#515 by GitHub stars
Leanmcp/gateway-skills
See your claude code logs in clear details in your dashboard
History
Review weekly changes to SKILL.md before updating. Dates mark the weeks in which we observed each version; checks apply to the recorded commits.
View weekly changes
claude-code-skills/SKILL.md
Week of Oct 26, 2026 · +0 / −0 lines
Before Instructions only → After Instructions only
7a708ce17d05 → 7a708ce17d05
skills/analyze-exports/SKILL.md
Week of Oct 26, 2026 · +0 / −0 lines
Before Local scripts → After Local scripts
7a708ce17d05 → 7a708ce17d05
skills/code-explanation/SKILL.md
Week of Oct 26, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
7a708ce17d05 → 7a708ce17d05
skills/fireworks-inference/SKILL.md
Week of Oct 26, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
7a708ce17d05 → 7a708ce17d05
skills/godot-city-game-3d/SKILL.md
Week of Oct 26, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
7a708ce17d05 → 7a708ce17d05
skills/ios-bootstrap-testflight/SKILL.md
Week of Oct 26, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
7a708ce17d05 → 7a708ce17d05
skills/leanmcp-builder/SKILL.md
Week of Oct 26, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
7a708ce17d05 → 7a708ce17d05
skills/mcp-apps-builder/SKILL.md
Week of Oct 26, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
7a708ce17d05 → 7a708ce17d05
skills/mcp-builder/SKILL.md
Week of Oct 26, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
7a708ce17d05 → 7a708ce17d05
skills/posthog-adblock-bypass/SKILL.md
Week of Oct 26, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
7a708ce17d05 → 7a708ce17d05
skills/publicity-distribution/SKILL.md
Week of Oct 26, 2026 · +0 / −0 lines
Before Instructions only → After Instructions only
7a708ce17d05 → 7a708ce17d05
skills/research-observability/SKILL.md
Week of Oct 26, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
7a708ce17d05 → 7a708ce17d05
skills/research-paper-integrity/SKILL.md
Week of Oct 26, 2026 · +0 / −0 lines
Before Local scripts → After Local scripts
7a708ce17d05 → 7a708ce17d05
skills/security-repro/SKILL.md
Week of Oct 26, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
7a708ce17d05 → 7a708ce17d05
skills/tinker-training-inference/SKILL.md
Week of Oct 26, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
7a708ce17d05 → 7a708ce17d05
skills/translate-explanation/SKILL.md
Week of Oct 26, 2026 · +0 / −0 lines
Before Instructions only → After Instructions only
7a708ce17d05 → 7a708ce17d05
skills/vuln-repro/SKILL.md
Week of Oct 26, 2026 · +0 / −0 lines
Before Network or broad shell → After Network or broad shell
7a708ce17d05 → 7a708ce17d05
2.1kGitHub stars
2stars in 7 days
17skills in this repository
1commit in 30 days
Heat
4.2- Star growth, last 7 daysAhead of 37% of tracked repositories
- Star growth, last 24 hoursAhead of 70% of tracked repositories
- Rank movement, last 7 daysAhead of 45% of tracked repositories
- Commits, last 30 daysAhead of 54% of tracked repositories
- Accounts asking about it through MCP, last 7 daysNot available
- Hot votes this weekAhead of 0% of tracked repositories
Heat never changes the order by stars, and sponsorship never touches it. How heat works
Stars over time
Individual skills in this repository
- claude-code-dev
claude-code-skills - analyze-exports
skills/analyze-exports - code-explanation
skills/code-explanation - fireworks-inference
skills/fireworks-inference - godot-city-game-3d
skills/godot-city-game-3d - ios-bootstrap-testflight
skills/ios-bootstrap-testflight - leanmcp-builder
skills/leanmcp-builder - mcp-apps-builder
skills/mcp-apps-builder - mcp-builder
skills/mcp-builder - posthog-adblock-bypass
skills/posthog-adblock-bypass - publicity-distribution
skills/publicity-distribution - research-observability
skills/research-observability - research-paper-integrity
skills/research-paper-integrity - security-repro
skills/security-repro - tinker-training-inference
skills/tinker-training-inference - translate-explanation
skills/translate-explanation - vuln-repro
skills/vuln-repro
How it works
claude-code-dev
When your agent uses it
How to develop, modify, and extend the Claude Code codebase following its established programming style, patterns, and conventions. Use this skill whenever working on the claude-code source — adding tools, commands, utils, components, types, hooks, services, or fixing bugs. Also use when the user asks about claude-code architecture, coding standards, file organization, or wants to understand how the codebase works. This skill ensures all contributions match the existing codebase style exactly.
What it loads into context
Frontmatter
105 tokensAlways available to the agent
SKILL.md
766 tokensWhen the skill is activated
Reference documents
35,060 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Summary
- Detailed Guides (Resource Files)
Files
01-project-overview.mddoc4,691 bytes02-directory-structure.mddoc9,308 bytes03-import-conventions.mddoc9,571 bytes04-naming-conventions.mddoc11,056 bytes05-typescript-patterns.mddoc12,608 bytes06-commenting-style.mddoc14,827 bytes07-error-handling.mddoc11,512 bytes08-function-patterns.mddoc12,819 bytes09-tool-architecture.mddoc13,919 bytes10-command-architecture.mddoc9,453 bytes11-state-management.mddoc8,939 bytes12-testing-conventions.mddoc5,962 bytes13-formatting-rules.mddoc8,638 bytes14-quick-references.mddoc10,182 bytesREADME.mddoc1,906 bytesSKILL.mdcore3,262 bytesSKILL.mdcore3,262 bytes
Read SKILL.md
# Claude Code Development Style Guide
This skill captures the programming style, patterns, and conventions used in the Claude Code codebase (`@anthropic-ai/claude-code`). Each topic below links to a dedicated deep-dive document with comprehensive examples and rules extracted from the actual source.
## Summary
**Claude Code** is an ESM TypeScript Node.js CLI application using Ink (React for terminals) for its UI, esbuild for transpilation, and Bun internally for feature flags and dead code elimination. Key stack: TypeScript, Zod v4, lodash-es, React/Ink, esbuild.
## Detailed Guides (Resource Files)
Each topic below is covered in depth in its own resource file within this skill's directory. Read the relevant file before working on that area of the codebase.
| # | Topic | File | Summary |
|---|---|---|---|analyze-exports
When your agent uses it
Analyze tau2-bench task export files to identify exactly where and why tasks failed. Map failures to specific conversation rounds, show root causes, check whether relevant documentation was available, and cite sources. Use this skill whenever you need to debug a tau2-bench evaluation, understand why an agent made wrong decisions, identify missing knowledge, or review task performance—especially when context length, eligibility criteria, or policy compliance might be at fault.
What it loads into context
Frontmatter
95 tokensAlways available to the agent
SKILL.md
2,420 tokensWhen the skill is activated
Reference documents
5,236 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Purpose
- Input Format
- Output Format & File Organization
- How to Use This Skill
- Key Definitions
- Example Analysis
- Important Notes
- Troubleshooting
- Script Dependencies
Scripts executed separately
scripts/analyze_failures.pyscripts/parse_export.py
Files
SKILL.mdcore10,322 bytesSKILL.mdcore10,322 bytesreferences/common_failures.mddoc10,473 bytesreferences/export_format.mddoc11,599 bytesscripts/analyze_failures.pyruns9,576 bytesscripts/parse_export.pyruns6,708 bytes
Read SKILL.md
# Analyze Exports Skill
## Purpose
When a tau2-bench task returns reward 0.0 (or fails), the export file contains everything you need to understand why—but it's buried in tool-call summaries and conversation transcripts. This skill systematically analyzes the export to show:
1. **Where it failed** — the exact round (Assistant #X, User #Y) and tool-call sequence
2. **What should have happened** — ground truth from the task explanation
3. **Why it failed** — root cause (missing logic, wrong arguments, bad order, policy misunderstanding)
4. **Was the docs available?** — whether the KB had the answer the agent needed
5. **Evidence** — quotes and citations from both the transcript and source documents
## Input Format
code-explanation
When your agent uses it
Generate a complete, beginner-friendly explanation of an entire code repository as a set of markdown files. Maps the repo structure with `treecap` (installing it if missing), studies the actual source, then writes a `CODE_EXPLANATION/` folder containing an `OVERVIEW.md` plus numbered deep-dive files (01_architecture.md, 02_models.md, ...) that explain how the code is built, what it does, and how the pieces fit together — illustrated with real code excerpts. Use this skill whenever the user wants to understand, document, onboard onto, or get a walkthrough of a codebase: phrases like "explain this repo", "explain the code", "code explanation", "walk me through this codebase", "help me understand how this is built", "document the architecture", or "what does this project do" — even if they don't say the word "skill". Prefer this over ad-hoc summaries whenever the goal is a durable, written explanation of a whole repo.
What it loads into context
Frontmatter
239 tokensAlways available to the agent
SKILL.md
2,120 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Workflow
- How to write the explanations
- Quick checklist
Files
SKILL.mdcore8,658 bytesSKILL.mdcore8,658 bytesSKILL.mdcore8,658 bytes
Read SKILL.md
# Code Explanation
Produce a thorough written explanation of an entire repository so someone new
can understand **what it does, how it is built, and how the pieces fit
together**. The output is a `CODE_EXPLANATION/` folder of markdown files: one
`OVERVIEW.md` and a series of numbered deep-dive documents.
The goal is genuine understanding, not a file inventory. A good explanation
reads like a knowledgeable engineer walking a new teammate through the codebase:
it names the important abstractions, shows real code, and explains *why* things
are shaped the way they are.
## Workflow
fireworks-inference
When your agent uses it
Run inference on Fireworks AI — direct, through the Leanmcp AI Gateway proxy (aigateway.leanmcp.com) for observability, or via LiteLLM / the OpenAI SDK / raw HTTP. Covers the endpoint-and-key matrix for each route, serverless vs dedicated deployments and their cold starts, browsing and filtering the model catalogue, reasoning models that return content:null with the answer in reasoning_content, function calling, concurrency and load testing, and runner scripts where many models share one protocol with a --use-proxy toggle. Use this skill whenever the user mentions Fireworks, FIREWORKS_API_KEY, api.fireworks.ai, fireworks_ai/ model ids, accounts/fireworks/models/..., a Fireworks deployment id, the Leanmcp gateway or LEANMCP_API_KEY, app.leanmcp.com observability, or gpt-oss / kimi / glm / qwen / deepseek served on Fireworks; wants to route LLM calls through a proxy for logging or cost tracking; is debugging empty responses, 404s, scope errors, cold starts, or "the gateway isn't working"; wants to pick a Fireworks model with tool calling; or wants to sweep several models over one benchmark. Reach for it even on vague asks like "why is this model returning nothing" or "set up inference for these models" when Fireworks is in play.
What it loads into context
Frontmatter
289 tokensAlways available to the agent
SKILL.md
1,884 tokensWhen the skill is activated
Reference documents
9,888 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- The route matrix — memorize this
- Start here
- Scripts
- Model ids — three shapes, not interchangeable
- litellm: two things that look like the service is down
- Things that are true and easy to miss
- Related
Scripts executed separately
assets/run_fireworks.shscripts/fw_hammer.pyscripts/fw_models.pyscripts/fw_ready.pyscripts/fw_smoke.py
Files
SKILL.mdcore7,918 bytesSKILL.mdcore7,918 bytesSKILL.mdcore7,918 bytesassets/run_fireworks.shruns6,474 bytesreferences/gateway.mddoc5,075 bytesreferences/load-and-concurrency.mddoc4,722 bytesreferences/models.mddoc5,765 bytesreferences/reasoning-models.mddoc4,585 bytesreferences/reference-implementation.mddoc4,588 bytesreferences/routes.mddoc5,323 bytesreferences/runner-scripts.mddoc5,378 bytesreferences/verification.mddoc4,321 bytesscripts/fw_hammer.pyruns11,669 bytesscripts/fw_models.pyruns8,311 bytesscripts/fw_ready.pyruns6,640 bytesscripts/fw_smoke.pyruns12,266 bytes
Read SKILL.md
# Fireworks inference
Inference on Fireworks is three independent choices, and nearly every confusing
failure is one of them being wrong while you debug another:
```
TRANSPORT ROUTE MODEL
───────── ───── ─────
raw HTTP direct Fireworks serverless
openai SDK × api.fireworks.ai × accounts/fireworks/models/<slug>
litellm Leanmcp gateway dedicated deployment
aigateway.leanmcp.com accounts/<acct>/deployments/<id>
```
godot-city-game-3d
When your agent uses it
Build, run, debug and ship 3D city games in Godot 4 — procedurally generated cities (block grids, districts, weighted building typologies, MultiMesh batching, facade shaders, terrain, day/night, landmarks), first-person controllers, headless verification, Blender-generated .glb assets, rigged character and animation packs, real OpenStreetMap-derived cities, WebAssembly export, and cloud GPU streaming on GCP. Use this skill whenever the work involves Godot or a .gd/.tscn/.gdshader/project.godot file; whenever someone wants to start, set up, clone onto a new machine, or stand up a 3D game or city generator; whenever they mention procedural city, city generator, block grid, building typology, MultiMesh, facade shader, terrain heightmap, navmesh, Godot export templates, export presets, headless Godot, .glb pipeline, Blender asset generation, character rigs or borrowed animations; and whenever they want to deploy or share a game — web export, SharedArrayBuffer/COOP/COEP, Selkies, pixel streaming, GPU VM, or "let people play this without installing anything." Reach for it even on vague asks like "get this running", "why is my city slow", "my model faces backwards", "make it work on a cloud machine", or "set this up somewhere else too" when a Godot 3D project is in play.
