Security-reviewed skills & MCP servers

Comprehensive UI/UX design intelligence skill for AI coding assistants. Injects structured design tokens, color theory, typography scales, accessibility guidelines, and component patterns into Claude Code, Cursor, and Windsurf.

A one-file Clean Code playbook (Robert C. Martin's rules on naming, functions, comments, errors, tests and classes) that AI coding agents follow when writing, reviewing or refactoring code.

Anthropic's financial-analysis plugin: 13 skills and 7 slash commands for DCF, comps, LBO and 3-statement models in Excel, spreadsheet audits and pitch-deck checks.

Microsoft's official skill that teaches coding agents to translate text with the Azure AI Translator Python SDK: translate, detect language, transliterate and look up dictionary entries.

pp-movie-goat skill: TMDb movie and TV search with OMDb ratings, where-to-stream checks, filmographies and a local watchlist via a CLI.

OpenClaw's tmux skill: lets an AI agent list tmux sessions, read pane output, send keys and wait for prompts in interactive CLIs.

Anthropic's data-visualization skill: pick the right chart and write clean, accessible Python charts with matplotlib, seaborn and plotly.

Community skill that teaches an agent to analyse a project for vulnerabilities (OWASP Top 10:2025, supply chain, attack surface, risk ranking) and ships a Python script that scans a folder.

Instruction-only SKILL.md that plans weekly workouts, applies progressive overload and deloads, reviews training logs, and refers out for medical issues.

fal.ai's official fal-recipes skill: restore and clean up photos (deblur, denoise, dehaze, fix faces, restore scans) through the genmedia CLI.

HubSpot's official skills that teach AI agents to look up, update and report on CRM records with the hubspot agent CLI.

claude-reflect: a self-learning skill and plugin that captures your corrections and turns them into CLAUDE.md / AGENTS.md rules after review.

Anthropic's review-contract skill: check a contract against your playbook, flag GREEN/YELLOW/RED clauses and draft ready-to-insert redlines.

pp-steam-web skill: audit your Steam library and backlog, compare friends' playtime and find easy achievements via the Steam Web API CLI.

OpenAI's imagegen skill: generate or edit raster images (photos, mockups, sprites, cutouts) with GPT Image models via a bundled Python CLI.

Anthropic's productivity plugin: a TASKS.md task list, two-tier workplace memory and a local dashboard so the agent works like a personal assistant.

otterai-cli skill: lets an AI agent list, search, download and manage your Otter.ai meeting transcripts with the unofficial otter CLI.

Community skill with design patterns for agents that plan and act on their own: ReAct, plan-execute, reflection, guardrails, cost control and durable execution, with a long list of failure modes.

A large open-source toolkit of agent definitions, slash commands, rules, hooks and skills for coding agents. Built for Claude Code; it also has a native Antigravity installer that copies rules, workflows, skills and agents into .agents/.

Neo4j's skill collection for graph databases: Cypher queries, graph modeling, imports, drivers, GraphRAG, vector indexes, GDS and Aura provisioning.

Community skill with a short procedure for handling CI/CD secrets safely: Vault, cloud secret managers, GitHub Actions, workload identity and rotation.

Snyk's container-security skill: scan Docker images for OS and app vulnerabilities via the Snyk MCP server and fix Dockerfiles.

Official DuckDB skills: query files and databases with the duckdb CLI, read CSV/Parquet/JSON, search DuckDB docs and install extensions.

Official Pollinations skill for the polli CLI: generate images, text, audio, video and 3D, transcribe speech and check your Pollen balance.

Community skill that gives an agent a simplicity-first method for architecture decisions: ask context questions, pick patterns with decision trees, and record the choice as an ADR.

Community skill with patterns and a list of known pitfalls for deploying Next.js apps to Vercel: environment variables, edge vs serverless, previews, domains and caching.

Community skill that fetches a YouTube video's caption transcript with the youtube-transcript-api Python library and has the agent write a long, structured summary.

Community skill that makes an agent work test-first: one failing behavioural test, minimal code to pass, then refactor, with a separate guide on mock anti-patterns.

