| act | Run GitHub Actions workflows locally using act. Test CI pipelines, debug jobs, and validate workflows before pushing. | See SKILL.md |
| apple-calendar | Apple Calendar.app integration for macOS. CRUD operations for events, search, and multi-calendar support. | See SKILL.md |
| beancount-analytics | Analyze Beancount ledgers with reusable CLI reports and question-driven queries. Use when user asks for last month/last 12 months reports, spending breakdowns, savings trends, or direct finance questions from a .bean ledger. | See SKILL.md |
| binance-prices | Fetch cryptocurrency prices from Binance public API (no API key required). Use when user asks for BTC, ETH, SOL, or any crypto price from Binance. | See SKILL.md |
| bird | bird is a fast X CLI for tweeting, replying, and reading via X/Twitter GraphQL (cookie auth). Requires bird cli installed (bun add -g @steipete/bird) | See SKILL.md |
| camsnap | Capture frames or clips from RTSP/ONVIF cameras. | See SKILL.md |
| compress-pdf | Shrink a scanned PDF under a size limit by recompressing each full-page image. Use when the user asks to compress a PDF, make a PDF smaller, or get a PDF under a size such as 1 MB or 3 MB. Run /compress-pdf. | See SKILL.md |
| contract-decoder | Decode and reverse-engineer smart contract binaries for security research. Solana: extract instructions, discriminators, PDAs, and error codes from .so files. EVM: decompile bytecode to recover function selectors and storage layout. Use for bug bounty recon, verifying deployed code, or analyzing closed-source contracts. | See SKILL.md |
| conventional-commits | Conventional Commits specification is a lightweight convention on top of commit messages. It provides an easy set of rules for creating an explicit commit history, which makes it easier to write automated tools on top of. This convention dovetails with SemVer, by describing the features, fixes, and breaking changes made in commit messages. | See SKILL.md |
| elevenlabs-voices | High-quality voice synthesis with 18 personas, 32 languages, sound effects, batch processing, and voice design using ElevenLabs API. | See SKILL.md |
| evm-contract-audit | Audits EVM/Solidity smart contracts for security vulnerabilities. Covers reentrancy, access control, flash loan exploits, upgrade issues, oracle manipulation, signature attacks, and more. Learned from EVMbench (120 real Code4rena vulnerabilities across 40 production codebases). | See SKILL.md |
| git-worktrees | Manage plain Git worktree feature branches without issue linking. Create a feature branch worktree, develop in isolation, push, and open a PR with commit-based changes summary. | See SKILL.md |
| github | Interact with GitHub using the gh CLI. Use gh issue, gh pr, gh run, and gh api for issues, PRs, CI runs, and advanced queries. | See SKILL.md |
| github-issue-worktree | Manage Git worktrees for isolated development environments per GitHub issue. Use gh issue develop to register linked branches and git worktree for isolated directories. Use it when the user explicity ask to work in a given github issue. | See SKILL.md |
| github-secrets | Manage GitHub repository secrets via the GitHub API. Supports listing, adding, updating, and deleting repository and organization secrets. Use when user needs to manage GitHub Actions secrets, environment variables, or repository-level secrets securely. | See SKILL.md |
| intelbras | Monitor and control Intelbras alarm systems and cameras. Supports AMT series, Intelbras IFR alarms with HTTP API. Get status, arm/disarm, and check camera streams. | See SKILL.md |
| kokoro-tts | High quality offline text-to-speech with Kokoro-82M running on the Apple Silicon GPU via MLX. 54 voices, 9 languages, Apache-2.0, no API key and no cost. Use when asked to speak, narrate, read aloud, or generate natural sounding TTS audio, and when macos-say voices sound too robotic. | See SKILL.md |
| macos-say | Free offline text-to-speech on macOS with the built-in say command. Speak text aloud, narrate a file, or render speech to wav/m4a/aiff using system voices. No API key, no network, no cost. Use when asked to speak, read aloud, narrate, voice, or generate TTS audio. | See SKILL.md |
| openai-whisper | Local speech-to-text with the Whisper CLI (no API key). | See SKILL.md |
| passbox | Read secrets from passbox, inject them into a child process, and stop Touch ID prompts in an unattended job using injection at launch or a scoped grant token. Use when a script, daemon or agent needs a credential, when repeated fingerprint prompts are blocking something long-running, or when working on the passbox store itself. | See SKILL.md |
| qmd | Fast local search for markdown files, notes, and docs using qmd CLI. Combines BM25 full-text search, vector semantic search, and LLM reranking — all running locally. No API keys needed. | See SKILL.md |
| skill-lint | Lint and auto-fix skill folders for metadata, naming consistency, path placeholder consistency, and optional agents/openai.yaml presence. | See SKILL.md |
| solana-best-practices | Reviews Solana/Anchor programs for development best practices. Use when writing, reviewing, improving or auditing Solana smart contracts. 31 vulnerability patterns with 4 real-world case studies. | See SKILL.md |
| solana-dev | End-to-end Solana development playbook (Jan 2026). Prefer Solana Foundation framework-kit (@solana/client + @solana/react-hooks) for React/Next.js UI. Prefer @solana/kit for all new client/RPC/transaction code. When legacy dependencies require web3.js, isolate it behind @solana/web3-compat (or @solana/web3.js as a true legacy fallback). Covers wallet-standard-first connection (incl. ConnectorKit), Anchor/Pinocchio programs, Codama-based client generation, LiteSVM/Mollusk/Surfpool testing, and security checklists. | See SKILL.md |
| solana-security-audit | Comprehensive Solana smart contract security auditor. Covers 65+ attack vectors across Anchor, native Rust, and Pinocchio: sealevel attacks, arithmetic safety, CPI exploits, oracle manipulation, Token-2022 extension risks, donation and forced-balance accounting DoS, asymmetric paired accounting, loss-blind refreshes, JIT deposit sniping, exposure limits on the wrong base or grouping, multi-asset denomination collapse, durable-nonce replay on admin instructions, the on-chain/off-chain trust boundary (forged events, CPI log spoofing, unauthenticated webhooks, sponsored fee payers, keeper keys), upgrade authority, on-chain randomness, and real-world case studies through 2026 (Loopscale, DeFiTuna, Drift). | See SKILL.md |
| things3 | Manage Things 3 via the things CLI on macOS (add/update projects+todos via URL scheme; read/search/list from the local Things database). Use when a user asks to add a task to Things, list inbox/today/upcoming, search tasks, or inspect projects/areas/tags. | See SKILL.md |
| tmux | Remote-control tmux sessions for interactive CLIs by sending keystrokes and scraping pane output. | See SKILL.md |
| ui-screenshot | Capture a PNG screenshot of any URL with a headless Chromium-family browser over CDP (Brave preferred, no Playwright needed), with phone viewports, browser language lists and a layout check. Use it whenever the user asks you to look at, check or visually verify a page or a frontend change, test it on mobile, or test a language redirect. Output PNG goes to /tmp/ui-shot.png by default; read it back with the Read tool. | See SKILL.md |
| x-twitter-brave | Read and search X/Twitter using Brave browser automation with an authenticated local profile. | See SKILL.md |
| x-twitter-chrome | Read and search X/Twitter using Chrome browser automation with an authenticated local profile. | See SKILL.md |