Top Agent Skills

Maps a codebase into feature-grouped flowcharts, identifies duplicated concerns across features, and proposes a unified architecture with handoff prompts for refactoring.

Turn a music track into a beat-synced video — lyric video, slideshow, or kinetic promo — with optional user-supplied images or videos cut onto the same beat grid.

Define a set of actionable design principles that guide decision-making and resolve trade-offs.

Defensive review of an LLM/agent application for OWASP-LLM-style risks — prompt injection, unsafe tool calls, excessive agency, and PII/secret leakage. Reads your code, flags issues with file:line. Pure Claude Code, no signup.

Profile a cold, cache-empty page load and build a text waterfall — the longest-pole requests, time to first byte, and time to interactive. Flags the critical-path bottlenecks. Playwright MCP only, no signup.

Rank the most complex code in a repo — long functions, deep nesting, high cyclomatic complexity, and god-files — worst-first, with a refactor suggestion for each. Pure Claude Code, no MCP, no signup.

Audit a site's cookies and trackers — inventory every cookie, flag missing Secure/HttpOnly/SameSite, list third-party trackers, and detect tracking that fires before consent. Playwright MCP only, no signup.

Audit project dependencies for risk — known-vulnerable versions, unpinned ranges, abandoned packages, and badly outdated majors. Reads package.json, requirements.txt, go.mod, Cargo.toml. Pure Claude Code, no signup.

Review the current git diff for correctness, security, and performance risks before you commit. Produces severity-ranked findings with the exact file:line and a suggested fix. Pure Claude Code — no MCP, no signup.

Probe the forms on a page for validation gaps — missing required-field enforcement, no client-side validation, accepts malformed input, and absent error messaging. Reports per-field findings. Playwright MCP only, no signup.

Scan infrastructure-as-code — Dockerfiles, Compose, Terraform, and GitHub Actions — for security misconfigurations like running as root, world-writable files, unpinned actions, and hardcoded secrets. Pure Claude Code, no signup.

Read, create, search, and manage notes in an Obsidian vault using the Obsidian CLI, with support for plugin and theme development workflows.

Provides Ktor server patterns including routing DSL, plugins, authentication, Koin DI, kotlinx.serialization, WebSockets, and testApplication testing.

Search the web and extract content from URLs using Tavily and Exa APIs via the inference.sh CLI.

Conducts systematic security code reviews to identify exploitable vulnerabilities, reporting only high-confidence findings after researching the codebase.

Extract Amazon product reviews by ASIN using the BrowserAct API, returning structured data including ratings, text, reviewer info, and verified purchase status.

Systematically deobfuscate multi-layer PowerShell malware using AST analysis, dynamic tracing, and tools like PSDecode and PowerDecode to reveal hidden payloads and C2 infrastructure.

Creates a concise, actionable plan for coding tasks by scanning context and producing a structured checklist.

Design high-converting landing pages with layout rules, hero section design, CTA psychology, and AI-generated visuals.

Automate spreadsheet operations including creating workbooks, writing data, formatting cells, upserting rows, and managing worksheets across Microsoft Excel and Google Sheets.

Generates a Playwright test from a user-provided scenario by recording browser interactions via Playwright MCP, then saves and runs the test until it passes.

Design a new PM skill through guided conversation, from raw idea to a structured, repo-compliant SKILL.md draft.

Review local branch changes for bugs, security vulnerabilities, and code quality issues using a structured checklist-driven process.

Formats responses for readers with ADHD by leading with actions, numbering steps, giving time estimates, and making progress visible.

Test and debug local web applications using Playwright browser automation, including UI verification, screenshot capture, and console log inspection.

Build and review high-quality technical documentation, including agent instruction files and contributor-governance files, with support for audits, multilingual parity, and sub-agent orchestration.

Build production-ready WordPress sites with theme and plugin development, WooCommerce integration, performance optimization, and security hardening, including WordPress 7.0 features.

Drafts professional emails that match your personal writing style by analyzing sent emails for tone, greeting, structure, and sign-off patterns.

Audits and upgrades existing websites and apps to premium quality by identifying generic AI patterns and applying high-end design standards without breaking functionality.

Provides backend architecture patterns, API design, database optimization, and server-side best practices for Node.js, Express, and Next.js API routes.

Edit and enhance images and videos with AI via muapi.ai — prompt-based editing, upscaling, background removal, face swap, lipsync, video effects, and more.

