Product & Planning

forcedotcom Bundle

Data Cloud 360° view of a single Agentforce session. TRIGGER when user asks to trace, inspect, summarize, or describe a specific Agentforce session by session id (Agent Session UUID `019d…` or MessagingSession id `0Mw…`). Also triggers on session discovery — find/list/search sessions by time, agent, channel, outcome, or conversation text — when the user has no session id yet. DO NOT TRIGGER for design-time architecture questions (use agentforce-architecture-analyze instead) or for runtime perf/latency/SLO questions that require platform telemetry beyond Data Cloud.

googleapis Skill

Sweep the googleapis/mcp-toolbox repo for issues and PRs with no real activity in N days (default 60), sort each by whose silence it is (the author's, ours, or nobody's), and draft the nudge or close comment. Use whenever a maintainer asks for a stale sweep, backlog cleanup, or an SLO check, e.g. "stale sweep", "find issues with no activity in 30 days", "what's gone quiet", "what's rotting in the backlog", "draft close comments for the stale ones", or during the weekly open-issues review. PROPOSE-ONLY: delivers the sweep in chat for the maintainer to apply; never comments, labels, closes, or merges on its own.

jeremylongworth-source Bundle

Write and review product requirements documents, feature specs, implementation briefs, and acceptance criteria. Use when Codex is asked to turn research, feedback, product decisions, or roadmap ideas into a PRD, product spec, feature brief, requirements doc, or implementation-ready product plan.

kayforkind Skill

Redact author-identifying text from academic PDFs for double-blind peer review anonymization — trigger when preparing manuscripts for blind review, anonymizing submissions, or stripping names/affiliations/emails/DOIs from PDFs. Not for scanned image-only PDFs, legal e-discovery, or general PDF merge/extract.

gabrielmoreira Skill

Read your team's messages the way opposing counsel would in litigation discovery — prevention training that makes communication hygiene visceral. Use when asked how would our Slack look in discovery, train my team on communication hygiene, review this thread like a plaintiff's lawyer, or what shouldn't we put in writing. Produces the highlighted-exhibit reading of sample messages, the patterns that create legal risk, and a debrief with the write-it-this-way rules — strictly for prevention, never for concealment.

gabrielmoreira Bundle

Compute who gets what at each exit price from a cap table — liquidation preferences, conversion points, and where the founders' share collapses. Use when asked to model an exit waterfall, what do I get if we sell for X, explain liquidation preferences on my cap table, or compare payouts across exit prices. Produces a per-stakeholder payout table across exit values with conversion decisions shown, plus the plain-English reading of what the structure means for each party.

gabrielmoreira Skill

A short weekly ritual that clears the mental backlog, picks the one thing that matters, and keeps you honest about your dependence on autopilot. Use when asked run my weekly reset, help me plan my week, my weekly check-in, or get me unstuck for the week. Produces a quick brain-dump and triage of what's on you, the single most important focus for the week, the stuck things and their tiny first steps, and a self-check on where you're coasting or over-relying — a recurring executive-function reset rather than a one-off fix.

openchamber Skill

Load when asked to triage, clean up, batch-process, or work through the issue backlog — covers the mechanical sweep (stale-fixed, dead needs-info, duplicates), fan-out assessment, and approved batch actions.

regenrek Bundle

Use this skill when the user wants to turn an application, product, startup idea, SaaS, mobile app, web app, API, AI product, or internal tool into a production-ready Markdown specification package for coding agents. Creates PRD/product spec, UX flows, design system brief, technical architecture, ADRs, AI/safety/privacy specs, API/data model, client/backend implementation specs, QA acceptance tests, release readiness, and executable task checklists. Do not use for simple one-off coding tasks unless the user asks for a complete spec, PRD, ADR, project plan for coding agents, or build package.

robert-hoffmann Bundle

Use this skill when work needs durable planning, adaptive product slicing, discovery before delivery, resumable sprint execution, wave or initiative scaffolding, source-pack routing, closeout evidence, final audits, or repeatable product-agile workflow structure. Do not use it for small direct fixes that do not need a durable artifact, or for governance-only questions that belong to ub-governance.

