Operational capabilities for autonomous software agents.

Use this skill when the user explicitly asks to map, document, or onboard into an existing codebase. Trigger for prompts like "map this codebase", "document this architecture", "onboard me to this repo", or "create codebase docs". Do not trigger for routine feature implementation, bug fixes, or narrow code edits unless the user asks for repository-level discovery.

Analyze existing websites and web applications from their actual code, content, and feature set; reorganize their design; remove generic AI and template patterns; humanize editorial copy; and improve the current project directly. Use when an agent must audit, redesign, de-slop, modernize, or technically and editorially improve an existing web project, including information architecture, responsive design, SEO, LLM readability, WCAG 2.2 AA accessibility, Core Web Vitals, and quality assurance, without inventing facts, damaging working logic, or rebuilding unnecessarily.

Build, migrate, debug, package, and release browser extensions using Manifest V3, service workers, offscreen documents, Firefox background pages, WebExtensions APIs, Web Audio, real-time EQ and DSP, storage, permissions, content scripts, cross-browser builds, CRX/XPI packaging, and store requirements. Use for goatEQ, AudioAffinityOptimizer, smartlinks, Git extensions, media controls, and privacy-sensitive browser tooling.

Reference for Claude API and Anthropic SDK development, including models, pricing, parameters, streaming, tool use, MCP, agents, caching, token counting, and migrations. Use whenever a request names Claude or Anthropic, asks to build or debug an Anthropic integration, or needs current Claude model and platform details. Skip when the task explicitly targets another provider.

Prepare Cloudflare Agent Skills and MCP access for coding agents with explicit trust boundaries, read-only defaults, OAuth for interactive use, scoped tokens for CI, and repository-specific capability selection. Use when setting up Cloudflare for Codex, Cursor, GitHub Copilot, Claude Code, OpenCode, Windsurf, or when deciding which Cloudflare services a repository should expose to agents.

Assess and prepare any repository for selectable Cloudflare capabilities and Codacy quality controls, generate provider profiles, and design preview-to-production release gates. Use for cross-repository rollout, repository branch preparation, CI/CD readiness, or correlating GitHub, Cloudflare, Codacy, and error-tracking evidence.

Install, configure, audit, and troubleshoot Codacy Guardrails while keeping local scans, repository rules, Codacy Cloud, MCP, and CI gates consistent. Use for Guardrails setup, rule drift, Windows or WSL limits, MCP startup failures, and safe AI-assisted remediation.

Prepare a repository for Codacy Cloud, Codacy Cloud CLI, client-side analysis, coverage, MCP, Skills, and quality gates with read-only defaults and stack-specific fallbacks. Use when onboarding repositories to Codacy, auditing existing Codacy setup, querying findings, selecting scanners, or designing CI quality and security gates.

Prompt and workflow for generating conventional commit messages using a structured XML format. Guides users to create standardized, descriptive commit messages in line with the Conventional Commits specification, including instructions, examples, and validation.

Inspect and operate the complete Coolify REST API through the mm-skills Coolify MCP, including servers, projects, environments, applications, services, databases, deployments, teams, GitHub Apps, cloud tokens, private-key metadata, Hetzner resources, backups, environment-variable metadata, and system operations. Use when an agent must understand or manage a self-hosted Coolify instance beyond the ten read-only tools provided by Coolify's built-in MCP. The default instance is panel.meyermedia.eu. All returned secret fields are redacted, while deployments, writes, destructive actions, root operations, logs, and sensitive reads remain behind separate server-side gates.

Install, build, configure, refresh, test, and operate the strict read-only Coolify documentation MCP bundled with this skill. Use when a user wants a local Coolify documentation MCP, needs evidence-backed searches over the allowlisted Coolify docs Gist, wants to configure the server in Codex or another MCP client, or needs to audit its closed-world security boundary. Do not use this skill to deploy, mutate Coolify resources, call the Coolify API, execute infrastructure commands, or handle secrets.

Prompt for generating an AGENTS.md file for a repository

Create an Architectural Decision Record (ADR) document for AI-optimized decision documentation.

Create a new implementation plan file for new features, refactoring existing code or upgrading packages, design, architecture or infrastructure.

Create a new specification file for the solution, optimized for Generative AI consumption.

