Tools

Static scanner for security and compliance issues in Terraform, CloudFormation, Kubernetes, Helm, Dockerfiles and CI pipeline configs, with over a thousand built-in policies and hard-coded secret detection. Outputs SARIF, JSON and more. Maintained by Prisma Cloud.

Publication-quality matplotlib plotting skill from a Yale PhD student: bar charts, trends, heatmaps and multi-panel figures with consistent fonts, colors and export settings, plus real plotting scripts from papers published in venues like Nature Machine Intelligence. Needs Python.

Manage database schemas as code: declare the desired schema in SQL, HCL or your ORM and Atlas plans, lints and applies migrations, and can export existing databases as HCL, SQL or Mermaid ER diagrams. Supports PostgreSQL, MySQL and a dozen other databases.

Converts the output of 100+ commands such as dig, ps, ls and ifconfig, plus common file formats, into JSON so agents can parse it reliably with jq or scripts. Also usable as a Python library.

Manages multiple Claude Code, Codex, Gemini and Aider sessions in parallel from one terminal: each task gets its own git worktree, can run in the background, and changes are reviewed before merging. Requires tmux and gh.

Companion skills for Google Stitch: generate UIs from text or images, extract DESIGN.md from code, and turn designs into React or React Native components. From Google Labs but not an officially supported Google product; set up the Stitch MCP first.

Free remote MCP service that turns any GitHub repo or GitHub Pages site into a docs endpoint, so agents can read up-to-date docs and search code on demand and hallucinate fewer APIs. No sign-up or install; self-hosting is also possible.

Spec-driven project management for software: guides brainstorming into a PRD, breaks it into epics and dependent tasks synced as GitHub Issues, answers standup, next-step and blocker questions, and can dispatch several agents to code in parallel. Needs Git, an authenticated gh CLI and a GitHub repo.

Open-source visual traceroute that shows IP geolocation, AS number and carrier for every hop, with continuous MTR probing and JSON output; the full edition can also be deployed as an MCP server.

Design engineer Jakub Krehel's 11 UI skills: targeted fixes for typography, color, layout, accessibility and UI copy, plus full interface reviews, animation teardowns, component state stress tests and multi-variant generation. Works on web project code; installing needs Node.js.

HTTP client CLI that reimplements HTTPie's syntax in Rust with a focus on performance; key-value pairs on the command line are sent as JSON by default, making it quick to debug REST APIs.

Removes backgrounds from images and videos with one AI command: batch whole folders, use a portrait model, refine edges or swap in a solid color, and output transparent MOV or composite video onto a new background. Runs locally; install PyTorch and ffmpeg first. Models download on first run.

Offline speech toolkit for Apple Silicon Macs: CLI text-to-speech (including Chinese and voice cloning) and speech-to-text, for voicing lessons and explainer videos or transcribing lectures and interviews, with data staying local. Needs an M-series Mac and Python 3.10+; MP3 export needs ffmpeg.

Query, modify and convert JSON, YAML, TOML, XML, CSV, HCL, INI and more with one selector syntax, editing config files in place or converting between formats, handy for agents handling structured data in scripts. A single dependency-free binary that works much like jq or yq.

Open-source font editor: fontforge -script runs Python scripts headlessly to batch-edit glyphs, convert between OTF, TTF, UFO and other formats, and generate fonts, for type design and font processing. Homebrew installs the CLI version; install the desktop app for the GUI.

asc CLI for scripting the App Store Connect API: manage builds, TestFlight, metadata, signing and review submissions to automate iOS and macOS releases from the terminal or CI. Ships with a companion agent skill pack. Needs an App Store Connect API key.

Query cloud resources and SaaS APIs live with SQL: plugins map AWS, Azure, GCP, GitHub, Kubernetes and other services to tables you can select from directly, no ETL needed. A single binary with Postgres built in.

Moonshot AI's official terminal coding agent: reads and edits code, runs commands, searches files and fetches web pages, with video input, MCP, plugins, subagents and hooks, plus Zed and JetBrains integration via ACP. Needs a Kimi sign-in or Moonshot API key. Replaces the archived Kimi CLI.

Diffusion model inference in pure C/C++: one sd-cli command runs SD, FLUX, Qwen Image, Wan and more locally to create or edit images and short videos, with Metal acceleration on Mac. No cloud needed; bring your own model weights and use a release binary or build from source.

Trail of Bits skill that audits GitHub Actions workflows wired to AI coding agents (Claude Code Action, Codex, Gemini CLI and others) for prompt injection, env-variable relays, dangerous sandbox settings, wildcard allowlists and other privilege risks.

Trail of Bits static analysis skills: CodeQL for interprocedural taint tracking and data-flow analysis, Semgrep for rule-based scanning, plus parsing and deduplicating SARIF results. Requires CodeQL or Semgrep installed locally.

From Trail of Bits: reviews PRs, commits or diffs from a security angle, tracing history with git blame, estimating blast radius by caller count and checking test coverage gaps, then writes a Markdown review report.

Trail of Bits skill that audits npm, PyPI and Go supply-chain risk: known advisories across direct deps and the whole lockfile tree, deprecated or archived upstreams, npm publisher concentration and install-time scripts. Needs uv; a logged-in gh is recommended.

Turns Peng Sida's public research-writing notes into a skill: revises abstracts, introductions, methods and experiments of ML/CV/NLP papers from a reviewer's view, checks that each claim has experimental evidence, and runs a pre-submission self-check. Pure methodology, no API key.