Software Development AI agent skills

13,359 skills in the archive. Read a skill’s instructions or open its original repository.

• Crlf Injection

  by @yaklang

  CRLF injection playbook. Use when user input reaches HTTP response headers, Location redirects, Set-Cookie values, or log files where carriage-return/line-feed characters can split or inject content.

• Authbypass Authentication Flaws

  by @yaklang

  Authentication bypass testing playbook. Use when assessing login flows, password reset logic, account recovery, MFA bypass, token predictability, brute-force resistance, and session boundary flaws.

• Hash Attack Techniques

  by @yaklang

  Hash attack playbook. Use when exploiting length extension, MD5/SHA1 collisions, HMAC timing leaks, birthday attacks, or hash-based proof of work in CTF and authorized testing scenarios.

• Jndi Injection

  by @yaklang

  JNDI injection playbook. Use when Java applications perform JNDI lookups with attacker-controlled names, especially via Log4j2, Spring, or any code path reaching InitialContext.lookup().

• Api Sec

  by @yaklang

  Entry P1 category router for API security. Use when choosing between API recon, authorization, token abuse, and hidden-parameter workflows before any deeper API topic skill.

• Insecure Source Code Management

  by @yaklang

  Source control and artifact exposure (.git, .svn, .hg, backups, .env). Use when recon finds VCS paths, 403 on hidden dirs, or backup/config leaks during authorized testing.

• Jwt Oauth Token Attacks

  by @yaklang

  JWT and OAuth token attack playbook. Use when validating token trust, signing algorithms, key handling, claim abuse, bearer flows, and OAuth account-binding weaknesses.

• Api Recon And Docs

  by @yaklang

  API reconnaissance and documentation review playbook. Use when discovering endpoints, schemas, versions, OpenAPI specs, hidden docs, and surface area for API testing.

• Csv Formula Injection

  by @yaklang

  CSV/spreadsheet formula injection (DDE, Excel/LibreOffice, Google Sheets IMPORT*). Use when exports, imports, or user fields feed spreadsheets or reporting tools.

• Api Auth And Jwt Abuse

  by @yaklang

  API authentication and JWT abuse playbook. Use when testing bearer tokens, API keys, claim trust, header spoofing, rate limits, and API auth boundary weaknesses.

• Cmdi Command Injection

  by @yaklang

  Command injection playbook. Use when user input may reach shell commands, process execution, converters, import pipelines, or blind out-of-band command sinks.

• Csrf Cross Site Request Forgery

  by @yaklang

  CSRF testing playbook. Use when reviewing state-changing web flows, anti-CSRF defenses, SameSite behavior, JSON CSRF, login CSRF, and OAuth state handling.

• Wp Env

  by @WordPress

  Use when setting up, configuring, or troubleshooting local WordPress development environments with @wordpress/env (wp-env). Triggers on mentions of wp-env, local WordPress development, Docker-based WordPress, or requests to…

• Ios Hig Design

  by @wondelai

  Design native iOS interfaces following Apple Human Interface Guidelines. Use when the user mentions "iPhone app", "iPad layout", "SwiftUI", "UIKit", "Dynamic Island", "safe areas", "HIG compliance", "SF Symbols", "haptic…

• Influence Psychology

  by @wondelai

  Apply the seven principles of ethical persuasion (reciprocity, commitment, social proof, authority, liking, scarcity, unity) to product design, copy, and sales. Use when the user mentions "social proof", "persuasive copy", "why…

• Design Everyday Things

  by @wondelai

  Apply foundational design principles: affordances, signifiers, constraints, feedback, and conceptual models. Use when the user mentions "why is this confusing", "affordance", "error prevention", "discoverability",…

• Design Sprint

  by @wondelai

  Run a structured 5-day process to prototype, test, and validate product ideas with real users. Use when the user mentions "design sprint", "validate before we build", "rapid prototype", "test with users", or "should we build…

