Marketplace
Find the right skill for the job.
Browse the full catalog through outcome-first channels, technical facets, rating filters, and server-side pagination built for a large public marketplace.
API Fuzzing for Bug Bounty
This skill should be used when the user asks to "test API security", "fuzz APIs", "find IDOR vulnerabilities", "test REST API", "test GraphQL", "API penetration testing", "bug bounty API testing", or needs guidance on API security assessment techniques.
mood-diary
心情日记 — 智能情绪追踪器，通过自然语言记录中文日记、自动识别7种情绪、 1-10分评分、智能标签提取，生成日/周/月报告和趋势分析。 数据纯本地JSON存储，零网络请求，保护隐私。
vulnerability-assessment
漏洞评估的专业技能和方法论
security-awareness-training
安全意识培训的专业技能和方法论
execution
A wrapper tool for executing individual sprints within multi-sprint epics. It injects sprint-specific context, manages CFN Loop execution, enforces scope boundaries, validates deliverables, and reports results with PROCEED/ITERATE/ABORT outcomes.
ci-cd-pipelines
Provides CI/CD pipeline templates for GitHub Actions with clear examples for test, build, and deploy stages. Includes Docker container building, deployment strategies comparison, and best practices like immutable artifacts and secrets management.
terraform-expert
Provides Terraform code patterns for AWS infrastructure including VPC, ECS, and RDS modules. Shows project structure, state management with S3 backend, and common patterns like for_each loops. Includes practical examples but lacks interactive guidance.
core-tester
A testing agent that generates unit, integration, and E2E tests with code examples. It includes pre/post hooks for environment validation and integrates with Jest/Vitest. Covers test pyramid concepts, FIRST principles, and provides concrete patterns for different test types with performance and security testing examples.
auth-implementation-patterns
Provides concrete implementation patterns for authentication and authorization systems, including JWT, session management, and OAuth2. Includes TypeScript code examples for token generation, refresh flows, and middleware. Focuses on practical security concerns like token storage and session configuration.
c-incremental-build-converter
Convert C/C++ project build.sh and test.sh scripts to support incremental builds. Use when fixing build scripts for re-execution after docker commit, converting to out-of-tree builds, or making scripts idempotent for repeated execution.
senior-security
Comprehensive security engineering skill for application security, penetration testing, security architecture, and compliance auditing. Includes security assessment tools, threat modeling, crypto implementation, and security automation. Use when designing security architecture, conducting penetration tests, implementing cryptography, or performing security audits.
database-migration
Automates creation of database migration files with up/down SQL scripts when users mention schema changes. Follows conventions for tools like Knex and Prisma, validates SQL syntax, and generates timestamped files. Useful for developers managing database schema evolution.
cfn-agent-swap
This skill provides automated recommendations for swapping underperforming agents in CFN Loops based on feedback themes. It maps specific feedback types to specialized replacement agents and offers multiple replacement strategies. The tool is stateless and designed for minimal side effects.
Docker
This Claude skill provides comprehensive container management for Docker and Podman, automatically detecting the runtime to build images, manage containers, handle compose files, debug issues, and optimize resources with security scanning and multi-architecture support.
github-actions-ssh-deploy
交互式配置 GitHub Actions 通过 SSH 密钥连接 VPS 的向导。当用户需要设置 GitHub Actions 部署到 VPS、配置 CI/CD SSH 连接、生成部署 workflow 时使用此 skill。通过问答方式收集必要信息后生成完整配置。
spring-security-6
Migrate Spring Security 5 to Spring Security 6 configuration. Use when removing WebSecurityConfigurerAdapter, replacing @EnableGlobalMethodSecurity with @EnableMethodSecurity, converting antMatchers to requestMatchers, or updating to lambda DSL configuration style. Covers SecurityFilterChain beans and authentication manager changes.
trivy-offline-vulnerability-scanning
Use Trivy vulnerability scanner in offline mode to discover security vulnerabilities in dependency files. This skill covers setting up offline scanning, executing Trivy against package lock files, and generating JSON vulnerability reports without requiring internet access.
clerk-auth
This skill provides Clerk authentication setup and troubleshooting for React, Next.js, and Cloudflare Workers. It helps implement protected routes, JWT verification, middleware, and testing while resolving common errors like secret key issues and JWKS cache problems.
nuxt-production
This skill provides expert guidance for optimizing Nuxt 4 production applications, covering hydration debugging, performance tuning, Vitest testing, deployment to major platforms, and migration from Nuxt 3.
tech-detection
Automatically detects technology stacks in projects by scanning configuration files, identifying languages, frameworks, package managers, and cloud platforms. Updates Claude permissions based on detected tech and generates project-context.json for other skills to reference. Includes automated LSP setup and specialist agent creation.
exploit-researcher
Exploit researcher persona specializing in attack surface analysis, exploit scenario generation, and vulnerability chaining
automated-code-fixer
Automatically fixes code issues like test failures, lint errors, and type mismatches with strict validation gates. Enforces test coverage, formatting rules, and security checks before accepting changes. Escalates complex issues to humans.
governance
Provides command-line control over Claude agent governance settings, allowing users to toggle enforcement rules for chain-of-command routing and session-end requirements without editing config files directly.
helm-chart-scaffolding
This skill provides comprehensive guidance for creating, organizing, and managing Helm charts to template, package, and deploy Kubernetes applications with reusable configurations and best practices.