jackson2w
UserWillie Jackson's Claude Code skills: Proxmox/homelab infra, Cloudflare development, web/design verification
Categories
Indexed Skills (46)
artifact-font-embedding
This skill should be used when the user asks to "show me font pairing options", "preview typography choices", "compare fonts", "mock up different fonts", or asks to see design/typography options rendered with real fonts inside a Claude Artifact. Also applies whenever a Worker/Artifact needs a Google Font and the CSP blocks external font requests. Covers sourcing real font files via Fontsource and embedding them as base64 @font-face data URIs so an Artifact renders the actual typeface rather than silently falling back to a system font.
cdp-layout-verification
This skill should be used when the user asks to "verify this looks right", "check the spacing/alignment/margin", "is this centered", "double check the CSS", "confirm the layout matches", or after any CSS/layout change on a web project where a screenshot alone would only be an eyeball check. It should also be used proactively whenever reporting a CSS fix as "verified" or "confirmed" — a headless screenshot is not sufficient verification for precise spacing, alignment, or color claims; only direct DOM measurement is.
cloudflare-pages-gotchas
This skill should be used when working on a Cloudflare Pages project with Pages Functions — debugging on-the-fly image resizing that won't work, a wrangler.toml with named [env.*] blocks where bindings mysteriously go missing in one environment, a crypto.subtle PBKDF2 call that throws in production but works locally, or a _redirects rule that silently never fires on a path a Function also handles. Trigger phrases include "pages images binding", "env.IMAGES", "wrangler.toml env production", "bindings missing in production", "PBKDF2 iterations error", "NotSupportedError iteration counts", "_redirects not working", "redirect skipped by functions", "pages function precedence".
cloudflare-workers-cron-email
This skill should be used when the user asks to debug a Cloudflare Workers Cron Trigger that "isn't firing" or "not running" (or fires on the wrong day), set up or troubleshoot the send_email binding or Email Routing destination addresses for Workers, size a Worker against Cloudflare's per-invocation subrequest limits, test a scheduled() handler locally against real R2/KV/email bindings, verify an R2 delete/rename actually took effect, or rename/reorganize keys in an R2 bucket. Trigger phrases include "cron trigger not firing", "scheduled worker not running", "cron ran on the wrong day", "wrangler cron", "cron trigger debug", "send_email binding", "Workers email binding", "Email Routing destination address", "workers subrequest limit", "test-scheduled --remote", "r2 object rename", "r2 delete not working", "r2 move objects".
cloudflare
Comprehensive Cloudflare platform skill covering Workers, Pages, storage (KV, D1, R2), AI (Workers AI, Vectorize, Agents SDK), feature flags (Flagship), networking (Tunnel, Spectrum), security (WAF, DDoS), and infrastructure-as-code (Terraform, Pulumi). Use for any Cloudflare development task. Biases towards retrieval from Cloudflare docs over pre-trained knowledge.
image-crop-focal-point
This skill should be used when the user asks to "fix this crop", "the photo is cut off", "set a focal point", "the preview is offset", "recrop this image", "the thumbnail cuts off the head", or any task requiring picking a normalized (x, y) focal point or CSS background-position so a specific subject stays in frame when an image is cropped to a different aspect ratio than its source.
