content fidelity is gated byte-level (text, ordered images, SEO metadata); design application is flexible (content re-laid-out onto donor modules). Use when the user says "reskin my site with this design", "apply this design system to my content", "restyle my site to look like <other site>", "new design, same content", "rebrand my site using these prototypes", or names a content site plus a design donor. NOT for redesigning from intent (that's the stardust core extract/direct/prototype chain) and NOT for keeping the current design while migrating (that's the replica flow).
god-tibo-imagen
Generate images using Codex's ChatGPT backend with zero production dependencies. Reuses existing local Codex authentication (~/.codex/auth.json) — no new credentials needed. Supports CLI (gti command), Node.js library, and Python SDK. Accepts text prompts with optional reference images (PNG/JPG/GIF/WebP). Includes dry-run mode and debug output. Triggers on: god-tibo-imagen, gti, image generation, codex image, chatgpt image, ai image, gpt image generation.
agent-teams
Claude Code Agent Teams - default team-based development with strict TDD pipeline enforcement
cdp-connect
Superseded by the web CLI: attach to an already-running Chrome with `web browser attach <cdp-url>`, then drive it with `web browser eval|run|cdp|screenshot`. Use when the user asks to attach to, connect to, or control an existing Chrome running with --remote-debugging-port.
microsoft-outlook
Read, search, draft, send and manage Outlook / Microsoft 365 email AND calendar events via Microsoft Graph. Use when the user mentions Outlook (mail or calendar), Microsoft 365 inbox, sending mail, replying / forwarding, today's agenda, scheduling a meeting, finding free time, or modifying / cancelling an event.
hunt-tls-network
Hunt TLS/SSL and DNS misconfigurations — missing HSTS (downgrade attack), weak cipher suites, expired/invalid certificates, mTLS bypass, missing SPF/DKIM/DMARC (email spoofing), DNS Zone Transfer (AXFR), dangling CNAME subdomain takeover, CAA records. Most of these are Info/Low on their own — this skill is opinionated about which findings actually pay (spoofable DMARC with delivered-to-inbox proof, AXFR returning internal hosts, dangling-CNAME takeover) versus which get rejected as best-practice noise (missing CAA, missing HSTS with no MitM position). Use during recon to find infrastructure weaknesses, and to TRIAGE them honestly before reporting.
hunt-laravel
Hunt Laravel specific vulnerabilities — Debug mode leakage (APP_DEBUG=true exposes full stack trace + env vars), Laravel Telescope/Horizon dashboard unauthorized access, Ignition RCE (CVE-2021-3129), Signed URL manipulation, Queue Worker abuse, mass assignment via Eloquent, deserialization via cookies, .env file exposure. Use when target runs Laravel (PHP) — detected via X-Powered-By, Laravel session cookies, or /storage/ paths.
earnings-revenue-guidance
Extract specific revenue guidance and growth projections from earnings call transcripts, including segment breakdown, constant currency adjustments, and M&A contributions.
earnings-analyst-questions
Identify key themes and concerns raised by analysts during earnings calls, including specific analyst attribution and topic categorization.
earnings-capital-allocation
Extract management's commentary on capital allocation, investment priorities, shareholder returns, and strategic investments from earnings call transcripts.
earnings-competitive-review
Analyze management's discussion of competitive landscape, market positioning, and strategic differentiation from earnings call transcripts.
symphony-setup
Set up Symphony (OpenAI's Codex orchestrator) for a user's repo. Use when the user mentions Symphony setup, configuring Symphony, getting Symphony running, or wants to connect their repo to Linear for autonomous Codex agents. Also use when the user says "set up symphony", "configure symphony for my repo", or references WORKFLOW.md configuration.
create-beads-orchestration
Bootstrap lean multi-agent orchestration with beads task tracking. Use for projects needing agent delegation without heavy MCP overhead.
album-art-director
Creates visual concepts for album artwork and generates AI art prompts. Use during planning for concept discussion, or after all tracks are Final for actual artwork generation.
pp-substack
Run your Substack growth and authoring loop from the command line — publish rich drafts, manage a multi-publication portfolio, and measure what drives growth. Trigger phrases: `post a substack note`, `schedule a week of substack notes`, `find substack swap partners`, `which of my notes drove subs`, `what's my engagement reciprocity`, `voice-match a substack note`, `best time to post on substack`, `create a substack draft`, `sync my substack portfolio`, `top posts across my publications`, `search my substack posts`, `use substack`, `run substack`.
xlsx
Create, read, edit Excel .xlsx workbooks and CSVs.
product-leader
Strategic product leadership guidance for SaaS and technology companies. Covers product strategy, roadmap planning, product discovery, user research, growth product management, platform strategy, product analytics, and product launches. Use when defining product vision, prioritizing features, conducting discovery, analyzing metrics, or launching products. Use for "product strategy", "roadmap planning", "feature prioritization", "product discovery", "product metrics", "PRD writing".