What it loads into context
Frontmatter
310 tokensAlways available to the agent
SKILL.md
3,469 tokensWhen the skill is activated
Reference documents
12,797 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Start here — pick the situation
- Bootstrap a new project
- Set up an existing project
- The scripts
- How a city generator is put together
- Architecture rules for the rest of the game
- Assets
- Real map data
- Shipping it
- Working on someone's existing city project
Scripts executed separately
scripts/bootstrap_project.pyscripts/build_assets.shscripts/check_project.shscripts/cloud/deploy_game.shscripts/cloud/provision_gcp.shscripts/cloud/setup_host.shscripts/cloud/stop.shscripts/ensure_export_presets.pyscripts/export_web.shscripts/import_assets.shscripts/install_godot.shscripts/lib.shscripts/run.shscripts/serve_web.py
Files
SKILL.mdcore14,590 bytesSKILL.mdcore14,590 bytesSKILL.mdcore14,590 bytesSKILL.mdcore14,590 bytesSKILL.mdcore14,590 bytesSKILL.mdcore14,590 bytesSKILL.mdcore14,590 bytesSKILL.mdcore14,590 bytesSKILL.mdcore14,590 bytesSKILL.mdcore14,590 bytesSKILL.mdcore14,590 bytesSKILL.mdcore14,590 bytesSKILL.mdcore14,590 bytesSKILL.mdcore14,590 bytesSKILL.mdcore14,590 bytesSKILL.mdcore14,590 bytesSKILL.mdcore14,590 bytesSKILL.mdcore14,590 bytesSKILL.mdcore14,590 bytesSKILL.mdcore14,590 bytesSKILL.mdcore14,590 bytesSKILL.mdcore14,590 bytesSKILL.mdcore14,590 bytesSKILL.mdcore14,590 bytesSKILL.mdcore14,590 bytesSKILL.mdcore14,590 bytesSKILL.mdcore14,590 bytesreferences/architecture.mddoc6,122 bytesreferences/assets.mddoc8,725 bytesreferences/city-generation.mddoc10,002 bytesreferences/deploy.mddoc8,111 bytesreferences/real-map-data.mddoc6,849 bytesreferences/setup.mddoc4,812 bytesreferences/troubleshooting.mddoc6,735 bytesscripts/bootstrap_project.pyruns7,456 bytesscripts/build_assets.shruns2,849 bytesscripts/check_project.shruns3,094 bytesscripts/cloud/deploy_game.shruns1,534 bytesscripts/cloud/provision_gcp.shruns4,170 bytesscripts/cloud/setup_host.shruns4,380 bytesscripts/cloud/stop.shruns1,177 bytesscripts/ensure_export_presets.pyruns4,824 bytesscripts/export_web.shruns1,979 bytesscripts/import_assets.shruns641 bytesscripts/install_godot.shruns4,770 bytesscripts/lib.shruns2,805 bytesscripts/run.shruns626 bytesscripts/serve_web.pyruns2,650 bytesscripts/templates/project.godotasset940 bytesscripts/templates/scenes/main.tscnasset169 bytesscripts/templates/scripts/city/city_config_{{CITY}}.gdasset2,707 bytesscripts/templates/scripts/city/city_generator.gdasset13,333 bytesscripts/templates/scripts/city/terrain.gdasset3,092 bytesscripts/templates/scripts/city/typology.gdasset2,220 bytesscripts/templates/scripts/game_input.gdasset852 bytesscripts/templates/scripts/main.gdasset2,731 bytesscripts/templates/scripts/player.gdasset3,256 bytesscripts/templates/shaders/facade.gdshaderasset2,860 bytes
Read SKILL.md
# Godot city game (3D)
A complete toolkit for procedurally generated 3D city games in Godot 4: scaffold
a new one in a minute, stand an existing one up on any machine, and ship it to a
browser or a cloud GPU.
Everything here assumes Godot 4.x. Godot 3 differs enough in GDScript,
rendering and node API that this guidance does not transfer.
## Start here — pick the situation
| Situation | Do this |
|---|---|
| Empty directory, want a city game | [Bootstrap](#bootstrap-a-new-project) |ios-bootstrap-testflight
When your agent uses it
Scaffold a native iOS app (SwiftUI, no dependencies) from nothing, run it in the Simulator, and archive + upload it to TestFlight entirely from the command line. Bundles working scripts for icon generation, simulator run, and signed upload via the App Store Connect API. Use this whenever the user wants to build, run, ship, or debug an iOS/iPhone/iPad app, mentions Xcode, SwiftUI, .xcodeproj, xcodebuild, simctl, provisioning, code signing, App Store Connect, TestFlight, archiving, or "get this on my phone" — and also when an existing iOS build is failing on icons, signing, teams, destinations, or duplicate build numbers.
What it loads into context
Frontmatter
157 tokensAlways available to the agent
SKILL.md
732 tokensWhen the skill is activated
Reference documents
3,665 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Read next
- Scripts
- The rule that saves the most time
- Environment expectations
Scripts executed separately
scripts/run.shscripts/screenshots.shscripts/upload_testflight.sh
Files
SKILL.mdcore3,061 bytesSKILL.mdcore3,061 bytesSKILL.mdcore3,061 bytesSKILL.mdcore3,061 bytesSKILL.mdcore3,061 bytesSKILL.mdcore3,061 bytesreferences/appstore.mddoc3,302 bytesreferences/bootstrap.mddoc3,361 bytesreferences/caveats.mddoc4,524 bytesreferences/testflight.mddoc3,744 bytesscripts/make_icon.swiftasset3,750 bytesscripts/run.shruns4,978 bytesscripts/screenshots.shruns3,986 bytesscripts/upload_testflight.shruns7,507 bytes
Read SKILL.md
# iOS bootstrap → TestFlight
Two jobs: create an iOS app that builds, and get it onto a real phone. Both are
almost entirely CLI. Xcode's UI is only needed for first-time account setup.
## Read next
| File | When |
|---|---|
| `references/bootstrap.md` | Creating a new project, or the project won't open/build |
| `references/testflight.md` | Signing, archiving, uploading. **Holds the user's Team ID and API key details.** |
| `references/appstore.md` | Public release — screenshots, metadata, privacy policy, review. Read the 4.3 risk section *before* the user invests in assets. |
| `references/caveats.md` | Anything looks wrong on device — button styling, layout, gestures, animation |
leanmcp-builder
When your agent uses it
Build MCP servers using the Leanmcp SDK with decorator-based TypeScript. Use this skill when users ask for "leanmcp", "MCP with decorators", "MCP with authentication", "MCP with elicitation", "MCP with environment injection", or want a simpler, more elegant way to build MCP servers. Leanmcp provides automatic schema generation, dependency injection, authentication, and user input collection.
What it loads into context
Frontmatter
93 tokensAlways available to the agent
SKILL.md
3,062 tokensWhen the skill is activated
Reference documents
1,424 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- When to Use This Skill
- Leanmcp vs Vanilla MCP
- Core Packages
- Project Structure
- Required package.json
- TypeScript Configuration
- Entry Point (main.ts)
- @Tool Decorator
- @Resource Decorator
- @Prompt Decorator
- @Authenticated Decorator
- @Elicitation Decorator
- @RequireEnv Decorator
- Complete Service Example
- Server Configuration Options
- Editing Guidelines
- Error Handling
- Best Practices
Scripts executed separately
assets/main.tsassets/mcp-example-index.tsassets/package.json
Files
SKILL.mdcore12,264 bytesSKILL.mdcore12,264 bytesassets/main.tsruns353 bytesassets/mcp-example-index.tsruns2,557 bytesassets/package.jsonruns651 bytesassets/tsconfig.jsonasset436 bytesreferences/decorators.mddoc5,304 bytes
Read SKILL.md
# Leanmcp Builder Skill
This skill guides you in building MCP servers using the Leanmcp SDK - a decorator-based TypeScript framework for elegant MCP development.
## When to Use This Skill
- User asks for "leanmcp server"
- User wants "MCP with decorators"
- User needs "authenticated MCP server"
- User wants "simpler MCP development"
- User mentions "@leanmcp/core"
- User needs "user input collection" or "elicitation"
- User wants "environment injection" for multi-tenant secrets
mcp-apps-builder
When your agent uses it
Build MCP Apps with interactive React UIs using the Leanmcp UI SDK. Use this skill when users ask for "MCP with UI", "MCP App", "interactive MCP", "leanmcp UI", "MCP dashboard", or want to create rich visual interfaces for their MCP tools. This skill covers @UIApp decorator, React components with useTool/useResource hooks, ToolDataGrid, ToolForm, ToolButton, and ChatGPT Apps support.
What it loads into context
Frontmatter
104 tokensAlways available to the agent
SKILL.md
3,961 tokensWhen the skill is activated
Reference documents
1,548 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- When to Use This Skill
- What is an MCP App?
- Core Architecture
- Required Dependencies
- TypeScript Configuration
- Project Structure
- Two Import Paths (Critical)
- @UIApp Decorator
- React Component Development
- Core Components
- Core Hooks
- GPT Apps SDK Hooks
- @GPTApp Decorator
- Complete Example
- Theming
- Editing Guidelines
Scripts executed separately
assets/Dashboard.tsxassets/main.tsassets/mcp-dashboard-index.tsassets/package.json
Files
SKILL.mdcore14,773 bytesassets/Dashboard.tsxruns4,404 bytesassets/main.tsruns346 bytesassets/mcp-dashboard-index.tsruns2,164 bytesassets/package.jsonruns816 bytesassets/tsconfig.jsonasset535 bytesreferences/ui-components.mddoc5,593 bytes
Read SKILL.md
# MCP Apps Builder Skill
This skill guides you in building MCP Apps - MCP servers with interactive React UIs using the Leanmcp UI SDK.
## When to Use This Skill
- User asks for "MCP with UI"
- User wants "interactive MCP server"
- User mentions "MCP App" or "leanmcp UI"
- User needs "dashboard for MCP tools"
- User wants "visual interface for AI tools"
- User mentions "@leanmcp/ui" or "@UIApp"
- User asks for "ChatGPT App" or "GPT App"
mcp-builder
When your agent uses it
Build MCP (Model Context Protocol) servers using the official @modelcontextprotocol/sdk. Use this skill when users ask to create an MCP server, MCP tools, MCP resources, or want to expose APIs/functionality to AI agents. This skill covers vanilla MCP implementation with Streamable HTTP transport, session management, tools, resources, and prompts.
What it loads into context
Frontmatter
76 tokensAlways available to the agent
SKILL.md
2,357 tokensWhen the skill is activated
Reference documents
944 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- When to Use This Skill
- MCP Core Concepts
- Project Structure
- Required Dependencies
- TypeScript Configuration
- Implementation Pattern
- Tool Implementation Examples
- Resource Implementation Examples
- Editing Guidelines
- Running the Server
Scripts executed separately
assets/mcp-server.tsassets/package.jsonassets/server.ts
Files
SKILL.mdcore9,758 bytesassets/mcp-server.tsruns2,660 bytesassets/package.jsonruns729 bytesassets/server.tsruns3,117 bytesreferences/patterns.mddoc4,030 bytes
Read SKILL.md
# MCP Builder Skill
This skill guides you in building MCP (Model Context Protocol) servers using the official `@modelcontextprotocol/sdk` package with TypeScript.
## When to Use This Skill
- User asks to "create an MCP server"
- User wants to "expose an API to AI agents"
- User needs "tools for Claude/LLM"
- User mentions "Model Context Protocol"
- User wants to build "AI agent integrations"
## MCP Core Concepts
posthog-adblock-bypass
When your agent uses it
Configure a Next.js app using posthog-js so session recording and dead-click capture survive browser ad blockers. Aliases the three blocker-flagged JS chunks (dead-clicks-autocapture.js, recorder.js, posthog-recorder.js) to bland same-origin paths via Next.js rewrites, and monkey-patches HTMLScriptElement so posthog-js requests the aliases. TRIGGER when posthog-js session replay or dead-click capture is failing in production with ERR_BLOCKED_BY_CLIENT or 404s on /static/dead-clicks-autocapture.js / /static/recorder.js / /static/posthog-recorder.js, or when the user wants to bypass ad blockers for these specific assets. Works alongside an existing PostHog reverse proxy (managed or otherwise) — only the three blocked files divert through Next.js, all other PostHog traffic stays on the original api_host. SKIP for unrelated PostHog setup, non-Next.js apps, or when capture/decide endpoints (/e/, /decide/, /array/*/config.js) are the ones being blocked — those need a different treatment.
