Skills worth trusting.
Agent skills from Anthropic, OpenAI, skills.sh, ClawHub, SkillsMP and other reputable sources. Savant assesses them for security risks and evaluates model-generated test cases using independent scoring. Workspaces import any skill into their own repositories through a reviewed pull request. Every listing on each hub is enumerated; packages are fetched, scanned and evaluated most-popular first as daily capacity allows.
incident-responder
Production incident response automation. Reads logs, checks recent deploys, identifies root cause, suggests fixes, drafts incident comms, creates post-mortem templates. Severity classification (SEV1-4), escalation paths, status page updates. Generates incident-report.md with timeline, root cause, impact assessment, remediation steps, and prevention measures.
hyperexecute-skill
Operates HyperExecute end-to-end for TestMu AI/LambdaTest cloud test execution: analyze projects, create YAML, validate locally, run CLI jobs, debug failures, and wire CI. Use when the user mentions HyperExecute, hyperexecute.yaml, HyperExecute CLI, autosplit, matrix execution, LambdaTest grid, cloud test runs, CI test orchestration, or migrating Playwright/Cypress/Selenium/Pytest/WebdriverIO tests to HyperExecute.
rw-integrate-video
Help users integrate Runway video generation APIs (text-to-video, image-to-video, video-to-video)
dbx-database-client
Open-source lightweight cross-platform database management tool built with Tauri, Vue 3, and Rust supporting MySQL, PostgreSQL, SQLite, Redis, MongoDB, DuckDB, ClickHouse, and SQL Server.
clawsec-feed
Security advisory feed package for OpenClaw-related threats and vulnerabilities. The upstream feed is updated daily; local automation is handled by clawsec-suite or the operator.
opencode-openai-codex-auth
OAuth authentication plugin for OpenCode that enables GPT-5.x and Codex model access via ChatGPT Plus/Pro subscriptions
osint
Open-source intelligence gathering - company repository enumeration, secret scanning, git history analysis, employee footprint, and code exposure discovery.
vllm-deploy-docker
Deploy vLLM using Docker (pre-built images or build-from-source) with NVIDIA GPU support and run the OpenAI-compatible server.
resume-tailoring
Use when creating tailored resumes for job applications - researches company/role, creates optimized templates, conducts branching experience discovery to surface undocumented skills, and generates professional multi-format resumes from user's resume library while maintaining factual integrity
wechat-article-search
搜索微信公众号文章技能。通过微信搜索获取文章列表，覆盖科技/AI、社会热点、财经、教育、职场等各类中文资讯；可按关键词检索并返回标题、概要、发布时间、来源公众号与链接。当用户需要查找微信公众号文章、整理参考资料或快速获取文章信息时使用此技能。
design-documentation
Transform approved requirements into comprehensive technical designs. Define system architecture, component interactions, data models, and interfaces to create a blueprint for implementation.
security-threat-model
Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Use when the user asks to threat model a codebase or path, enumerate threats or abuse paths, or perform AppSec threat modeling. Do NOT use for general architecture summaries, code review, security best practices (use security-best-practices), or non-security design work.
chrome-devtools
Browser debugging, performance profiling, and automation via Chrome DevTools MCP. Use when user says "debug this page", "take a screenshot", "check network requests", "profile performance", "inspect console errors", or "analyze page load". Do NOT use for full E2E test suites (use playwright-skill) or non-browser debugging.
vidu-skills
Generate and deliver Vidu videos, images, and speech through vidu-cli; manage generation tasks, reference assets, creations, personal cloned voices, and credit quotes. Use for Vidu generation, lip-sync, timeline composition, video extension or upscaling, and related Vidu account workflows. Requires VIDU_TOKEN and vidu-cli v0.2.36 or newer.
document-writing
Expert knowledge in document and essay writing conventions for English, Japanese, and Chinese (Traditional). Use when writing or translating formal documents, essays, articles, reports, or professional communications. Provides language-specific writing styles, formatting conventions, and rhetorical patterns.
research-methodology
You must use this when matching research questions to appropriate designs, sampling strategies, or validity controls — or when a research problem is stuck and needs creative reframing (cross-domain analogies, first-principles deconstruction).