Inspect, migrate, back up, restore, and troubleshoot production PostgreSQL, MariaDB/MySQL, Redis, Prisma, Drizzle, connection pools, schema drift, locks, slow queries, replication, and application database lifecycle. Use across Next.js, Node.js, .NET, hosting, mail, LDAP, invoicing, cloud-drive, and Coolify deployments. Prefer migration-based changes over unrestricted SQL.

Maintain dependencies, security, and quality across polyglot local workspaces containing Next.js, Node.js, pnpm, .NET, NuGet, and Avalonia. Use when an agent must detect projects, migrate npm workspaces to pnpm, enforce a minimum seven-day release age for Node dependencies, update packages, run audits, validate builds and tests, consolidate package versions, analyze configuration or UI assets, configure Renovate or Changesets, or orchestrate safe backups and rollbacks.

Perform a systematic diagnostic scan of an AI workflow across 5 quality dimensions — prompt quality, context efficiency, tool health, architecture fitness, and safety — producing a scored report with prioritized remediation actions.

Clone an authorized website into componentized Next.js or Vite source with Ditto through the hosted REST API or the official Ditto MCP routed by the central mm-skills MCP. Use when an agent needs a deterministic starting point from an existing public design, must submit a clone job, inspect available Ditto MCP tools, or integrate website cloning into an app-builder workflow. Defaults to a single-page Next.js project with Tailwind styling.

Build and maintain a source-backed documentation and knowledge platform across repositories, OpenAPI documents, ADRs, issues, pull requests, releases, runbooks, wikis, architecture diagrams, and generated references. Use for lnxr-docs, Greg wikis, API documentation, docs MCPs, stale-page detection, code-doc drift, onboarding, troubleshooting, and answer generation with precise sources.

Three-layer verification pipeline for AI output. Extracts verifiable claims, finds supporting or contradicting sources via web search, runs adversarial review for hallucination patterns, and produces a structured verification report with source links for human review.

Improve AI application with evaluation-driven development. Define eval criteria, instrument the application, build golden datasets, observe and evaluate application runs, analyze results, and produce a concrete action plan for improvements. ALWAYS USE THIS SKILL when the user asks to set up QA, add tests, add evals, evaluate, benchmark, fix wrong behaviors, improve quality, or do quality assurance for any Python project that calls an LLM model.

Diagnose, analyze, repair, and verify Docker build, Docker Compose, Coolify deployment, and Traefik routing failures. Use for failing Dockerfiles or image builds, Coolify build/deploy logs, unhealthy or restarting containers, "Stopped after reaching restart limit" crash loops, missing post-crash containers, GitHub Actions failures related to container delivery, 404/502/503/504 responses, TLS or domain failures, incorrect Traefik labels, and Docker network problems involving the designated public Coolify network `coolify`.

Guidance for distinctive, intentional visual design when building new UI or reshaping an existing one. Helps with aesthetic direction, typography, and making choices that don't read as templated defaults.

Audit GitHub Actions workflow efficiency and recommend fixes to reduce CI minutes and costs.

Security hardening reviewer for GitHub Actions workflow files (.github/workflows/*.yml). Reasons about the Actions threat model that pattern matchers and general code linters miss — untrusted-input script injection, privileged triggers running fork code, mutable action references, and over-scoped tokens. Use this skill when asked to review, audit, harden, or secure a GitHub Actions workflow, when writing a new workflow, or for any request like "is this workflow safe?", "review my CI for security issues", "why is pull_request_target dangerous here?", "pin my actions", or "lock down GITHUB_TOKEN permissions". Covers script injection via ${{ }} interpolation, pull_request_target / workflow_run privilege escalation, SHA-pinning of third-party actions, least-privilege permissions, GITHUB_ENV/GITHUB_OUTPUT injection, secret exposure, OIDC over long-lived credentials, and self-hosted runner exposure on public repositories.

Inspect, diagnose, deploy, and safely operate Kubernetes and OpenShift workloads, namespaces, deployments, stateful sets, services, ingresses, jobs, secrets metadata, RBAC, network policies, storage, autoscaling, rollouts, Helm releases, events, logs, and cluster capacity. Use with the official containers/kubernetes-mcp-server or kubectl-compatible tooling when a project moves beyond Coolify or requires orchestration.

