Security guidance and vulnerability review for codebases, APIs, services, CLI tools, libraries, and daemons. Use for security questions, focused reviews, vulnerability research, security audits, or pen tests. Run the complete workflow only for explicit codebase audit or pen-test requests, full/comprehensive/end-to-end reviews, or requested report artifacts.
quiche draft GitHub release automation from a release commit hash or existing tag. Use when creating draft releases for the quiche crate from a quiche/Cargo.toml version bump.
13k58d agoReviewMountCreate a free account to mount
Use for creating, modifying, moving, or reviewing React frontend code anywhere in packages/*, including Workshop pages, gatekeeper management apps, shared UI, components, hooks, forms, interactions, styling, accessibility, and frontend tests.
Steady6 mentions in 2 weeks
8 projects use a version of this
12k54d agoReviewMountCreate a free account to mount
Guides implementation of Gatekeeper Workers that bridge Gadgets to external services. Covers auth, capability-based API design, approval queue integration, action kinds and auto-approval verdicts, caching, and action simulation. Load when creating, modifying, or reviewing the implementation of a gatekeeper.
12k54d agoReviewMountCreate a free account to mount
Control headless Chrome via Cloudflare Browser Rendering CDP WebSocket. Use for screenshots, page navigation, scraping, and video capture when browser automation is needed in a Cloudflare Workers environment. Requires CDP_SECRET env var and cdpUrl configured in browser.profiles.
10k9mo agoReviewMountCreate a free account to mount
capnweb RPC patterns for this repo, with a heavy focus on stub lifecycle and disposal. Load when touching anything that crosses the Durable Object ↔ computerd boundary: packages/rpc, packages/computer, the computerd client, or the Durable Object server. Triggers include "capnweb", "RpcTarget", "stub", "RPC wire", "promise pipelining", "stub disposal", "RpcPromise".
Steady5 mentions in 2 weeks
No other project uses it yet
9.9k3mo agoReviewMountCreate a free account to mount
Index of Cloudflare-platform skills relevant to this repo. Load when working on anything that touches Workers, Durable Objects, wrangler, the sandbox SDK, the agents SDK, or other Cloudflare platform surface. Triggers include "Cloudflare", "Workers", "Durable Object", "wrangler", "KV", "R2", "D1", "Vectorize", "Containers", "sandbox".
Debug computerd in real-FUSE mode end-to-end without workerd, vitest-pool-workers, or wrangler in the loop. Boot the linux-x64 binary in a privileged docker container, drive its capnweb /api endpoint from Node, simulate DO-side sync from a SQLiteTestStorage, and isolate FUSE-related deadlocks. Load when a real-FUSE bug reproduces locally but unit tests pass, when the harness vitest tests hang against a real container, or when you need to attribute a wedge to FUSE vs sync vs exec.
Steady5 mentions in 2 weeks
9.9k3mo agoReviewMountCreate a free account to mount
Style guidance for the written word. Use when asked to write code comments, commit messages, pull requests, READMEs, or documentation. Triggers might be phrases like "write a commit", "document this", or "add a README".
Steady5 mentions in 2 weeks
14 projects use a version of this
9.9k3mo agoReviewMountCreate a free account to mount
Describes how to write pull/merge requests. Use when asked to write or edit a pull request or merge request description. This skill is not relevant to commit messages.
Steady5 mentions in 2 weeks
15 projects use a version of this
9.9k3mo agoReviewMountCreate a free account to mount
Drives development with tests. Use when implementing any logic, fixing any bug, or changing any behavior. Use when you need to prove that code works, when a bug report arrives, or when you're about to modify existing functionality.
How exec works in this workspace. The command is the source of an ECMAScript module, evaluated in a fresh Dynamic Worker, not a shell command. Read this before running code, and when a run fails with "Disallowed operation called within global scope" or returns nothing.
Steady5 mentions in 2 weeks
4 projects use a version of this
9.9k3mo agoReviewMountCreate a free account to mount
How exec works in this workspace. Commands run in bash in a real Linux container, with Node.js, git and network access, and the workspace is synced in and out around each call. Read this before running commands, installing packages, or debugging files that don't show up where you expect.
Steady5 mentions in 2 weeks
4 projects use a version of this
9.9k3mo agoReviewMountCreate a free account to mount
A sample skill shipped with the Worker. Read it to see how files bundled with computerBundle() reach the workspace, or run its script to check the shell works.
Steady5 mentions in 2 weeks
7 projects use a version of this
9.9k3mo agoReviewMountCreate a free account to mount
How exec works in this workspace. Commands run in just-bash, a bash interpreter inside a Dynamic Worker, not on a Linux machine. Read this before running a command, and when a command is "not found" or behaves differently from real bash.
Steady5 mentions in 2 weeks
4 projects use a version of this
9.9k3mo agoReviewMountCreate a free account to mount
How to write, change and check Gardener tasks (.gardener/tasks/*/TASK.md), the AI maintenance tasks this repository runs from GitHub Actions. Use before creating or editing anything under .gardener/.
Steady5 mentions in 2 weeks
1 project uses a version of this
9.9k3mo agoReviewMountCreate a free account to mount
Migrates Next.js projects to vinext (Vite-based Next.js reimplementation). Load when asked to migrate, convert, or switch from Next.js to vinext. Handles compatibility scanning, package replacement, Vite config generation, ESM conversion, and deployment setup (Cloudflare Workers natively, other platforms via Nitro).
Steady5 mentions in 2 weeks
2 projects use a version of this
9.3k12d agoReviewMountCreate a free account to mount
Opt-in workflow for triaging one GitHub issue without fixing it. Invoked only via `/triage <github-issue-url>` (`$triage` in Codex). Establishes live state, reproduces with our own fixtures, probes real Next.js for parity, classifies the issue, and drafts the issue reply and next action. Hands valid bugs off to the fix step.
Mandatory rules for running bazel tests during development. Load this skill before running any bazel test command, especially when validating fixes or verifying regression tests. Prevents false confidence from cached results, filter flags that silently match nothing, and partial test runs that miss breakage.
9.1k8mo agoReviewMountCreate a free account to mount
Commit categorization rules for changelogs and "what's new" summaries. MUST be loaded before categorizing commits in changelog or whats-new commands. Provides the canonical path-based category table used to group commits by area.
9.1k8mo agoReviewMountCreate a free account to mount
A folder with a SKILL.md file: a name, a description of when to use it, and instructions. Claude loads a skill only when the task matches its description.
How do I use one I find here?
Copy the folder into your project's .claude/skills/ directory, or into your own skills folder to use it everywhere.
What do the warnings mean?
We read each file for commands that read secrets, delete things or pipe downloads into a shell, and say so before you copy it. No warning is not a promise that a file is safe.
Which skills worked for people?
Open a skill to see its discussion. Reports from people and their agents are coming.
CloudflareSkill