• 37signals Way

  by @wondelai

  Build lean, opinionated products using the 37signals philosophy from "Getting Real", "Rework", and "Shape Up". Use when the user mentions "Getting Real", "Rework", "Shape Up", "37signals", "Basecamp method", "six-week cycles",…

• Clean Architecture

  by @wondelai

  Structure software around the Dependency Rule: source code dependencies point inward from frameworks to use cases to entities. Use when the user mentions "architecture layers", "dependency rule", "ports and adapters…

• Software Design Philosophy

  by @wondelai

  Manage software complexity through deep modules, information hiding, and strategic programming. Use when the user mentions "module design", "API too complex", "shallow class", "complexity budget", "strategic vs tactical", "deep…

• Continuous Discovery

  by @wondelai

  Build a weekly cadence of customer touchpoints using Opportunity Solution Trees, assumption mapping, and interview snapshots. Use when the user mentions "continuous discovery", "opportunity solution tree", "weekly interviews",…

• Microinteractions

  by @wondelai

  Design the small details -- triggers, rules, feedback, loops and modes -- that separate good products from great ones. Use when the user mentions "microinteraction", "button feedback", "loading state", "toggle design",…

• Domain Driven Design

  by @wondelai

  Model software around the business domain using bounded contexts, aggregates, and ubiquitous language. Use when the user mentions "domain modeling", "bounded context", "aggregate root", "ubiquitous language", "anti-corruption…

• Mom Test

  by @wondelai

  Talk to customers without leading them using Mom Test rules: discuss their life not your idea, ask about specifics in the past, and talk less. Use when the user mentions "customer interviews", "validate my idea", "users say they…

• Refactoring Patterns

  by @wondelai

  Apply named refactoring transformations to improve code structure without changing behavior. Use when the user mentions "refactor this", "code smells", "extract method", "replace conditional", "technical debt", "move method",…

• Pragmatic Programmer

  by @wondelai

  Apply meta-principles of software craftsmanship: DRY, orthogonality, tracer bullets, and design by contract. Use when the user mentions "best practices", "pragmatic approach", "broken windows", "tracer bullet", "software…

• Clean Code

  by @wondelai

  Write readable, maintainable code through disciplined naming, small functions, and clean error handling. Use when the user mentions "clean up this code", "this function is too long", "code smells", "naming conventions", "boy…

• Inspired Product

  by @wondelai

  Build empowered product teams using discovery and delivery dual-track. Use when the user mentions "product discovery", "empowered teams", "feature factory", "opportunity assessment", "product vision", "product strategy", "what…

• Working With Legacy Code

  by @wondelai

  Safely change and test untested codebases using Feathers' "Working Effectively with Legacy Code". Use when the user mentions "legacy code", "no tests", "untested codebase", "how do I test this", "seams", "characterization…

• Jobs To Be Done

  by @wondelai

  Discover what customers truly need by analyzing the "job" they hire your product to do. Use when the user mentions "customer discovery", "why customers churn", "what job does this solve", "competing against luck",…

• Scorecard Marketing

  by @wondelai

  Build quiz and assessment funnels that generate qualified leads at 30-50% conversion. Use when the user mentions "quiz funnel", "scorecard", "lead magnet", "score-based segmentation", or "lead qualification". Also trigger when…

• Architecture Optimization

  by @wondelai

  Guided journey from a working codebase grown slow and tangled to one measurably fast, cleanly bounded, and readable. Orchestrates eight skills phase by phase - working-with-legacy-code, clean-architecture,…

• Create Website

  by @wondelai

  Guided journey from a blank page to a live, high-converting website, built message-first, then design, then conversion. Orchestrates ten skills phase by phase - one-page-marketing, storybrand-messaging, made-to-stick,…

• Design Code Architecture

  by @wondelai

  Guided journey from an app idea to a deliberate architecture: boundaries, domain model, data decisions, and resilience, making only the expensive-to-reverse decisions and deferring the rest. Orchestrates eight skills phase by…

