Loading...
Loading...
Found 1,244 Skills
Extracts the full design soul, system, and agent rules from reference UI images. Use this skill when the user provides screenshots, Figma exports, or any UI reference images and wants the agent to design with the same soul, taste, feeling, and personality — not just copy colors and spacing. Marrow reads beneath the surface: it extracts the living core of a design — the decisions, proportions, restraint, and emotional intent that make a UI feel the way it does. Triggers on: /marrow, /extract-ui, /design-from-ref, /read-design, or any prompt like "extract the design system from these images", "make it look and feel like this", "get the rules from this UI", "build with the same soul", "match this design". Always use this skill when images are provided alongside a request to replicate, match, or be inspired by a design.
LeadMagic platform help — Email Finder (97% accuracy), Email Validation (catch-all detection), Mobile Finder, Profile Search, Personal Email Finder, Company Search (firmographics), Technographics, Company Funding, Employee Finder, Role Finder, Job Change Detector, Jobs Finder, Google/Meta/B2B Ads Search, REST API (19 endpoints), MCP Server (Claude/Cursor/Windsurf), CLI. Use when asking 'how do I use LeadMagic', 'LeadMagic API', 'LeadMagic email finder', 'LeadMagic mobile finder', 'LeadMagic company search', 'LeadMagic ads intelligence', 'LeadMagic MCP', 'LeadMagic vs Apollo', 'LeadMagic vs Clay'. Do NOT use for enrichment strategy across tools (use /sales-enrich), prospect list strategy across tools (use /sales-prospect-list), intent signal strategy across tools (use /sales-intent), or competitive intelligence strategy across tools (use /sales-compete).
SAML SSO assertion attack playbook. Use when testing signature validation, assertion wrapping, audience restrictions, ACS handling, XML trust boundaries, and enterprise SSO flaws.
Troubleshoot and resolve common issues with the ClickHouse Node.js client (@clickhouse/client). Use this skill whenever a user reports errors, unexpected behavior, or configuration questions involving the Node.js client specifically — including socket hang-up errors, Keep-Alive problems, stream handling issues, data type mismatches, read-only user restrictions, proxy/TLS setup problems, or long-running query timeouts. Trigger even when the user hasn't precisely named the issue; vague symptoms like "my inserts keep failing" or "connection drops randomly" in a Node.js context are strong signals to use this skill. Do NOT use for browser/Web client issues.
Tend the Allium garden. Use when the user wants to write, edit, update, add to, improve, clarify, refine, restructure, fix or migrate Allium specs. Covers adding entities, rules, triggers, surfaces and contracts, fixing syntax or validation errors, renaming or refactoring within specs, migrating specs to a new language version, and translating requirements into well-formed specifications. Pushes back on vague requirements.
Use when securing FastAPI API endpoints with JWT Bearer token validation, scope/permission checks, or stateless auth - integrates auth0-fastapi-api for REST APIs receiving access tokens from SPAs, mobile apps, or other clients. Also handles DPoP proof-of-possession token binding. Triggers on: Auth0FastAPI, FastAPI API auth, JWT validation, require_auth, DPoP.
trendHERO platform help — Instagram influencer analytics (95M+ profiles, 20+ filters), Account Quality Score (AQS 1-100, fake follower detection), Audience Analysis, Daily Tracking, Ads Database (10M+ posts), Audience Overlap, REST API (Bearer auth, webhooks). Covers discovery search, AQS interpretation, audience vetting, tracking setup, ads database research, API integration, and pricing (Free/Lite/Pro/Advanced). Use when you suspect an influencer has fake followers, trendHERO search results aren't matching your niche, you need to monitor an influencer's metrics over time, you want to see which influencers your competitors are using, the trendHERO API isn't working as expected, you're unsure which trendHERO plan fits your budget, or you're deciding between trendHERO, HypeAuditor, and Heepsy. Do NOT use for influencer strategy across platforms (use /sales-influencer-marketing), TikTok marketing (use /sales-tiktok-marketing), gaming influencer marketing (use /sales-gaming-marketing), or ad campaigns (use /sales-retargeting).
Debug production render failures in telecine. Inspect render state in the database, Valkey queues, and Cloud Run logs. Restart failed renders, trace the render pipeline flow, and diagnose fragment-level failures.
Create reproducible, cross-platform development environments with Flox — a declarative environment manager built on Nix. ALWAYS use this skill when the user needs to: set up a project with system-level dependencies (compilers, databases, native libraries like openssl, libvips, BLAS, LAPACK); configure reproducible toolchains for Python, Node.js, Rust, Go, C/C++, Java, Ruby, Elixir, PHP, or any language; manage environments that must work identically across macOS and Linux; pin exact package versions for a team; run local services (PostgreSQL, Redis, Kafka) alongside development tools; onboard new developers with a single command; or solve 'works on my machine' problems. Especially valuable for AI-assisted and vibe coding — Flox lets agents install tools into a project-scoped environment without sudo, system pollution, or sandbox restrictions, and the resulting environment is committed to the repo so anyone can reproduce it instantly. Use this skill even if the user doesn't mention Flox — if they describe needing reproducible, declarative, cross-platform dev environments with system packages, this is the right tool. Also use when the user mentions .flox/, manifest.toml, flox activate, or FloxHub.
Guideline for designing, implementing, and verifying secure APIs following OWASP API Security Top 10 (2023) best practices. Use when the user wants to: (1) review API code or design for security vulnerabilities, (2) design a secure REST, GraphQL, or gRPC API architecture, (3) implement API authentication and authorization (OAuth2, JWT, API keys, mTLS), (4) configure rate limiting, input validation, or CORS, (5) audit API endpoints for BOLA, BFLA, or mass assignment vulnerabilities, (6) create API security checklists or verification plans, (7) fix API security bugs or harden existing APIs, (8) set up API security testing (OWASP ZAP, Schemathesis, Burp Suite), or (9) handle any API security concern including SSRF prevention, resource consumption limits, business flow protection, API inventory management, and secure third-party API consumption.
Save what matters at the end of a session so the next session picks up exactly where you left off. Or restore context at the start of a new session so nothing is lost between them.
Recover a suppressed, blocked, or deactivated Amazon listing. Maps the suppression reason code to the specific fix path and produces the reinstatement message. Use when a user asks about a suppressed listing, a blocked listing, listing deactivated, pricing error suppression, image policy, restricted phrase, or missing required field. Trigger phrases: "suppressed listing", "blocked listing", "listing deactivated", "pricing error", "image suppression", "restricted phrase". Works with zero tools. the user pastes the suppression notice.