What it loads into context
Frontmatter
239 tokensAlways available to the agent
SKILL.md
2,466 tokensWhen the skill is activated
Reference documents
3,053 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- When to use this
- Prerequisites to confirm before implementing
- Implementation — three changes
- Verification
- Common follow-ups and pitfalls
- Files modified summary (template for the PR description)
Files
SKILL.mdcore9,880 bytesSKILL.mdcore9,880 bytesposthog-adblock-bypass.mddoc11,926 bytesskills-lock.jsonasset275 bytes
Read SKILL.md
# PostHog ad-blocker bypass for Next.js
## When to use this
The user has posthog-js working *mostly* — events, feature flags, decide, config all reach PostHog fine — but **session recording and/or dead-click capture aren't working**, and DevTools shows:
- `/static/dead-clicks-autocapture.js` failing
- `/static/recorder.js` or `/static/posthog-recorder.js` failing
- `ERR_BLOCKED_BY_CLIENT` or a synthesized 404 (the file actually returns 200 via `curl`)
Root cause: ad blockers (uBlock Origin / Brave Shields / AdBlock Plus / EasyPrivacy) match on **filename patterns** (`recorder`, `autocapture`, `dead-clicks`) regardless of host. A reverse proxy alone doesn't help — renaming on a different host still trips the same filter. **Confirmation step**: ask the user to disable their ad blocker on the page; if the requests succeed, this skill applies.
This skill applies the **surgical** fix: only those three files divert through the Next.js app under bland filenames. All other PostHog traffic (events, decide, config, recording uploads) keeps using the existing `api_host`.
publicity-distribution
When your agent uses it
Write and distribute launch and publicity content across LinkedIn, X/Twitter, Instagram, Discord, Medium, Substack, and YouTube. Produces per-platform copy that does not read as AI-written (no em dashes, no "thrilled to announce", no engagement-bait), plus the exact image/video specs and character limits each platform wants. Use this skill whenever the user wants to announce, launch, publicize, promote, cross-post, or share anything - a product, a feature, an open-source release, a research paper, a blog post, a demo video, a milestone, a job opening, or a conference talk. Trigger it on phrases like "post this on LinkedIn", "write a launch tweet", "announce this", "share this in Discord", "turn this into a thread", "what should I post", "write a Medium article about", "help me with distribution", "draft a YouTube description", "make this sound less like AI", or "de-slop this post". Also use it when the user has just finished shipping something and asks how to get it in front of people.
What it loads into context
Frontmatter
237 tokensAlways available to the agent
SKILL.md
1,759 tokensWhen the skill is activated
Reference documents
21,829 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- The two failure modes
- Workflow
- Things that are always true
Files
SKILL.mdcore7,603 bytesSKILL.mdcore7,603 bytesSKILL.mdcore7,603 bytesexamples/discord-soft-share.mddoc4,662 bytesexamples/paper-launch.mddoc8,527 bytesexamples/product-launch.mddoc5,625 bytesplatforms/discord.mddoc9,991 bytesplatforms/instagram.mddoc3,686 bytesplatforms/linkedin.mddoc6,157 bytesplatforms/medium.mddoc4,961 bytesplatforms/substack.mddoc4,873 bytesplatforms/twitter-x.mddoc4,493 bytesplatforms/youtube.mddoc6,136 bytesreferences/anti-ai-tells.mddoc9,899 bytesreferences/asset-specs.mddoc4,015 bytesreferences/campaign-playbooks.mddoc7,520 bytesstyles/builder-technical.mddoc3,639 bytesstyles/professional.mddoc4,233 bytesstyles/whatsapp-lowercase.mddoc3,378 bytes
Read SKILL.md
# Publicity and Distribution
Shipping something is half the work. This skill covers the other half: turning one thing you built into channel-native copy that people actually read, without it smelling like it came out of a language model.
## The two failure modes
Almost all bad launch content fails in one of two ways:
1. **It reads as AI-written.** Em dashes, "I'm thrilled to announce", rocket emojis, three perfectly parallel bullets, a closing question nobody will answer. Readers on LinkedIn and X have been trained to spot this in under a second and they scroll past it or, worse, mock it in the comments. Fixing this is not optional and it is not cosmetic.
2. **It is the same paragraph pasted five times.** A LinkedIn post and a tweet and a Discord message are different formats for different rooms. Copying one into the other five places is visible and it is lazy.
Everything below exists to avoid those two things.
## Workflowresearch-observability
When your agent uses it
Add file-based observability, tracing, and run analysis to LLM/agent experiments — per-turn transcripts, tool calls and results, reasoning traces, token/cost accounting, per-episode artifacts, plus terminal viewers and a run-comparison report. Platform-agnostic: one small adapter covers OpenAI, Gemini/Vertex, Anthropic, LiteLLM, Tinker, vLLM, or any custom inference stack, and the same tooling then works unchanged. Use this skill whenever the user wants observability, tracing, logging, or run tracking for model experiments; asks why an agent failed a task or wants to replay/debug/diff an episode; wants to compare models, arms, or ablations; wants to instrument a new folder, repo, or platform ("add observability here", "do the same for Tinker/Gemini/OpenAI"); wants to import or tie in existing experiment results so old runs show up alongside new ones; or wants eval runner scripts where many models share one protocol. Reach for this even when they only say "log what the model is doing", "I can't tell what happened in this run", or "set up traces for this experiment".
What it loads into context
Frontmatter
247 tokensAlways available to the agent
SKILL.md
1,828 tokensWhen the skill is activated
Reference documents
11,174 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Start here
- What gets installed
- The shape of an instrumented run
- Principles that make this worth doing
- Environment knobs
- Related
Scripts executed separately
assets/_common_eval.shscripts/obs.pyscripts/obs_adapters.pyscripts/obs_import.pyscripts/obs_report.pyscripts/view_trace.pyscripts/view_trace_tui.py
Files
SKILL.mdcore7,704 bytesSKILL.mdcore7,704 bytesSKILL.mdcore7,704 bytesSKILL.mdcore7,704 bytesSKILL.mdcore7,704 bytesassets/_common_eval.shruns4,776 bytesreferences/data-model.mddoc8,436 bytesreferences/integration.mddoc8,935 bytesreferences/platforms.mddoc11,413 bytesreferences/reference-implementation.mddoc4,541 bytesreferences/runner-scripts.mddoc4,997 bytesreferences/viewers.mddoc6,659 bytesscripts/obs.pyruns26,271 bytesscripts/obs_adapters.pyruns18,246 bytesscripts/obs_import.pyruns8,278 bytesscripts/obs_report.pyruns6,855 bytesscripts/view_trace.pyruns12,525 bytesscripts/view_trace_tui.pyruns24,246 bytes
Read SKILL.md
# Research observability
Experiments you cannot replay are experiments you have to rerun. This skill
installs a small, file-based observability layer over any LLM/agent experiment
and the tools to read it: every generation, every tool call and result, every
reasoning trace, every reward — on disk as plain JSONL, greppable, diffable, and
re-gradable months later.
The design bet: **the recording format is fixed and platform-independent, so
adding a platform is writing one ~15-line normalizer, not re-plumbing
observability.** LiteLLM, OpenAI, Gemini, Anthropic, Tinker and a bespoke
inference server all produce identical files, and every viewer, report and diff
downstream works with no further changes.
research-paper-integrity
When your agent uses it
Standards and audits for writing academic papers, especially ML/NLP submissions to NeurIPS, ICML, ICLR, ACL, EMNLP, NAACL. Covers the author's house prose rules (zero em dashes, zero fluff, every sentence earns its place), verification of hallucinated claims and hallucinated or malformed bibliography entries, the ACL policy on AI writing assistance and what must be disclosed, and best practices for paper structure, experiments, reproducibility checklists, and rebuttals. Use this skill whenever the user is drafting, editing, polishing, restructuring, or reviewing a paper, abstract, intro, related work, rebuttal, or camera-ready; whenever they ask to "clean up" or "tighten" academic writing; whenever citations or a .bib file need checking; and whenever they ask what has to be disclosed about AI assistance. Reach for it even when the user only says "make this section better", "check my references", or "is this ready to submit".
What it loads into context
Frontmatter
209 tokensAlways available to the agent
SKILL.md
1,206 tokensWhen the skill is activated
Reference documents
5,939 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- What lives where
- The three commitments
- Default workflow when handed a draft
- How to report
Scripts executed separately
scripts/check_prose.py
Files
SKILL.mdcore5,420 bytesreferences/ai-writing-policy.mddoc6,445 bytesreferences/conference-writing.mddoc8,010 bytesreferences/hallucination-audit.mddoc6,038 bytesreferences/writing-style.mddoc5,940 bytesscripts/check_prose.pyruns9,906 bytes
Read SKILL.md
# Research paper integrity
This skill is the index. Each area below lives in its own reference file so you only
load what the current task needs. Read the file before acting on that area, not after,
because these rules change what you write rather than how you check it afterwards.
## What lives where
| Area | File | Read it when |
|---|---|---|
| Prose rules: no em dashes, no fluff, necessity test | `references/writing-style.md` | Writing or editing any prose the user will submit |
| Hallucination audit: unsupported claims, fake or wrong citations, bib hygiene | `references/hallucination-audit.md` | Any draft has claims or references that were not hand-verified |
| AI assistance disclosure (ACL 2023 policy and its logic) | `references/ai-writing-policy.md` | The user asks what to disclose, fills a responsible-NLP checklist, or used a model for text, ideas, or code |
| Conference craft: structure, experiments, figures, rebuttals, checklists | `references/conference-writing.md` | Planning a paper, restructuring sections, prepping a submission or rebuttal |security-repro
When your agent uses it
Build safe, local, defensive reproductions of ALREADY-PATCHED, publicly disclosed security vulnerabilities (CVEs, vendor advisories, AI-agent incidents) for whitepapers, control testing, and education. Use this skill whenever the user wants to reproduce, demonstrate, or write up a known vulnerability or security incident — phrases like "reproduce this CVE", "build a repro for", "demonstrate the EchoLeak/Cursor/postmark-mcp issue", "show how this exploit worked", "add a reproducibility guide", or "pull the NVD/CVE details for". It fetches advisory metadata from NVD and CVE.org, confirms the issue is fixed, and produces a vulnerable-vs-patched harness that is offline, loopback-only, and uses synthetic markers. It NEVER discovers, develops, or weaponizes new zero-days and refuses any unpatched or live-target request.
What it loads into context
Frontmatter
210 tokensAlways available to the agent
SKILL.md
1,647 tokensWhen the skill is activated
Reference documents
732 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- The one hard line (read first)
- Workflow
- Scripts
- References
Scripts executed separately
scripts/check_patched.pyscripts/fetch_cve.pyscripts/fetch_nvd.py
Files
SKILL.mdcore6,907 bytesSKILL.mdcore6,907 bytesSKILL.mdcore6,907 bytesreferences/harness-pattern.mddoc2,909 bytesscripts/check_patched.pyruns3,027 bytesscripts/fetch_cve.pyruns2,030 bytesscripts/fetch_nvd.pyruns2,266 bytes
Read SKILL.md
# security-repro
Reproduce **already-fixed, publicly disclosed** vulnerabilities so a reader can
see the failure mode and confirm the vendor's patch closes it. The audience is
a whitepaper or an internal control test. The output is a contrast: the
vulnerable behavior fires, the patched behavior refuses, and nothing real is
touched.
## The one hard line (read first)
This skill exists to reproduce **the past**, not to find **the new**. Everything
below flows from that.
- **Only patched or withdrawn issues.** If the vendor has not shipped a fix (ortinker-training-inference
When your agent uses it
Train and run models on Tinker (Thinking Machines) — LoRA and full fine-tuning, SFT with correct loss masking, RL/RFT with group-relative advantages and importance sampling, agentic RL over multi-turn tool-using agents, inference via the SamplingClient or the OpenAI-compatible endpoint, checkpoint management and export, every hyperparameter, and cost estimation from the live price table. Use this skill whenever the user mentions Tinker, tinker://, TINKER_API_KEY, console.tinker.ai, or the tinker CLI; wants to fine-tune, SFT, RFT, or RL a model on Tinker; asks about Tinker models, context windows, LoRA rank, sampling params, loss functions (cross_entropy, importance_sampling, ppo, cispo, dro), Datum construction, forward_backward or optim_step; wants to sample from, download, resume, merge, or export a Tinker checkpoint; or asks what a Tinker run will cost. Whenever Tinker work is initialized in a project, this skill also creates a TINKER_PRICING.md there so prices sit next to the training code. Reach for it even on vague asks like "train a model on this data" or "get inference working" when Tinker is the platform in play.
What it loads into context
Frontmatter
273 tokensAlways available to the agent
SKILL.md
2,021 tokensWhen the skill is activated
Reference documents
18,656 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Do this first, in any new Tinker project
- Where to go
- Runnable templates
- The API in one screen
- Things that are true and easy to miss
- Recording the run
- Links
Scripts executed separately
scripts/tinker_infer.pyscripts/tinker_pricing.pyscripts/tinker_rl.pyscripts/tinker_sft.py
Files
SKILL.mdcore8,602 bytesSKILL.mdcore8,602 bytesSKILL.mdcore8,602 bytesSKILL.mdcore8,602 bytesSKILL.mdcore8,602 bytesassets/TINKER_PRICING.mddoc5,416 bytesreferences/agentic-rl.mddoc6,786 bytesreferences/chat-templates.mddoc5,731 bytesreferences/checkpoints.mddoc5,263 bytesreferences/hyperparameters.mddoc6,924 bytesreferences/inference.mddoc5,639 bytesreferences/pricing.mddoc6,274 bytesreferences/reference-implementation.mddoc4,592 bytesreferences/setup.mddoc5,467 bytesreferences/training-rl.mddoc6,907 bytesreferences/training-sft.mddoc6,378 bytesreferences/troubleshooting.mddoc6,432 bytesscripts/tinker_infer.pyruns5,391 bytesscripts/tinker_pricing.pyruns16,353 bytesscripts/tinker_rl.pyruns10,138 bytesscripts/tinker_sft.pyruns9,621 bytes
Read SKILL.md
# Tinker: training and inference
Tinker gives you token-level control of hosted fine-tuning: you build the
`Datum`s, you own the chat template, you hold the exact prompt and completion
token ids on both sides. That is the reason to use it — a training run stays
auditable, because the tokens the policy was updated on are tokens you can point
at — and it is also why there is more to get right than with a hosted
fine-tuning button. This skill is the map.
