Software Development AI agent skills

13,359 skills in the archive. Read a skill’s instructions or open its original repository.

• Google Apps Script

  by @jezweb

  Build Google Apps Script automation for Sheets and Workspace. Custom menus, triggers (onEdit / time-driven / form submit), dialogs, sidebars, email batches, PDF export, external API. Use whenever the user wants to automate a…

• Git Workflow

  by @jezweb

  Guided git workflows: prepare PRs, clean up branches, resolve merge conflicts, handle monorepo tags, squash-and-merge patterns. Use when asked to prepare a PR, clean branches, resolve conflicts, or tag a release.

• Spatie Guidelines

  by @freekmurze

  Spatie's PHP, Laravel, JavaScript and Vue coding guidelines and conventions. Use when writing or reviewing PHP, Laravel, JavaScript, or Vue code for Spatie projects or packages. Covers code style, type declarations, docblocks,…

• Livewire 4

  by @freekmurze

  Build Livewire 4 components and applications. Use when creating reactive Laravel interfaces, single-file components, multi-file components, page components, forms, actions, or any Livewire-based UI. Triggers include "Livewire…

• Flare

  by @freekmurze

  Manage Flare error tracking and performance monitoring using the flare CLI. Use when the user wants to list, triage, resolve, snooze, or debug errors; manage projects; create projects and retrieve API keys; check error counts;…

• Spatie Package Skeleton

  by @freekmurze

  Guide for creating PHP and Laravel packages using Spatie's package-skeleton-laravel and package-skeleton-php templates. Use when the user wants to create a new PHP or Laravel package, scaffold a package. Also use when building…

• Audit Architecture

  by @freekmurze

  Run an application-wide, read-only architecture audit that finds materially useful simplifications in a codebase's data structures, state representation, control flow, algorithms, and ownership boundaries. Fans out bounded…

• Paywall Upgrade Cro

  by @freekmurze

  When the user wants to create or optimize in-app paywalls, upgrade screens, upsell modals, or feature gates. Also use when the user mentions "paywall," "upgrade screen," "upgrade modal," "upsell," "feature gate," "convert free…

• Explain Changes

  by @freekmurze

  Explain how the code on the current branch works, as an HTML page opened in the browser, written so someone can understand the change and review it. Use when asked to explain a branch, explain these changes, walk me through this…

• Conductor

  by @freekmurze

  Working with Conductor (conductor.build), the parallel-agent app. Creating local and cloud workspaces, the conductor CLI and public API, auth, sessions and messages, deep links, settings and setup scripts, environment variables,…

• Ableton

  by @freekmurze

  Control Ableton Live through the AbletonMCP tools. Use when the user wants to build tracks, patches, clips, drums, automation, or generative music in Ableton, or asks to change any device, mixer, or transport setting in their…

• Signup Flow Cro

  by @freekmurze

  When the user wants to optimize signup, registration, account creation, or trial activation flows. Also use when the user mentions "signup conversions," "registration friction," "signup form optimization," "free trial signup,"…

• Product Marketing Context

  by @freekmurze

  When the user wants to create or update their product marketing context document. Also use when the user mentions 'product context,' 'marketing context,' 'set up context,' 'positioning,' or wants to avoid repeating foundational…

• Review Pr

  by @freekmurze

  Review and merge GitHub pull requests for Spatie packages. Use when asked to review a PR, review a pull request, merge a PR, or when given a GitHub PR URL to review. Also triggers on 'review this PR,' 'check this pull request,'…

• Write Freek Dev Blogpost

  by @freekmurze

  When the user wants to write, draft, or outline a blog post for freek.dev. Also use when the user mentions 'blog post,' 'write a post,' 'freek.dev post,' 'draft a post,' or 'blogpost.' This skill captures the writing style,…

• Speeding Up Laravel Tests

  by @freekmurze

  Use when Laravel/Pest test suites are slow, CI duration is growing, individual tests take seconds, or the user asks to speed up, optimize, or profile tests. Covers factories, fakes, config caching, XDebug/pcov, BCRYPT_ROUNDS,…

• Gemma Trainer

  by @google-gemma

  Trigger this skill when the user wants to train, fine-tune, or adapt Gemma models (e.g. SFT, DPO, RLHF, Reward Modeling) on local hardware. Covers TRL, Unsloth, dataset preparation, validation, and GGUF/LiteRT conversion.