supermldev Skill

Validate a PRD for completeness, consistency, and implementation readiness. Use when the user says 'validate the PRD', 'review requirements', or 'is the PRD ready for development'.

travisjneuman Skill

Project status report generation from git history, task context, and milestone tracking. Use when creating weekly updates, sprint reviews, stakeholder reports, or project dashboards.

zubair-trabzada Skill

Generate a professional PDF report from a GEO audit using pandoc + Chrome headless. Converts GEO-AUDIT-REPORT.md into a styled, client-ready PDF with a cover page, color-coded score tables, severity-tagged findings, and a 90-day roadmap.

atlassian Bundle

Automatically convert Confluence specification documents into structured Jira backlogs with Epics and implementation tickets. When an agent needs to: (1) Create Jira tickets from a Confluence page, (2) Generate a backlog from a specification, (3) Break down a spec into implementation tasks, or (4) Convert requirements into Jira issues. Handles reading Confluence pages, analyzing specifications, creating Epics with proper structure, and generating detailed implementation tickets linked to the Epic.

comet-ml Skill

Use when building or extending a Page Object Model (POM) for the Opik E2E suite (under `tests_end_to_end/e2e/pom/`) and you need to choose stable selectors against the live UI. Walks through seeding required state, exploring the running page with the Playwright MCP (accessibility snapshot + data-testid enumeration), picking the most stable locator for each element, and verifying it before committing. Used as the discovery sub-step by the `writing-e2e-tests` skill.

gabrielmoreira Bundle

When the user wants to plan a content strategy, decide what content to create, or figure out what topics to cover. Also use when the user mentions "content strategy," "what should I write about," "content ideas," "blog strategy," "topic clusters," "content planning," "editorial calendar," "content marketing," "content roadmap," "what content should I create," "blog topics," "content pillars," or "I don't know what to write." Use this whenever someone needs help deciding what content to produce, not just writing it. For writing individual pieces, see copywriting. For SEO-specific audits, see seo-audit. For social media content specifically, see social.

danielfreitas Skill

Orquestra acquire-codebase-knowledge para bootstrap ou redescoberta do conhecimento do codebase

elementalsouls Skill

Cloud IAM red-team attack chain across AWS, Azure, GCP — focused on EXTERNAL exploitation paths and post-credential-discovery privilege analysis. Covers IAM enumeration (aws iam, az role, gcloud iam), STS/AssumeRole chaining, Azure Managed Identity abuse (via SSRF/leak), GCP service account JSON abuse, IMDSv1/v2 attacks via SSRF, K8s ServiceAccount token privilege analysis once held (token discovery / cluster exposure is owned by hunt-k8s), role-trust-policy confused-deputy, cross-account assume-role enumeration, IAM privilege escalation patterns (24+ AWS, 8+ Azure, 6+ GCP), and AWS Cognito Identity Pool unauthenticated-role attack chain (GetId → GetCredentialsForIdentity → IAM role abuse). Built for the case where recon yields a credential (key, JSON, token) and you need to know what it grants and how to escalate. Use when an AWS key / Azure secret / GCP service account JSON / K8s SA token surfaces from a code repo, JS bundle, APK, breach corpus, or SSRF chain.

gaasher Skill

Use when the user has a known, already-observed anomaly in their data — a metric spike or drop, an outlier, an unexpected number — and wants its root cause diagnosed, not guessed. Forms a slate of candidate causes, tests each against the data, and eliminates the ones the data refutes, narrowing the live candidates until exactly one survives refutation and passes a positive confirming test. The result is an investigation log with the confirmed root cause and the evidence that ruled out the alternatives. Not for open-ended discovery over a dataset with no specific anomaly in hand (that is data-analysis), and not for checking an external claim against sources (that is claim-verify) — this is reactive diagnosis of one anomaly you already know about.

