Browse the marketplace
Security-reviewed skills, MCP servers, and toolkits for AI agents. Filter by type, price, and delivery, then install any listing with one command. Every listing is scanned before an agent can run it.
Featured
PilotStack
Your agent flies the app — you stay in the cockpit. PilotStack is an MCP server that drives iOS, Android, and web side by side: cheap semantic UI context, deep Flutter introspection, and a human approve/deny gate on every action.
Grill With Docs
A relentless interview to sharpen a plan or design, which also creates docs (ADR's and glossary) as we go.
Grill With Docs
Grilling session that challenges your plan against the existing domain model, sharpens terminology, and updates documentation (CONTEXT.md, ADRs) inline as decisions crystallise. Use when user wants to stress-test a plan against their project's language and documented decisions.
Access Control
Detect missing or incorrect access control — missing modifiers, wrong role checks, privileged function exposure, public initializers, and role-escalation paths. Activate on any function that mutates state, transfers funds, mints tokens, sets admin parameters, upgrades implementations, or pauses/unpauses.
Flutter Build Responsive Layout
Build adaptive layouts using LayoutBuilder, MediaQuery, or Expanded/Flexible widgets to ensure the UI looks elegant across all mobile, tablet, and desktop form factors.
Flutter Animations
>-
Flutter Adaptive Ui
Build, fix, review, and validate adaptive or responsive Flutter UIs for mobile, tablet, desktop, web, large screens, foldables, and mixed input devices. Use when creating breakpoint-driven layouts, responsive navigation, adaptive dialogs/lists/grids, keyboard/mouse/touch behavior, window-size decisions with MediaQuery or LayoutBuilder, or Capability and Policy patterns for platform-specific behav…
Grill Me
A relentless interview that sharpens a plan or design before any work starts — one sharp question at a time, often 40–50 deep, until you (and Claude) actually know what you want.
Lex
Episodic memory and architectural policy for AI agents. Frames, Atlas, and Policy.
Wolfbot Community
Free self-hosted trading bot for Windows & Linux — unify crypto exchanges and MT5 (Forex, Gold, Indices) into one interface, one risk engine, one portfolio. Plus free local AI Live Translate (52 languages) and an MCP AI Agent interface for policy-controlled agent trading. Non-custodial.
Studio
Edite vídeos conversando com o Claude: Nível 1 gratuito (Remotion) e Nível 2 avançado (Higgsfield).
Macos Computer Use Kit
AX-first computer use for AI agents on macOS with optional Jev (TypeSafe System One) semantic guards: calibrated target/input judgments before an irreversible action, decisions kept in code. Accessibility-tree targeting, window-scoped input, clipboard-safe paste, read-back verification. Ships a pip CLI, a pi package and a DeepSeek Harness plugin.
Vuln Audit
