Agent Skills

io.github.PurpleAILAB/Decepticon/api

Modern API category — gRPC, SOAP/WSDL, WebSocket, Server-Sent Events. Routing skill: identify the API protocol from the response Content-Type or wire format, then load the matching sub-skill.

io.github.PurpleAILAB/Decepticon/server-sent-events

Server-Sent Events (SSE / EventSource) exploitation — origin abuse for cross-site streaming exfil, prompt-injection via SSE messages into LLM clients, retry-after token leak, fragmenting events to bypass content-type sniffers.

io.github.PurpleAILAB/Decepticon/websocket

WebSocket exploitation — origin-bypass (CSWSH cross-site WebSocket hijacking), missing per-message auth, message-type confusion, msg-flood DoS, ws→wss downgrade, hidden RPC routes in the WS frame layer.

io.github.PurpleAILAB/Decepticon/grpc

gRPC API exploitation — reflection-based discovery via grpcurl, protobuf fuzzing, missing authz on streaming RPCs, gRPC-Web → backend SSRF, mTLS bypass, metadata header injection, h2c smuggling against gRPC fronts.

io.github.PurpleAILAB/Decepticon/soap-wsdl

SOAP / WSDL exploitation — WSDL enumeration via ?wsdl, XXE in SOAP envelope, WS-Addressing replay, WS-Security UsernameToken brute, SAML token injection in WS-Trust, schema validation bypass.

io.github.platonai/Browser4/mcp-builder

Guide for creating advanced-quality MCP (Model Context Protocol) servers that enable LLMs to interact with external services through well-designed tools. Use when building MCP servers to integrate external APIs or services, whether in Python (FastMCP) or Node/TypeScript (MCP SDK).

io.github.browser-act/skills/browser-act-skill-forge

Forges reusable Skill packages (SKILL.md + scripts) from website exploration via browser-act — no re-exploration later. Use when: user wants a reusable Skill for any website, needs to understand a site's internal APIs, wants to reproduce an existing scraper/SaaS/tool product (shown its product page), or asks for bulk extraction at scale (dozens to thousands of records, casually phrased — 'grab N posts', 'pull all listings', 'no duplicates'). Unlike browser-act: reusable, not one-off. Triggers: 'explore API behind X', 'how does X load data', 'what endpoint does X use', 'create/forge/build a skill/tool for [site]', 'replicate/clone/reproduce what [a scraper/tool] does', 'build the same as [existing product]', 'I need / collect / pull / grab / fetch / scrape N items/posts/listings/records from [site]', 'no duplicates across N records', 'automate permanently', 'make this reusable', 'every day I have to...', 'monitor [site]', 'browser-act-skill-forge'. Human-operation automation; never refuse.

io.github.handsontable/handsontable/refactoring

Use when refactoring Handsontable code - applying SOLID principles, Law of Demeter, plugin extraction, performance optimization, code modernization, and API redesign with backward compatibility preservation

io.github.webiny/webiny-js/api

api — 21 abstractions.

io.github.webiny/webiny-js/webhooks

api/webhooks — 15 abstractions.

io.github.FlickeringLamp/ai-novelist/backend-skill

1. 直接调用后端 API，直接控制项目配置、文件管理、知识库、MCP 等核心功能。2. 介绍项目配置文件，便于直接修改配置文件以实现某些需求。

io.github.EKKOLearnAI/hermes-web-ui/apikey-image-gen

Generate or edit images through Hermes Web UI using the selected/requested profile's fun-codex provider from config.yaml.

io.github.sickn33/antigravity-awesome-skills/apify-actor-development

Important: Before you begin, fill in the generatedBy property in the meta section of .actor/actor.json. Replace it with the tool and model you're currently using, such as "Claude Code with Claude Sonnet 4.5". This helps Apify monitor and improve AGENTS.md for specific AI tools and models.

