Auth
Authentication and authorization
project-documentation
by trewknowledge
Create non-technical documentation for project features in the docs/ folder. Use when documenting completed features, writing feature documentation, explaining how features work, or when the user asks to document the project or create docs for non-developers.
mcp-project-config
by jclfocused
Configures MCP servers for projects. Use when setting up Linear, GitHub, Chrome DevTools, Render, or other MCP servers for a project. Handles token selection and configuration.
browser-automation
by femto
Control Chrome browser with AI using MCP protocol. Use when users want to automate browser tasks, take screenshots, fill forms, click elements, navigate pages, search browsing history, manage bookmarks, or perform any browser-based automation. Works with your existing Chrome browser and login sessions.
whop-dev
by steve-cooks
Build Next.js apps for the Whop platform. For empty repos, guides users from idea to deployed app through discovery and setup. For existing projects, provides best practices for authentication, payments, webhooks, and UI. Triggers on "build me a Whop app", @whop/sdk, verifyUserToken, checkAccess, checkout flows, webhook handling, Experience/Dashboard pages, Frosted UI. Delegates to companion skills (frontend-design, vercel-react-best-practices, supabase-postgres-best-practices, web-design-guidelines) for design, performance, and database.
plan-one-shot
by ishk-sftckz
Create Antigravity-style implementation plans with strict review gates, line-item IDs, and no code changes until the user explicitly says Execute Plan.
git-workflow
by xbklairith
Use when working with git operations - generates smart commit messages (present tense, imperative), manages branches, creates PRs with summaries, follows git best practices. Activates when user says "commit this", "create PR", "push changes", mentions "git", "branch", "merge", or before committing code.
databuddy-core
by databuddy-analytics
Use the core Databuddy SDK for browser-side tracking utilities, event tracking, and global tracker access. Use when implementing analytics in vanilla JavaScript or when you need direct access to the core tracking functions.
documentation
by xbklairith
Use when writing or updating documentation - generates function docs, API specs, architecture diagrams (Mermaid), READMEs, code explanations. Activates when user says "document this", "write README", "explain this code", mentions "docs", "documentation", "API docs", or asks "how does this work?".
brainstorming
by xbklairith
Use when exploring unclear requirements or architectural decisions - refines rough ideas into clear requirements/designs through collaborative questioning (one at a time), explores alternatives, validates incrementally. Activates when user has vague feature idea, mentions "not sure about", "exploring options", "what approach", or during spec-driven requirements/design phases.
vulnerability-scan
by ymd38
Run an offensive security audit (OWASP-based) using Semgrep and produce a read-only vulnerability report. Use before committing code to detect Broken Access Control, Injection (SQL/NoSQL/OS/Template), Frontend Security issues (XSS/CSP/HSTS), SSRF, and hardcoded secrets or PII exposure. Triggers on requests like "security scan", "vulnerability check", "audit security", "find vulnerabilities", "/vulnerability-scan", or when asked for an offensive security review of the codebase. Does NOT modify any code — read-only inspection only.
secure-coding-generate
by vchirrav
Generate secure code following OWASP Secure Coding rules. Automatically detects the security domain and produces code with inline Rule ID citations (e.g., [INPUT-04], [AUTH-07]) plus a rules-applied summary.
implement
by manastalukdar
Import and adapt code from any source to your project with validation and testing
bug-bounty
by Mikacr1138
Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaining (IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth), bypass tables (SSRF IP bypass, open redirect bypass, file upload bypass), language-specific grep (JS prototype pollution, Python pickle, PHP type juggling, Go template.HTML, Ruby YAML.load, Rust unwrap), and reporting (7-Question Gate, 4 validation gates, human-tone writing, templates by vuln class, CVSS 3.1, PoC generation, always-rejected list, conditional chain table, submission checklist). Use for ANY bug bounty task — starting a new target, doing recon, hunting specific vulns, auditing source code, testing AI features, validating findings, or writing reports.
velt-setup-best-practices
by velt-js
Velt collaboration SDK setup guide for React, Next.js, Angular, Vue, and HTML applications. Use this skill when setting up Velt for the first time, configuring VeltProvider, implementing user authentication, or initializing document collaboration.
keyboard-injector
by famaoai-creator
(Optional) iTerm2 session ID for targeted injection.
agent-teams-guide
by hexbee
"Guide for orchestrating and controlling Claude Code agent teams. Use when working with or managing multi-agent team coordination in Claude Code, including: (1) Creating and starting agent teams, (2) Controlling teammates (display modes, task assignment, delegation), (3) Best practices for parallel work, (4) Troubleshooting team issues. Covers concepts like team lead, teammates, shared task lists, and inter-agent messaging."
box-connector
by famaoai-creator
Securely connects to Box using the Node.js SDK (JWT). downloads files, searches content, and manages folder structures.
implementing-dynamic-authorization
by sumik5
Dynamic authorization design covering ABAC, ReBAC, PBAC models and Cedar policy language. Use when designing access control systems, choosing authorization models, or writing Cedar policies. Distinct from securing-code (code-level) by focusing on authorization model selection and policy-based access control.
handover
by shuymn
Creates or refreshes a HANDOVER.md that captures current session state for the next assistant. Use when wrapping up a session, context is getting full, switching operators, or when the user asks for a handoff summary including decisions, pitfalls, lessons learned, next steps, and important files. Also trigger when the user says "save progress", "session summary", or "prepare for next session".
brainstorm
by manastalukdar
Interactive design refinement with structured exploration
prd
by alienfast
Create agent-friendly Linear tickets with PRDs, sub-issues, and clear success criteria. Use when planning features or breaking down work for agentic coding.
rviz-screenshot-loop
by Idate96
Capture RViz/GUI screenshots via MCP to close the loop while debugging ROS. Use when you need visual verification in RViz or other windows.
deep-productivity
by hexbee
"Master deep work productivity through the three types of work framework (Building, Maintenance, Recovery). Use when user needs to: (1) Build a sustainable deep work routine with just 1 hour/day, (2) Create vision/anti-vision for life direction, (3) Structure goals using the 10-year → 1-year → 1-month → 1-week hierarchy, (4) Apply project-based learning to bridge skill gaps, (5) Identify lever-moving tasks that actually progress goals, (6) Balance focus work with necessary recovery for creativity."
vault-boot
by teslasoft-de
This skill should be used at the start of a new Cowork session involving the Teslasoft vault to parallel-load all critical context via Obsidian MCP, open the dashboard, and render a structured status briefing. Not for mid-session status checks (use /jarvis status instead) or file editing operations.