按清单系统性排查二进制漏洞模式（vulnerability audit / pwn 预筛）：内存破坏、格式化字符串、整数溢出、命令注入、危险 API 组合。触发：漏洞审计、找漏洞、pwn 攻击面梳理、fuzz 前目标筛选、SRC 静态预筛。是 checklist 知识层——具体命令见 ghidra-core。动手前必须先用 skill 工具加载本 skill 全文并遵守其流程；一切观察/结论用 ledger.py 落账。
Ghidra Core
Ghidra headless 执行底座（execution engine）——rpc_driver/ghidra-rpc 命令、daemon 起停、doctor 环境自检、脚本清单。当需要实际运行任何 Ghidra 命令（import/decompile/disassemble/rename/patch/version-track）、环境排障、或其他逆向 skill 里的操作不知道具体命令时加载。不含分析方法论。动手前必须先用 skill 工具加载本 skill 全文并遵守其流程；一切观察/结论用 ledger.py 落账。
Android Re
Android/APK 逆向（纯 DEX / Java 层，APK reversing）：APK 分诊（结构/签名/Manifest/多 dex 自有类统计/flag 全扫）、反编译与校验点定位（jadx/smali）、adb 动态驱动与真机 oracle、v1 未签名 APK 改写重签。触发：APK/Android/DEX/安卓/逆向 APK/smali/jadx。不分析原生 so——APK 内含 lib/ 的 .so 走 ghidra-static；不做流量分析——抓包/隐信道走 traffic-analysis。动手前必须先用 skill 工具加载本 skill 全文并遵守其流程；一切观察/结论用 ledger.py 落账。
Re Triage
未知二进制的第一步（file triage / sample identification）：判文件类型（PE/ELF/Mach-O/固件/APK）、语言（C/C++/Go/Rust/.NET/Python）、壳（packer detection）、威胁面，决定后续路线（静态深挖/动态/换工具）。触发：新样本、未知 exe/elf/bin/固件、"看看这个文件"、疑似加壳、恶意样本分诊（malware triage）。只做判断和路线决策，不做深挖——要深挖去 ghidra-static。动手前必须先用 skill 工具加载本 skill 全文并遵守其流程；一切观察/结论用 ledger.py 落账。
Re Dynamic
让二进制跑起来观察行为（dynamic analysis）：直接运行（ELF 走 WSL、PE 走本机）、函数级 Oracle（单函数调用+观察输入输出）、Frida 插桩、gdb/qiling 入口指引。触发：静态看不懂/需要验证函数行为/拿到 check 函数要试输入/想"先跑起来看看"。不做静态分析——那是 ghidra-static。动手前必须先用 skill 工具加载本 skill 全文并遵守其流程；一切观察/结论用 ledger.py 落账。
Ghidra Static
对已建立基本认知的二进制做静态深挖（static analysis / reverse engineering）：反编译（decompile）、xref 追数据流、语义标注、patch 二进制、导出交付。触发：反编译某函数、提取算法/flag 逻辑、打补丁、批量导出伪码、CTF 逆向题主体攻坚。前提是已知样本类型——未知样本先走 re-triage。动手前必须先用 skill 工具加载本 skill 全文并遵守其流程；一切观察/结论用 ledger.py 落账。
Traffic Analysis
CTF 流量分析与网络取证（pcap / network forensics）：pcap 分诊、DNS/ICMP/TCP 隐信道与隧道重组（covert channel / tunneling）、USB HID 键鼠抓包还原、WPA/TLS 解密、文件与凭据提取。触发：流量/pcap/抓包/Wireshark/tshark/网络取证/流量包/隐蔽信道/隧道。不做二进制逆向——那是 ghidra-static 系；提取出的文件需逆向时回 re-triage。动手前必须先用 skill 工具加载本 skill 全文并遵守其流程；一切观察/结论用 ledger.py 落账。
Re Unpack
对已确认或疑似加壳的二进制执行脱壳与验证（unpacking / deobfuscation）：UPX/ASPack/Themida/VMProtect/MPRESS，PyInstaller 解包反编译（pyc/decompile），PE/ELF，多层壳。触发：triage 检出壳、熵高、节名 UPX/.aspack/.vmp、导入表异常干净。只做脱壳与脱壳成功验证——脱完回 re-triage 重新分诊，不做内容分析。动手前必须先用 skill 工具加载本 skill 全文并遵守其流程；一切观察/结论用 ledger.py 落账。
After Effects Mcp Vision
MCP server that builds in a live After Effects session and then looks at what it made. 16 tools addressed by stable Item/Layer id, frame capture so an agent can verify its own work instead of trusting the object tree, and a layout engine that writes baked values plus expression rigs. AE 2022+ on macOS and Windows.
Write E2e Cumulocity Cypress Test
Write, update, and verify end-to-end Cypress tests for Cumulocity UI plugins using the cumulocity-cypress package. Use when asked to create or fix e2e tests for a Cumulocity feature or bug, or when e2e tests fail in CI. Covers backend request discovery, intercept/wait patterns, and an autonomous run-analyze-fix verification loop.
Vox Agent
>
Bitflix Mcp Apps Example
Bitflix - MCP Apps Example Application for video, powered by the Bitmovin Player.