interaction-design
Interaction design (IxD) principles and frameworks for digital product work. Covers interaction flows, component state design (hover/focus/error/loading/empty), micro-interactions, affordances, feedback mechanisms, mental models, task flows, gesture design, response time guidelines, and handoff annotations. Grounded in Norman's design principles and Tognazzini's first principles of interaction design.
ux-writing-skill
Systematic UX writing for digital products — applies four quality standards (Purposeful, Concise, Conversational, Clear) to all interface copy. Covers microcopy patterns for buttons, error messages, empty states, form labels, notifications, tooltips, and onboarding. Includes accessibility writing guidelines, voice/tone framework, and before/after examples.
preview-environments-builder
Creates ephemeral preview deployments for each pull request with automatic deployment, unique URLs, and cleanup on PR close. Use for "preview deployments", "PR environments", "ephemeral environments", or "review apps".
minimax-web-search
使用 MiniMax MCP 进行网络搜索。触发条件：(1) 用户要求进行网络搜索、在线搜索、查找信息 (2) 需要查询最新资讯、新闻、资料 (3) 使用 MiniMax 的 web_search 功能
upgrade-js-deps
Upgrade JavaScript dependencies using npm-check-updates, then run post-upgrade checks to ensure nothing is broken.
pentester-mcp-security-tools
MCP server integrating 200+ penetration testing tools (nmap, sqlmap, ffuf, etc.) via Docker sandbox for AI-driven security testing
codex-ppt-skill
Generate image-based PowerPoint presentations using gpt-image-2, converting articles, papers, and reports into visual slide decks
dependency-management
Manage third-party libraries, runtimes, and SaaS dependencies. Use this skill when setting an update cadence, responding to security advisories, dealing with deprecated dependencies, evaluating new dependencies, auditing what's installed, or unblocking a dependency upgrade. Triggers on dependency, package update, security patch, lockfile, deprecated, breaking change, supply chain, dependency audit, npm audit, dependabot, renovate. Also triggers when a build breaks after an update or when an advisory is published for a used package.
codex-cli-best-practice
Guide to mastering Codex CLI through subagents, skills, workflows, MCP servers, and agentic engineering patterns
react-native-update
Integrate and troubleshoot React Native Update OTA for Pushy and Cresc. Use when wiring react-native-update into React Native CLI, Expo prebuild, tvOS/react-native-tvos, HarmonyOS, brownfield, monorepo, or mixed native apps; configuring update.json/appKey, Pushy/Cresc clients, UpdateProvider/useUpdate, native bundle loading, release baseline upload, native cold-start recovery/forceBoot/purgeRestore, bundleHash and error metadata, source maps, checkStrategy/updateStrategy, canary/metaInfo flows, Hermes-base verification, expo-updates conflicts, or OTA failures.
social-post
Use when the user wants to post or schedule to YouTube, a Facebook Page or Mastodon through Publora. YouTube needs a video on every post, Facebook publishes to Pages only, Mastodon caps at 500 characters. Not for the platforms that have their own skill.
cli-printing-press-generator
Generate AI-agent-first CLIs from any API (OpenAPI, GraphQL, or browser-sniffed) with SQLite sync, compound commands, and MCP servers
webhook-setup
Configure webhooks to receive inbound messages and delivery updates with signature verification.
patch-codex-fast
Patch Codex App to enable Fast/Speed mode and Plugins in API key mode, or optionally enable Zed as an SSH-capable remote open target. Supports macOS and Windows with backup, rollback, and bundle pattern discovery.
search-specialist
Research questions with focused web searches, primary-source verification, and explicit evidence gaps.
sci-zotero
Interact with your Zotero library to sync references, add citations by DOI/ISBN/PMID, and manage PDFs. Triggers on Zotero-related requests.
security-reactnative
Security - React Native 0.87 Best Practices. Use when reviewing security, implementing auth, or hardening code.