proxmox-ansible-provisioning
This skill should be used when creating a new Proxmox LXC (pct create) or VM, writing or debugging Ansible playbooks that target Proxmox/Debian hosts (including Debian 13/trixie), or troubleshooting a Proxmox+Ansible workflow — a "storage 'local-lvm' does not exist" error, a "Systemd 257 detected" nesting warning, Ansible failing with a locale error inside a fresh LXC, an Ansible lineinfile task that keeps reporting changed on every run, writing multi-line config/YAML files to a remote host over SSH, an "apt-key or gpg binary is required" error from Ansible's apt_repository module, a Proxmox-family product (PVE/PBS/PMG) apt install failing with a 401 against enterprise.proxmox.com, Tailscale/anything needing `/dev/net/tun` stuck crash-looping inside an unprivileged LXC, any host device (GPU render node, USB dongle) bind-mounted into an unprivileged LXC showing up owned by `nobody:nogroup`, or an LXC's own dashboard/monitoring reporting a suspiciously high load average that doesn't match its actual workload. T
agent-command-approval-gate
This skill should be used when building or reviewing an approval gate that decides whether a self-hosted agent's shell command needs human approval — OpenClaw/Olu, Hermes/Chuka, or any agent whose exec tool needs a human in the loop for privileged or outbound actions. Covers the three command-matching designs and why only one is safe (substring over-gates, anchored regex under-gates, command-position tokenizer is correct by construction), the full wrapper-bypass catalogue, the heredoc/backtick false positive the tokenizer introduces and its provable fix, block-vs-gate as originating-vs-continuing, the refactor regression a unit harness structurally cannot catch, OpenClaw's 512-char approval cap, the three-case live-fire protocol, and drift detection for a gate living where no playbook deploys it. Built across `dfw` (OpenClaw `admin-changes-gate`) and `hermes` (Hermes `outbound-email-approval`) 2026-09-01 to 2026-09-05. Trigger phrases include "approval gate", "pre_tool_call hook", "before_tool_call", "gate ag
agent-delivery-canary
This skill should be used when building monitoring for a self-hosted always-on agent (OpenClaw/Olu, Hermes/Chuka, or a future one) that must catch failures the agent itself cannot report — silent non-delivery of a scheduled turn, a wedged or crash-looping gateway, or a fault already broken at baseline. Covers the delivery-canary pattern (agent-owned cron job + an out-of-process root verifier reading the log), the agent/verifier trust split, mutual liveness via tailnet-only health documents each host publishes and its peer watches, and persistent-state escalation that replaces transition-only alerting. Built and verified on both `dfw` (OpenClaw) and `hermes` (Hermes) on 2026-09-04. Trigger phrases include "delivery canary", "agent monitoring", "silent non-delivery", "turn dispatch bug", "canary verifier", "peer watch", "mutual liveness", "agent health endpoint", "tailscale serve health json", "transition-only alerting", "today > 0 && prev == 0", "persistent state escalation", "agent crash loop unnoticed", "who
agent-vault-credential-broker
This skill should be used when deploying or debugging Infisical's Agent Vault (a self-hosted, research-preview credential broker that intercepts an agent's outbound HTTPS calls via a local MITM proxy and injects real API keys so the agent process never holds them) — including provisioning a new instance, wiring it in front of an existing agent (OpenClaw, Hermes, a coding agent), the `agent-vault` CLI (vault/service/agent/run subcommands), or debugging a broken cutover. Trigger phrases include "agent vault", "credential broker", "get.agent-vault.dev", "agent-vault run", "AGENT_VAULT_TOKEN", "AGENT_VAULT_ADDR", "AGENT_VAULT_VAULT", "mitm-ca.pem", "agent-vault server", "unmatched_host_policy", "openclaw-on-vps.mdx", "hermes-on-vps.mdx", "placeholder api key vault", "__anthropic_api_key__", "Failed to set up mount namespacing", "agent process never holds credential", "MITM proxy inject api key", "vault service add catalog", "netguard blocked by network policy", "AGENT_VAULT_NETWORK_ALLOWLIST", "AGENT_VAULT_ALLOW_
agents-sdk
Build AI agents on Cloudflare Workers using the Agents SDK. Load when creating stateful agents, durable workflows, real-time WebSocket apps, scheduled tasks, MCP servers, chat applications, voice agents, or browser automation. Covers Agent class, state management, callable RPC, Workflows, durable execution, queues, retries, observability, and React hooks. Biases towards retrieval from Cloudflare docs over pre-trained knowledge.
anthropic-admin-cost-api
This skill should be used when provisioning Anthropic Admin API access, minting an Admin API key or an org:admin OAuth token, querying the Usage & Cost API (`/v1/organizations/cost_report` or `/v1/organizations/usage_report/messages`), diagnosing why the Console's "Admin keys" page 404s or the "+ Create key" dialog has no type selector, or investigating unexpected/high Anthropic spend by workspace or model. Trigger phrases include "anthropic admin api key", "anthropic cost report", "anthropic usage api", "sk-ant-admin", "ant auth login", "org:admin scope", "anthropic organization cost_report", "platform.claude.com/settings/admin-keys 404", "anthropic individual org admin api unavailable", "cache_creation.ephemeral_5m_input_tokens", "anthropic cost by workspace".
