安全

sql-jdbc-access-design

2security

Design customer-facing SQL access to a product's data - a JDBC/ODBC endpoint, warehouse share, or hosted query surface. Covers the architecture gate by scan frequency (zero-copy share, replicated copy, per-tenant compute isolation), engine-level tenant isolation with secure views and row-level security, an additive-only schema-stability contract enforced in CI, BI-tool connectivity and driver certification, query governance and cost caps, short-lived credential issuance, and the pricing shape. Use whenever the user mentions JDBC, ODBC, SQL access for customers, connecting Tableau or Power BI to product data, or pricing a SQL add-on - even if they never say "SQL access". Do NOT use for bulk file delivery - use samber/developer-platform-skills@bulk-data-sharing-design instead.

samber

limrun-xcode-bazel

Build a Bazel-based iOS / macOS / Apple app on Limrun's remote build execution (RBE) instead of a local Mac, and install it on a remote iOS simulator. Use when the project is a Bazel workspace (MODULE.bazel / WORKSPACE) building rules_apple / rules_swift targets and the user wants to `bazel build` it or run it on a simulator, or when a `--config=limrun` build or install misbehaves. To then tap, type, screenshot, or otherwise interact with the running app, use limrun-ios-simulator. For non-Bazel (plain xcodebuild) projects use limrun-xcode instead.

limrun-inc

bat-submit

Submit an AI tool to BAT AI Tools (bataitools.com) via bat-cli CLI. Use a continuous 3-step workflow — extract, translate, then pack and submit.

bataitools

5dive-cli

Use the local `5dive` CLI on a 5dive runtime VM to spawn, inspect, send to, and tear down sibling agents — plus the shared task queue and org chart. Trigger when the user wants a worker, sub-agent, side task, parallel run, fan-out, or to delegate — or names a sibling agent ("ask X", "ping X", "tell X", "hand off to X", "coordinate with X"); confirm it exists via `5dive agent list --json`, then `agent send` / `agent ask`. Also for filing and tracking shared work (`5dive task add/ls/done`), the org chart (`5dive org tree`), parking a blocking question on a human (`task need`), and a quick recall of team memory (`5dive memory search`). For everything else the CLI can do — crew hosting, multi-account auth, auth recovery, declarative fleets/compose, goal DAGs, objectives, loops, compiling into the wiki, org-chart writes, governance votes, digest/usage/supervisor/fleet/diagnose, telegram pairing, the persona market, BYO providers, and the company wizard — see the `5dive-cli-extras` skill. When a request came over a chat channel (Telegram/Discord `<channel>` tag) and another agent should handle it, pass the chat context via `--reply-to-chat=<id> --reply-to-msg=<id>` so that agent replies from its own bot — don't relay. Always prefer `5dive` over running coding CLIs by hand.

5dive-ai

twitter-api

A Twitter API alternative and X API alternative on fetcher.sh — pay-per-call in USDC via x402, or prepaid credits with a Bearer key, no OAuth and no developer application. Use when the user wants to search tweets by keyword, hashtag, or advanced operators (from:, to:, since:, until:, min_faves:, filter:), scrape a Twitter/X profile by handle, pull a user's tweets, replies, followers, or followings, fetch a single tweet with its replies or retweeters, read a Twitter List's members or tweets, check trending topics by country, or search for X accounts by name. Also covers Twitter data pipelines, competitor monitoring, hashtag tracking, sentiment analysis input, or follower export without the official X API's pricing tiers or app-review process.

fetcher-sh

yunqi-agent-attendance

云栖大会（Yunqi）参会与摘要 Skill。创建、批量创建、查询和取消 Agent 会议订阅，记录订阅与统计，并领取、追问和总结会后摘要。按会前、会中、会后三阶段引导对话：会前会中引导看直播，会后按状态告知整理进度或领取摘要正文。适用于「订阅会议」「批量订阅会议」「查看订阅列表」「取消订阅」「领取摘要」「追问摘要」「总结摘要」等场景。数据源为 qianwen CLI 的 yunqi 子命令，包含订阅读写与摘要读取能力。

qianwen-ai

nerd-patrol

Use when examining a confirmed code, pull request, module, application, endpoint, dependency, or configuration scope for vulnerabilities, unsafe behavior, or exploitability.

danangjoyoo

nerd-fast

Use when explicitly invoked or when a concrete latency constraint requires minimizing wall-clock agent time without reducing accuracy.

danangjoyoo

affiliate-program-terms

Draft the terms and conditions an affiliate accepts when joining a commission-based program - the affiliate program agreement, with the canonical clause set, prohibited-tactics clauses and enforcement ladder, commission validation, clawback and termination mechanics, and jurisdiction overlays (FTC endorsement rules, EU P2B, UK ASA/CAP, GDPR roles). Output is a clause-complete draft flagged for mandatory legal review, for B2B SaaS and B2C ecommerce alike. Use whenever the user mentions affiliate program terms, an affiliate agreement, prohibited tactics, or a brand-bidding policy, even if they only ask what affiliates must agree to. Do NOT use for reviewing a published post's disclosure label - use mbfinotti/partnerships-skills@affiliate-disclosure-compliance instead.