## Do this first, in any new Tinker project
**Create the pricing file.** Prices next to the training script get read before a
550B RL run is launched; prices in a browser tab do not.
translate-explanation
When your agent uses it
Translate existing code-explanation docs into another language, Chinese by default. Translates a whole `CODE_EXPLANATION/` folder into a parallel `CODE_EXPLANATION_<LANG>` copy (e.g. `CODE_EXPLANATION_ZH`), or a single file — either bilingually in place (English + translation interleaved) for small files or as a `<name>_<lang>.<ext>` sidecar copy for larger ones. Keeps filenames, code, identifiers, file paths, and technical terms in English — only the explanatory prose is translated. Use this skill whenever the user wants to translate, localize, or produce a non-English version of code-explanation / codebase documentation: phrases like "translate-explanation", "translate the code explanation", "translate the CODE_EXPLANATION folder", "localize these docs to Chinese", "make a Chinese version of the explanation", or naming any target language for the explanation files. Default to Chinese (ZH) when no language is specified.
What it loads into context
Frontmatter
236 tokensAlways available to the agent
SKILL.md
2,311 tokensWhen the skill is activated
Reference documents
0 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- Translation modes
- Folder mode
- Single-file mode
- What to translate vs. keep as-is
- Quick checklist
Files
SKILL.mdcore9,662 bytesSKILL.mdcore9,662 bytesSKILL.mdcore9,662 bytesSKILL.mdcore9,662 bytesSKILL.mdcore9,662 bytesSKILL.mdcore9,662 bytesSKILL.mdcore9,662 bytesSKILL.mdcore9,662 bytesSKILL.mdcore9,662 bytes
Read SKILL.md
# Translate Explanation
Translate generated code-explanation docs (the kind produced by the
`code-explanation` skill) into another language. The prose is translated but
everything technical stays in English so the docs remain accurate and usable by
engineers.
**Default language is Chinese (`ZH`).** If the user names another language, use
its code instead (see the table below).
## Translation modes
First decide what's being translated — a whole folder or a single file — because
the output shape differs.vuln-repro
When your agent uses it
End-to-end methodology for reproducing AND patching publicly disclosed, already-fixed vulnerabilities: sourcing the advisory and the fix commit, reading the patch diff, rebuilding a pinned offline lab, building a vulnerable-vs-patched contrast harness with proper controls, minimizing the trigger, designing and validating the fix, and writing it up as a blog post or whitepaper. Use this skill whenever the user wants to reproduce, demonstrate, understand, teach, or write about a known vulnerability or security incident: "reproduce this CVE", "build a repro for", "how did EchoLeak / Log4Shell / the postmark-mcp package actually work", "show me how this exploit worked", "write a blog post about this vulnerability", "set up a lab for CVE-XXXX", "pull the NVD/CVE/OSV details", or "make a PoC I can publish". Use it just as eagerly for the patching half: "how should this be fixed", "is this patch correct", "what would have caught this", "review this security fix", "write a regression test for this CVE", "how do I backport this", or "what's the right fix for this bug class" - even when the user never says the word "reproduce". Reach for it on vague asks like "help me understand this security advisory", "I want to write about this incident", or "can we test whether we were vulnerable" when a disclosed vulnerability is in play. This skill only handles ALREADY-PATCHED, publicly disclosed issues and refuses zero-day discovery, live targets, and weaponization.
What it loads into context
Frontmatter
366 tokensAlways available to the agent
SKILL.md
3,362 tokensWhen the skill is activated
Reference documents
7,824 tokensLoaded on request
Token counts are estimates. Scripts run separately; they are not counted as reference context.
The playbook
- The hard line, read this first
- What a reproduction actually is
- Workflow
- Running things
- Files
Scripts executed separately
assets/harness_template.pyscripts/check_patched.pyscripts/fetch_cve.pyscripts/fetch_nvd.pyscripts/fetch_osv.pyscripts/minimize.pyscripts/triage.py
Files
SKILL.mdcore14,379 bytesSKILL.mdcore14,379 bytesSKILL.mdcore14,379 bytesSKILL.mdcore14,379 bytesSKILL.mdcore14,379 bytesassets/harness_template.pyruns4,920 bytesreferences/harness-pattern.mddoc4,638 bytesreferences/patching.mddoc16,625 bytesreferences/sourcing.mddoc6,548 bytesreferences/writeup.mddoc5,319 bytesscripts/check_patched.pyruns3,015 bytesscripts/fetch_cve.pyruns2,026 bytesscripts/fetch_nvd.pyruns2,262 bytesscripts/fetch_osv.pyruns3,293 bytesscripts/minimize.pyruns4,545 bytesscripts/triage.pyruns6,815 bytes
Read SKILL.md
# vuln-repro
Reproduce a disclosed vulnerability faithfully, explain the fix that closed it,
and publish the result. The output is a controlled experiment plus an engineering
analysis, not a demo.
## The hard line, read this first
This skill reproduces **the past**. It does not discover **the new**. Everything
below depends on that distinction holding, and it is what keeps the work legal
and publishable.
- **Only patched or withdrawn issues.** A fix version, a patch commit, or a
withdrawal notice. "Reported to the vendor" and "advisory published" are notSkills included
- claude-code-dev
- analyze-exports
- code-explanation
- fireworks-inference
- godot-city-game-3d
- ios-bootstrap-testflight
- leanmcp-builder
- mcp-apps-builder
- mcp-builder
- posthog-adblock-bypass
- publicity-distribution
- research-observability
- research-paper-integrity
- security-repro
- tinker-training-inference
- translate-explanation
- vuln-repro
Repository facts
- License
- MIT
- Created
- Mar 31, 2026
- Last pushed
- Oct 7, 2026
- Forks
- 2,085
- Open issues
- 0
- Project activity
- Active
Rank over the last 12 weeks
Now #515 · best #370 · down 68 in 30 days
- #509 on Nov 1
- #511 on Nov 2
- #513 on Nov 3
- #514 on Nov 4
- #513 on Nov 5
- #515 since Nov 6
25 earlier periods
- #368 on Aug 1
- #355 on Aug 4
- #370 on Aug 17
- #381 on Aug 29
- #389 on Aug 31
- #392 on Sep 6
- #406 on Sep 9
- #410 on Sep 19
- #423 on Sep 23
- #421 on Oct 3
- #442 on Oct 7
- #447 on Oct 8
- #443 from Oct 10 to Oct 11
- #455 on Oct 12
- #452 on Oct 17
- #474 on Oct 19
- #475 on Oct 20
- #481 on Oct 21
- #476 on Oct 22
- #474 on Oct 23
- #462 on Oct 24
- #498 on Oct 25
- #504 on Oct 28
- #506 on Oct 29
- #508 from Oct 30 to Oct 31
Before you install
Network or broad shellAutomated signals, not a guarantee
Checked Nov 3, 2026
Not fully analyzed: some files were too long, unreadable or missing. This never lowers the level.
Show 63 notes
claude-code-skills/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/analyze-exports/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/code-explanation/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/code-explanation/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/fireworks-inference/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/fireworks-inference/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/godot-city-game-3d/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/godot-city-game-3d/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/godot-city-game-3d/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/godot-city-game-3d/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/godot-city-game-3d/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/godot-city-game-3d/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/godot-city-game-3d/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/godot-city-game-3d/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/godot-city-game-3d/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/godot-city-game-3d/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/godot-city-game-3d/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/godot-city-game-3d/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/godot-city-game-3d/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzedskills/godot-city-game-3d/SKILL.md:1Analysis incomplete: Referenced executable target unavailable; not analyzed
- No broad tool permissions
- 21 dangerous shell commandsin 12 files: ios-bootstrap-testflight/references/bootstrap.md:7 godot-city-game-3d/scripts/install_godot.sh:38 godot-city-game-3d/scripts/cloud/deploy_game.sh:40 and 9 more
- 289 network referencesin 49 files: fireworks-inference/assets/run_fireworks.sh:16 godot-city-game-3d/scripts/cloud/setup_host.sh:20 fireworks-inference/scripts/fw_smoke.py:10 and 46 more
- No hidden or obfuscated text
- No instruction overrides
- 56 executable scriptsin 56 files: analyze-exports/scripts/analyze_failures.py:1 analyze-exports/scripts/parse_export.py:1 fireworks-inference/assets/run_fireworks.sh:1 and 53 more
- 133 references to secretsin 34 files: fireworks-inference/assets/run_fireworks.sh:15 research-observability/assets/_common_eval.sh:71 fireworks-inference/references/runner-scripts.md:22 and 31 more
- No requests to vote in Hot
Show all 499 signals by file
claude-code-skills/06-commenting-style.md
- Network accessline 278
// See: https://github.com/BurntSushi/ripgrep/discussions/2156#discussioncomment-2316335
claude-code-skills/README.md
- Network accessline 3
This is a [Claude Code skill](https://docs.anthropic.com/en/docs/claude-code/skills) that teaches Claude how to work with the Claude Code codebase following its established patterns and conventions.
skills/analyze-exports/scripts/analyze_failures.py
- Executable scriptline 1
#!/usr/bin/env python3
skills/analyze-exports/scripts/parse_export.py
- Executable scriptline 1
#!/usr/bin/env python3
skills/code-explanation/SKILL.md
- Network accessline 41
1. **`treecap`** — preferred. Check with `which treecap`. 2. If it is missing, **install it**: `pip install treecap` (it is a PyPI package: https://pypi.org/project/treecap/). If `pip` isn't available, try - Network accessline 42
2. If it is missing, **install it**: `pip install treecap` (it is a PyPI package: https://pypi.org/project/treecap/). If `pip` isn't available, try `pip3 install treecap` or `python -m pip install treecap`. - Network accessline 43
package: https://pypi.org/project/treecap/). If `pip` isn't available, try - Network accessline 141
async def handle(self, req: Request) -> Response: user = await self.auth.verify(req.token) # 1. authenticate record = await self.store.fetch(req.id) # 2. load state - Network accessline 142
user = await self.auth.verify(req.token) # 1. authenticate record = await self.store.fetch(req.id) # 2. load state return self._render(record, user) # 3. shape response - Network accessline 143
record = await self.store.fetch(req.id) # 2. load state
skills/fireworks-inference/SKILL.md
- Access to secretsline 3
[Credential-related source omitted] - Network accessline 24
| | base URL | key | | --- | --- | --- | | **direct Fireworks** | `https://api.fireworks.ai/inference/v1` | `FIREWORKS_API_KEY` | - Network accessline 25
| --- | --- | --- | | **direct Fireworks** | `https://api.fireworks.ai/inference/v1` | `FIREWORKS_API_KEY` | | **Leanmcp gateway** | `https://aigateway.leanmcp.com/v1/fireworks` | `LEANMCP_API_KEY` | - Network accessline 26
[Credential-related source omitted] - Access to secretsline 26
[Credential-related source omitted] - Network accessline 27
[Credential-related source omitted] - Access to secretsline 27
[Credential-related source omitted] - Network accessline 34
Gateway keys at <https://app.leanmcp.com/api-keys> (top up credits first at - Network accessline 35
<https://app.leanmcp.com/billing>); every request then shows up at - Network accessline 36
<https://app.leanmcp.com/observability>. - Network accessline 96
model="fireworks_ai/accounts/fireworks/models/gpt-oss-20b", messages=[...], api_base="https://aigateway.leanmcp.com/v1/fireworks", # no /chat/completions - Network accessline 97
[Credential-related source omitted] - Network accessline 98
api_base="https://aigateway.leanmcp.com/v1/fireworks", # no /chat/completions - Access to secretsline 99
[Credential-related source omitted]
skills/fireworks-inference/assets/run_fireworks.sh
- Executable scriptline 1
#!/usr/bin/env bash - Access to secretsline 15
[Credential-related source omitted] - Network accessline 16
[Credential-related source omitted] - Access to secretsline 16
[Credential-related source omitted] - Access to secretsline 17
[Credential-related source omitted] - Network accessline 18
# -> https://app.leanmcp.com/api-keys (top up first at /billing) - Network accessline 33
DIRECT_BASE="https://api.fireworks.ai/inference/v1" - Network accessline 34
PROXY_BASE="https://aigateway.leanmcp.com/v1/fireworks" - Access to secretsline 55
[Credential-related source omitted] - Network accessline 58
[Credential-related source omitted] - Network accessline 59
[Credential-related source omitted] - Access to secretsline 59
[Credential-related source omitted] - Network accessline 60
[Credential-related source omitted] - Access to secretsline 60
[Credential-related source omitted] - Network accessline 61
[Credential-related source omitted] - Access to secretsline 61
[Credential-related source omitted] - Network accessline 62
echo " get one at https://app.leanmcp.com/api-keys" >&2 - Network accessline 63
echo " (top up credits first at https://app.leanmcp.com/billing)" >&2 - Network accessline 64
[Credential-related source omitted] - Network accessline 65
[Credential-related source omitted] - Network accessline 66
[Credential-related source omitted] - Access to secretsline 66
[Credential-related source omitted] - Access to secretsline 67
[Credential-related source omitted] - Access to secretsline 69
[Credential-related source omitted] - Network accessline 89
┌─ Fireworks run: $RUN_NAME │ route : $MODE │ api_base : $API_BASE - Network accessline 90
[Credential-related source omitted] - Network accessline 91
│ api_base : $API_BASE - Access to secretsline 92
[Credential-related source omitted] - Network accessline 103
if [[ "$MODEL_PATH" == *"/deployments/"* && "$DRY_RUN" -eq 0 ]]; then echo "warming $MODEL_LABEL (up to ${WARM_TIMEOUT}s)…" if ! python fw_ready.py --api-base "$API_BASE" --model "$MODEL_PATH" \ - Network accessline 104
echo "warming $MODEL_LABEL (up to ${WARM_TIMEOUT}s)…" if ! python fw_ready.py --api-base "$API_BASE" --model "$MODEL_PATH" \ --wait "$WARM_TIMEOUT" >/dev/null; then - Network accessline 105
if ! python fw_ready.py --api-base "$API_BASE" --model "$MODEL_PATH" \ - Network accessline 118
echo "timestamp : $(date -u +%Y-%m-%dT%H:%M:%SZ)" echo "route : $MODE" echo "api_base : $API_BASE" - Network accessline 119
[Credential-related source omitted] - Network accessline 120
echo "api_base : $API_BASE" - Access to secretsline 121
[Credential-related source omitted] - Access to secretsline 132
[Credential-related source omitted] - Network accessline 136
[Credential-related source omitted] - Access to secretsline 136
[Credential-related source omitted] - Network accessline 137
[Credential-related source omitted] - Access to secretsline 137
[Credential-related source omitted] - Access to secretsline 151
[Credential-related source omitted] - Access to secretsline 152
[Credential-related source omitted] - Access to secretsline 158
[Credential-related source omitted]
skills/fireworks-inference/references/gateway.md
- Network accessline 8
your code ──► https://aigateway.leanmcp.com/v1/fireworks ──► Fireworks - Access to secretsline 9
[Credential-related source omitted] - Network accessline 14
| | base URL | key | | --- | --- | --- | | direct | `https://api.fireworks.ai/inference/v1` | `FIREWORKS_API_KEY` | - Network accessline 15
| --- | --- | --- | | direct | `https://api.fireworks.ai/inference/v1` | `FIREWORKS_API_KEY` | | gateway | `https://aigateway.leanmcp.com/v1/fireworks` | `LEANMCP_API_KEY` | - Network accessline 16
[Credential-related source omitted] - Access to secretsline 16
[Credential-related source omitted] - Network accessline 17
[Credential-related source omitted] - Access to secretsline 17
[Credential-related source omitted] - Network accessline 19
- Keys: <https://app.leanmcp.com/api-keys> - Network accessline 20
- Credits: <https://app.leanmcp.com/billing> — **top up before creating a key**; - Network accessline 22
- Observability: <https://app.leanmcp.com/observability> - Network accessline 29
# raw / openai SDK — bare Fireworks model path client = OpenAI(base_url="https://aigateway.leanmcp.com/v1/fireworks", - Network accessline 30
client = OpenAI(base_url="https://aigateway.leanmcp.com/v1/fireworks", - Access to secretsline 31
[Credential-related source omitted] - Network accessline 35
litellm.completion( model="fireworks_ai/accounts/fireworks/models/gpt-oss-20b", api_base="https://aigateway.leanmcp.com/v1/fireworks", - Network accessline 36
[Credential-related source omitted] - Network accessline 37
api_base="https://aigateway.leanmcp.com/v1/fireworks", - Access to secretsline 38
[Credential-related source omitted]
skills/fireworks-inference/references/load-and-concurrency.md
- Network accessline 95
cents, before anything expensive runs. - **Route through the gateway** so the spend is visible per model and per run at <https://app.leanmcp.com/observability> rather than reconstructed afterwards. - Network accessline 97
<https://app.leanmcp.com/observability> rather than reconstructed afterwards.