jiaxuan-tao Skill

当用户要求评审 PRD 或产品需求文档，或在需求立项语境中判断需求是否值得推进、检查用户问题与 MVP 范围、补充成功指标或验收标准、把模糊产品想法整理为可评审 Brief 时使用；不用于纯文案润色、技术架构设计、实施任务拆解或已完成 Web 产品的交付验收。

kid-sid Bundle

Use when writing a PRD, drafting user stories with acceptance criteria, breaking an epic into sprint-sized vertical slices, story pointing in planning poker, or defining a team's Definition of Done.

gabrielmoreira Skill

Triage a raw bug report into something a team can act on — clean repro steps, a defensible severity/priority, environment, likely area/owner, and duplicate check. Use when asked to triage this bug, set severity and priority, is this a P1, or clean up this bug report for the backlog. Produces the normalized repro, a severity and priority with the reasoning (impact × frequency × workaround), the environment/metadata, a suspected component and owner queue, and a duplicate/related-issue check — flagging when info is missing rather than guessing.

gabrielmoreira Skill

Write a structured monthly or quarterly investor update. Use when asked to write an investor update, investor newsletter, board update, or startup progress report for investors. Produces a clear, credible update with highlights, metrics, challenges, and asks — in the format investors actually want to read.

gabrielmoreira Skill

Stress-test a plan, strategy, PRD, or launch by simulating hostile expert personas who attack it from every angle. Use when asked to red-team, stress-test, pre-mortem, pressure-test, play devil's advocate, or find the blind spots in a plan before committing. Produces a per-persona critique, a ranked list of the most dangerous risks, a pre-mortem, and the specific changes that would most strengthen the plan.

gabrielmoreira Bundle

Structure and facilitate sprint planning sessions. Use when asked to plan a sprint, organise backlog items, assign story points, create sprint goals, or prepare sprint planning agendas. Produces a sprint goal, velocity-calibrated backlog, capacity plan, risk flags, and a structured sprint planning meeting agenda.

netdata Bundle

Netdata integrations pipeline reference. Use when editing metadata.yaml and needing to validate, regenerate, or deliver it; modifying integrations generators, schemas, templates, generated integration docs, integrations.js, integrations.json, COLLECTORS.md, SECRETS.md, or SERVICE-DISCOVERY.md; changing collector consistency artifacts; working with ibm.d contexts.yaml to metadata.yaml generation or the NPM catalog generator; or asked what the collector taxonomy.yaml files are.

openlair Skill

Run an end-to-end workflow that chains `aris-research-refine` and `aris-experiment-plan`. Use when the user wants a one-shot pipeline from vague research direction to focused final proposal plus detailed experiment roadmap, or asks to "串起来", build a pipeline, do it end-to-end, or generate both the method and experiment plan together.

opensensenova Bundle

USE FOR Google-backed image discovery via Serper.dev. Returns image URLs, page URLs, titles, and source domains.

shinpr Skill

Update existing design documents (Design Doc / PRD / ADR) with review

snailsploit Skill

Advanced API exploitation methodology focused on business logic abuse and sophisticated attack patterns that bypass traditional security controls. Covers business logic bypass through API call chaining and workflow manipulation. Addresses GraphQL-specific attacks including batching for credential brute-force, query depth exploitation, and introspection abuse. Includes pagination exploitation for data exfiltration, webhook hijacking for SSRF and data interception, and resource exhaustion through algorithmic complexity attacks. Covers race conditions in API transactions using parallel request techniques. Provides comprehensive JWT manipulation including algorithm confusion, kid injection, jku/x5u abuse, and claim tampering. Details API key leakage detection across source repositories, client-side code, and error messages. Covers undocumented endpoint discovery through predictable naming, debug routes, and source map analysis. Tooling includes Arjun, ParamSpider, jwt_tool, and GraphQL Voyager. Designed for autho

strands-agents Skill

Identify documentation gaps and prioritize the docs backlog. Use when planning a docs improvement sprint, after signals surface repeated friction, when new SDK features ship without docs, or for periodic health assessment. Also triggers on "plan docs work", "what docs need writing", "prioritize the backlog", "docs health check", "what should we document next".