xcuitest-skill
Generates XCUITest UI tests for iOS/iPadOS apps in Swift. Apple's native testing framework for reliable, fast UI automation. Supports local simulators and TestMu AI cloud real devices. Use when user mentions "XCUITest", "XCTest", "iOS UI test", "Swift test", "XCUIApplication". Triggers on: "XCUITest", "XCTest UI", "iOS UI test", "Swift UI test", "XCUIApplication", "TestMu".
exa-search
Exa.ai search API integration for neural and keyword web search with content retrieval. Use when implementing web search features, integrating Exa SDK (exa_py, exa-js), or retrieving web content. Triggers on: Exa, exa_py, exa-js, neural search, web search API, search_and_contents, searchAndContents, find_similar, findSimilar, domain filtering, date filtering, text extraction, page summaries, highlights, search auto mode, fast search, search categories, livecrawl, excluding domains, include text, exclude text, EXA_API_KEY.
resolve-pr-feedback
Resolve PR review feedback by evaluating validity and fixing issues in parallel. Use when addressing PR review comments, resolving review threads, or fixing code review feedback.
exa-rag
Build RAG pipelines with Exa.ai for real-time web retrieval. Use when building retrieval-augmented generation, integrating Exa with LangChain, LlamaIndex, Vercel AI SDK, or implementing AI agents with web search capabilities. Triggers on: RAG pipeline, retrieval augmented generation, Exa LangChain, Exa LlamaIndex, ExaSearchRetriever, ExaSearchResults, Exa MCP, Exa tool calling, Claude tool use, AI agent web search, grounded generation, citation generation, fact checking, hallucination detection, OpenAI compatibility, chat completions.
nsfc-research-foundation-writer
当用户明确要求"写/改研究基础""研究基础+工作条件+风险应对编排"时使用。为 NSFC 正文"（三）研究基础"写作/重构，并同步编排"工作条件"和"研究风险应对"，用证据链证明项目可行、资源条件对位研究内容、风险预案可执行。
launchdarkly-ui-skills
Launchdarkly's UI design system. Use when building interfaces inspired by Launchdarkly's aesthetic - dark mode, Inter font, 4px grid.
posthog-ui-skills
Posthog's UI design system. Use when building interfaces inspired by Posthog's aesthetic - dark mode, Inter font, 4px grid.
tooluniverse-protein-structure-prediction
Protein 3D structure prediction from sequence — ESMFold de novo prediction, AlphaFold database retrieval, experimental structures from RCSB, ProtVar variant impact assessment, ProtParam sequence properties. Use for structure prediction when no experimental structure exists, fold-confidence scoring, and structure-guided variant interpretation.
hz-unity-fbx-import
Ensures complete FBX URLs or absolute paths are used when importing external 3D models into Unity projects targeting Meta VR and Horizon OS. Use when adding FBX files, 3D models, or external assets.
shiki-code-blocks
Syntax highlight code blocks with Shiki. Supports server-side rendering in RSC and automatic light/dark theme switching.
n8n:linear-issue
Fetch and analyze Linear issue with all related context. Use when starting work on a Linear ticket, analyzing issues, or gathering context about a Linear issue.
openclaw-pr-maintainer
Review, triage, repair, or land OpenClaw issues and pull requests with current-source evidence and the native maintainer workflow.
nano-banana-pro
Generate or edit images via Gemini 3 Pro Image (Nano Banana Pro).
appsec-expert
Elite Application Security engineer specializing in secure SDLC, OWASP Top 10 2025, SAST/DAST/SCA integration, threat modeling (STRIDE), and vulnerability remediation. Expert in security testing, cryptography, authentication patterns, and DevSecOps automation. Use when securing applications, implementing security controls, or conducting security assessments.
communication-storytelling
Transforms analysis, data, and complex information into clear, persuasive narratives tailored to specific audiences — executives, customers, investors, or non-technical stakeholders. Provides story structures (Hero's Journey, Problem-Solution-Benefit, Situation-Complication-Resolution) and audience adaptation techniques. Use when presenting findings, explaining technical concepts to non-technical audiences, writing announcements, or when user mentions "write this for", "explain to", "present findings", "make this compelling", or "audience is".