Routes marketing requests to the appropriate specialist skill from a library of 44 skills across content, SEO, CRO, channels, growth, intelligence, and sales enablement.

Audit Claude Code configuration files for security vulnerabilities, misconfigurations, and injection risks using AgentShield.

Provides best practices for implementing authentication, authorization, input validation, CSRF protection, secrets management, rate limiting, and dependency security in Spring Boot services.

Manage design tokens by listing, adding, and updating them while keeping JSON sources, CSS variables, and dark-mode values in sync.

Audits web performance by measuring Core Web Vitals (LCP, INP, CLS) and supplementary metrics, identifying render-blocking resources, network dependency chains, layout shifts, caching issues, and accessibility gaps using Chrome DevTools MCP.

Build augmented reality interfaces for display glasses using Jetpack Compose Glimmer, covering design principles, theming, input mapping, and projected activity setup.

Convert frontend code (Vite, React, etc.) into a Stitch Design by extracting static HTML, analyzing the design system, and uploading to Stitch.

Quantifies the business and regulatory impact of a potential data breach by inventorying sensitive data, tracing data flows, scoring exposure vectors, and estimating regulatory fines using law-sourced figures.

Design and implement Arduino integration with Azure IoT Hub and IoT Edge, including secure provisioning, resilient telemetry, command handling, and production guardrails.

Plan and orchestrate multi-slide PowerPoint creation from scratch, classifying each slide type, enforcing visual variety, setting typography/spacing rules, and running text-based QA to catch content issues.

Responds to security incidents in cloud environments (AWS, Azure, GCP) by performing identity-based containment, cloud-native log analysis, resource isolation, and forensic evidence acquisition adapted for ephemeral cloud infrastructure.

Hardens the Docker daemon by configuring daemon.json with user namespace remapping, TLS authentication, rootless mode, and CIS benchmark controls.

Automate phishing incident response by creating Splunk SOAR containers, adding artifacts, and triggering investigation playbooks.

Facilitate structured post-incident reviews to identify root causes, document what worked and failed, and produce actionable recommendations to improve future incident response.

Apply CIS Docker Benchmark v1.8.0 security best practices to harden Docker containers for production, covering daemon configuration, image building, runtime controls, and auditing.

Systematically tests web applications for vulnerabilities following the OWASP Web Security Testing Guide (WSTG) methodology, covering authentication, authorization, input validation, session management, and business logic using Burp Suite and manual techniques.

Coordinate staged releases across Stripe, Supabase, and Vercel from the shell using the Composio CLI. One script kicks off the whole 'ship it' sequence: product/price updates, DB migrations, frontend deploy, smoke checks, changelog post.

Facilitate structured design critiques with clear feedback frameworks and actionable outcomes.

Creates a cinematic 5–10 second product advertisement video from a product photo and brand brief, using AI image generation, upscaling, and video animation.

Audit screens against Nielsen's heuristics and mobile UX best practices using the StyleSeed Toss design language as the implementation context.

Analyzes stocks using the AlphaGBM Five Pillars framework, returning a composite score, risk assessment, target price, and AI-generated report from real market data.

Write modern C# code with advanced features like records, pattern matching, and async/await. Optimizes .NET applications, implements enterprise patterns, and ensures comprehensive testing.

Write and review modern Python 3.12+ code with async patterns, performance optimization, and production-ready practices using the latest ecosystem tools.

Prevent repeated AI coding-agent mistakes by turning failures into durable instructions, drift checks, regression tests, failure memory, and adoption reports tailored to the target repository.

Provides reusable React and Next.js patterns for component composition, state management, data fetching, and performance optimization.

Connects an AI agent to a FlowStudio MCP server for Power Automate, handling authentication, tool discovery, and response parsing. Load this foundation skill before using specialized workflow skills for building, debugging, monitoring, or governing flows.

Implements OAuth 2.0/2.1 authorization flows in Fastify applications, including authorization code with PKCE, client credentials, device flow, refresh token rotation, JWT validation, and token introspection/revocation endpoints.

Configure Okta as a SAML 2.0 Identity Provider and implement SP-initiated and IdP-initiated SSO flows with attribute mapping, assertion encryption, and security hardening.

Maps observed adversary behaviors, security alerts, and detection rules to MITRE ATT&CK techniques and sub-techniques to quantify detection coverage and guide control prioritization.