Compresses a completed plan-tree branch into .claude/plans/archive/{NODE_ID}.summary.md. Removes the original node files (preserved by checkpoint history). Reduces always-loaded surface area as features ship.

Use when "Polars", "fast dataframe", "lazy evaluation", "Arrow backend", or asking about "pandas alternative", "parallel dataframe", "large CSV processing", "ETL pipeline", "expression API"

PolicyEngine API - Flask REST service powering policyengine.org and programmatic access

Deploying PolicyEngine backend APIs to Modal — workspace setup, authentication, deployment commands, environments, and troubleshooting

PostgreSQL indexing strategies and optimization

PostgreSQL migration patterns and best practices

PostgreSQL performance tuning and optimization

Plans and executes safe Prisma schema migrations with data backfills, rollback strategies, and SQL preview. Handles complex schema changes including data transformations. Use for "Prisma migrations", "schema changes", "database migrations", or "data backfills".

Search Product Hunt launches, products, and makers via the GraphQL V2 API. Use when the user asks about Product Hunt launches, trending products, or wants to research a product's reception. Requires a free developer token (~2 min setup).

Use this skill when selling one time products on Android with RevenueCat. Covers fetching offerings, running awaitPurchase on a non subscription package, and relying on the SDK to acknowledge or consume automatically.

Use this skill to access Reddit's full data archive via reddapi.dev API. Features semantic search, subreddit discovery, and real-time trend analysis. Perfect for market research, competitive analysis, and niche opportunity discovery.

Provides dynamic repository configuration patterns for gh-workflow agents. Use when an agent needs the default branch name for diffs, the repository owner/name for API calls, or branch naming and commit conventions for validation.

Guidelines for documenting research findings and investigation results. Use when writing content about discoveries, analysis, and recommendations from code analysis, API testing, or other research.

Research external documentation and best practices. Use when user says "look up the docs for this library", "research best practices for implementing caching", "how do other projects handle authentication", "check the official documentation for this API", "compare our implementation with industry standards", or "what's the recommended way to structure this".

Retrieve code diff from a GitHub Pull Request via GitHub API. Use this as the first step in a code review pipeline when reviewing GitHub PRs.

Implementing a single planned task (T-X.Y.Z) end-to-end: selects the right backend agent by language and service type, drives one TDD RED->GREEN turn, then verifies coverage, lint, license headers, runtime, and delivery before handoff. Runs as Gate 0 before ring:reviewing-code. Use to drive ONE task inside an already-running cycle. Skip when asked to implement a whole tasks.md or multiple tasks (use ring:running-dev-cycle).

Guides users through running Node.js as a sidecar process in Tauri applications, enabling JavaScript backend functionality without requiring end-user Node.js installations.

Rust security skill for supply chain safety and memory-safe development. Use when auditing dependencies with cargo-audit, enforcing policies with cargo-deny, reviewing RUSTSEC advisories, writing memory-safe FFI patterns, or integrating fuzzing and Miri into a security review pipeline. Activates on queries about cargo-audit, cargo-deny, RUSTSEC advisories, supply chain security, Rust CVEs, safe FFI, or fuzzing for security.

Query the Runway API for organization details: rate limits, credit balance, usage tier, and daily generation counts

Complete Runway API setup: check compatibility, configure API key, and integrate generation endpoints

Use when working with any code that handles user input, authentication, authorization, or secrets. Also use when adding or updating dependencies, reviewing infrastructure-as-code, or before claiming security posture is adequate. Covers OWASP Top 10, secrets detection (API keys, passwords, tokens in code), dependency vulnerabilities, IaC security, Docker hardening, and supply chain risks. If code touches a database query, HTTP endpoint, or config file with credentials, this skill applies.

Guide for using the Sentry CLI to interact with Sentry from the command line. Use when the user asks about viewing issues, events, projects, organizations, making API calls, or authenticating with Sentry via CLI.

Manage Claude Agent SDK / Managed Agents sessions — creation, resumption, compaction, forking, and termination. Covers when to start fresh, when to resume, and how to handle context window pressure in long sessions. Use this skill when building multi-turn agents, debugging "my agent forgot the earlier context", or designing session retention policies. Activate when: agent session, session resume, conversation compaction, session fork, context window overflow, session lifecycle.

This skill should be used when the user asks to "show token usage", "how many tokens", "token count", "token stats", "input output tokens", "API usage", "usage summary", "sessionlog tokenusage", "tokenusage", or wants to extract and report input/output token counts from Claude Code session logs.

Set up a Stylus smart contract project with OpenZeppelin Contracts for Stylus on Arbitrum. Use when users need to: (1) install Rust toolchain and WASM target for Stylus, (2) create a new Cargo Stylus project, (3) add OpenZeppelin Stylus dependencies to Cargo.toml, or (4) understand Stylus import conventions and storage patterns for OpenZeppelin.

iOS Simulator utility commands for screenshots, resizing, and common operations. Use these commands when taking simulator screenshots, resizing images for API compatibility, or performing common simulator operations.