skills/fireworks-inference/references/models.md
skills/fireworks-inference/references/reference-implementation.md
- Access to secretsline 12
[Credential-related source omitted]
skills/fireworks-inference/references/routes.md
- Network accessline 15
| | base URL | key | | --- | --- | --- | | **direct Fireworks** | `https://api.fireworks.ai/inference/v1` | `FIREWORKS_API_KEY` | - Network accessline 16
| --- | --- | --- | | **direct Fireworks** | `https://api.fireworks.ai/inference/v1` | `FIREWORKS_API_KEY` | | **Leanmcp gateway** | `https://aigateway.leanmcp.com/v1/fireworks` | `LEANMCP_API_KEY` | - Network accessline 17
[Credential-related source omitted] - Access to secretsline 17
[Credential-related source omitted] - Network accessline 18
[Credential-related source omitted] - Access to secretsline 18
[Credential-related source omitted] - Network accessline 24
The gateway forwards to Fireworks and logs every request at <https://app.leanmcp.com/observability>. Keys: <https://app.leanmcp.com/api-keys> - Network accessline 25
<https://app.leanmcp.com/observability>. Keys: <https://app.leanmcp.com/api-keys> - Network accessline 26
(top up credits first at <https://app.leanmcp.com/billing>). - Access to secretsline 51
[Credential-related source omitted] - Network accessline 68
model="fireworks_ai/accounts/fireworks/models/gpt-oss-20b", messages=[...], api_base="https://aigateway.leanmcp.com/v1/fireworks", # no /chat/completions - Network accessline 69
[Credential-related source omitted] - Network accessline 70
api_base="https://aigateway.leanmcp.com/v1/fireworks", # no /chat/completions - Access to secretsline 71
[Credential-related source omitted] - Access to secretsline 84
[Credential-related source omitted] - Access to secretsline 88
[Credential-related source omitted]
skills/fireworks-inference/references/runner-scripts.md
- Network accessline 20
if [[ "$USE_PROXY" -eq 1 ]]; then API_BASE="https://aigateway.leanmcp.com/v1/fireworks" - Network accessline 21
API_BASE="https://aigateway.leanmcp.com/v1/fireworks" - Access to secretsline 22
[Credential-related source omitted] - Network accessline 23
MODE="Leanmcp gateway" else API_BASE="https://api.fireworks.ai/inference/v1" - Network accessline 24
[Credential-related source omitted] - Network accessline 25
API_BASE="https://api.fireworks.ai/inference/v1" - Access to secretsline 26
[Credential-related source omitted] - Access to secretsline 34
[Credential-related source omitted] - Access to secretsline 35
[Credential-related source omitted] - Access to secretsline 50
[Credential-related source omitted] - Access to secretsline 140
[Credential-related source omitted] - Access to secretsline 141
[Credential-related source omitted] - Network accessline 147
[Credential-related source omitted] - Access to secretsline 147
[Credential-related source omitted] - Network accessline 148
[Credential-related source omitted] - Access to secretsline 148
[Credential-related source omitted] - Network accessline 149
echo " get one at https://app.leanmcp.com/api-keys (top up first at /billing)" >&2
skills/fireworks-inference/references/verification.md
- Access to secretsline 10
[Credential-related source omitted] - Network accessline 17
For the gateway, **credits must be topped up before the key works** (<https://app.leanmcp.com/billing>). A key with no credit behind it fails like a - Network accessline 18
(<https://app.leanmcp.com/billing>). A key with no credit behind it fails like a
skills/fireworks-inference/scripts/fw_hammer.py
- Executable scriptline 1
#!/usr/bin/env python3 - Network accessline 49
DIRECT_BASE = "https://api.fireworks.ai/inference/v1" - Network accessline 50
GATEWAY_BASE = "https://aigateway.leanmcp.com/v1/fireworks" - Access to secretsline 78
[Credential-related source omitted] - Access to secretsline 79
[Credential-related source omitted] - Access to secretsline 117
[Credential-related source omitted] - Access to secretsline 195
[Credential-related source omitted] - Access to secretsline 199
[Credential-related source omitted]
skills/fireworks-inference/scripts/fw_models.py
- Executable scriptline 1
#!/usr/bin/env python3 - Access to secretsline 19
[Credential-related source omitted] - Network accessline 39
API_URL = "https://api.fireworks.ai/v1/accounts/fireworks/models" - Access to secretsline 48
[Credential-related source omitted] - Access to secretsline 49
[Credential-related source omitted] - Access to secretsline 53
[Credential-related source omitted] - Access to secretsline 57
[Credential-related source omitted] - Access to secretsline 59
[Credential-related source omitted] - Network accessline 73
def _get(url: str, key: str) -> dict: req = urllib.request.Request(url, headers={ - Network accessline 74
req = urllib.request.Request(url, headers={ - Network accessline 77
"User-Agent": "curl/8.4.0", # the default urllib UA gets 403'd by the WAF }) with urllib.request.urlopen(req, context=_ssl_context(), timeout=60) as r: - Network accessline 78
}) with urllib.request.urlopen(req, context=_ssl_context(), timeout=60) as r: return json.load(r) - Network accessline 79
with urllib.request.urlopen(req, context=_ssl_context(), timeout=60) as r: - Access to secretsline 107
[Credential-related source omitted]
skills/fireworks-inference/scripts/fw_ready.py
- Executable scriptline 1
#!/usr/bin/env python3 - Network accessline 16
python fw_ready.py --model gpt-oss-20b --direct python fw_ready.py --model <deployment-id> --account <acct> --wait 600 python fw_ready.py --api-base https://aigateway.leanmcp.com/v1/fireworks \ - Network accessline 17
python fw_ready.py --model <deployment-id> --account <acct> --wait 600 python fw_ready.py --api-base https://aigateway.leanmcp.com/v1/fireworks \ --model accounts/fireworks/models/gpt-oss-20b - Network accessline 18
python fw_ready.py --api-base https://aigateway.leanmcp.com/v1/fireworks \ - Network accessline 39
DIRECT_BASE = "https://api.fireworks.ai/inference/v1" - Network accessline 40
GATEWAY_BASE = "https://aigateway.leanmcp.com/v1/fireworks" - Access to secretsline 49
[Credential-related source omitted] - Access to secretsline 50
[Credential-related source omitted] - Network accessline 54
def post(url: str, body: dict, key: str, timeout: float, ctx) -> dict: req = urllib.request.Request( - Network accessline 55
req = urllib.request.Request( - Network accessline 58
"Accept": "application/json"}, method="POST") with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp: - Network accessline 59
method="POST") with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp: return json.load(resp) - Network accessline 60
with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp: - Access to secretsline 135
[Credential-related source omitted] - Access to secretsline 138
[Credential-related source omitted]
skills/fireworks-inference/scripts/fw_smoke.py
- Executable scriptline 1
#!/usr/bin/env python3 - Network accessline 10
transports routes raw plain HTTP POST direct https://api.fireworks.ai/inference/v1 - Network accessline 11
raw plain HTTP POST direct https://api.fireworks.ai/inference/v1 - Network accessline 12
[Credential-related source omitted] - Access to secretsline 12
[Credential-related source omitted] - Network accessline 13
lite litellm.completion gateway https://aigateway.leanmcp.com/v1/fireworks - Access to secretsline 14
[Credential-related source omitted] - Network accessline 41
DIRECT_BASE = "https://api.fireworks.ai/inference/v1" - Network accessline 42
GATEWAY_BASE = "https://aigateway.leanmcp.com/v1/fireworks" - Access to secretsline 47
[Credential-related source omitted] - Access to secretsline 55
[Credential-related source omitted] - Network accessline 122
[Credential-related source omitted] - Network accessline 123
[Credential-related source omitted] - Network accessline 124
[Credential-related source omitted] - Access to secretsline 156
[Credential-related source omitted] - Access to secretsline 197
[Credential-related source omitted] - Access to secretsline 233
[Credential-related source omitted] - Access to secretsline 237
[Credential-related source omitted] - Network accessline 240
print(f"ERROR: {keyname} is not set (shell env or a repo .env).") if not args.direct: print(" Gateway keys: https://app.leanmcp.com/api-keys " - Network accessline 241
if not args.direct: print(" Gateway keys: https://app.leanmcp.com/api-keys " "(top up first at https://app.leanmcp.com/billing)") - Network accessline 242
print(" Gateway keys: https://app.leanmcp.com/api-keys " - Network accessline 243
"(top up first at https://app.leanmcp.com/billing)") - Network accessline 269
print(f"\nAll transports reached {model} via {route}.") if not args.direct: print("The request should now appear at https://app.leanmcp.com/observability") - Network accessline 270
if not args.direct: print("The request should now appear at https://app.leanmcp.com/observability") return 0 - Network accessline 271
print("The request should now appear at https://app.leanmcp.com/observability")
skills/godot-city-game-3d/references/deploy.md
- Network accessline 90
Render on a cloud GPU, encode to H.264 with the GPU's NVENC chip, ship video to a browser over WebRTC, send input back. The mature open-source stack is [Selkies](https://github.com/selkies-project/selkies) — started by Google - Network accessline 91
a browser over WebRTC, send input back. The mature open-source stack is [Selkies](https://github.com/selkies-project/selkies) — started by Google engineers; effectively self-hosted Stadia. - Network accessline 92
[Selkies](https://github.com/selkies-project/selkies) — started by Google
skills/godot-city-game-3d/scripts/bootstrap_project.py
skills/godot-city-game-3d/scripts/build_assets.sh
- Executable scriptline 1
#!/usr/bin/env bash - Network accessline 33
fi [[ -n "${BLENDER:-}" && -x "$BLENDER" ]] || die "Blender not found. Install from https://www.blender.org/download/ (free, GPL), or: - Network accessline 34
[[ -n "${BLENDER:-}" && -x "$BLENDER" ]] || die "Blender not found. Install from https://www.blender.org/download/ (free, GPL), or: BLENDER=/path/to/blender bash $0" - Network accessline 35
Install from https://www.blender.org/download/ (free, GPL), or: - Dangerous shell operationline 53
trap 'rm -f "$LOG"' EXIT
skills/godot-city-game-3d/scripts/check_project.sh
skills/godot-city-game-3d/scripts/cloud/deploy_game.sh
- Executable scriptline 1
#!/usr/bin/env bash - Dangerous shell operationline 40
gcloud compute ssh "$NAME" --zone="$ZONE" --command 'sudo systemctl restart godot-stream && sleep 3 && sudo systemctl is-active godot-stream' - Dangerous shell operationline 41
'sudo systemctl restart godot-stream && sleep 3 && sudo systemctl is-active godot-stream' - Network accessline 44
--format='get(networkInterfaces[0].accessConfigs[0].natIP)')" echo echo "${GREEN}Play at:${OFF} http://${IP}:8080 (player / changeme)" - Network accessline 45
echo echo "${GREEN}Play at:${OFF} http://${IP}:8080 (player / changeme)" echo "${YELLOW}Stop billing when done:${OFF} bash cloud/stop.sh" - Network accessline 46
echo "${GREEN}Play at:${OFF} http://${IP}:8080 (player / changeme)"
skills/godot-city-game-3d/scripts/cloud/provision_gcp.sh
- Executable scriptline 1
#!/usr/bin/env bash - Network accessline 27
command -v gcloud >/dev/null || die "gcloud not found. Install: brew install --cask google-cloud-sdk (or https://cloud.google.com/sdk)" - Network accessline 28
brew install --cask google-cloud-sdk (or https://cloud.google.com/sdk)" - Network accessline 50
if [[ -n "$LIMIT" && "${LIMIT%%.*}" == "0" ]]; then die "GPU quota for $QUOTA in $REGION is 0. Request an increase: https://console.cloud.google.com/iam-admin/quotas - Network accessline 51
die "GPU quota for $QUOTA in $REGION is 0. Request an increase: https://console.cloud.google.com/iam-admin/quotas Filter on '$QUOTA', select $REGION, Edit Quotas, ask for 1. - Network accessline 52
Request an increase: https://console.cloud.google.com/iam-admin/quotas - Dangerous shell operationline 98
gcloud compute ssh ${NAME} --zone=${ZONE} \ --command='sudo journalctl -u google-startup-scripts -f' - Dangerous shell operationline 99
--command='sudo journalctl -u google-startup-scripts -f' - Network accessline 103
bash cloud/deploy_game.sh open http://${IP}:8080 # user: player / changeme - Network accessline 104
open http://${IP}:8080 # user: player / changeme
skills/godot-city-game-3d/scripts/cloud/setup_host.sh
- Executable scriptline 1
#!/usr/bin/env bash - Network accessline 20
GODOT_VERSION="$(curl -fsS -H 'Metadata-Flavor: Google' \ - Network accessline 21
'http://metadata.google.internal/computeMetadata/v1/instance/attributes/godot-version' \ - Network accessline 25
apt-get update apt-get install -y --no-install-recommends \ curl ca-certificates gnupg lsb-release \ - Network accessline 26
apt-get install -y --no-install-recommends curl ca-certificates gnupg lsb-release - Network accessline 27
curl ca-certificates gnupg lsb-release \ - Network accessline 33
[Credential-related source omitted] - Access to secretsline 33
[Credential-related source omitted] - Network accessline 34
https://developer.download.nvidia.com/compute/cuda/repos/ubuntu2404/x86_64/cuda-keyring_1.1-1_all.deb - Access to secretsline 35
[Credential-related source omitted] - Network accessline 40
install -m 0755 -d /etc/apt/keyrings curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc - Network accessline 41
curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyrings/docker.asc - Network accessline 42
chmod a+r /etc/apt/keyrings/docker.asc echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] \ https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" \ - Network accessline 43
echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" - Network accessline 44
https://download.docker.com/linux/ubuntu $(. /etc/os-release && echo "$VERSION_CODENAME") stable" \ - Network accessline 47
[Credential-related source omitted] - Access to secretsline 47
[Credential-related source omitted] - Network accessline 48
[Credential-related source omitted] - Access to secretsline 48
[Credential-related source omitted] - Network accessline 49
[Credential-related source omitted] - Access to secretsline 49
[Credential-related source omitted] - Network accessline 50
[Credential-related source omitted] - Access to secretsline 50
[Credential-related source omitted] - Network accessline 60
cd /opt curl -fsSL -o godot.zip \ - Network accessline 61
curl -fsSL -o godot.zip \ - Network accessline 62
"https://github.com/godotengine/godot/releases/download/${GODOT_VERSION}-stable/Godot_v${GODOT_VERSION}-stable_linux.x86_64.zip" - Dangerous shell operationline 66
rm godot.zip - Dangerous shell operationline 81
ExecStartPre=-/usr/bin/docker rm -f godot-stream
skills/godot-city-game-3d/scripts/cloud/stop.sh
- Executable scriptline 1
#!/usr/bin/env bash
skills/godot-city-game-3d/scripts/ensure_export_presets.py
- Executable scriptline 1
#!/usr/bin/env python3
skills/godot-city-game-3d/scripts/export_web.sh
skills/godot-city-game-3d/scripts/import_assets.sh
- Executable scriptline 1
#!/usr/bin/env bash
skills/godot-city-game-3d/scripts/install_godot.sh
- Executable scriptline 1
#!/usr/bin/env bash - Network accessline 33
else TMP="$(mktemp -d)" curl -fsSL -o "$TMP/godot.zip" \ - Network accessline 34
TMP="$(mktemp -d)" curl -fsSL -o "$TMP/godot.zip" \ "https://github.com/godotengine/godot/releases/download/${GODOT_VERSION}-stable/Godot_v${GODOT_VERSION}-stable_macos.universal.zip" - Network accessline 35
curl -fsSL -o "$TMP/godot.zip" \ - Network accessline 36
"https://github.com/godotengine/godot/releases/download/${GODOT_VERSION}-stable/Godot_v${GODOT_VERSION}-stable_macos.universal.zip" - Dangerous shell operationline 38
rm -rf "$TMP" - Network accessline 52
esac TMP="$(mktemp -d)" curl -fsSL -o "$TMP/godot.zip" \ - Network accessline 53
TMP="$(mktemp -d)" curl -fsSL -o "$TMP/godot.zip" \ "https://github.com/godotengine/godot/releases/download/${GODOT_VERSION}-stable/Godot_v${GODOT_VERSION}-stable_${SUFFIX}.zip" - Network accessline 54
curl -fsSL -o "$TMP/godot.zip" \ - Network accessline 55
"https://github.com/godotengine/godot/releases/download/${GODOT_VERSION}-stable/Godot_v${GODOT_VERSION}-stable_${SUFFIX}.zip" - Dangerous shell operationline 60
rm -rf "$TMP" - Network accessline 91
say "Installing export templates ${FULL}" TMP="$(mktemp -d)" curl -fsSL -o "$TMP/tpz.zip" \ - Network accessline 92
TMP="$(mktemp -d)" curl -fsSL -o "$TMP/tpz.zip" \ "https://github.com/godotengine/godot/releases/download/${FULL}-stable/Godot_v${FULL}-stable_export_templates.tpz" \ - Network accessline 93
curl -fsSL -o "$TMP/tpz.zip" \ - Network accessline 94
"https://github.com/godotengine/godot/releases/download/${FULL}-stable/Godot_v${FULL}-stable_export_templates.tpz" \ - Network accessline 95
|| die "could not download templates for ${FULL}. Check the version exists at https://github.com/godotengine/godot/releases" mkdir -p "$DEST" - Network accessline 96
https://github.com/godotengine/godot/releases" - Dangerous shell operationline 101
rm -rf "$TMP"
skills/godot-city-game-3d/scripts/lib.sh
- Executable scriptline 1
#!/usr/bin/env bash
skills/godot-city-game-3d/scripts/run.sh
- Executable scriptline 1
#!/usr/bin/env bash
skills/godot-city-game-3d/scripts/serve_web.py
- Executable scriptline 1
#!/usr/bin/env python3 - Network accessline 60
socketserver.TCPServer.allow_reuse_address = True with socketserver.TCPServer((args.bind, args.port), Handler) as httpd: print(f"serving {os.getcwd()} on http://localhost:{args.port}") - Network accessline 61
with socketserver.TCPServer((args.bind, args.port), Handler) as httpd: print(f"serving {os.getcwd()} on http://localhost:{args.port}") print("COOP/COEP headers are set -- SharedArrayBuffer will be available") - Network accessline 62
print(f"serving {os.getcwd()} on http://localhost:{args.port}")
skills/ios-bootstrap-testflight/references/bootstrap.md
- Dangerous shell operationline 7
sudo xcode-select -s /Applications/Xcode.app/Contents/Developer - Dangerous shell operationline 8
sudo xcodebuild -license accept - Dangerous shell operationline 9
sudo xcodebuild -runFirstLaunch - Dangerous shell operationline 98
already committed — use `git rm -r --cached build/` for those.