mbfinotti

alliance-prioritization

Rank named candidate strategic alliances and technology partnerships by expected value, effort, and risk, to decide where partner-team capacity goes - must-pass screens, a weighted alliance scorecard with sensitivity analysis, co-innovation and platform-dependency risk checks, a ranked shortlist, and a go/no-go recommendation memo. Covers B2B tech alliances and B2C brand and creator partnerships. Use whenever the user mentions alliance prioritization, partnership ranking, partner shortlisting, or asks which of several named partners deserves investment, even if they never say prioritization. Portfolio-level comparison only. Do NOT use for modeling one partner's P&L - use mbfinotti/partnerships-skills@partner-economics instead.

mbfinotti

agentix-ceo

Manage your team — create roles, assign tasks, spawn workers, and monitor progress

agentix-cloud

extension-authorization

Authorization system with role-based access control. Must-have for all apps that manage personal or access-restricted data.

caffeinelabs

extension-oql

Make a canister's data queryable by the Caffeine Data Intelligence agent. Use whenever an app stores structured data (Maps/Lists/arrays of records) that should be answerable in natural language — "top customers", "revenue by region", "active projects". Adds a discoverable `schema()` and a JSON `execute()` query endpoint via the `caffeineai-oql` mops package's `Expose` mixin.

caffeinelabs

ai-music

Generate AI music on RunComfy via the `runcomfy` CLI — a smart router across the music-model catalog. Routes to ElevenLabs AI Music Generation (premium 44.1 kHz stereo vocal tracks, 5 s–5 min, $0.0083/s) and ACE Step / ACE Step 1.5 (StepFun-AI open-weights, tag-driven composition, multilingual lyrics, $0.0002–0.0003/s, ~27× cheaper), plus ACE Step audio-inpaint (regenerate a time range inside an existing track) and ACE Step audio-outpaint (extend a track before or after). Picks the right model for the user's actual intent — premium vocal hook, cheap background music library, multilingual pop song, repair a bad chorus, lengthen a 30 s draft into a 2 min cut — and ships each model's documented prompting patterns plus the minimal `runcomfy run` invoke. Triggers on "generate music", "make a song", "AI music", "background music", "instrumental track", "soundtrack", "jingle", "theme music", "royalty-free music", "compose", "music with lyrics", "extend music", "fix this song", "inpaint music", or any explicit ask to generate or edit music.

genmedia-labs

x-api

An X API alternative and Twitter API alternative on fetcher.sh — pay-per-call in USDC via x402, or prepaid credits with a Bearer key, no OAuth and no developer application. Use when the user wants to search X posts by keyword, hashtag, or advanced operators (from:, to:, since:, until:, min_faves:, filter:), scrape an X/Twitter profile by handle, pull a user's posts, replies, followers, or followings, fetch a single post with its replies or reposters, read an X List's members or posts, check trending topics by country, or search for X accounts by name. Also covers building an X data pipeline, social listening, competitor monitoring, hashtag tracking, or follower export without the official X API's pricing tiers or app-review process.

fetcher-sh

imap-smtp-email

Read and send email via IMAP/SMTP. Check for new/unread messages, fetch content, search mailboxes, mark as read/unread, and send emails with attachments. Works with any IMAP/SMTP server including Gmail, Outlook, 163.com, vip.163.com, 126.com, vip.126.com, 188.com, and vip.188.com.

boomsystel-code

incidentio-cli

Invoke the `incidentio` CLI to drive the incident.io API — incidents, actions, follow-ups, alerts/alert sources/routes, escalations & on-call schedules, catalog (types/entries/resources), custom fields, severities, incident types/roles/statuses/timestamps, status pages (including creating and managing public pages, components, layout, subscribers, templates), workflows, users, teams, API keys, heartbeats, maintenance windows, and settings. Uses the public Bearer API (OpenAPI-generated commands) plus internal dashboard (cookie) commands generated from captured HARs, hand-curated internal endpoints, and a `raw` escape hatch for any un-codified path. Use whenever a task needs incident.io data or actions, such as "list our incidents", "create an incident", "show the on-call schedule", "build or manage a status page", "list status page subscribers", "tune a dashboard setting", or "hit an internal dashboard endpoint".

paymog

alan-review-pr

Review a GitHub pull request using Alan's GitHub MCP tools

supatest-ai

instagram-scraper

Scrape public Instagram data without logging in and without a Meta developer account — profiles, posts, reels, stories, comments, hashtags, locations, and mentions. Use when the user wants to fetch an Instagram profile's follower count, bio, or post count, pull a profile's recent posts or reels, read the comments on a post, find posts under a hashtag or at a location, search for accounts by keyword, track a competitor's Instagram content, vet or discover influencers, export engagement metrics, monitor a brand's mentions, or build an Instagram data pipeline. Runs on Apify's Instagram Scraper; needs a free Apify account (API token), which this skill will help set up on first use.

skillify-sh

instagram-scraper

jeniok

acomo

プラットフォーム利用者（acomo 上でワークフローモデルを使って開発する開発者）向け。 acomo CLI および公開 API の標準的な使い方（モデル取得・プロセス操作・認証）を案内する。 acomo 本体の内部実装は対象外。 acomo CLI を使うとき、ワークフローやプロセスの操作・モデル定義の確認を行うときに参照する。

progress-all

safe-action-middleware