Advanced SQL patterns including window functions, CTEs, recursive queries, and optimization techniques.

Analyzes and optimizes SQL queries using EXPLAIN plans, index recommendations, query rewrites, and performance benchmarking. Use for "query optimization", "slow queries", "database performance", or "EXPLAIN analysis".

Load and analyze Strava activities, stats, and workouts using the Strava API

List all tables exposed via the Supabase PostgREST API to identify the attack surface.

SurrealFS virtual filesystem for AI agents. Rust core + Python agent (Pydantic AI). Persistent file operations backed by SurrealDB. Part of the surreal-skills collection.

Guide for using Telegram MCP tools across both servers — telegram-all (personal account, full access) and telegram-bot (Bot API). Covers reading chats, sending messages, search, history, group management, and how to pick the right server. Use when the user asks about Telegram messages, chats, contacts, or bot operations.

Apply when defining service.json routes, choosing public vs segment vs private URL prefixes for VTEX IO services, or setting HTTP cache headers that interact with the VTEX edge and CDN. Covers path patterns, cookie visibility, edge caching behavior, and aligning Cache-Control with data sensitivity. Use for Node or .NET IO backends where request path and response headers determine CDN safety.

Writing unit and integration tests for the tldraw SDK. Use when creating new tests, adding test coverage, or fixing failing tests in packages/editor or packages/tldraw. Covers Vitest patterns, TestEditor usage, and test file organization.

This skill should be used when encountering authentication errors, API key errors, 401 errors, "invalid API key", "BANKR_API_KEY not set", job failures, or any Bankr API errors. Provides setup instructions and troubleshooting guidance for resolving Bankr configuration issues.

This skill should be used when executing Bankr requests, submitting prompts to Bankr API, polling for job status, checking job progress, using Bankr MCP tools, or understanding the submit-poll-complete workflow pattern. Provides the core asynchronous job pattern for all Bankr API operations.

This skill should be used when the user asks about "testing FastAPI", "FastAPI tests", "API testing", "test FastAPI endpoints", "mock FastAPI dependencies", "TestClient", "async API tests"

Use proactively for authorization with ActionPolicy. Creates policies, scopes, and integrates with GraphQL/ActionCable. Preferred over Pundit for composable, cacheable authorization.

Diagnose and fix LSP setup for the current project's detected ecosystems (Rust, TypeScript, Ruby). Use when the SessionStart hook nudged about a missing LSP plugin, when the env isn't ready (no `bundle install`, no `cargo build`, missing server binary), when LSP calls are failing, or when the user invokes `/actually-lsp-doctor` directly. Walks the per-ecosystem state machine, reports what's missing, then runs the fix.

Build your first Claude Agent SDK agent — TypeScript or Python. Covers installation, minimal agent loop, tool definitions, and the difference between "roll-your-own" and Managed Agents. Use this skill when starting a new AI agent project, migrating from raw messages.create loops to the Agent SDK, or evaluating SDK vs direct API. Activate when: Claude Agent SDK, @anthropic-ai/claude-agent-sdk, build agent, agent SDK quickstart, agent tutorial.

Test APIs with Newman/Postman collections, contract testing with Pact, mock servers, and GraphQL testing.

Connect a new data source to AnomalyArmor. Handles "connect my database", "add snowflake", "setup postgres", "connect warehouse".

Always check ~/.bashrc for credentials, API keys, passwords, and configuration values before asking user

Execute codeagent-wrapper for multi-backend AI code tasks. Supports Codex, Claude, and Gemini backends with file references (@syntax) and structured output.

Scan your project for exposed credentials, API keys, and secrets before running OpenClaw skills. Prevents accidental exfiltration.

Guides n8n credential setup through Computer Use browser tools. Use when a user needs OAuth apps, API keys, client IDs, client secrets, or other credential values from an external service console.

SpacetimeDB C#/.NET client SDK reference. Use when building C# clients that connect to SpacetimeDB (console, desktop, or any .NET app).

Transform product requirements into technical architecture blueprints with technology stack decisions, API contracts, and data models. Use when moving from requirements to implementation, evaluating technology stacks, or designing system components.

Security pattern for input validation and sanitization. Use when implementing input handling, preventing injection attacks (SQL, XSS, command), ensuring data integrity, or processing data from untrusted sources. Addresses "Entity provides unexpected data" problem.

Sets up DataRobot for local development including Python SDK, dr-cli, Agent Assist, and all required dependencies. Use when the user has not yet worked with DataRobot on this machine and wants to deploy agents to DataRobot, build an agent from scratch, or connect to DataRobot's APIs from a new project.