• Improve Code Quality

  by @wondelai

  Guided journey from a working-but-untested vibe-coded prototype to a production-ready product with tests, clean structure, a business-rules boundary, and resilience at scale. Orchestrates nine skills phase by phase -…

• Docx

  by @OpenCoworkAI

  Comprehensive document creation, editing, and analysis with support for tracked changes, comments, formatting preservation, and text extraction. When Claude needs to work with professional documents (.docx files) for: (1)…

• Pptx

  by @OpenCoworkAI

  Presentation creation, editing, and analysis. When Claude needs to work with presentations (.pptx files) for: (1) Creating new presentations, (2) Modifying or editing content, (3) Working with layouts, (4) Adding comments or…

• Pdf

  by @OpenCoworkAI

  Comprehensive PDF manipulation toolkit for extracting text and tables, creating new PDFs, merging/splitting documents, and handling forms. When Claude needs to fill in a PDF form or programmatically process, generate, or analyze…

• Research Deep

  by @Weizhena

  读取调研outline，为每个item启动独立agent进行深度调研。禁用task output。

• Cate Cli

  by @0-AI-UG

  Drive Cate browser, terminal, editor, panel, review, and coding-agent orchestration surfaces from a Cate terminal. Browser page automation targets Cate's live webviews directly.

• Claude Blog Brain

  by @AgriciDaniel

  Scaffold and operate Claude Blog Brain, a source-cited Obsidian brain for blog content creation, optimization, and management dual-optimized for Google rankings (E-E-A-T, the 2026 core updates) and AI citations (GEO/AEO),…

• Blog Flow

  by @AgriciDaniel

  FLOW framework integration for bloggers. Evidence-led content workflow using the Find, Optimize, Win loop with stage-specific AI prompts from the FLOW knowledge base (30 blog-applicable prompts, CC BY 4.0). Use when user says…

• Blog Outline

  by @AgriciDaniel

  SERP-informed outline generation with H2/H3 heading hierarchy, competitive content gap analysis, section-by-section word count targets, chart and image placement markers, optional FAQ question planning, and internal linking…

• Blog Analyze

  by @AgriciDaniel

  Audit and score blog posts on a 5-category 100-point scoring system covering content quality, SEO optimization, E-E-A-T signals, technical elements, and AI citation readiness. Includes advisory editorial style diagnostics…

• Blog Seo Check

  by @AgriciDaniel

  Post-writing SEO validation with pass/fail checklist covering title tag length and keyword placement, meta description quality, heading hierarchy and keyword density, internal/external link audit with anchor text analysis,…

• Blog Factcheck

  by @AgriciDaniel

  Verify statistics and claims in blog posts by fetching cited source URLs and checking if the claimed data actually appears on the page. Extracts all load-bearing claims (statistics, product or policy claims, ranking and…

• Blog Localize

  by @AgriciDaniel

  Deep cultural adaptation of translated blog posts. Run after blog-translate completes. Goes beyond translation to swap brand examples, adapt CTAs, substitute legal references, localize statistic sources where possible, and…

• Blog Persona

  by @AgriciDaniel

  Create and manage writing personas with NNGroup 4-dimension tone framework (Funny-Serious, Formal-Casual, Respectful-Irreverent, Enthusiastic-Matter-of-fact). Personas define readability targets, sentence length distribution,…

• Blog Audit

  by @AgriciDaniel

  Full-site blog health assessment scanning all blog files for quality scores, orphan pages, topic cannibalization, stale content, and AI citation readiness. Runs canonical batch analysis before site-wide checks. Produces per-post…

• Blog Decay

  by @AgriciDaniel

  Detect content decay from Google Search Console exports by comparing current and previous page performance, flagging quarter-over-quarter traffic drops, dropped pages, and refresh, consolidate, prune, or query-shift actions. Use…

• Oss Bounty Finder

  by @tinyfish-io

  Find paid open-source work, OSS bounties, open source grants, or ways to get paid contributing to open source. Use when someone asks any of the following — "find me paid open source work", "show me OSS bounties for Rust", "how…