• Skills Manager Cli

  by @jiweiyeah

  Drive the Skills Manager CLI (`skm`) to initialize the hub, adopt unmanaged skills, list/enable/disable skills per AI tool, and doctor/fix symlink sync. Use whenever the user or an agent needs to manage skills from a terminal,…

• 1password Sdk

  by @MadAppGang

  How to load secrets and environment variables from 1Password programmatically using the official @1password/sdk (JavaScript/TypeScript). Use this skill whenever code needs to read a 1Password secret, resolve an op:// reference,…

• Pr Comment

  by @MadAppGang

  Write GitHub PR comments in Jack's voice. Use whenever writing, drafting, or posting PR comments — review feedback, thank-you notes, merge comments, close explanations, or change requests. Also use when the user asks to "comment…

• Mindmemos Cli

  by @mindscale-noah

  Give an AI agent persistent, cross-session long-term memory through MindMemOS. Covers installing and authenticating the mindmemos CLI, the full command interface (add / search / get / update / delete / feedback / dreaming) with…

• Oauth Hunter

  by @H-mmer

  OAuth 2.0 / 2.1, OpenID Connect (OIDC), SAML SSO, and JWT specialist. Dispatcher passes subtype — 'oauth', 'oidc', 'saml', or 'jwt' — in the task; falls back to inference. Use for redirect_uri / returnTo flaws, state/nonce/PKCE…

• Browser Stealth Agent

  by @H-mmer

  Stealth browser automation agent for targets behind Cloudflare, Akamai, Google, DataDome, or PerimeterX bot detection. Drives the local camofox-browser REST server (Camoufox, C++-patched Firefox) for recon, client-side bug…

• Business Logic

  by @H-mmer

  Business Logic vulnerability specialist (H1 #28, CWE-840/841/639/362). Use for testing workflow bypasses, price manipulation, coupon abuse, MFA/2FA bypass, password-reset bypass, free-trial abuse, race-condition on payment,…

• Ssti Hunter

  by @H-mmer

  Server-Side Template Injection specialist. Covers Jinja2 (H1 #74), Twig, Velocity, FreeMarker, ERB, Handlebars, Thymeleaf. Use for any rule-engine, comment/message rendering, PR automation, admin template, or user-customizable…

• Sast

  by @H-mmer

  Source code vulnerability hunting (SAST). Decomposes analysis into specialized passes: map entry points, map dangerous ops, trace flows, find gaps, adversarial validation, exploit. Usage: /sast <repo_path> [--lang…

• Js Analyzer

  by @H-mmer

  JavaScript static analysis agent for client-side security review. Use for analyzing JS bundles, finding hardcoded secrets, tracing DOM XSS source-sink flows, identifying postMessage handlers, extracting API endpoints, and…

• Recon

  by @H-mmer

  Reconnaissance agent for target enumeration. Use for subdomain discovery, port scanning, service fingerprinting, tech stack identification, and OSINT gathering. Specify scope and depth: 'passive' for DNS/cert/OSINT only,…

• Poc Builder

  by @H-mmer

  Bug bounty PoC and report builder. Use after confirming a vulnerability to create minimal reproduction steps, self-contained HTML demonstration pages, curl-based reproduction scripts, and platform-ready report drafts for…

• Waf Profiler

  by @H-mmer

  WAF fingerprinting and behavior mapping specialist. Use to identify the WAF, map its blocking rules, find bypass techniques, and document WAF behavior for other agents. Always run this before xss-hunter or injection testing on…

• Hunt

  by @H-mmer

  Active vulnerability hunting on a target. Loads scope, reads brain, detects tech stack, runs targeted tests with concrete payloads. Usage: /hunt target.com [--vuln-class…

• Config Auditor

  by @H-mmer

  Security header and server configuration auditor. Use for HTTP security header analysis, CSP evaluation, CORS policy review, TLS configuration assessment, cookie security, and server hardening checks. Provide target URL or list…

• Browser Agent

  by @H-mmer

  Browser automation agent for interactive web testing. Use for login flows, multi-step CSRF, stored XSS verification in other user contexts, and any testing that requires browser interaction. Requires Claude in Chrome MCP.

• Chain Builder

  by @H-mmer

  Deep exploit chain builder. Given bug A, recursively walks the chain graph — each confirmed link becomes the new A. No depth limit. Supports 2-link to 10+ link chains. Use when you have any finding that needs escalation.

• Rce Hunter

  by @H-mmer

  Remote Code Execution specialist (H1 #70). Use for testing command injection, template injection (SSTI), deserialization, expression language injection, and any vector that achieves server-side code execution.