backblaze-b2-rclone-backup
This skill should be used when setting up or debugging an rclone-based backup sync to Backblaze B2's S3-compatible API — especially anything involving Object Lock (immutable/WORM backups), a brand-new B2 account or bucket, or errors like "NoSuchBucket" during a bulk sync, "403 Forbidden" partway through a large job, or "Malformed Access Key Id" from awscli against B2. Sibling skill to cloudflare-r2-rclone-backup (same rclone-to-S3-compatible-provider pattern) — load that one too for the shared flag/config gotchas (--s3-no-check-bucket, --fast-list, --checksum vs --size-only for content-addressed chunk stores). Trigger phrases include "backblaze b2 object lock", "b2 governance mode", "rclone s3-object-lock-mode", "NoSuchBucket bulk sync", "B2 403 Forbidden partway through", "b2 daily class b transaction cap", "b2 caps exceeded", "Malformed Access Key Id aws b2", "b2 master key id format", "rclone concurrent NoSuchBucket", "b2 s3 provider not known".
better-documents
Apply communication best practices when generating or reviewing any document, presentation, report, memo, slide deck, proposal, or email. Use this skill when asked to write, create, draft, or generate a document or presentation — apply the principles at generation time, not as an afterthought. Also use when asked to "review my doc," "look at this deck," "does this make sense," "is this clear," "improve this proposal," "check this before I send it," "make this more effective," or any request to evaluate whether a document will land with its audience. Use this skill even when the request seems minor — a "quick look" or a "short memo" is exactly when these principles matter most.
caddy-cloudflare-wildcard-proxy
This skill should be used when standing up Caddy as a reverse proxy for internal/homelab domains with a wildcard TLS certificate via Cloudflare DNS-01, when a Caddyfile needs one certificate to cover many internal hostnames, when routing Caddy to a backend that's deliberately bound to loopback only and reachable via an existing Tailscale Serve endpoint, when a Caddy instance itself needs to be loopback-only and a request returns an empty 200 response or `ss -tlnp` shows it listening on `*:port` despite the site address looking like `127.0.0.1:port`, or when debugging a fresh unprivileged LXC where tailscaled fails with "/dev/net/tun does not exist" or MagicDNS doesn't register into systemd-resolved. Trigger phrases include "caddy wildcard cert", "caddy dns-01 cloudflare", "caddy custom build dns plugin", "reverse proxy to tailscale serve backend", "loopback-bound service reverse proxy", "tun device does not exist unprivileged lxc", "tailscale magicdns not registering systemd-resolved", "split-horizon internal
claude-code-headless-tool-restriction
This skill should be used when building an unattended/headless `claude -p` invocation (cron job, systemd timer, CI step, webhook handler) that needs a real security boundary restricting which tools the agent can use — not just permission-prompt convenience. Trigger phrases include "headless claude code", "unattended claude -p", "restrict claude code tools", "claude code allowedTools", "claude code disallowedTools", "safe automated claude invocation".
cloudflare-cron-telegram-alert
This skill should be used when scaffolding a Cloudflare Worker that runs on a cron trigger, checks something external (a URL, an API, a heartbeat), and sends a Telegram alert only on failure — e.g. an uptime monitor, a health check, a dead-man's-switch. Trigger phrases include "cron trigger uptime monitor", "Telegram alert Worker", "cloudflare cron health check", "scheduled Worker Telegram", "uptime monitor Cloudflare Worker", "dead man's switch worker".
cloudflare-email-service
Send and receive transactional emails with Cloudflare Email Service (Email Sending + Email Routing). Use when building email sending (Workers binding or REST API), email routing, Agents SDK email handling, or integrating email into any app — Workers, Node.js, Python, Go, etc. Also use for email deliverability, SPF/DKIM/DMARC, wrangler email setup, MCP email tools, or when a coding agent needs to send emails. Even for simple requests like "add email to my Worker" — this skill has critical config details.