• Oss Alternatives

  by @tinyfish-io

  Find actively maintained open source alternatives to any paid SaaS tool or commercial API. Use this skill whenever a user mentions wanting to replace, swap out, self-host, or find a free/open source version of a paid tool —…

• Dev Pain Finder

  by @tinyfish-io

  Scrape real developer pain points for any keyword, technology, or problem space from Reddit, Hacker News, dev.to, and GitHub Discussions simultaneously — then group complaints by theme, score them by frequency and upvote weight,…

• Kb Builder

  by @tinyfish-io

  Build an Obsidian-compatible knowledge base from public web sources using the TinyFish CLI. Use this skill when a user wants a builder-grade markdown knowledge base on a technical topic, asks for a structured research vault, or…

• Interview Prep

  by @tinyfish-io

  Generate a structured interview preparation guide for any company by scraping real candidate experiences from Glassdoor, Blind, and Reddit in real time using parallel TinyFish agents. Use this skill whenever a user mentions…

• Tenders Finder

  by @tinyfish-io

  Find open Singapore government tenders for any sector in real time using parallel TinyFish agents scraping multiple government tender portals simultaneously. Use this skill whenever a user wants to find government tenders, asks…

• Fetch

  by @tinyfish-io

  Default, free, and fastest way to read a URL's actual content — pulls clean, full page content (not a summary or a truncated snippet) as markdown, HTML, or structured JSON, including from JavaScript-heavy pages, in parallel…

• Npm Package Comparator

  by @tinyfish-io

  Compare two or more npm packages side by side using live data — downloads, bundle size, GitHub stars, last update, known vulnerabilities, and community sentiment. Use this skill when a user asks "zustand vs jotai vs redux",…

• Salary Market Scanner

  by @tinyfish-io

  Scan live job boards and salary databases to find real-time compensation data for any role and location. Use this skill when a user asks "what's the going rate for a senior React engineer in London", "software engineer salary…

• Leetcode Coach

  by @tinyfish-io

  Find and set up coding practice problems tailored to your weak areas, then create local files so you can solve them right away. Use this skill when a user wants to practice coding, asks for a LeetCode problem, says "give me a…

• Stalk My Interviewer

  by @tinyfish-io

  Research an interviewer online before a meeting using parallel TinyFish agents and return a structured prep report. Use this skill when a user says "research my interviewer", "I have an interview with [name] at [company]",…

• Hackathon Finder

  by @tinyfish-io

  Find hackathons tailored to your tech profile and location by searching Devpost, Luma, Partiful, MLH, and Eventbrite. Use this skill when a user asks "find me a hackathon", "are there any hackathons near me", "what hackathons…

• Doctor

  by @tinyfish-io

  Diagnose and repair your TinyFish setup — MCP registration, auth, and connectivity. Runs the TinyFish CLI's own doctor for the config checks, then does the one thing the CLI cannot — proving this harness can actually reach…

• Tinyfish Doctor

  by @tinyfish-io

  Diagnose and repair your TinyFish setup — MCP registration, auth, and connectivity. Runs the TinyFish CLI's own doctor for the config checks, then does the one thing the CLI cannot — proving this harness can actually reach…

• Self Improve With Tinyfish

  by @tinyfish-io

  Enables Hermes to create new reusable skills for itself by researching live web sources with TinyFish Search and Fetch, analyzing source coverage, writing SKILL.md files, and installing them into Hermes memory. Use when the user…

• Afrexai Performance Engineering

  by @LeoYeAI

  Complete performance engineering system — profiling, optimization, load testing, capacity planning, and performance culture. Use when diagnosing slow applications, optimizing code/queries/infrastructure, load testing before…

• Vibe Coding Mastery

  by @LeoYeAI

  The complete operating system for building software with AI. From first prompt to production deployment — prompting frameworks, architecture patterns, testing strategies, debugging playbooks, and production graduation…

• Agent Memory Architecture

  by @LeoYeAI

  Complete zero-dependency memory system for AI agents — file-based architecture, daily notes, long-term curation, context management, heartbeat integration, and memory hygiene. No APIs, no databases, no external tools. Works with…

• Technical Documentation Engine

  by @LeoYeAI

  Complete technical documentation system — from planning through maintenance. Covers READMEs, API docs, guides, architecture docs, runbooks, and developer portals. Includes templates, quality scoring, and automation.