Design, inspect, synchronize, and safely operate OpenLDAP directories, LDAP users and groups, OAuth 2.0 and OIDC clients, Better Auth, sessions, TOTP, passkeys, role mappings, account lifecycle, and identity integrations. Use for lnxr-ldap-manager, SSO architecture, directory drift, OAuth client registration, session revocation, onboarding, offboarding, password flows, and access reviews.

Inspect, configure, and troubleshoot mail domains, SMTP delivery, IMAP access, mail queues, aliases, mailboxes, quotas, bounces, spam controls, TLS, MX, SPF, DKIM, DMARC, reverse DNS, transactional email, and self-hosted mail clients. Use for lnxr-mail, lunexor-mailtools, PBX notifications, account verification, deliverability incidents, domain onboarding, and controlled mailbox lifecycle operations.

Guide for creating high-quality MCP (Model Context Protocol) servers that enable LLMs to interact with external services through well-designed tools. Use when building MCP servers to integrate external APIs or services, whether in Python (FastMCP) or Node/TypeScript (MCP SDK).

Configure, review, test, and operate the declarative remote-provider registry in the mm-skills MCP router. Use when adding a Streamable HTTP MCP, assigning a namespace, choosing compact or expanded exposure, setting credential environment variables, enforcing read-only or allow policies, troubleshooting initialization, or evaluating whether an external MCP is safe to route.

Design, implement, migrate, validate, document, and release components with @meyermedia/ui across Next.js, React, Tailwind CSS, motion, Radix UI, React Aria, Lexical, icons, themes, layouts, patterns, blocks, domains, and registries. Use for mm-ui, lnxr-mm-ui, SaaS dashboards, Lunexor products, component extraction, design-token governance, accessibility, visual regression, and registry maintenance.

Create optimized multi-stage Dockerfiles for any language or framework

Plan, inspect, validate, and operate IPAM, IPv4 and IPv6 prefixes, BGP sessions, routing policy, WireGuard tunnels, Proxmox SDN, VLAN/VXLAN, DNS and reverse DNS, UFW/nftables firewalls, and network automation. Use for mvnet, Lunexor hosting, Peer4Host, gregIPAM, rack planning, tunnel products, outage diagnosis, allocation conflict detection, and controlled network changes.

Diagnose production incidents using metrics, logs, traces, error tracking, health checks, deployment history, and infrastructure state. Use with Grafana, Prometheus, Loki, OpenTelemetry, Sentry or Bugsink, Uptime Kuma, Coolify, Docker, HTTP, DNS, TLS, SMTP, PostgreSQL, Redis, and related systems. Produces evidence-backed timelines and safe remediation plans before any restart, rollback, or configuration change.

Design, provision, inspect, and troubleshoot Proxmox VE, Proxmox Backup Server, KVM, cloud-init, templates, clusters, storage, networks, snapshots, backups, and hosting-product workflows. Use for KVM shops, VPS lifecycle automation, capacity planning, tenant isolation, provisioning plans, backup validation, migration, and integrations with billing, IPAM, DNS, monitoring, and Coolify.

Design, build, audit, debug, and verify production Progressive Web Apps across frameworks. Use for web app manifests, service workers, offline behavior, installability, update flows, cache strategy, push notifications, background capabilities, iOS or Android PWA behavior, Lighthouse findings, and regressions caused by stale cached assets.

Surgical code refactoring to improve maintainability without changing behavior. Covers extracting functions, renaming variables, breaking down god functions, improving type safety, eliminating code smells, and applying design patterns. Less drastic than repo-rebuilder; use for gradual improvements.

Inventory and govern a large fleet of GitHub, GitLab, Gitea, and Forgejo repositories. Use when classifying repositories, detecting duplicates and forks, finding abandoned projects, comparing implementations, standardizing CI and branch rules, identifying monorepo candidates, mapping shared packages, planning archival, or coordinating changes across many repositories without merging directly to protected branches.

Design, reconcile, and safely operate SaaS billing, subscriptions, usage metering, invoices, taxes, payments, refunds, credits, dunning, collections, affiliates, WHMCS, Invoice Ninja, Stripe, and Paywise integrations. Use for Lunexor hosting products, usage-based billing, overdue invoices, payment reconciliation, invoice documents, customer synchronization, and collection handover workflows.

