Browse reusable Agent Skills, each with a clear purpose and practical guidance.
Interactive guide to deploy a production-ready WordPress site for international trade businesses. Triggers on "build a trade website", "deploy wordpress trade site", "set up B2B website", or similar requests.
Intelligent code security scanner with hybrid local-cloud detection. Fingerprints packages, runs static behavioral analysis, and consults cloud threat intelligence (enabled by default, can be disabled) for confidence scoring.
This skill should be used when the user wants to bulk-build ArcKit artefacts in parallel rather than running individual /arckit:* commands one at a time. Invoke manually with /arckit:arckit-build when the task sounds like 'kick off a build', 'build everything', 'generate all artefacts', 'run all the commands', 'rebuild this project from scratch', 'resume the build', 'pick up where we left off', 'refresh the artefacts', 'run the recipe', 'build the whole project end-to-end', or 'parallel build', or mentions `--plan`, `--resume`, `--target`, `--refresh`, `--recipe`, or `.arckit/state.json`. The skill orchestrates parallel /arckit:* generation using subagent isolation: reads project state, computes the artefact dependency DAG, dispatches one subagent per target per wave (each subagent invokes a /arckit:* skill in its own context), validates outputs, commits the wave, and persists progress to .arckit/state.json for resumability.
This skill should be used when the user asks about "ISO 27001", "Cyber Essentials", "NCSC principles", "cloud security", "what certifications", "SOC 2", "data protection", "UK GDPR", "security clearance", "PCI DSS", "compliance framework", "CSA STAR", "DSPT", "Technology Code of Practice", "AI Playbook", "what evidence do I need", "security certification", "NHS data", "BPSS", "SC clearance", "DV clearance", "what security do I need", "certification cost", "ISO 22301", or needs guidance on security certifications, compliance requirements, and evidence for G-Cloud submissions.
Check every dependency in a package.json against live CVE databases and security advisories in real time — specifically targeting vulnerabilities disclosed in the last 48 hours, the window that Snyk, Dependabot, and npm audit miss. Use this skill whenever a user mentions checking dependencies for vulnerabilities, wants to audit their package.json, asks about CVEs for their packages, says "are my dependencies safe", "check my packages for security issues", "any new vulnerabilities in my deps", or pastes a package.json and asks about security. Also trigger when a user mentions wanting fresher data than Snyk or Dependabot provides. Returns: which dependencies have brand-new vulnerabilities, severity, what the vulnerability does, whether a patched version exists yet, and a prioritised fix list.
Expose local ports to the internet as public HTTPS URLs using tinyfi.sh SSH tunnels. Use when you need to expose a locally running app, test webhooks, or give TinyFish access to a site that is only hosted locally — tunnel it first, then point TinyFish to the tunneled URL. No signup, no API key, no installation beyond SSH.
Generates idiomatic Cloud Foundation Fabric (CFF) Terraform code using CFF modules. Use when users ask to create GCP resources, use Fabric modules, or generate Terraform code for Google Cloud.
Guides the user step-by-step through the prerequisites for the FAST 0-org-setup stage, supporting both Standard GCP and Google Cloud Dedicated (GCD) environments. Use when a user asks to prepare or run prerequisites for 0-org-setup or bootstrap the FAST landing zone.
Release process guide for Shopify's Hydrogen framework. Covers the full release flow (standard, back-fix, snapshot), manual vs automatic steps, changelog.json updates, h2 upgrade enablement, and release failure recovery. Use when performing or debugging a Hydrogen release. Also activates when someone mentions "release", "release process", "back-fix", "snapit", "changelog.json", "h2 upgrade enablement", "release failure", "version PR", "release PR", or "hydrogen release".
Project-specific triage and design principles for kube2iam, focusing on AWS API limits and local environment support.