skills/ios-bootstrap-testflight/references/testflight.md
- Network accessline 31
https://appstoreconnect.apple.com/access/integrations/api → Team Keys → **+**, - Network accessline 45
1. Set `DEVELOPMENT_TEAM` and a unique `PRODUCT_BUNDLE_IDENTIFIER`. 2. Create the app record: https://appstoreconnect.apple.com/apps → **+** → - Network accessline 46
2. Create the app record: https://appstoreconnect.apple.com/apps → **+** →
skills/ios-bootstrap-testflight/scripts/run.sh
skills/ios-bootstrap-testflight/scripts/screenshots.sh
- Executable scriptline 1
#!/usr/bin/env bash
skills/ios-bootstrap-testflight/scripts/upload_testflight.sh
- Executable scriptline 1
#!/usr/bin/env bash - Dangerous shell operationline 63
sudo xcode-select -s /Applications/Xcode.app/Contents/Developer" - Dangerous shell operationline 128
rm -rf "$ARCHIVE_PATH" "$EXPORT_DIR" - Network accessline 144
cat > "$EXPORT_OPTIONS" <<PLIST <?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> - Network accessline 145
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> <plist version="1.0"> - Network accessline 146
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> - Network accessline 193
say "Uploaded $CURRENT_VERSION ($TARGET_BUILD)" echo "Processing takes 5-30 min. Track it at:" echo " https://appstoreconnect.apple.com/apps" - Network accessline 194
echo "Processing takes 5-30 min. Track it at:" echo " https://appstoreconnect.apple.com/apps" echo - Network accessline 195
echo " https://appstoreconnect.apple.com/apps"
skills/leanmcp-builder/SKILL.md
skills/leanmcp-builder/assets/main.ts
- Executable scriptline 1
Executable file
skills/leanmcp-builder/assets/mcp-example-index.ts
- Executable scriptline 1
Executable file
skills/leanmcp-builder/assets/package.json
skills/leanmcp-builder/references/decorators.md
skills/mcp-apps-builder/assets/Dashboard.tsx
- Executable scriptline 1
Executable file
skills/mcp-apps-builder/assets/main.ts
- Executable scriptline 1
Executable file
skills/mcp-apps-builder/assets/mcp-dashboard-index.ts
- Executable scriptline 1
Executable file
skills/mcp-apps-builder/assets/package.json
skills/mcp-builder/SKILL.md
- Access to secretsline 72
[Credential-related source omitted] - Network accessline 264
city: { type: 'string', description: 'City name' } }, async ({ city }) => { const response = await fetch(`https://api.weather.com/v1/current?city=${encodeURIComponent(city)}&key=${process.env.WEATHER_API_KEY}`); - Network accessline 265
}, async ({ city }) => { const response = await fetch(`https://api.weather.com/v1/current?city=${encodeURIComponent(city)}&key=${process.env.WEATHER_API_KEY}`); const data = await response.json(); - Network accessline 266
[Credential-related source omitted] - Access to secretsline 266
[Credential-related source omitted]
skills/mcp-builder/assets/mcp-server.ts
- Executable scriptline 1
Executable file
skills/mcp-builder/assets/package.json
skills/mcp-builder/assets/server.ts
- Executable scriptline 1
Executable file
skills/mcp-builder/references/patterns.md
- Network accessline 70
userId: { type: 'string', description: 'User ID' } }, async ({ userId }) => { const response = await fetch(`${API_BASE}/users/${userId}`, { - Network accessline 71
[Credential-related source omitted] - Network accessline 72
const response = await fetch(`${API_BASE}/users/${userId}`, { - Access to secretsline 73
[Credential-related source omitted]
skills/posthog-adblock-bypass/SKILL.md
- Network accessline 22
1. The project is **Next.js** (App Router or Pages Router both fine) with `posthog-js` from npm. 2. Server-side: `curl -I https://<api_host>/static/dead-clicks-autocapture.js?v=1.x` returns 200. If it returns 404, the upstream proxy is misc - Network accessline 23
2. Server-side: `curl -I https://<api_host>/static/dead-clicks-autocapture.js?v=1.x` returns 200. If it returns 404, the upstream proxy is misconfigured — **fix that first**, this skill won't help. - Network accessline 37
const PH_ASSETS = "https://us-assets.i.posthog.com"; // EU: "https://eu-assets.i.posthog.com" - Network accessline 101
- The `__phRewriteInstalled` flag is required because Next.js dev HMR can re-execute modules and `Object.defineProperty` would otherwise throw. - Stripping the host (replacing the entire URL with `/_p/dc.js?v=...`) makes the request same-or - Network accessline 103
- The patcher targets the `src` property setter on the prototype — posthog-js loads chunks by setting `script.src`, so this catches them. It does **not** catch `fetch()` or dynamic `import()` (not used by posthog-js for these chunks today, - Access to secretsline 120
[Credential-related source omitted] - Network accessline 136
curl -I "https://<your-domain>/_p/dc.js?v=1.0" - Network accessline 137
curl -I "https://<your-domain>/_p/r2.js?v=1.0"
skills/posthog-adblock-bypass/posthog-adblock-bypass.md
- Network accessline 28
// next.config.js const PH_ASSETS = 'https://us-assets.i.posthog.com'; // US cloud - Network accessline 29
const PH_ASSETS = 'https://us-assets.i.posthog.com'; // US cloud - Network accessline 96
useEffect(() => { posthog.init(process.env.NEXT_PUBLIC_POSTHOG_KEY!, { api_host: 'https://api.agentruntime.app', // unchanged - Network accessline 97
[Credential-related source omitted] - Access to secretsline 97
[Credential-related source omitted] - Network accessline 98
api_host: 'https://api.agentruntime.app', // unchanged - Network accessline 118
// next.config.js const PH_API = 'https://us.i.posthog.com'; // events, decide, capture, etc. - Network accessline 119
const PH_API = 'https://us.i.posthog.com'; // events, decide, capture, etc. - Network accessline 120
const PH_ASSETS = 'https://us-assets.i.posthog.com'; // /static/* - Network accessline 147
[Credential-related source omitted] - Access to secretsline 147
[Credential-related source omitted] - Network accessline 148
api_host: 'https://your-app.example.com/_p/api', // <-- changed - Network accessline 154
You'll also want the rewriter to strip the host on `/static/*` requests so the SDK's lazy-loaded chunks land on `/_p/static/<file>` (same-origin), not `https://your-app.example.com/_p/api/static/<file>`. Either configure `assets_host` on th - Network accessline 208
# Server side curl -I "https://your-app.example.com/_p/dc.js?v=1.372.10" - Network accessline 209
curl -I "https://your-app.example.com/_p/dc.js?v=1.372.10" - Network accessline 210
curl -I "https://your-app.example.com/_p/r2.js?v=1.372.10" - Network accessline 246
| `next.config.js` | Add the three aliases + `/_p/static/:path*` + `/_p/api/:path*` rewrites | | `lib/posthog-rewrite-loader.ts` | Same patcher (still needed for the three blocker-flagged filenames) | | Your PostHog provider | Same patcher - Network accessline 248
| Your PostHog provider | Same patcher call **and** `api_host: 'https://your-app.example.com/_p/api'` |
skills/research-observability/assets/_common_eval.sh
- Executable scriptline 1
#!/usr/bin/env bash - Access to secretsline 71
[Credential-related source omitted] - Access to secretsline 72
[Credential-related source omitted] - Access to secretsline 73
[Credential-related source omitted] - Access to secretsline 75
[Credential-related source omitted] - Access to secretsline 76
[Credential-related source omitted] - Access to secretsline 78
[Credential-related source omitted] - Access to secretsline 79
[Credential-related source omitted] - Access to secretsline 81
[Credential-related source omitted] - Access to secretsline 82
[Credential-related source omitted] - Access to secretsline 85
[Credential-related source omitted] - Access to secretsline 86
[Credential-related source omitted]
skills/research-observability/references/platforms.md
skills/research-observability/references/runner-scripts.md
- Access to secretsline 60
[Credential-related source omitted]
skills/research-observability/scripts/obs.py
- Executable scriptline 1
#!/usr/bin/env python3
skills/research-observability/scripts/obs_adapters.py
- Executable scriptline 1
#!/usr/bin/env python3
skills/research-observability/scripts/obs_import.py
- Executable scriptline 1
#!/usr/bin/env python3
skills/research-observability/scripts/obs_report.py
- Executable scriptline 1
#!/usr/bin/env python3
skills/research-observability/scripts/view_trace.py
- Executable scriptline 1
#!/usr/bin/env python3
skills/research-observability/scripts/view_trace_tui.py
- Executable scriptline 1
#!/usr/bin/env python3
skills/research-paper-integrity/references/ai-writing-policy.md
skills/research-paper-integrity/scripts/check_prose.py
- Executable scriptline 1
#!/usr/bin/env python3
skills/security-repro/scripts/check_patched.py
- Executable scriptline 1
#!/usr/bin/env python3 - Network accessline 19
NVD = "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=" - Network accessline 20
CVEORG = "https://cveawg.mitre.org/api/cve/" - Network accessline 23
def get(url, headers=None): req = urllib.request.Request(url, headers=headers or {"User-Agent": "security-repro"}) - Network accessline 24
req = urllib.request.Request(url, headers=headers or {"User-Agent": "security-repro"}) - Network accessline 25
with urllib.request.urlopen(req, timeout=30) as r: - Access to secretsline 38
[Credential-related source omitted] - Access to secretsline 39
[Credential-related source omitted]
skills/security-repro/scripts/fetch_cve.py
- Executable scriptline 1
#!/usr/bin/env python3 - Network accessline 16
API = "https://cveawg.mitre.org/api/cve/" - Network accessline 21
raise SystemExit("usage: fetch_cve.py CVE-YYYY-NNNN") cve = sys.argv[1].upper() req = urllib.request.Request(API + cve, headers={"User-Agent": "security-repro"}) - Network accessline 22
cve = sys.argv[1].upper() req = urllib.request.Request(API + cve, headers={"User-Agent": "security-repro"}) try: - Network accessline 23
req = urllib.request.Request(API + cve, headers={"User-Agent": "security-repro"}) - Network accessline 24
try: with urllib.request.urlopen(req, timeout=30) as r: data = json.load(r) - Network accessline 25
with urllib.request.urlopen(req, timeout=30) as r:
skills/security-repro/scripts/fetch_nvd.py
- Executable scriptline 1
#!/usr/bin/env python3 - Access to secretsline 9
[Credential-related source omitted] - Network accessline 17
API = "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=" - Network accessline 22
raise SystemExit("usage: fetch_nvd.py CVE-YYYY-NNNN") cve = sys.argv[1].upper() req = urllib.request.Request(API + cve, headers={"User-Agent": "security-repro"}) - Network accessline 23
cve = sys.argv[1].upper() req = urllib.request.Request(API + cve, headers={"User-Agent": "security-repro"}) key = os.environ.get("NVD_API_KEY") - Network accessline 24
req = urllib.request.Request(API + cve, headers={"User-Agent": "security-repro"}) - Access to secretsline 25
[Credential-related source omitted] - Network accessline 27
req.add_header("apiKey", key) try: with urllib.request.urlopen(req, timeout=30) as r: - Network accessline 28
try: with urllib.request.urlopen(req, timeout=30) as r: data = json.load(r) - Network accessline 29
with urllib.request.urlopen(req, timeout=30) as r:
skills/tinker-training-inference/SKILL.md
- Access to secretsline 3
[Credential-related source omitted] - Network accessline 24
That writes `TINKER_PRICING.md` — the full catalogue, what each operation meters, and the pre-launch checklist. It is a **snapshot**: verify against the live catalogue at <https://tinker-docs.thinkingmachines.ai/tinker/models/>, and - Network accessline 25
meters, and the pre-launch checklist. It is a **snapshot**: verify against the live catalogue at <https://tinker-docs.thinkingmachines.ai/tinker/models/>, and regenerate with `--force` when it moves. Then: - Network accessline 26
live catalogue at <https://tinker-docs.thinkingmachines.ai/tinker/models/>, and - Access to secretsline 30
[Credential-related source omitted] - Access to secretsline 67
[Credential-related source omitted] - Network accessline 151
- Docs and model catalogue: <https://tinker-docs.thinkingmachines.ai/tinker/models/> - Network accessline 152
- CLI reference: <https://tinker-docs.thinkingmachines.ai/tinker/cli/checkpoint/> - Network accessline 153
- Console / API keys: <https://console.tinker.ai>
skills/tinker-training-inference/assets/TINKER_PRICING.md
- Network accessline 3
> Snapshot. Prices per 1M tokens (USD), effective July 17. > **Verify against the live catalogue before relying on a number here — models > retire and prices move:** <https://tinker-docs.thinkingmachines.ai/tinker/models/> - Network accessline 4
> **Verify against the live catalogue before relying on a number here — models > retire and prices move:** <https://tinker-docs.thinkingmachines.ai/tinker/models/> > - Network accessline 5
> retire and prices move:** <https://tinker-docs.thinkingmachines.ai/tinker/models/> - Network accessline 79
Console: <https://console.tinker.ai> · Docs: <https://tinker-docs.thinkingmachines.ai/tinker/models/>
skills/tinker-training-inference/references/checkpoints.md
- Network accessline 82
`tinker -h` / `tinker checkpoint -h` prints live help for your installed version. Docs: <https://tinker-docs.thinkingmachines.ai/tinker/cli/checkpoint/> - Network accessline 83
Docs: <https://tinker-docs.thinkingmachines.ai/tinker/cli/checkpoint/> - Network accessline 96
with urllib.request.urlopen(url_resp.url, timeout=120) as r, open(tar_path, "wb") as f:
skills/tinker-training-inference/references/inference.md
skills/tinker-training-inference/references/pricing.md
skills/tinker-training-inference/references/setup.md
- Network accessline 6
[Credential-related source omitted] - Network accessline 7
[Credential-related source omitted] - Access to secretsline 7
[Credential-related source omitted] - Access to secretsline 14
[Credential-related source omitted] - Access to secretsline 15
[Credential-related source omitted] - Access to secretsline 16
[Credential-related source omitted] - Access to secretsline 25
[Credential-related source omitted] - Network accessline 71
The live catalogue — sizes, context windows, prices — is at <https://tinker-docs.thinkingmachines.ai/tinker/models/>. `scripts/tinker_pricing.py list` - Network accessline 72
<https://tinker-docs.thinkingmachines.ai/tinker/models/>. `scripts/tinker_pricing.py list` - Access to secretsline 126
[Credential-related source omitted]
skills/tinker-training-inference/scripts/tinker_infer.py
- Executable scriptline 1
#!/usr/bin/env python3 - Access to secretsline 20
[Credential-related source omitted] - Network accessline 35
BASE_URL = "https://tinker.thinkingmachines.dev/services/tinker-prod/oai/api/v1" - Access to secretsline 77
[Credential-related source omitted] - Access to secretsline 114
[Credential-related source omitted] - Access to secretsline 115
[Credential-related source omitted]
skills/tinker-training-inference/scripts/tinker_pricing.py
- Executable scriptline 1
#!/usr/bin/env python3 - Network accessline 37
ALWAYS re-check against the live catalogue before trusting a number here: https://tinker-docs.thinkingmachines.ai/tinker/models/ - Network accessline 38
https://tinker-docs.thinkingmachines.ai/tinker/models/ - Network accessline 51
DOCS_URL = "https://tinker-docs.thinkingmachines.ai/tinker/models/" - Network accessline 52
CONSOLE_URL = "https://console.tinker.ai"
skills/tinker-training-inference/scripts/tinker_rl.py
skills/tinker-training-inference/scripts/tinker_sft.py
skills/vuln-repro/assets/harness_template.py
- Executable scriptline 1
#!/usr/bin/env python3
skills/vuln-repro/references/sourcing.md
- Access to secretsline 37
[Credential-related source omitted]
skills/vuln-repro/scripts/check_patched.py
- Executable scriptline 1
#!/usr/bin/env python3 - Network accessline 19
NVD = "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=" - Network accessline 20
CVEORG = "https://cveawg.mitre.org/api/cve/" - Network accessline 23
def get(url, headers=None): req = urllib.request.Request(url, headers=headers or {"User-Agent": "vuln-repro"}) - Network accessline 24
req = urllib.request.Request(url, headers=headers or {"User-Agent": "vuln-repro"}) - Network accessline 25
with urllib.request.urlopen(req, timeout=30) as r: - Access to secretsline 38
[Credential-related source omitted] - Access to secretsline 39
[Credential-related source omitted]
skills/vuln-repro/scripts/fetch_cve.py
- Executable scriptline 1
#!/usr/bin/env python3 - Network accessline 16
API = "https://cveawg.mitre.org/api/cve/" - Network accessline 21
raise SystemExit("usage: fetch_cve.py CVE-YYYY-NNNN") cve = sys.argv[1].upper() req = urllib.request.Request(API + cve, headers={"User-Agent": "vuln-repro"}) - Network accessline 22
cve = sys.argv[1].upper() req = urllib.request.Request(API + cve, headers={"User-Agent": "vuln-repro"}) try: - Network accessline 23
req = urllib.request.Request(API + cve, headers={"User-Agent": "vuln-repro"}) - Network accessline 24
try: with urllib.request.urlopen(req, timeout=30) as r: data = json.load(r) - Network accessline 25
with urllib.request.urlopen(req, timeout=30) as r:
skills/vuln-repro/scripts/fetch_nvd.py
- Executable scriptline 1
#!/usr/bin/env python3 - Access to secretsline 9
[Credential-related source omitted] - Network accessline 17
API = "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=" - Network accessline 22
raise SystemExit("usage: fetch_nvd.py CVE-YYYY-NNNN") cve = sys.argv[1].upper() req = urllib.request.Request(API + cve, headers={"User-Agent": "vuln-repro"}) - Network accessline 23
cve = sys.argv[1].upper() req = urllib.request.Request(API + cve, headers={"User-Agent": "vuln-repro"}) key = os.environ.get("NVD_API_KEY") - Network accessline 24
req = urllib.request.Request(API + cve, headers={"User-Agent": "vuln-repro"}) - Access to secretsline 25
[Credential-related source omitted] - Network accessline 27
req.add_header("apiKey", key) try: with urllib.request.urlopen(req, timeout=30) as r: - Network accessline 28
try: with urllib.request.urlopen(req, timeout=30) as r: data = json.load(r) - Network accessline 29
with urllib.request.urlopen(req, timeout=30) as r:
skills/vuln-repro/scripts/fetch_osv.py
- Executable scriptline 1
#!/usr/bin/env python3 - Network accessline 18
VULN = "https://api.osv.dev/v1/vulns/" - Network accessline 19
QUERY = "https://api.osv.dev/v1/query" - Network accessline 22
def post(url, payload): req = urllib.request.Request( - Network accessline 23
req = urllib.request.Request( - Network accessline 24
url, data=json.dumps(payload).encode(), headers={"User-Agent": "vuln-repro", "Content-Type": "application/json"}) with urllib.request.urlopen(req, timeout=30) as r: - Network accessline 25
headers={"User-Agent": "vuln-repro", "Content-Type": "application/json"}) with urllib.request.urlopen(req, timeout=30) as r: return json.load(r) - Network accessline 26
with urllib.request.urlopen(req, timeout=30) as r: - Network accessline 30
def get(url): req = urllib.request.Request(url, headers={"User-Agent": "vuln-repro"}) - Network accessline 31
req = urllib.request.Request(url, headers={"User-Agent": "vuln-repro"}) - Network accessline 32
with urllib.request.urlopen(req, timeout=30) as r:
skills/vuln-repro/scripts/minimize.py
- Executable scriptline 1
#!/usr/bin/env python3
skills/vuln-repro/scripts/triage.py
- Executable scriptline 1
#!/usr/bin/env python3 - Access to secretsline 17
[Credential-related source omitted] - Network accessline 25
NVD = "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=" - Network accessline 26
CVEORG = "https://cveawg.mitre.org/api/cve/" - Network accessline 27
OSV = "https://api.osv.dev/v1/vulns/" - Network accessline 34
def get(url, headers=None): req = urllib.request.Request(url, headers={**UA, **(headers or {})}) - Network accessline 35
req = urllib.request.Request(url, headers={**UA, **(headers or {})}) - Network accessline 36
with urllib.request.urlopen(req, timeout=30) as r: - Access to secretsline 52
[Credential-related source omitted]
How the signals fit together
Facts from a static read of the files at the pinned commit. They describe what the code does, not why.
