Drive HeyGen's avatar-video generation REST API from the operator's terminal. Use this skill whenever the user asks to "generate a HeyGen video", "list HeyGen avatars", "make a talking-head avatar video", "poll a HeyGen job", or any HeyGen content task. Replaces the unmaintained `heygen-mcp@0.0.3` PyPI package (anonymous author, fails the minReleaseAge audit gate). SPENDS MONEY — per-second video generation. Confirmation required before any state-changing action.
Brand-voice-aware content writer. Five modes: blog post (800-2000 words, TL;DR + CTA), Twitter thread (8-15 tweets, hook-driven), YouTube script (intro hook + 3-act + outro CTA), newsletter issue (300-700 words), press release (AP-style). Reads assets/brand/<project>/voice.md when present. Triggers on: blog post, twitter thread, youtube script, newsletter, press release.
Enforce frontend quality bar — accessibility (WCAG 2.2 AA), performance (Core Web Vitals: LCP/INP/CLS), semantic HTML, image optimization, bundle size, mobile-first, loading/empty/error states. Use this skill on any PR that touches React/Next.js/Astro/Svelte/Vue components, CSS/Tailwind, layout files, or anything in `app/`, `components/`, `pages/`, `src/`. Critical for [Project A] (Argentine mobile users on slow 3G/4G) and [Company] docs site (developer audience expects fast). Auto-triggers on `*.tsx`, `*.jsx`, `*.svelte`, `*.vue`, `*.astro`, `*.css`.
Run a rigorous, multi-dimensional review checklist on any pull request before opening, merging, or after receiving review comments. Use this skill ALWAYS before opening a PR, when asked to "review this PR/branch/diff", "check my changes", "is this ready to merge", or before promoting a branch from dev to staging or staging to main. Goes beyond style — checks security, performance, testing rigor, supply chain, and Definition of Done coverage.
OWASP Top 10 (web, not agentic) baseline review for any web application code change — auth, sessions, headers, CSRF, XSS, SQL injection, CORS, rate limits, secret handling, file upload, SSRF. Use this skill on any PR or diff that touches HTTP handlers, auth flows, session/cookie logic, file uploads, redirect/URL parsing, database queries with user input, or proxying/fetching external URLs. Catches the bug classes that ship to production and become public CVEs. Distinct from the security-auditor agent (which is invoked explicitly); this skill auto-triggers when relevant code is in scope.
Run a comprehensive daily security audit of all installed MCP servers, Claude Code skills, agent configs, and AI CLI tooling. Detects supply chain attacks, tool-name shadowing, malicious skills, configuration drift, missing CVE patches, and untrusted package versions. Use this skill EVERY MORNING before starting work, on demand when installing a new MCP/skill, or after pulling Walter-OS updates. ALSO trigger when the user asks "is my agent setup safe", "audit my MCPs", "check for vulnerabilities", "any new CVEs", or mentions concerns about supply chain, tool poisoning, prompt injection, or malicious skills.
Generate or edit images using Google's Nano Banana family (Gemini 2.5 Flash Image, Gemini 3.1 Flash Image Preview, and Gemini 3 Pro Image Preview). Use this skill whenever the user asks to "generate an image", "create a visual", "make a hero image", "edit this photo", "blend these references", produce assets for blog posts, social media, marketing/DevRel content, icons, infographics, magazine-style mocks, isometric scenes, or product mockups, OR when the user mentions "nano banana", "Gemini image", "nanobanana", "Imagen alternative", or "Google image gen". Trigger this skill even when the request is casual, such as "make me an image of X" or "I need a visual for the blog post". Always prefer this over describing an image in text when a real image is what the user wants.
How Walter-OS imports Vercel's official agent-skills (vercel-labs/agent-skills) where they make sense. NOT a wholesale fork — selective integration, since Walter-OS already has overlapping skills. Use this skill when the user mentions "vercel agent-skills", "react best practices skill", "deploy-to-vercel skill", or you need to evaluate adding a Vercel skill to Walter-OS.