gabrielmoreira Skill

Creates specs before coding. Use when starting a new project, feature, or significant change and no specification exists yet. Use when drafting a PRD or requirements document with objectives and scope, or when requirements are unclear, ambiguous, or only exist as a vague idea. Use when a single requirement spans several independently testable capabilities and needs decomposing into a capability map of modules before specifying.

aronhy Bundle

Operate TikTok Shop research and planning with KSS MCP across product discovery, shop analysis, viral commerce videos, creator matching, caption extraction, pagination, sorting, and evidence-based action plans. Use when a user asks to research TikTok Shop products, shops, videos, creators, subtitles, competitors, or a complete commerce operations workflow.

elementalsouls Skill

Hunt Microsoft SharePoint Server (2013/2016/2019/Subscription Edition) on-prem farms — anonymous endpoint enumeration, version disclosure, legacy SOAP login bypass (Authentication.asmx), ToolShell precondition chain (CVE-2025-53770), SafeControl reflection enumeration via Picker.aspx, NTLM Type-2 AD topology disclosure, custom-branding module discovery, EoL farm permanent-CVE-window exploitation, FormDigest anonymous issuance, file-extension blocklist NOT-an-oracle pattern, custom-zone Forms auth bridging on-prem AD. Use when target has SharePoint headers (SPRequestGuid, X-MS-InvokeApp, X-SharePointHealthScore, MicrosoftSharePointTeamServices) or paths (/_layouts/15/, /_vti_bin/, /_api/, /_catalogs/).

elementalsouls Bundle

Operational arsenal for authorized external red-team and bug-bounty recon. Concrete probes, wordlists, regexes, dorks, curl one-liners for: subdomain enum, GraphQL/Swagger/REST discovery, identity fabric (Entra/Okta/ADFS/Google/SAML/M365 deep — Teams/SharePoint/OneDrive), cloud bucket enum (S3/GCS/Azure), CDN/WAF bypass, origin discovery, vendor fingerprinting (Citrix/F5/Pulse/Fortinet/PaloAlto/Cisco/VMware), CI/CD exposure, 48-pattern secret-scan catalog (AWS/GCP/GitHub/Stripe/Slack/Anthropic/OpenAI/Atlassian/DataDog/npm/PyPI), Postman workspaces, breach correlation (HudsonRock/HIBP/DeHashed/IntelX), TLS/JA3 audit, certificate transparency, JS endpoint extraction, package registry leaks, mobile/APK recon, sat imagery, sector-specific recon (healthcare DICOM, finance SWIFT, ICS/SCADA Modbus/BACnet). Detail content in 15 modular reference files, loaded on demand. Use for any authorized recon: scoping, asset discovery, attack-path mapping, secret triage, severity scoring.

elementalsouls Bundle

Organization-grade cloud and supply-chain attack-surface discovery: S3/GCS/Azure Blob bucket discovery via observed-name mining (CNAME/cert-SAN/Wayback) and bounded two-class permutation (6 prefixes x 15 suffixes on trusted tokens, bounded target-bound expansion on subdomain stems), existence (HEAD/GET) vs public-listing confirmation, object-key triage into 9 value tiers (database dumps, credentials, IaC state, kubeconfig, VCS dirs, config, archives, PII, logs), dangling-CNAME bucket-takeover detection, and the ownership-gated severity model that stops an unattributable public bucket from becoming a false CRITICAL; the fully offline AWS-account-ID recovery from a leaked AKIA/ASIA/AROA access key (base32 decode, runnable stdlib Python, canonical test vector, AWS-documentation-example-ID screening); dependency-confusion confirmation for npm/PyPI (internal-signal classifier -- private-registry binding vs org-namespace match -- paired with a read-only public-registry 404 check and the npm scope-claimability nuanc