cloudflare-one-migrations
Plans migrations from Zscaler ZIA/ZPA, Palo Alto, legacy VPN, SWG, or SASE stacks to Cloudflare One. Use for migration assessments, policy mapping, rollout plans, and parity/gap analysis.
cloudflare-one
Guides Cloudflare One Zero Trust and SASE work across Access, Gateway, WARP, Tunnel, Cloudflare WAN, DLP, CASB, device posture, and identity. Use when designing, configuring, troubleshooting, or reviewing Cloudflare One deployments. Retrieval-first: use current Cloudflare docs/API schemas instead of embedded product docs.
cloudflare-r2-restic-backup
This skill should be used when setting up a nightly/periodic encrypted backup of a directory (an app's state/data dir, a database dump, an agent's working directory) to a Cloudflare R2 bucket via restic, or when debugging an existing restic-to-R2 systemd timer job. Distinct from the `cloudflare-r2-rclone-backup` skill — that one covers plain `rclone sync` (mirrors a tree as-is, no encryption/dedup/snapshots); this one covers `restic` (client-side encrypted, deduplicated, snapshotted, with retention/pruning) — pick restic whenever the source is app state you'd want point-in-time recovery of, not just an already-static archive worth mirroring. Trigger phrases include "restic backup to R2", "restic R2 repository", "nightly restic backup", "restic systemd timer", "restic keep-daily keep-weekly prune", "restic init repository", "restic check integrity", "restic restore verify", "restic unable to open cache", "R2 access key for restic", "AWS_ACCESS_KEY_ID restic env", "credential assert guard rail ansible", "restic
cloudflare-worker-tailscale-shield
This skill should be used when building a Cloudflare Worker that sits in front of a homelab service reachable only via Tailscale Funnel — validating auth/rate-limiting at Cloudflare's edge before forwarding inward, with a Cloudflare Queue for retry-on-failure. Also covers a specific `wrangler secret put` misuse that leaks the secret value as the secret's *name*. Trigger phrases include "cloudflare worker in front of tailscale", "webhook shield worker", "worker forward to tailscale funnel", "workers can't reach tailnet", "wrangler secret put wrong name", "queue retry backoff worker", "workers_dev false no public url".
credential-rotation-protocol
This skill should be used whenever a live credential (API key, bot token, access token, etc.) needs to be rotated, changed, OR REMOVED ENTIRELY — whether because it leaked, is being proactively refreshed, is being replaced as part of an incident response, or auth is simply being turned off on a service. Disabling/removing a password is the same category of change as rotating it and needs the same consumer inventory — arguably more so, since there's no new value to hand out, only broken consumers to discover the hard way if you skip the check. Also load it whenever verifying that a credential file/rotation is correct, since that's exactly the step that causes leaks if done wrong. Trigger phrases include "rotate this credential", "the key leaked", "update this token everywhere", "credential rotation", "verify the new key works", "did the secret change", "disable the password", "turn off auth", "remove the login requirement", "no longer needs a password".
debian-kernel-reboot-check
This skill should be used when checking whether a Debian-based host (Proxmox host, LXC, VM, bare metal, or VPS) needs a reboot to pick up a kernel update, when "apt update" reports no upgradable packages but a reboot is suspected to be pending anyway, when planning a safe reboot of a host running live services, or when auditing an entire fleet of mixed LXC/VM/bare-metal hosts for pending kernel upgrades. Trigger phrases include "kernel upgrade", "check for pending reboot", "reboot-required", "unattended-upgrades installed a new kernel", "does this host need a reboot", "safe reboot checklist", "fleet kernel sweep", "uname -r doesn't match installed kernel", "proxmox-kernel not applied", "LXC kernel version", "does the container share the host kernel".
durable-objects
Create and review Cloudflare Durable Objects. Use when building stateful coordination (chat rooms, multiplayer games, booking systems), implementing RPC methods, SQLite storage, alarms, WebSockets, or reviewing DO code for best practices. Covers Workers integration, wrangler config, and testing with Vitest. Biases towards retrieval from Cloudflare docs over pre-trained knowledge.