• Sast Danger Mapper

  by @H-mmer

  Maps dangerous operations in a source file: memory ops, type casts, arithmetic near trust boundaries, free/dealloc patterns. Pattern matching task — list what you see, don't speculate. Use via /sast command.

• Sast Hunter

  by @H-mmer

  Focused PoC builder for SAST candidates. Receives a SPECIFIC candidate vulnerability that survived adversarial validation. Writes a PoC, compiles, runs with ASan, confirms or rejects. Use via /sast command.

• Sast Exploit Builder

  by @H-mmer

  Builds working exploits from confirmed SAST findings. Takes a confirmed crash, develops it into a full exploit. Tier 1 (DoS) → Tier 5 (code execution). Use via /sast command after PoC confirmation.

• Recon Ranker

  by @H-mmer

  Attack surface ranker. Takes recon output + brain data, produces P1/P2/Kill prioritized attack plan with concrete curl commands for each P1 target. Use after recon to decide what to test first.

• Sast Entry Mapper

  by @H-mmer

  Maps entry points where untrusted data enters a source file. Lists every function that receives external input with data type, size constraints, and initial validation. Use via /sast command.

• Sast Devils Advocate

  by @H-mmer

  Adversarial validator for SAST findings. Your ONLY job is to DISPROVE the candidate. Find every reason it's not exploitable. If you can't disprove it, it survives. Use via /sast command.

• Cors Hunter

  by @H-mmer

  CORS Misconfiguration specialist (H1 #58). Use for testing cross-origin resource sharing policies, origin reflection, null origin bypass, and credential-bearing cross-origin requests.

• Race Condition

  by @H-mmer

  Race Condition specialist (H1 #29). Use for testing TOCTOU flaws, double-spend, parallel request abuse on balance operations, coupon redemption, and any non-idempotent state changes.

• Sast File Ranker

  by @H-mmer

  Source file attack surface ranker. Reads a repository, scores every source file 1-5 by exploitability. Outputs ranked JSON for per-file hunting. Use via /sast command.

• Dupcheck

  by @H-mmer

  Check if a vulnerability has already been reported. Searches platform hacktivity + local findings. Usage: /dupcheck <vuln_type> e.g. /dupcheck XSS in search endpoint

• Open Redirect

  by @H-mmer

  Open Redirect specialist (H1 #38). Use for testing URL redirect parameters, login/logout flows, OAuth callbacks, and any endpoint that redirects based on user input.

• Report

  by @H-mmer

  Generate submission-ready reports for all confirmed findings. Runs dedup, PoC builder, quality check, and report writer. Usage: /report bounty or /report pentest

• Pipeline

  by @H-mmer

  Prepare the battlefield — recon, scanning, and surface ranking. Stops before hunting. Run /hunt or /autopilot after. Usage: /pipeline or /pipeline <target>

• Brain

  by @H-mmer

  Manage the engagement brain. Subcommands: 'init' to set up, 'brief <target>' for pre-flight, 'status' for overview, 'exhausted [target]' to see dead ends.

• Monitor

  by @H-mmer

  Monitor targets for changes. Usage: /monitor baseline (first run), /monitor check (detect changes), /monitor scope (check platform for scope updates)

• Chain

  by @H-mmer

  Build deep exploit chains — dispatches chain-builder agent. Given bug A, recursively walks the chain graph. Usage: /chain (then describe bug A)

• Mindmap

  by @H-mmer

  Generate a text-based attack surface mindmap. Shows tech stack → vuln class → endpoint relationships. Usage: /mindmap <target>

• Sync

  by @H-mmer

  Sync program scope, policy, and hacktivity from a bug bounty platform. Usage: /sync hackerone tesla or /sync bugcrowd uber

• Learn

  by @H-mmer

  Record a platform response and update learning. Usage: /learn <report_id> <status> [--bounty 500] [--vuln-type XSS]

• New

  by @H-mmer

  Create a new engagement workspace. Usage: /new <platform> <program> [--type web-app|api|mobile|smart-contract]

• Status

  by @H-mmer

  Show engagement dashboard with program info, scope, brain state, findings, agent activity, and cost estimate.

• Triage

  by @H-mmer

  Batch-validate ALL findings through the 7-Question Gate. Kills weak findings in bulk. Usage: /triage

• Correlate

  by @H-mmer

  Run the finding correlation engine to discover attack chains from individual findings.

• Maintain Cross Platform

  by @agent-sh

  Use when preparing an AgentSys release, checking cross-platform compatibility, or changing the installer, transforms, adapters or marketplace pins. Maintainer skill for this repo only.