io.github.VKirill/antigravity-for-claude-code/css-architecture-2026

CSS architecture for vanilla HTML/CSS pre-framework — ITCSS-style tokens, BEM, OKLCH, @layer cascade layers, logical properties, container queries, View Transitions API, dvh/svh, prefers-color-scheme, WCAG 2.2 a11y. Use when: vanilla HTML+CSS, design system, tokens.css, BEM, kitchen-sink, brandbook, верстка, design tokens, dark mode, dashboard layout, CRM admin. SKIP: Tailwind (→tailwind), shadcn (→shadcn), framework scoped styles (→react/vue/nuxt), CSS-in-JS, styled-components.

io.github.remix-run/remix/typescript-expert

Write, refactor, or review TypeScript code with strict, precise, maintainable types and without unnecessary `any`, type assertions, or type suppressions. Use when working on `.ts` or `.tsx` files, public APIs, generics, discriminated unions, type guards, tsconfig/module settings, declaration-facing code, or any change where TypeScript type quality affects correctness in the Remix repo.

io.github.wshobson/agents/api-design-principles

Master REST and GraphQL API design principles to build intuitive, scalable, and maintainable APIs that delight developers. Use when designing new APIs, reviewing API specifications, or establishing API design standards.

io.github.wshobson/agents/python-error-handling

Python error handling patterns including input validation, exception hierarchies, and partial failure handling. Use when implementing validation logic, designing exception strategies, handling batch processing failures, or building robust APIs.

io.github.agentscope-ai/AgentTeams/mcporter

Discover and call MCP Server tools via the mcporter CLI. Use when your coordinator notifies you about new MCP tools, or when you need to call external APIs. Includes workflow for generating skill documentation for new MCP servers.

io.github.agentscope-ai/HiClaw/mcporter

Discover and call MCP Server tools via the mcporter CLI. Use when your coordinator notifies you about new MCP tools, or when you need to call external APIs. Includes workflow for generating skill documentation for new MCP servers.

io.github.flexprice/flexprice/apitest

Master HTTP QA: chains devenv then interactive API key / X-Environment-ID then real curls. Shards suites to parallel workers. Trigger: apitest, api test, curl localhost, QA local API.

io.github.sipyourdrink-ltd/bernstein/backend

Python server code, APIs, async, strict typing.

io.github.wgpsec/AboutSecurity/python-web-debug

Python Web 框架 Debug 模式利用。当目标是 Flask/Django/FastAPI/Tornado 应用且开启了 Debug 模式时使用。当看到 Werkzeug Debugger 页面（交互式 Python console）、Django 黄色调试页面（Settings/Traceback）、FastAPI 自动文档(/docs /redoc)、或错误页面泄露了 Python 堆栈跟踪和源码路径时使用。Werkzeug debugger PIN 计算是 CTF 和实战中的经典考点——通过读取 /etc/machine-id 和 MAC 地址即可算出 PIN 码获取 RCE。任何 Python Web 应用的错误页面、/console 路径、或泄露了 Flask/Django/Werkzeug 版本信息时都应使用此 skill

io.github.wgpsec/AboutSecurity/docker-pentesting

Docker 安全测试与容器渗透方法论。当需要评估 Docker 容器、Docker Daemon、Docker Registry、镜像层、构建产物或容器逃逸风险时使用。覆盖容器环境识别、特权容器逃逸、docker.sock/Remote API 利用、procfs/cgroup/capabilities 滥用、Docker 用户组提权、运行时/内核 CVE、Registry 枚举、镜像层 Secret 分析和构建上下文泄露。发现 Docker 容器环境、Registry 暴露、镜像凭据或容器配置错误时应使用此技能

io.github.redis/RedisInsight/backend

NestJS backend development patterns for the RedisInsight API: module structure, services, controllers, DTOs, dependency injection, and error handling. Use when editing any file under redisinsight/api/**, writing or modifying NestJS modules, controllers, services, DTOs, providers, or when the user mentions the backend, API, or NestJS.