Run Gemini Deep Research from Claude Code. Optimizes prompts for depth and structure, then executes multi-step research via the Interactions API. Use when you need in-depth analysis, competitive landscaping, literature reviews, market research, or any question requiring real-time web research across many sources.

Guides architectural decisions for Deep Agents applications. Use when deciding between Deep Agents vs alternatives, choosing backend strategies, designing subagent systems, or selecting middleware approaches.

Django REST Framework patterns. Trigger: When building REST APIs with Django - ViewSets, Serializers, Filters.

Surface documentation debt — stale READMEs, missing public API docs, broken internal links, undocumented env vars. Use when onboarding gets friction, before a release, or when an API has evolved without matching doc updates.

Documentation creation and summarization. Use when the user asks to "write docs", "create documentation", "update README", "document this", "summarize code", "add docs", "write a changelog", "document the API", "explain this module", or mentions documentation, summarization, or README updates.

Refactor a backend domain to follow the 3-layer architecture pattern (Controller → Service → Entity). Use when asked to refactor a domain, add an entity layer, fix architecture violations, or align a domain with backend-architecture.md. Triggers on phrases like "refactor domain", "add entity", "fix architecture", "align with pattern", or "domain doesn't have an entity".

Export PostHog events, persons, or sessions on demand and download the resulting files. Use when the user asks to download/export raw PostHog data, create a one-off file export, fetch a Parquet or JSONLines export, or use the file_download_batch_exports API. Covers starting the export with MCP, polling completion, and downloading via the existing REST redirect endpoint.

Rust eBPF skill using the Aya framework. Use when writing eBPF programs in Rust with aya-bpf and aya-log, defining BPF map types, integrating with tokio userspace, sharing maps between kernel and userspace, or debugging Aya compilation and loading errors. Activates on queries about Aya, aya-bpf, Rust eBPF, aya-log, eBPF in Rust, or BPF programs with tokio.

Security anti-pattern for excessive data exposure (CWE-200). Use when generating or reviewing API responses, database queries, or data serialization. Detects returning more data than necessary including internal fields, sensitive attributes, and related records.

Escape Docker containers and exploit Kubernetes clusters using privileged containers, Docker socket access, misconfigurations, and API abuse. Use when testing container security or performing container escape.

Explore Salesforce schema before writing queries - discover custom fields, picklist values, relationship names, and record types. Use when unsure about field API names or object structure.

Expression Language injection playbook. Use when Java EL, SpEL, OGNL, or MVEL expressions may evaluate attacker-controlled input in Spring, Struts2, Confluence, or similar frameworks.

SDK language router for FeatBit. Routes SDK questions to the correct language-specific skill. Use when user asks about "which SDK to use", "SDK overview", "all FeatBit SDKs", or mentions FeatBit SDK without specifying a language. Do not use for deployment, REST API, observability, or documentation questions.

Retrieves up-to-date documentation, API references, and code examples for any developer technology. Use this skill whenever the user asks about, or when you need to lookup documentation or usage reference a specific library, framework, SDK, CLI tool, or cloud service - even if well-known as your training data may be outdated. Prefer this over web search for library documentation and API details.

Implement HTTP networking with Dio including interceptors, retry logic, and response caching. Use when building API clients, configuring authentication headers, or handling network errors gracefully.

Integrate Firebase services including Authentication, Firestore, Cloud Messaging, Crashlytics, and Analytics. Use when adding backend capabilities, push notifications, crash reporting, or remote configuration to a Flutter app.

Create and schedule link posts on freek.dev blog. Use when asked to publish, post, or share a link on freek.dev. Handles post creation, updating, and scheduling via the blog API.

Create Convex queries, mutations, and actions with proper validation, authentication, and error handling. Use when implementing new API endpoints.

Retrieve and decrypt secrets from the local encrypted credential store (~/.get_vars.json). Use when the user needs to access stored credentials, API keys, passwords, or other secrets that have been exported from 1Password. This reads from the encrypted JSON file created by the get_vars.sh script.

Entry P0 primary router for HackSkills. Use when the task involves web application testing, API security assessment, recon, vulnerability triage, exploit path planning, or choosing the right next category skill before any deep topic skill.

Manage Hetzner Cloud infrastructure with the `hcloud` CLI — servers, networks, firewalls, load balancers, volumes, DNS zones, SSH keys, primary/floating IPs, snapshots, certificates, placement groups, storage boxes. Use whenever the user mentions Hetzner, hcloud, VPS provisioning, or Hetzner location codes (fsn1, hel1, nbg1, ash, hil, sin) — even if they don't say "hcloud". CLI-only; does NOT cover Hetzner Robot (dedicated servers, separate product and API).