• Afrexai Competitive Intel

  by @LeoYeAI

  Complete competitive intelligence system — market mapping, product teardowns, pricing intel, win/loss analysis, battlecards, and strategic monitoring. Goes far beyond SEO to cover the full business landscape.

• Afrexai Claude Code Production

  by @LeoYeAI

  Complete Claude Code productivity system — project setup, prompting patterns, sub-agent orchestration, context management, debugging, refactoring, TDD, and shipping 10X faster. Zero scripts needed.

• AI Recruiting Engine

  by @LeoYeAI

  Full-cycle recruiting agent — source, screen, score, and hire top talent with structured frameworks, scorecards, and pipeline automation. Zero dependencies.

• Playwright Recording

  by @digitalsamba

  Record browser interactions as video using Playwright. Use for capturing demo videos, app walkthroughs, and UI flows for Remotion videos. Triggers include recording a demo, capturing browser video, screen recording a website, or…

• Moviepy

  by @digitalsamba

  Python video composition with moviepy 2.x — overlaying deterministic text on AI-generated video (LTX-2, SadTalker), compositing clips, single-file build.py video projects. Use when adding labels/captions/lower-thirds to LTX-2 or…

• Wp Block Development

  by @WordPress

  Use when developing WordPress (Gutenberg) blocks: block.json metadata, register_block_type(_from_metadata), attributes/serialization, supports, dynamic rendering (render.php/render_callback), deprecations/migrations, viewScript…

• Wp Performance

  by @WordPress

  Use when investigating or improving WordPress performance (backend-only agent): profiling and measurement (WP-CLI profile/doctor, Server-Timing, Query Monitor via REST headers), database/query optimization, autoloaded options,…

• Wp Wpcli And Ops

  by @WordPress

  Use when working with WP-CLI (wp) for WordPress operations: safe search-replace, db export/import, plugin/theme/user/content management, cron, cache flushing, multisite, and scripting/automation with wp-cli.yml.

• Wp Patterns

  by @WordPress

  Pattern: create or update WordPress block patterns (starter pages, templates, template parts, Query Loop layouts), review pattern registration, block markup, categories, accessibility, or i18n/escaping, or improve pattern design…

• Wp Plugin Development

  by @WordPress

  Use when developing WordPress plugins: architecture and hooks, activation/deactivation/uninstall, admin UI and Settings API, data storage, cron/tasks, security (nonces/capabilities/sanitization/escaping), and release packaging.

• Wp Rest Api

  by @WordPress

  Use when building, extending, or debugging WordPress REST API endpoints/routes: register_rest_route, WP_REST_Controller/controller classes, schema/argument validation, permission_callback/authentication, response shaping,…

• Wp Phpstan

  by @WordPress

  Use when configuring, running, or fixing PHPStan static analysis in WordPress projects (plugins/themes/sites): phpstan.neon setup, baselines, WordPress-specific typing, and handling third-party plugin classes.

• Wp Interactivity Api

  by @WordPress

  Use when building or debugging WordPress Interactivity API features (data-wp-* directives, @wordpress/interactivity store/state/actions, block viewScriptModule integration, wp_interactivity_*()) including performance, hydration,…

• Wp Project Triage

  by @WordPress

  Use when you need a deterministic inspection of a WordPress repository (plugin/theme/block theme/WP core/Gutenberg/full site) including tooling/tests/version hints, and a structured JSON report to guide workflows and guardrails.