forgejo-deployment
This skill should be used when installing or debugging a self-hosted Forgejo (Gitea fork) git server as a native binary + systemd service — not Docker. Covers the three required secrets (SECRET_KEY/INTERNAL_TOKEN/JWT_SECRET) and the permission-denied crash-loop from a locked-down config file, unattended install without exposing the web setup wizard, why Forgejo's built-in git-SSH server needs firewall-level scoping instead of an app-level bind address, a non-obvious API scope requirement for repo deletion, and Vultr Block Storage's region-locking. Trigger phrases include "forgejo install", "forgejo systemd", "forgejo app.ini", "JWT_SECRET failed loading", "save oauth2.JWT_SECRET failed", "forgejo not supposed to be run as root", "forgejo admin user create", "forgejo random-password", "forgejo generate secret", "forgejo INSTALL_LOCK", "forgejo git-ssh port", "forgejo delete repo API 403", "write:user scope forgejo", "vultr block storage wrong region", "no active instances available in this region", "vultr NVMe
grafana-api-token-provisioning
This skill should be used when provisioning a scoped Grafana API credential for an automation/script (a monitoring sweep, a health-check script, a report generator), when deciding what Grafana role a service account needs, when checking real alert-rule health/evaluation state via the API rather than the UI, or when a Grafana RBAC fixed role like `fixed:alerting.rules:reader` doesn't seem to be assignable. Trigger phrases include "grafana service account", "grafana api token", "grafana read-only token", "grafana alert rule health api", "api/prometheus/grafana/api/v1/rules", "fixed:alerting.rules:reader not available", "grafana RBAC OSS vs enterprise", "grafana viewer role least privilege".
grafana-prometheus-alerting
This skill should be used when a Prometheus + Grafana stack has metrics being scraped but no real alerting configured, when adding a new Grafana alert rule via provisioning-as-code (not the UI), when checking whether Prometheus alert rules actually exist versus assuming a monitoring stack alerts on its own, when detecting individual systemd service failures across a fleet without building a custom OnFailure-to-webhook mechanism, or when a Grafana alert rule needs testing end-to-end before trusting it. Trigger phrases include "prometheus has no alert rules", "grafana provisioning alert rules", "node_systemd_unit_state", "grafana rules.yaml", "alert on systemd unit failure", "grafana noDataState", "test grafana alert rule firing", "prometheus /api/v1/rules empty", "node_exporter systemd collector".
hermes-agent-deployment
This skill should be used when deploying or debugging a self-hosted Hermes Agent (Nous Research's self-hosted personal-assistant gateway bridging Telegram/WhatsApp/Slack/Discord to an LLM with tool/skill/cron access — Will calls his instance "Chuka") — including install via the `hermes` CLI, the `hermes-gateway.service` systemd unit, native `hermes cron` scheduled jobs, the `hermes skills` system (SKILL.md drop-in files distinct from Claude Code's own skills), Debian 13 install gotchas (python3.13-venv, broken IPv6/gai.conf), fleet-readonly SSH access design, or UID-scoped egress firewalling. For credential protection via Agent Vault specifically, see the separate `agent-vault-credential-broker` skill — this skill covers Hermes's own deployment, not the broker. Trigger phrases include "hermes agent", "hermes gateway", "hermes cli", "hermes cron create", "hermes skills list", "hermes-gateway.service", "hermes mcp install", "ensurepip is not available", "HERMES_HOME", "hermes gateway install --system", "chuka",
home-assistant
This skill should be used when configuring, troubleshooting, or extending a Home Assistant OS (HAOS) instance — installing add-ons/apps, editing configuration.yaml, setting up Tailscale/remote access, or troubleshooting onboarding, the Supervisor, or backups. Trigger phrases include "Home Assistant add-on", "Home Assistant apps", "configuration.yaml", "HAOS", "Home Assistant Tailscale", "Supervisor", "HACS".