OpenClaw's one-file mcporter skill: lets an AI agent list, configure, authenticate and call MCP servers from the shell through the mcporter CLI.

Community skill that gives an agent a command reference for the Metasploit penetration-testing framework. It is an offensive-security skill: the upstream file is marked risk: offensive and meant for authorised assessments and lab use only.

Cloudflare's official wrangler skill: tells an AI agent how to deploy, configure and debug existing Wrangler-based Workers projects using current Cloudflare docs.

GitHub's own MCP server: lets an agent read repositories and manage issues, pull requests, Actions runs and security alerts through your GitHub account, as a hosted remote server or a local Docker image.

Community skill that gives an agent a measure-first workflow for slow apps: baseline, find the bottleneck, fix one anti-pattern, re-measure, and guard with a budget.

Vercel's find-skills skill: your AI agent searches the open skills ecosystem with npx skills find, vets results and installs the one you pick.

Microsoft's playwright-cli skill: an AI agent drives a real browser with short shell commands to test pages, mock requests and write Playwright tests.

OpenClaw's sag skill: an AI agent speaks text aloud or saves it as audio through ElevenLabs, using the say-style sag CLI.

Community skill that gives an agent a framework for content planning: pillars and topic clusters, searchable vs shareable content, keyword research by buyer stage and a weighted scoring sheet for ideas.

Community skill with a long reference guide for planning and tuning paid campaigns on Google, Meta, LinkedIn, X and TikTok; it is advice text, it does not connect to any ad account.

OpenClaw's OpenHue skill: lets an agent control Philips Hue lights, rooms and scenes through a Hue Bridge with the openhue CLI.

Vercel Labs' agent-browser skill: a native Rust CLI that lets AI agents drive Chrome via CDP with accessibility snapshots and @eN element refs.

Anthropic's official algorithmic-art skill: a written algorithmic philosophy, then a self-contained p5.js viewer with seeded randomness, parameter sliders and seed navigation.

Skill from the UI UX Pro Max repo for designing social, ad, hero and print banners in HTML/CSS with several art directions.

Anthropic's official skill that applies a fixed brand palette and Poppins/Lora typography to slides, docs and other artifacts.

Official Browser Use skill: lets AI agents control your local Chrome (or a Browser Use Cloud browser) over CDP through the browser-use CLI.

OpenClaw's gog skill: list, create and update Google Calendar events (plus Gmail, Drive, Sheets, Docs) through the gog command-line tool.

Anthropic's official canvas-design skill: turns a poster or art request into a written design philosophy, then a one-page PNG or PDF, with 29 bundled font families.

Instruction-only skill that makes your agent build HTML design artifacts (landing pages, decks, prototypes, animations) with set design rules and starter files.

Comfy-Org's official comfy skills: teach your agent to drive ComfyUI (local or Comfy Cloud) through comfy-cli to make images, video, audio and 3D.

Superpowers' requesting-code-review skill: the agent sends a git diff to a reviewer subagent and gets Critical/Important/Minor findings and a verdict.

Design token skill from the UI UX Pro Max repo: three-layer tokens, component specs, Tailwind integration and token-based HTML slides.

Corey Haines' emails skill: plans and writes email sequences, drip campaigns and lifecycle emails with timing, subject lines and copy rules.

Figma's implement-design skill for Codex: turns Figma frames into production code with 1:1 visual fidelity through the Figma MCP server.

Anthropic's official frontend-design skill: guidance for distinctive, intentional UI design, typography and copy that avoids templated AI defaults.

K-Dense's research-grants skill: helps researchers plan, check and critique NSF, NIH, DOE, DARPA and Taiwan NSTC proposals against the actual call.

Skill from the UI UX Pro Max repo for strategic HTML presentations with Chart.js, design tokens, layout patterns and copy formulas.

Paul Bakaus's Impeccable design skill: one /impeccable skill with 24 design commands, live browser iteration and a 59-rule detector for AI-generated frontend patterns.

iOS Simulator skill by Conor Luddy: Python scripts for Xcode builds, accessibility-based simulator navigation and device management.