implementing-jwt-signing-and-verification
Implements secure JWT (RFC 7519) signing and verification using HMAC-SHA256, RSA-PSS, ES256, and EdDSA, including token expiration, claims validation, and defenses against algorithm-confusion, none-algorithm, and key-injection attacks. Use when adding or hardening JWT-based authentication/authorization, or when auditing token verification code for common JWT vulnerabilities.
pp-google-ads
Google Ads API for account discovery, GAQL reporting, campaigns, budgets, assets, conversions, audiences, planning, and billing operations. Trigger phrases: `pull a Google Ads report`, `GAQL query`, `check campaign performance`, `use google-ads`.
ollama-optimizer
Optimize Ollama configuration for the current machine's hardware. Use when asked to speed up Ollama, tune local LLM performance, or pick models that fit available GPU/RAM. Don't use for LM Studio, llama.cpp, vLLM, or hosted-API LLM providers.
ga4
Read Google Analytics 4 reporting data through the GA4 Data API. Use for explicit GA4 property metadata, compatible metric/dimension reports, traffic analysis, key events, quotas, and bounded exports.
newsroom-style
Enforces AP Style and newsroom conventions. Use when writing news, editing drafts, creating headlines, or tightening copy.
book-hotel
Book a hotel package and pay with USDC via the x402 payment protocol. Use this skill when the user explicitly wants to confirm and pay for a hotel — phrases like "book it", "reserve hotel
docx
Use this skill whenever the user wants to create, read, edit, or manipulate Word documents (.docx files). Triggers include: any mention of 'Word doc', 'word document', '.docx', or requests to produce professional documents with formatting like tables of contents, headings, page numbers, or letterheads. Also use when extracting or reorganizing content from .docx files, inserting or replacing images in documents, performing find-and-replace in Word files, working with tracked changes or comments, or converting content into a polished Word document. If the user asks for a 'report', 'memo', 'letter', 'template', or similar deliverable as a Word or .docx file, use this skill. Do NOT use for PDFs, spreadsheets, Google Docs, or general coding tasks unrelated to document generation.
swiftui-patterns
Use when implementing iOS 17+ SwiftUI patterns: @Observable/@Bindable, MVVM architecture, NavigationStack, lazy loading, UIKit interop, accessibility (VoiceOver/Dynamic Type), async operations (.task/.refreshable), or migrating from ObservableObject/@StateObject.
Investment Analyzer
Analyze investment opportunities across asset classes with risk assessment, return modeling, and portfolio optimization
cboe-data
Datos de CBOE via APIs publicas: cotizaciones delayed de indices, futuros VX, charts intraday, most-active, market summary (equities + opciones), symbol lookup, futures products. Sin API key.
blog-refresher
Refresh and improve existing blog posts to outrank competitors using a 6-phase content audit and SERP gap analysis. Use when the user wants to update, refresh, or improve an existing blog post, recover lost rankings, or asks why a post fell behind competitors.
alicloud-security-center-sas
Manage Alibaba Cloud Security Center (Sas) via OpenAPI/SDK. Use whenever the user needs Security Center resource operations, configuration updates, status queries, and troubleshooting Sas API or security workflow issues.
alicloud-platform-multicloud-docs-api-benchmark
Benchmark similar product documentation and API documentation across Alibaba Cloud, AWS, Azure, GCP, Tencent Cloud, Volcano Engine, and Huawei Cloud. Given one product keyword, auto-discover latest official docs/API links, score quality consistently, and output detailed prioritized improvement recommendations.
tavily-web
Web search, content extraction, crawling, and research capabilities using Tavily API
hand-drawn-infographic-creator
Generate hand-drawn style diagrams and infographics for recovery education articles. Creates anatomist's notebook aesthetic visuals - brain diagrams, timelines, social comparisons, and process flows using continuous line art, semantic color coding, and margin annotations.
prelude-install
Install and configure Prelude (darkmatter/prelude) in any repository — run the setup wizard, wire it into an existing or new flake (the flake-parts module, or prelude.lib.evalModule for blueprint and other flakes), activate packages.prelude-shell in the devshell, and verify with real smoke checks. Use for adding devshell UI (MOTD, x command picker, docs viewer, themed prompt), integrating the generated prelude.nix sidecar, or activation questions (nix develop, direnv, lorri).
earnings-mgmt-comments
Extract management's commentary on specific topics from earnings call transcripts, including product development, strategy, competitive positioning, and executive quotes.
earnings-market-expansion
Identify market expansion and geographic growth plans discussed in earnings calls, including new market launches, international expansion, and product diversification strategies.