homelab-terminal-report-delivery
This skill should be used when building or modifying a homelab automation that needs to deliver a status report via email + Telegram + (optionally) a GitHub-hosted markdown archive — the shared report system (resilience-ledger-styled HTML as of 2026-08-17, previously Kanagawa-Wave-terminal-styled) already used by the weekly housekeeping sweep, the nightly backup summary, and the R2/B2 offsite sync emails. Also covers choosing between a minimal-link Telegram ping and a rich bulleted Telegram-as-primary-channel with conditional email (added 2026-08-20 to cut Postmark's 100/month free-tier quota). Trigger phrases include "homelab status report", "ledger styled email", "kanagawa wave email", "render-terminal-report", "homelab-report-lib", "consolidate emails into a digest", "add a new homelab report automation", "resilience-ledger design system", "claude_code_prompts schema", "push report to obsidian-vault", "deploy report script to a host other than ansible-ctrl", "raw ISO timestamp in email/telegram", "human re
immich-sdcard-sync-prune
This skill should be used when building or debugging a macOS launchd automation that uploads a camera SD card's contents to Immich on insert (via @immich/cli), or when building a workflow to prune Immich assets that were deleted from their source card/folder after import. Covers the Immich CLI's non-obvious API key permission requirements (album.create vs albumAsset.create, the "Found 0 new files" scoped-key bug), launchd's StartOnMount trigger and its missing-Homebrew-PATH gotcha, parsing `immich upload -j` JSON output, the Immich bulk-delete (trash vs permanent) endpoint, and — critically — why a delete/prune workflow across multiple source cards feeding one album must scope its diff by a per-source manifest rather than diffing the whole album, or a second card mounted alone will make every surviving photo from the first card look deletable. Trigger phrases include "sd card to immich", "immich cli upload", "@immich/cli permissions", "albumAsset.create", "Found 0 new files and 0 duplicates", "launchd StartOn
infisical-secrets-manager
This skill should be used when migrating a credential off a plaintext .env file onto self-hosted Infisical (the fleet secrets-management platform — distinct from Agent Vault, its separate MITM-proxy product), when provisioning a new host's Infisical machine identity, when debugging an `infisical-wrapper.sh`/`infisical-get.sh` fetch failure, or when auditing which fleet credentials still live in plaintext. Trigger phrases include "infisical secrets manager", "infisical-wrapper.sh", "infisical-get.sh", "infisical machine identity", "infisical login universal-auth", "homelab-fleet project", "migrate credential to infisical", "retire .env file", "Injecting N Infisical secrets", "infisical secrets get", "lookup('pipe', '/root/bin/infisical-get.sh", "deployed-copy vs git-tracked-source".
jellyfin-media-permissions
This skill should be used when Jellyfin shows "Playback failed due to a fatal player error" for a newly-added title, when a library item has empty/stub metadata (title from the folder name only, no overview/poster/runtime), or when media was ingested via an rsync pipeline from macOS. Trigger phrases include "fatal player error", "jellyfin playback failed", "jellyfin permission denied", "jellyfin metadata empty", "openrsync chown", "rsync macOS uid gid Linux permissions".
jellyfin-proxmox-deployment
This skill should be used when deploying (or redeploying) Jellyfin on a Proxmox host as an unprivileged LXC with Intel QuickSync hardware transcoding passthrough — including the VM-vs-LXC decision for a shared iGPU, the manual device-passthrough steps Terraform can't do declaratively, the media-volume backup-exclusion pattern, and the Tailscale-Serve-only exposure model. Trigger phrases include "deploy jellyfin", "reinstall jellyfin", "jellyfin quicksync passthrough", "jellyfin proxmox LXC", "renderD128 jellyfin", "jellyfin hardware transcoding setup", "redeploy jellyfin from scratch".
