Loading...
Loading...
Found 368 Skills
CreatiBI CLI Shared Basics: Application configuration initialization, authentication login (auth login), identity check (auth whoami). Triggered when users need to configure for the first time, use login authorization, encounter insufficient permissions, or use cbi-cli for the first time.
Performs automated static analysis of Android applications using Mobile Security Framework (MobSF) to identify hardcoded secrets, insecure permissions, vulnerable components, weak cryptography, and code-level security flaws without executing the application. Use when assessing Android APK/AAB files for security vulnerabilities before deployment, during penetration testing, or as part of CI/CD security gates. Activates for requests involving Android static analysis, MobSF scanning, APK security assessment, or mobile application code review.
Controls a running iOS, iPad, or Apple Watch Simulator via the serve-sim CLI (npx serve-sim) and streams it into the host agent's preview pane. Use whenever the user wants an AI agent to view or drive an Apple Simulator — streaming to preview, taps at normalized coordinates, multi-touch gestures, hardware buttons, rotation, memory warnings, CoreAnimation debug, synthetic camera injection, media drag-drop, or managing app privacy permissions. Triggers include "serve-sim", "iOS simulator", "Apple simulator", "iPad simulator", "Apple Watch simulator", "stream the simulator", "show the simulator in preview", "view the simulator here", "open simulator in preview", "simulator gestures", "tap on the simulator", "rotate the simulator", "inject camera feed", "grant simulator permissions", "allow push notifications in the simulator", or any request to drive or display an Apple Simulator visually. Do NOT use for Android emulators, building/installing an iOS app (use xcodebuild), booting a simulator from scratch (use xcrun simctl boot), in-app React Native runtime debugging (use rn-debugger), or real iOS hardware.
Scan GitHub Actions workflow files for security vulnerabilities by reading the YAML and reporting findings directly — no external tools, no installation, no shell execution. Use this skill whenever the user shares a `.github/workflows/` file, pastes workflow YAML, asks for a CI/CD security review, mentions `pull_request_target`, `workflow_run`, action pinning, `GITHUB_TOKEN` permissions, pwn requests, template injection, cache poisoning, secret exfiltration, supply chain risk, or any GitHub Actions hardening topic. Also trigger when the user is hardening an OSS repo, doing a CI/CD red team assessment, evaluating a target for supply-chain scanning, or writing publicly about CI/CD security. Bias toward triggering this skill rather than answering from memory — CI/CD security defaults are wrong almost everywhere and the rules are unintuitive.
Capture and save a Feishu/Lark document link or regular web page link to a local directory (Feishu documents support Markdown/PDF/HTML + image attachments; regular web pages only support Markdown with images kept as external links). It can also create new documents in the user's Feishu space, or write Markdown content into Feishu documents that the user has edit permissions for (create/append/insert by title or block/replace block/delete block; use list-blocks to check the block structure first). For arXiv papers (either link or bare ID is acceptable), an independent script is used to download the PDF, HTML, and converted Markdown together without relying on browser extensions. When a user posts a Feishu document or any web page URL in any project and wants to download/save/export/pull/capture it to a local path, or wants to write/append/update content to a Feishu document, this skill must be used, even if the user doesn't explicitly say "use larksnap" or "use the extension". It bridges to the logged-in larksnap browser extension via a local daemon, which holds the login state and export/edit engine; when encountering unlogged-in/unauthorized domains, it will prompt the user to log in or authorize via the browser according to the exit code. This skill is self-contained (daemon is distributed with the skill), can be called from any project, and does not depend on the larksnap repository.
Harness patterns for coding agents — memory, permissions, context engineering, delegation, skills, hooks, bootstrap.
Build, scaffold, maintain, or restyle DatoCMS plugins built with datocms-plugin-sdk and datocms-react-ui. Use when users ask to create a new DatoCMS plugin project, patch an existing plugin, add or adjust plugin hooks, field extensions, config screens, sidebars, pages, modals, asset sources, dropdown actions, lifecycle hooks, browser CMA flows, plugin permissions, package metadata, dark mode upgrades, or UI changes that should match the DatoCMS dashboard. Route standalone CMA scripts to datocms-cma and frontend website integrations to datocms-frontend-integrations.
Generate Claude Code permissions config from session history. Use when setting up autonomous mode, configuring .claude/settings.json, avoiding --dangerously-skip-permissions, or analyzing what permissions a project needs. Reads session logs to extract Bash commands and MCP tools actually used, then generates appropriate allow/deny rules.
Bootstrap new projects with curated settings.local.json permissions, CLAUDE.md, and .gitignore. Detects project type (cloudflare-worker, vercel-app, node-generic, python, ops-admin) and generates grouped, commented permission presets. Also tidies existing messy settings files (removes leaked secrets, shell fragments, deprecated MCP refs, duplicate entries). Trigger with 'kickoff', 'new project', 'bootstrap', 'setup claude', 'tidy permissions', 'clean settings', or 'init project'.
Optimize Claude Code permissions by finding safe Bash commands from session history and auto-applying them to settings.json. Can run from any coding agent but targets Claude Code specifically. Use when experiencing permission fatigue, too many permission prompts, wanting to optimize permissions, or needing to set up allowlists. Triggers on "optimize permissions", "reduce permission prompts", "allowlist commands", "too many permission prompts", "permission fatigue", "permission setup", or complaints about clicking approve too often.
Validate a Steedos package after creation or modification. Run this tool to check that all files conform to Steedos conventions: correct naming, required fields, valid enum values, proper file organization. TRIGGER: After creating or modifying files in a Steedos package (objects, fields, buttons, triggers, functions, listviews, permissions, apps, tabs, pages). Run before completing the task to catch issues early. SKIP: When only reading files, answering questions, or working outside a Steedos package context.
Use this skill when the user asks "who has access", "audit permissions", "check user roles", "list API keys", "review access controls", "rotate API keys", "create API key", "delete expired keys", "send data keys", "configure SAML", "set up SSO", "IP allowlist", "IP access restrictions", "check IP whitelist", "add user", "deactivate user", "manage team groups", "user permissions", "role-based access", "manage scopes", "system roles", "API key admin", "team member keys", "group membership", or wants to audit, manage, or configure access controls for a Coralogix account.