Some files could not be read; the facts below still hold.
Declared and executed: 21 facts
- Contacts godotengine.org, which SKILL.md, the README and the plugin manifest do not mentiongodot-city-game-3d/scripts/bootstrap_project.py:47High confidence
- Contacts www.blender.org, which SKILL.md, the README and the plugin manifest do not mentiongodot-city-game-3d/scripts/build_assets.sh:35High confidence
- Contacts cloud.google.com, which SKILL.md, the README and the plugin manifest do not mentiongodot-city-game-3d/scripts/cloud/provision_gcp.sh:28High confidence
- Contacts console.cloud.google.com, which SKILL.md, the README and the plugin manifest do not mentiongodot-city-game-3d/scripts/cloud/provision_gcp.sh:52High confidence
- Contacts metadata.google.internal, which SKILL.md, the README and the plugin manifest do not mentiongodot-city-game-3d/scripts/cloud/setup_host.sh:21High confidence
- Contacts developer.download.nvidia.com, which SKILL.md, the README and the plugin manifest do not mentiongodot-city-game-3d/scripts/cloud/setup_host.sh:34High confidence
- Contacts download.docker.com, which SKILL.md, the README and the plugin manifest do not mentiongodot-city-game-3d/scripts/cloud/setup_host.sh:41High confidence
- Contacts nvidia.github.io, which SKILL.md, the README and the plugin manifest do not mentiongodot-city-game-3d/scripts/cloud/setup_host.sh:47High confidence
- Contacts github.com, which SKILL.md, the README and the plugin manifest do not mentiongodot-city-game-3d/scripts/cloud/setup_host.sh:62High confidence
- Contacts github.com, which SKILL.md, the README and the plugin manifest do not mentiongodot-city-game-3d/scripts/install_godot.sh:36High confidence
- Contacts www.apple.com, which SKILL.md, the README and the plugin manifest do not mentionios-bootstrap-testflight/scripts/upload_testflight.sh:146High confidence
- Contacts appstoreconnect.apple.com, which SKILL.md, the README and the plugin manifest do not mentionios-bootstrap-testflight/scripts/upload_testflight.sh:195High confidence
- Contacts services.nvd.nist.gov, which SKILL.md, the README and the plugin manifest do not mentionsecurity-repro/scripts/check_patched.py:19High confidence
- Contacts cveawg.mitre.org, which SKILL.md, the README and the plugin manifest do not mentionsecurity-repro/scripts/check_patched.py:20High confidence
- Contacts cveawg.mitre.org, which SKILL.md, the README and the plugin manifest do not mentionsecurity-repro/scripts/fetch_cve.py:16High confidence
- Contacts services.nvd.nist.gov, which SKILL.md, the README and the plugin manifest do not mentionsecurity-repro/scripts/fetch_nvd.py:17High confidence
- Contacts tinker.thinkingmachines.dev, which SKILL.md, the README and the plugin manifest do not mentiontinker-training-inference/scripts/tinker_infer.py:35High confidence
- Contacts services.nvd.nist.gov, which SKILL.md, the README and the plugin manifest do not mentionvuln-repro/scripts/check_patched.py:19High confidence
- Contacts cveawg.mitre.org, which SKILL.md, the README and the plugin manifest do not mentionvuln-repro/scripts/check_patched.py:20High confidence
- Contacts cveawg.mitre.org, which SKILL.md, the README and the plugin manifest do not mentionvuln-repro/scripts/fetch_cve.py:16High confidence
- Contacts services.nvd.nist.gov, which SKILL.md, the README and the plugin manifest do not mentionvuln-repro/scripts/fetch_nvd.py:17High confidence
Signal confidence: 479 facts
- Network access in code of documentationclaude-code-skills/06-commenting-style.md:278Low confidence
- Network access in prose of documentationclaude-code-skills/README.md:3Low confidence
- Executable script in code of a file that runsanalyze-exports/scripts/analyze_failures.py:1High confidence
- Executable script in code of a file that runsanalyze-exports/scripts/parse_export.py:1High confidence
- Network access in prose of the SKILL.mdcode-explanation/SKILL.md:41Low confidence
- Network access in prose of the SKILL.mdcode-explanation/SKILL.md:42Low confidence
- Network access in prose of the SKILL.mdcode-explanation/SKILL.md:43Low confidence
- Network access in code of the SKILL.mdcode-explanation/SKILL.md:141High confidence
- Network access in code of the SKILL.mdcode-explanation/SKILL.md:142High confidence
- Network access in code of the SKILL.mdcode-explanation/SKILL.md:143High confidence
- Access to secrets in the frontmatter of the SKILL.md: a variable, placeholder or call, not a stored valuefireworks-inference/SKILL.md:3Low confidence
- Network access in prose of the SKILL.mdfireworks-inference/SKILL.md:24Low confidence
- Network access in prose of the SKILL.mdfireworks-inference/SKILL.md:25Low confidence
- Network access in prose of the SKILL.mdfireworks-inference/SKILL.md:26Low confidence
- Access to secrets in prose of the SKILL.mdfireworks-inference/SKILL.md:26Low confidence
- Network access in prose of the SKILL.mdfireworks-inference/SKILL.md:27Low confidence
- Access to secrets in prose of the SKILL.mdfireworks-inference/SKILL.md:27Low confidence
- Network access in prose of the SKILL.mdfireworks-inference/SKILL.md:34Low confidence
- Network access in prose of the SKILL.mdfireworks-inference/SKILL.md:35Low confidence
- Network access in prose of the SKILL.mdfireworks-inference/SKILL.md:36Low confidence
- Network access in code of the SKILL.mdfireworks-inference/SKILL.md:96High confidence
- Network access in code of the SKILL.mdfireworks-inference/SKILL.md:97High confidence
- Network access in code of the SKILL.mdfireworks-inference/SKILL.md:98High confidence
- Access to secrets in code of the SKILL.md: a variable, placeholder or call, not a stored valuefireworks-inference/SKILL.md:99Low confidence
- Executable script in code of a file that runsfireworks-inference/assets/run_fireworks.sh:1High confidence
- Access to secrets in a comment of a file that runs: a variable, placeholder or call, not a stored valuefireworks-inference/assets/run_fireworks.sh:15Low confidence
- Network access in a comment of a file that runsfireworks-inference/assets/run_fireworks.sh:16Low confidence
- Access to secrets in a comment of a file that runsfireworks-inference/assets/run_fireworks.sh:16Low confidence
- Access to secrets in a comment of a file that runsfireworks-inference/assets/run_fireworks.sh:17Low confidence
- Network access in a comment of a file that runsfireworks-inference/assets/run_fireworks.sh:18Low confidence
- Network access in code of a file that runsfireworks-inference/assets/run_fireworks.sh:33High confidence
- Network access in code of a file that runsfireworks-inference/assets/run_fireworks.sh:34High confidence
- Access to secrets in code of a file that runs: a variable, placeholder or call, not a stored valuefireworks-inference/assets/run_fireworks.sh:55Low confidence
- Network access in code of a file that runsfireworks-inference/assets/run_fireworks.sh:58High confidence
- Network access in code of a file that runsfireworks-inference/assets/run_fireworks.sh:59High confidence
- Access to secrets in code of a file that runs: a variable, placeholder or call, not a stored valuefireworks-inference/assets/run_fireworks.sh:59Low confidence
- Network access in code of a file that runsfireworks-inference/assets/run_fireworks.sh:60High confidence
- Access to secrets in code of a file that runs: a variable, placeholder or call, not a stored valuefireworks-inference/assets/run_fireworks.sh:60Low confidence
- Network access in code of a file that runsfireworks-inference/assets/run_fireworks.sh:61High confidence
- Access to secrets in code of a file that runsfireworks-inference/assets/run_fireworks.sh:61High confidence
- Network access in code of a file that runsfireworks-inference/assets/run_fireworks.sh:62High confidence
- Network access in code of a file that runsfireworks-inference/assets/run_fireworks.sh:63High confidence
- Network access in code of a file that runsfireworks-inference/assets/run_fireworks.sh:64High confidence
- Network access in code of a file that runsfireworks-inference/assets/run_fireworks.sh:65High confidence
- Network access in code of a file that runsfireworks-inference/assets/run_fireworks.sh:66High confidence
- Access to secrets in code of a file that runs: a variable, placeholder or call, not a stored valuefireworks-inference/assets/run_fireworks.sh:66Low confidence
- Access to secrets in code of a file that runs: a variable, placeholder or call, not a stored valuefireworks-inference/assets/run_fireworks.sh:67Low confidence
- Access to secrets in code of a file that runs: a variable, placeholder or call, not a stored valuefireworks-inference/assets/run_fireworks.sh:69Low confidence
- Network access in code of a file that runsfireworks-inference/assets/run_fireworks.sh:89High confidence
- Network access in code of a file that runsfireworks-inference/assets/run_fireworks.sh:90High confidence
and 429 more
Only the first 500 facts are listed.
Works with
| Agent | Status | Evidence | Install to |
|---|---|---|---|
| Claude Code | Compatible | Standard SKILL.md claude-code-skills/SKILL.md | .claude/skills/<skill-name>/ |
| Codex | Compatible | Standard SKILL.md claude-code-skills/SKILL.md | .agents/skills/<skill-name>/ |
| Cursor | Compatible | Standard SKILL.md claude-code-skills/SKILL.md | .cursor/skills/<skill-name>/ |
| Gemini CLI | Compatible | Standard SKILL.md claude-code-skills/SKILL.md | .gemini/skills/<skill-name>/ |
| GitHub Copilot | Compatible | Standard SKILL.md claude-code-skills/SKILL.md | .github/skills/<skill-name>/ |
| OpenCode | Compatible | Standard SKILL.md claude-code-skills/SKILL.md | .opencode/skills/<skill-name>/ |
- Native The repository ships a manifest, folder or frontmatter field for this agent.
- Compatible A standard SKILL.md that this agent can read.
- Unknown No evidence either way.
Derived automatically from paths, manifests and frontmatter. Not tested on each agent.
Explore alternatives and comparisons
Add this badge to your README
It updates every night and links to this page.
[](https://hotskills.dev/skill/leanmcp-gateway-skills/)