laravel-filament-proxmox-lxc
This skill should be used when deploying a Laravel + Filament v3 app (an admin panel, internal dashboard, or CMDB) as a native systemd service inside an unprivileged Proxmox LXC, instead of Docker — dedicated PHP-FPM pool, Caddy loopback front, Pest testing, Laravel Boost, Laravel Nightwatch APM, and adding a read-only Sanctum token API for an external consumer. Also covers a Filament panel behind Tailscale Serve generating mixed-content http:// asset URLs on an https:// page (including a plain asset() call not honoring URL::forceScheme), Eloquent's belongsToMany pivot-table naming surprising an agent building the schema by hand, php-fpm socket permission errors from a restrictive service-user home directory, Boost's guideline generation silently doing nothing under --no-interaction, Sanctum's abilities/ability middleware aliases not existing on a bootstrap/app.php (no Kernel.php) app, and an unauthenticated api/* request 500ing instead of 401ing when no Accept header is sent. For theming/skinning an already-
n8n-workflow-api-authoring
This skill should be used when authoring an n8n workflow as JSON to import via n8n's REST API (rather than hand-clicking in the editor), when an n8n HTTP Request node's attached credential seems to be silently ignored, when an n8n Code node throws "Module 'X' is disallowed", when a `{{ }}` expression field throws a bare "invalid syntax", when downstream Code node fields go missing/undefined after an HTTP Request node, when importing/updating an n8n workflow via `POST`/`PUT /api/v1/workflows` hits errors like "active is read-only", "PATCH method not allowed", or a referenced error-workflow name not resolving, when a Wait-node-delayed check using `$getWorkflowStaticData` gives a stale/wrong answer, or when decoding n8n's SQLite `execution_data` for debugging without an API key. Trigger phrases include "n8n workflow JSON", "n8n REST API import", "n8n credential not working", "n8n expression invalid syntax", "n8n Module crypto is disallowed", "n8n HTTP Request neverError", "n8n workflow active read-only", "POST /
openclaw-deployment
This skill should be used when deploying or debugging a self-hosted OpenClaw (formerly Clawdbot/Moltbot) agent gateway — a Node.js personal-assistant service bridging Telegram/WhatsApp/Discord to an LLM with tool/skill access. Covers install, secure baseline config (loopback bind, token auth, exec approval gating), the two non-obvious config traps that silently break things (model selection vs. API key, exec security vs. ask), Telegram channel lockdown, configuring the web_search tool/Brave provider, voice-note transcription (tools.media.audio/Groq), memory indexing and its embedding-provider auth (openclaw memory index/status), evaluating ClawHub skills/plugins by real usage data, and building trustworthy custom skills instead of pulling from the unvetted ClawHub marketplace. Trigger phrases include "openclaw config", "openclaw gateway", "tools.exec.security", "openclaw model not found", "ProviderAuthError No API key found for provider openai", "exec denied security=deny", "openclaw dashboard", "openclaw pai
paperless-ngx-bare-metal
This skill should be used when installing, upgrading, or troubleshooting a Paperless-ngx deployment via its bare-metal (non-Docker) release tarball rather than Docker Compose — especially inside a Proxmox LXC. Trigger phrases include "paperless-ngx bare metal", "paperless-ngx without docker", "pip install requirements.txt paperless", "granian paperless", "PAPERLESS_BIND_ADDR", "mysqlclient pkg-config error", "liblept", "paperless-ngx tarball structure", "paperless systemd service", "paperless-webserver.service".
pihole-dot-upstream-failover
This skill should be used when adding DNS-over-TLS (DoT) as a Pi-hole upstream resolver, when evaluating cloudflared for DoT/DoH proxying, when a "no fallback DNS" or "DNS failures should surface" constraint needs to coexist with wanting resilience against a recursive resolver (e.g. Unbound) going down, when pihole-FTL --config dns.upstreams rejects an unquoted value as invalid JSON, or when designing an alerted (not silent) failover watcher for infrastructure that must not silently mask its own failures. Trigger phrases include "cloudflared proxy-dns", "cloudflared DoT deprecated", "pihole DNS over TLS", "stubby DoT", "pihole-FTL --config dns.upstreams", "dns.upstreams invalid JSON", "Unbound fallback resolver", "no fallback DNS constraint", "alerted failover watcher", "silent fallback DNS", "pihole upstream failover".
pihole-local-dns-records
This skill should be used when configuring Pi-hole so devices show by friendly name instead of raw IP in the dashboard/Top Clients/Query Log, when the "List of configured clients" (Group Management > Clients) Comment field doesn't seem to change any display elsewhere, when identifying an unlabeled/mystery device on the network without router access, when a dashboard label doesn't update even though the dns.hosts record looks correct, or when managing dns.hosts declaratively via Ansible. Trigger phrases include "pi-hole map traffic to devices", "pi-hole client names in dashboard", "pi-hole Local DNS Records", "dns.hosts pihole.toml", "pihole-FTL --config dns.hosts", "client comment not showing in dashboard", "pihole network table discover devices", "identify unknown device on network", "what is this IP/MAC", "dns-sd companion-link", "mdns bonjour identify device", "private wifi address randomized mac", "dashboard name not updating", "pihole query log lag".