• Wordpress Router

  by @WordPress

  Use when the user asks about WordPress codebases (plugins, themes, block themes, Gutenberg blocks, WP core checkouts) and you need to quickly classify the repo and route to the correct workflow/skill (blocks, theme.json, REST…

• Blueprint

  by @WordPress

  Use when the deliverable is WordPress Playground Blueprint JSON or a Blueprint bundle, including creating, editing, reviewing, validating schema keys, choosing steps/resources, and debugging Blueprint files. For only running or…

• 1688 Product To Ozon

  by @LeoYeAI

  将1688的商品铺货到俄罗斯电商平台Ozon（上架），通过Ozon官方API实现商品信息的上传和状态查询。适用于需要将单个1688的商品上架到Ozon的场景。

• 1m Trade

  by @LeoYeAI

  Integrated on-chain operations hub: integrates BlockBeats market intelligence, Hyperliquid DEX trading via `hl1m`, wallet creation and management at https://www.1m-trade.com, and supports local initialization using `hl1m…

• 1688 Product Search

  by @LeoYeAI

  1688商品搜索SKILL：提供完整的1688商品搜索能力，包括类目查询、关键词搜索、图片搜索、商品详情、相关性商品、拉取货盘底池等9个核心接口。 支持多语言搜索和商品推荐，使用1688开放平台官方API，统一鉴权，Token全局缓存共享。

• Earth2037 Game

  by @LeoYeAI

  OpenClaw-based SLG game. Multiplayer, real-time commands, planning. Battle with other lobsters, build alliances. Use when user says "2037" or "earth2037" and wants key/apikey, register, login. Execute python3…

• Aavegotchi Gbm Skill

  by @LeoYeAI

  View, create, cancel, bid, and claim Aavegotchi GBM auctions on Base mainnet (8453). Subgraph-first discovery (Goldsky), with onchain verification + execution via Foundry cast. Safety-first: DRY_RUN defaults to 1 (simulate with…

• 360Guard

  by @LeoYeAI

  360-degree comprehensive security review Skill. Use before installing any Skill from ClawHub, GitHub, or other sources. Performs full security scans including all Skill Vetter checks plus extended system/privacy/behavior checks…

• 1m Trade Dex

  by @LeoYeAI

  Hyperliquid DEX/Perps entrypoint via `hl1m`: market queries, order placement. Wallet creation/management at https://www.1m-trade.com; local `hl1m init-wallet` with address + proxy (API) private key — never the main wallet key.…

• Adme Property Predictor

  by @LeoYeAI

  Predict ADME (Absorption, Distribution, Metabolism, Excretion) properties for drug candidates using cheminformatics models and molecular descriptors. Evaluates drug-likeness, bioavailability, and pharmacokinetic profile to guide…

• A0x Agents

  by @LeoYeAI

  Two superpowers for AI agents: a collective brain and a Base ecosystem mentor. BRAIN: Before debugging/compiling/architecting, search for existing solutions. After solving, propose so no agent repeats your mistake. MENTOR:…

• Acuity Scheduling

  by @LeoYeAI

  Acuity Scheduling API integration with managed OAuth. Manage appointments, calendars, clients, and availability. Use this skill when users want to schedule, reschedule, or cancel appointments, check availability, or manage…

• Addiction Self Assessment

  by @LeoYeAI

  Substance use and behavioral addiction self-assessment and harm reduction guidance. Use when someone suspects their drinking or substance use has become a problem, wants an honest self-assessment, or needs help finding…

• 12 Factor Apps

  by @LeoYeAI

  Perform 12-Factor App compliance analysis on any codebase. Use when evaluating application architecture, auditing SaaS applications, or reviewing cloud-native applications against the original 12-Factor methodology.

• Add Analytics

  by @LeoYeAI

  Add Google Analytics 4 tracking to any project. Detects framework, adds tracking code, sets up events, and configures privacy settings.

• Pr Review

  by @NVIDIA-NeMo

  Review Nemotron pull requests for critical bugs, tests, and documentation affected by the change.

• Code996

  by @hellodigua

  根据 Git 提交时间分析团队工作时段与 996 指标；用于用户要求的工作强度报告。