• Embed Ai Tool

  by @LeoKemp223

  嵌入式开发技能集的总控入口。负责两类任务：(1) 用户请求安装本仓库 skill 时，引导选择全部或按需安装；(2) 用户发出模糊指令（如"烧录"、"编译"、"调试"）且无法自动判断应使用哪个具体 skill 时，列出同分类下的候选 skill 供用户选择。

• Static Analysis

  by @LeoKemp223

  当需要对嵌入式 C/C++ 代码运行 cppcheck、clang-tidy 或 GCC analyzer 静态分析，或进行 MISRA-C 合规检查时使用。

• Rtos Debug

  by @LeoKemp223

  当需要进行 FreeRTOS/RT-Thread/Zephyr 的线程感知调试，查看任务列表、栈水位或死锁检测时使用。

• Debug Gdb Openocd

  by @LeoKemp223

  当需要通过 OpenOCD 启动或附着 GDB 会话，调用自带脚本完成固件下载、在线调试或崩溃现场检查时使用。

• Logic Analyzer

  by @LeoKemp223

  当需要用 Saleae 逻辑分析仪在线采集数字波形并解码 I2C/SPI/UART/CAN 时使用，通过 Logic 2 自动化服务驱动硬件采集、添加协议解码器并导出数据。

• Visa Debug

  by @LeoKemp223

  当需要调试 GPIB/USB/TCP/Serial VISA 仪器通信时使用，支持 SCPI 命令收发、波形捕获、截图和持续监控。

• Modbus Debug

  by @LeoKemp223

  当需要调试 Modbus RTU（串口）或 Modbus TCP（网络）设备通信时使用，支持寄存器读写、从站扫描和持续监控。

• Flash Platformio

  by @LeoKemp223

  当需要通过 PlatformIO 烧录固件到目标板时使用，利用 platformio.ini 中的上传配置自动完成烧录。

• Debug Jlink

  by @LeoKemp223

  当需要通过 J-Link GDB Server 启动或附着 GDB 会话，完成固件下载、在线调试或崩溃现场检查时使用。

• Flash Keil

  by @LeoKemp223

  当需要通过 Keil MDK 内置调试器烧录固件到目标板时使用，利用工程中已配置的调试器和 Flash 算法执行下载。

• Build Idf

  by @LeoKemp223

  当需要配置或构建基于 ESP-IDF 的固件工程，调用自带脚本执行 idf.py build 并定位固件产物时使用。

• Debug Platformio

  by @LeoKemp223

  当需要通过 PlatformIO 内置调试功能对目标板进行 GDB 调试时使用，支持下载暂停、附加和崩溃现场分析。

• Build Platformio

  by @LeoKemp223

  当需要通过 PlatformIO 命令行编译嵌入式工程，调用自带脚本解析环境配置、执行构建并定位固件产物时使用。

• Build Keil

  by @LeoKemp223

  当需要通过 Keil MDK 命令行编译嵌入式工程，调用自带脚本解析工程文件、执行构建并定位固件产物时使用。

• Can Debug

  by @LeoKemp223

  当需要调试 CAN 总线通信时使用，支持通过 USB-CAN 适配器监听、发送 CAN 帧和扫描节点。

• Flash Openocd

  by @LeoKemp223

  当需要使用已探测或显式指定的产物与探针配置，调用自带脚本通过 OpenOCD 烧录嵌入式固件时使用。

• Build Cmake

  by @LeoKemp223

  当需要配置或构建基于 CMake 的嵌入式固件工程，调用自带脚本执行构建并定位固件产物时使用。

• Flash Idf

  by @LeoKemp223

  当需要通过 ESP-IDF 工具链烧录固件到 ESP32 系列芯片，或启动调试会话时使用。

• Flash Jlink

  by @LeoKemp223

  当需要使用 SEGGER J-Link 探针烧录固件，或启动 RTT 日志捕获时使用。

• Workflow

  by @LeoKemp223

  当需要串联多个 skill 完成编译+烧录+监控或编译+烧录+调试等流水线任务时使用。

• Serial Monitor

  by @LeoKemp223

  当需要识别正确串口、调用自带脚本抓取日志，并分析嵌入式固件运行状态时使用。

• Homerail Shared

  by @xiaotianfotos

  Shared HomeRail rules for AI agents operating the local-source release candidate: service roles, environment variables, secrets, provider boundaries, Docker callback networking, update expectations, and safe command behavior.…