Guide for configuring and managing GitHub secret scanning, push protection, custom patterns, and secret alert remediation. For pre-commit secret scanning in AI coding agents via the GitHub MCP Server, this skill references the Advanced Security plugin (`advanced-security@copilot-plugins`). Use this skill when enabling secret scanning, setting up push protection, defining custom patterns, triaging alerts, resolving blocked pushes, or when an agent needs to scan code for secrets before committing.

AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when asked to scan code for security vulnerabilities, find bugs, check for SQL injection, XSS, command injection, exposed API keys, hardcoded secrets, insecure dependencies, access control issues, or any request like "is my code secure?", "review for security issues", "audit this codebase", or "check for vulnerabilities". Covers injection flaws, authentication and access control bugs, secrets exposure, weak cryptography, insecure dependencies, and business logic issues across JavaScript, TypeScript, Python, Java, PHP, Go, Ruby, and Rust.

Investigate and remediate production errors, regressions, traces, releases, performance problems, affected users, suspect commits, source maps, environments, and issue groups using Sentry or compatible error tracking. Use with the official Sentry MCP, Bugsink, Next.js, Node.js, .NET, mobile, browser extensions, and deployed services. Emphasizes evidence, release correlation, safe reproduction, and verified fixes.

Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.

Design, inspect, verify, and operate S3-compatible storage, MinIO, local volumes, file platforms, Restic, Borg, Proxmox Backup Server, database dumps, snapshots, retention, replication, restore testing, and disaster recovery. Use for cloud-drive, MariaDBAutobackup, Docker volumes, customer files, application backups, storage incidents, retention planning, and recovery exercises.

Research, design, review, validate, and safely operate Terraform providers, modules, registries, state, plans, workspaces, variables, imports, refactors, HCP Terraform, and Terraform Enterprise. Use for infrastructure-as-code adoption, provider selection, module evaluation, drift review, plan analysis, workspace operations, and migration from manual infrastructure. Integrates with the official HashiCorp Terraform MCP where available.

Full STRIDE-A threat model analysis and incremental update skill for repositories and systems. Supports two modes: (1) Single analysis — full STRIDE-A threat model of a repository, producing architecture overviews, DFD diagrams, STRIDE-A analysis, prioritized findings, and executive assessments. (2) Incremental analysis — takes a previous threat model report as baseline, compares the codebase at the latest (or a given commit), and produces an updated report with change tracking (new, resolved, still-present threats), STRIDE heatmap, findings diff, and an embedded HTML comparison. Only activate when the user explicitly requests a threat model analysis, incremental update, or invokes /threat-model-analyst directly.

Audit an existing React or Next.js application's UI and incrementally extract its reusable primitives, component variants, patterns, themes, content adapters, and CMS layouts into a central UI package without redesigning the application. Use this skill whenever a user asks to centralize UI, create or extend a design system, migrate local components into a shared package, deduplicate Tailwind or Radix components, make an existing frontend themeable, publish a component registry, or preserve an existing design while making it reusable. Prefer existing application implementations and official upstream primitives over inventing new components.

Build, inspect, and maintain Unity IL2CPP mods using MelonLoader, Harmony, C#, Rust FFI bridges, native cdylib plugins, type dumps, generated interop assemblies, runtime configuration, event systems, asset extraction, and compatibility testing. Use for Data Center, Greg framework and mods, UnityExplorer, Il2CppAssemblyFixer, LuaLoader, MelonLoader plugins, and game-version migration.

Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn/ui). Use for complex artifacts requiring state management, routing, or shadcn/ui components - not for simple single-file HTML/JSX artifacts.

This skill enables visual inspection of websites running locally or remotely to identify and fix design issues. Triggers on requests like "review website design", "check the UI", "fix the layout", "find design problems". Detects issues with responsive design, accessibility, visual consistency, and layout breakage, then performs fixes at the source code level.

Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.

Plan, execute, verify, and recover multi-step tasks as bounded autonomous, evidence-driven workflows. Use when Codex or another agent must coordinate multiple tools, files, external systems, quality gates, progress updates, risk decisions, or approval boundaries, especially for research, analysis, coding, artifact generation, and operational work that cannot be completed reliably in one immediate step.