postmark
This skill should be used when the user asks to "send email via Postmark", "set up Postmark", "configure an SMTP relay with Postmark", "check Postmark delivery status", "use my Postmark account", or needs transactional email sending/delivery verification through Postmark's SMTP relay or HTTP API — including from non-Workers systems like Proxmox, cron jobs, or backend services that support a generic SMTP smarthost.
proxmox-docker-compose-vm
This skill should be used when deploying an application that only ships via Docker Compose (no native/bare-metal install path — e.g. Immich, and similar multi-container stacks with a custom database extension baked into a maintained image) inside a Proxmox VM, managing its Docker Compose file and secrets as code via Ansible, debugging a Compose service that's unexpectedly reachable on the plain LAN IP instead of only over Tailscale Serve, wiring up a hardware-acceleration `extends:` stanza (hwaccel.yml, OpenVINO/VAAPI image tags) that ships commented-out in the upstream Compose file, or exposing one feature of an otherwise tailnet-only app (e.g. Immich share links) to people outside the tailnet via a purpose-built proxy sidecar + narrow Funnel rather than punching a hole in the app's own API. Also covers verifying an async first-run job (ML indexing, search embedding, etc.) actually processed something rather than just checking container health, and a shared Ansible `file` loop silently drifting a sensitive d
proxmox-no-subscription-nag
This skill should be used when a user on a no-subscription (free) Proxmox VE or Proxmox Backup Server install wants to suppress the "No valid subscription" login popup, or asks whether that popup indicates a real problem. Trigger phrases include "no valid subscription popup", "proxmox subscription nag", "remove subscription popup", "proxmox no-nag patch", "checked_command proxmoxlib.js".
proxmox-node-systemd-service
This skill should be used when deploying a Node.js application (Next.js, n8n, or any pnpm/npm-based app) as a native systemd service inside an unprivileged Proxmox LXC, instead of Docker — installing Node via NodeSource, running a dedicated non-root service user, building with pnpm, and exposing it only over Tailscale Serve. Also covers debugging an Ansible playbook for this pattern that never reports `changed=0` on a repeat run, a "detected dubious ownership in repository" git error, a service that's unexpectedly reachable on the plain LAN IP instead of only over Tailscale, or an app that fails to write scratch/upload files under `/tmp` despite the service showing active. Trigger phrases include "run Node app as systemd service", "NodeSource install Ansible", "pnpm build systemd", "next start binds 0.0.0.0", "HOSTNAME env var not working Next.js", "ansible git dubious ownership", "git module changed every run", "recursive chown always changed ansible", "Docker-in-LXC alternative for Node app", "ProtectSystem
proxmox-pbs-backup-job
This skill should be used when adding a new host (LXC or VM) to an existing Proxmox Backup Server nightly backup schedule, creating a vzdump job via `pvesh`, debugging a backup job that succeeds but the prune step fails with a permission error, excluding one specific mount point (e.g. a bulky media/data volume) from an LXC's backup while still backing up its rootfs, setting up PBS-to-PBS replication via a Remote + Sync Job (a second physical PBS instance holding a pulled copy of another datastore), a PBS API token that returns `{}` from `/access/permissions` despite a correct-looking ACL grant, `apt update` failing with `401 Unauthorized` against `enterprise.proxmox.com` on a no-subscription PBS install, or restore-testing a PBS datastore/replica by restoring to a throwaway VMID/CTID. Trigger phrases include "add backup job pvesh", "vzdump schedule new host", "pbs prune permission denied", "Datastore.Modify Datastore.Prune missing", "backup job finished with errors", "proxmox-backup-client prune permission ch
Bio shown is the top-scored skill's repo description as a fallback — real GitHub bios land in a future update.