App Pricing Localize
Compute localized App Store subscription prices across countries and render a comparison, a single-product report, or a multi-product price matrix. Uses PPP (purchasing-power, World Bank price levels), an optional competitor benchmark (any app you have research data on), and the optional App Masters charm ladder — each in local currency and USD, snapped to real Apple price points. Read-only; to p…
App Pricing Research
Research any App Store app's in-app-purchase / subscription prices across countries, with live USD conversion. Resolves an app by name or numeric App Store id (defaults to ChatGPT), pulls each storefront's real rendered prices, converts via live exchange rates, and prints one table per pricing tier. Use when researching app pricing strategy, comparing subscription prices by country/region, buildi…
App Pricing Apply
Apply a localized subscription pricing matrix (produced by app-pricing-localize) to the Apple App Store and/or Google Play. Reads the matrix .md and, per subscription tier, sets each market's price via the App Store Connect API (scheduled price changes) or the Android Publisher API (regional configs). Dry-run by default; only ever lowers. Use when rolling out per-country/per-region subscription p…
App Release Notes
Set or update the App Store "What's New" (release notes) text for an app version across all its localized locales, using the `asc` CLI. Auto-resolves the editable version, translates the source notes into each active store language, applies per locale, and verifies by reading back — without touching the marketing Description. Use when updating What's New / release notes for an App Store version,…
Skillforge
Skill生成工厂 — 从任意意图，通过七步元认知（搜/分/叠/展/衡/验/成），推导出完整 Skill 架构。
Azure Acr Modeler
Model projected Azure Consumed Revenue (ACR) for a prospective or planned Azure workload, using live Azure retail pricing. Use this whenever the user wants to estimate Azure spend/consumption for a client or workload, project ACR over time (12/36 months), size compute (VMs, App Service) costs, or map projected consumption to Microsoft partner incentive tiers. Trigger on phrases like "model ACR",…
Wt Remove
Remove a git worktree checkout, delete its branch, and close the herdr workspace or tmux window showing it. Resolves the target from a branch name, directory slug, absolute path, or the worktree you are standing in. Use whenever the user wants a worktree gone: "wt remove", "delete this worktree", "close and remove that herdr worktree workspace", "tear down the branch I spun out". This is the only…
Wt Create
Create a git worktree at ~/_wt/<repo>/<branch-slug> and open it on the current multiplexer. A single-pane herdr workspace nested under the workspace you ran it from when inside herdr, a tmux window when inside tmux. Carries uncommitted changes, symlinks .env files, installs deps, copies the path. Use whenever the user wants to spin work out into a worktree, branch, herdr workspace, or tmux tab: "…
Wt Cleanup Loop
Polls for merged PRs and closes the herdr workspaces or tmux windows behind them, on a timer. Args: [tick] [duration], defaults 5m and 3h. Use when the user wants tabs cleaned up as PRs land rather than right now: \"watch and close tabs as PRs merge\", \"wt cleanup-loop\", \"keep sweeping finished worktrees for the next few hours\". Same skill on both multiplexers; there is no herdr-specific vari…
Wt
>-
Wt Clear
One-off sweep: closes every herdr workspace or tmux window whose git branch has a merged or closed GitHub PR, leaving checkouts and branches on disk. Use when the user wants their tabs tidied now that PRs are done: \"wt clear\", \"clear finished worktrees\", \"close the merged PR tabs\", \"clean up finished herdr workspaces\". Same skill on both multiplexers; there is no herdr-specific variant. F…
Creating Glaido Mcp Servers
>-
Sixtyfour
Default for any task involving people or company intelligence. Use whenever you need to investigate, research, or gather structured information about a person, company, or organization — whether it's a quick lookup or a deep investigation. Covers identity resolution, competitive intelligence, due diligence, org chart mapping, relationship mapping, risk signal detection, and answering any question…
Differential Review
>
Code Review
A Claude skill from EonHao/SkillCODER.
Github Issue Triage
>
Add Canary Journey
>
Docker Uv Image Builds
>
Witan Project Tracker
>
Extract Style Profile
>
Witan Task
>
Address Pr Feedback
>
Witan Code
>
Create Ol Github Issue
>