• Homerail Cli

  by @xiaotianfotos

  HomeRail CLI syntax, flags, configuration, and command reference. Use to translate a known operation into an exact hr command or diagnose CLI configuration. Use homerail-dag-ops for the full DAG design, execution, supervision,…

• Serial Shell

  by @LeoKemp223

  当需要通过串口与嵌入式设备建立交互式 Shell 会话、执行单条命令或批量脚本时使用。

• Vertex Agent Skill

  by @zeenie-ai

  Delegate heavy tasks to a Google cloud-hosted managed agent (Antigravity) with its own sandboxed Linux environment - code execution, file management, Google Search, and URL fetching all run in Google's cloud. Use for multi-step…

• Tikhub Skill

  by @zeenie-ai

  Scrape TikTok, Douyin, Instagram, YouTube, Twitter/X, Xiaohongshu, Bilibili, Kuaishou, Weibo, Reddit, Threads, LinkedIn and more through the TikHub pay-per-request API - discover endpoints, call them by id, parse any share URL,…

• Aws Skill

  by @zeenie-ai

  Work with Amazon Web Services through the official boto3 SDK — check the identity behind the key, list, start and stop EC2 instances, list, upload, download and delete S3 objects, and call any other AWS API operation. Output is…

• Homerail Pr Review

  by @xiaotianfotos

  Run HomeRail's built-in read-only pull request review DAG. Use when the user asks to review a GitHub PR, requests an evidence-backed PR audit, or wants a reusable independent Qwen, Kimi, and GLM review with retained findings.

• Shell Skill

  by @zeenie-ai

  Execute short-lived shell commands inside the per-workflow workspace. Uses Nushell when installed and otherwise the host shell. External tools on PATH (npm, node, python, git, ...) are available.

• Homerail Pr Closeout

  by @xiaotianfotos

  Determine whether a GitHub pull request can leave Draft or is ready for its owner to merge, using immutable validation, review, CI, dependency, and approval evidence. Never merge a pull request.

• Process Manager Skill

  by @zeenie-ai

  Start, stop, and manage long-running processes with full system PATH. Use for npm, python, node, dev servers, watchers, build tools. Destructive file commands blocked.

• Pr Closeout

  by @xiaotianfotos

  Present an evidence-grounded pull request closeout decision after review, CI, or real-machine validation.

• Wsl Skill

  by @zeenie-ai

  Windows Subsystem for Linux (WSL) commands for running Linux tools on Windows.

• Add Server Logic

  by @microsoft

  Creates, edits, and manages Power Pages Server Logic files — server-side JavaScript that runs securely on the Power Pages runtime. Orchestrates the full lifecycle: gathering requirements, fetching documentation, implementing…

• Add Cloud Flow

  by @microsoft

  Integrates Power Automate cloud flows into a Power Pages site. Lists available flows, suggests relevant ones based on intent, identifies scenarios and web roles, creates metadata files, and generates client-side code to call…

• Test Native Extension

  by @microsoft

  Validate a third-party control repo across four automated layers plus one printed manual recipe. Layer 1 asserts native-source structure (Android getName() and iOS +moduleName to manifest nativeModule; @ReactMethod /…

• Generate Native Extension

  by @microsoft

  Read the approved PRD.md and generate the native sources for a third-party PAM control (the compiled `.ppmplugin` track) — iOS Obj-C `<Pascal>Module` plus optional system-frameworks podspec, Android Kotlin `<Pascal>Module` with…

• Generate Ppmplugin Manifest

  by @microsoft

  Validate, reconcile to the chosen target(s), and stage the `manifest.json` for a `.ppmplugin` bundle. In the normal flow the committed `./manifest.json` already exists (authored by /generate-native-extension), so this stage…

• Publish Pcf Companion

  by @microsoft

  Deploy the dispatcher PCF for a third-party `.ppmplugin` control to a Power Platform environment via `pac pcf push`. The dispatcher PCF is the Studio-side control that dispatches the composite key `<name>/<receiver>` over the…

• Generate Pcf Companion

  by @microsoft

  Generate the dispatcher PCF for a third-party `.ppmplugin` (wrap-runtime) control. Runs `pac pcf init` in the pcf/ subfolder, rewrites ControlManifest.Input.xml from ARCHITECTURE §6, and writes index.ts derived from ARCHITECTURE…

• Design Native Extension Feature

  by @microsoft

  Capture a 2-3 line pitch from the user, draft a product overview (PRD.md) and a technical design (ARCHITECTURE.md) for a third-party `.ppmplugin` native control, then walk through every operation's iOS + Android implementation…