Hexagonal architecture layering for Java services with strict boundaries. Trigger: When structuring Java apps by Domain/Application/Infrastructure, or refactoring toward clean architecture.

Use when building an HTTP val — a web endpoint, API route, webhook receiver, or any val that responds to HTTP requests. Covers the handler signature, Hono usage, the endpoint URL, CORS behavior, redirects, and Val Town-specific limitations.

Mark price, premium index, and basis kline series for HTX USDT-M perpetuals — fair-value pricing for liquidation reference and basis monitoring. Public, no API key required.

Settlement and insurance fund data for HTX USDT-M perpetuals — estimated next-settlement price, historical settlement records, and insurance fund balance/history. Public, no API key.

Manage HubSpot CRM contacts, companies, deals, and CMS content via API. Use when the user says "add contact to HubSpot", "create deal", "search CRM", "HubSpot contacts", "update deal stage", "CRM report", "HubSpot pages", or asks about managing their sales pipeline, CRM data, or HubSpot content.

OWASP A01 - Injection Prevention. Use this skill when reviewing code for SQL injection, NoSQL injection, command injection, LDAP injection, or any user input that reaches databases, shells, or interpreters. Activate when: SQL query, database query, user input, command execution, shell command, exec, eval, system call, parameterized query.

Set up Inngest in a TypeScript project. Install the SDK, create a client, configure environment variables, serve endpoints or connect as a worker, and run the local dev server.

Add and manage integration tests for repositories and API endpoints. Use when adding integration tests, testing a repository, testing an API endpoint, or setting up integration test infrastructure.

Investigates a session recording by gathering metadata, person profile, same-session events, and linked error tracking issues in one pass. Use when a user provides a recording or session ID and wants to understand what happened — who the user was, what they did, what errors occurred, and whether there are related error tracking issues. Replaces the manual chain of session-recording-get, persons-retrieve, execute-sql, and query-error-tracking-issues-list.

JIRA API usage patterns, JQL query examples, and field mapping best practices

JNDI injection playbook. Use when Java applications perform JNDI lookups with attacker-controlled names, especially via Log4j2, Spring, or any code path reaching InitialContext.lookup().

Develop and extend Koko — the Elixir/OTP agent living alongside joelclaw. Covers OTP patterns, Redis bridge protocol, shadow execution, and workload implementation.

Security anti-pattern for hash length extension vulnerabilities (CWE-328). Use when generating or reviewing code that uses hash(secret + message) for authentication, API signatures, or integrity verification. Detects Merkle-Damgard hash misuse.

Context for working on the next AI SDK major release. Only use when explicitly invoked by the user (e.g. via '/major-version-mode'). Do NOT trigger autonomously based on task content.

Context for working on the next AI SDK major release. Only use when explicitly invoked by the user (e.g. via '/major-version-mode'). Do NOT trigger autonomously based on task content.

Execute mcloud logs to fetch and stream runtime logs for Cloud environments. Use when reading backend or storefront logs, filtering by time range, searching for errors, or scoping logs to a specific deployment.

Connect MCP servers to AI clients — Claude Desktop, Claude Code, Cursor, the Claude Agent SDK, and custom apps — including config file locations, auth, and debugging connection failures. Use this skill when the user wants to wire an MCP server into a client, troubleshoot "server not connecting" errors, or build a custom MCP client with the SDK. Activate when: MCP client, mcp.json, claude_desktop_config.json, connect MCP, MCP not working, list MCP tools, programmatic MCP client.

Use this skill when the user wants to read or search their Monologue notes through the Monologue Notes REST API. It covers authentication with the MONOLOGUE_API_KEY environment variable, safe token handling, listing notes, fetching a single note, pagination, filters, and error handling. The API is read-only and should be accessed with direct HTTP requests such as curl or any equivalent REST client.

Control Tesla vehicles from macOS via the Tesla Owner API using teslapy (auth, list cars, status, lock/unlock, climate, charging, location, and extras). Use when you want to check your car state or run safe remote commands. Designed for Parth Maniar (@officialpm) with local-only auth caching, confirmation gates for disruptive actions, and chat-friendly status output.

NoSQL injection playbook. Use when MongoDB-style operators, JSON query objects, flexible search filters, or backend query DSLs may allow data or logic abuse.

Notion API for creating and managing pages, databases, and blocks.

Handle npm package installation in non-interactive environments by piping confirmations. Use when installing Node.js packages that require user confirmation prompts.

Create and manage SLOs in Elastic Observability using the Kibana API. Use when defining SLIs, setting error budgets, or managing SLO lifecycle.

View and edit encrypted credentials in an Output.ai project. Use when adding secrets, updating API keys, verifying credential values, or retrieving a specific credential.

Calculate and display the cost of an Output SDK workflow execution run. Use when checking LLM token costs, API service costs, or total spend for a specific workflow run.