Mobile-first design rules for iOS and Android apps (React Native, Flutter, native) from vudovn's AG Kit: touch targets, platform conventions, performance, plus a read-only audit script.

OpenAI's frontend-skill for Codex: art-direction rules for landing pages and app UI. Removed from openai/skills in April 2026; still installable from history.

Instruction-only skill for deciding whether to build SEO pages at scale from templates and data, and for designing the page system if the answer is yes. It scores feasibility first and says to stop below 50.

Remotion's official agent skills: a router SKILL.md plus 11 bundled guides for building, previewing and rendering videos in React with Remotion.

Apollo GraphQL's rust-best-practices skill: makes your agent write and review Rust by Apollo's handbook (ownership, errors, Clippy, tests, generics).

Instruction-only skill for deciding whether structured data is justified on a page and then writing valid JSON-LD for it. It scores eligibility first and tells the agent to stop when markup would be unsupported or misleading.

Instruction-only skill for diagnosing crawlability, indexation and on-page SEO problems: it asks for scope first, then reports evidence-backed findings with severity and confidence. It does not crawl or connect to any account.

Short principles guide to how search engines judge pages (E-E-A-T, Core Web Vitals, technical SEO, content, schema, AI-assisted content), plus a small local Python script that flags missing titles, descriptions, Open Graph tags, extra H1s and image alt text in HTML, JSX and TSX files.

Official shadcn/ui skill: project-aware rules for adding, searching, composing and styling shadcn components via the shadcn CLI.

Slack's official skills plugin: Slack MCP server plus skills for messaging, search, Web API, Slack CLI, Block Kit and building Slack apps.

Superdesign agent skill: lets a coding agent create UI, slide and graphic drafts on the superdesign.dev canvas through the @superdesign/cli command line tool.

Anthropic's task-management skill: the agent keeps your to-dos in a plain TASKS.md file with Active, Waiting On, Someday and Done sections.

Open-source agent skill (design-taste-frontend) that gives coding agents an art direction, real pictures and a browser check so landing pages look less generic.

Tavily's official tavily-search skill: web search with LLM-optimized snippets, domain filters and time ranges via the tvly CLI.

Anthropic's doc-coauthoring skill: a three-stage workflow in which the agent interviews you, drafts a spec or design doc section by section, then tests it on a fresh reader.

Anthropic skill with 10 preset color and font themes for slides, docs, reports and landing pages, plus custom theme generation.

Companion skill from the UI UX Pro Max repo for shadcn/ui components, Tailwind CSS styling, dark mode, theming and canvas visuals.

Addy Osmani's WCAG 2.2 accessibility skill: audit workflow, code patterns, testing checklist and issues ranked by impact.

Anthropic skill that scaffolds a React, TypeScript, Tailwind and shadcn/ui project and bundles it into one self-contained HTML file.

Vercel's review skill: fetches Vercel's Web Interface Guidelines at run time, checks the files you name and lists violations as file:line findings.

Unofficial Python MCP server by Andrew Lo (alohc) that lets an AI assistant generate, animate and extend short Google Veo video clips with your Gemini API key and save them as local MP4 files.

Unofficial MCP server by Eric Pheterson that lets AI assistants search Apple Music, edit your library and playlists, and control playback through Music.app, Safari, Chrome or the Apple Music API.

Portainer's MCP server (now deprecated upstream): lets AI agents inspect environments and manage Docker, Kubernetes and GitOps stacks through the Portainer API.

Official MCP reference server for reading, writing, editing, moving and searching files inside directories you allow.

DigitalOcean's open-source MCP server: manage Droplets, App Platform, databases, DNS, Kubernetes and more from an AI agent.

Archived MCP reference server for running SQL against a SQLite file, inspecting tables and collecting insights in a memo.

DeepWiki MCP server from Cognition (Devin): a free hosted endpoint with three tools to read and ask questions about public GitHub repositories' generated documentation. No install, no API key.

Figma's official MCP server: gives AI coding agents design context from Figma frames, variables and Code Connect; remote server can also write to the canvas.