Agent skills by type of work: a list worth building from

Most lists of agent skills are organised by technology, which is the wrong axis. You do not wake up wanting a Kubernetes skill. You wake up wanting to know why the deploy failed.

This is organised by job. For each one: what the skill is for, the description line that decides whether it ever fires, and what capability it needs behind it. Skills that only need instructions are marked instructions only. Skills that need live access say what kind.

If the format is new to you, start with what agent skills are. To build one, how to write your first agent skill.

Debugging and operations

The highest return category, because the work is procedural and the cost of a wrong order is high.

Incident triage. Narrow an outage to a layer before guessing. Needs live network checks. Written out in full in an agent skill for incident triage.

description: Narrow a website or service outage to a layer, in order,
  before proposing a cause. Use when a site is down, unreachable,
  intermittently failing, or slow for some users.

Log triage. Read an error dump, group by cause rather than by line, and name the first thing to fix. Instructions only if the logs are pasted in; needs access if it must fetch them.

Deploy failure. Your pipeline's actual failure modes, in the order they occur. Needs CI access to be automatic, works pasted in otherwise. This is the skill most worth writing because nobody else can write it: the failures are yours.

Rollback decision. When to roll back rather than fix forward, and what to check first. Instructions only, and valuable precisely because it is judgement under pressure.

Network, DNS and mail

Email deliverability. Why mail bounces or lands in spam, in the order that avoids changing the wrong record. Needs DNS lookups. Full file in an agent skill for DNS and email debugging.

TLS triage. Certificate faults, including the browser caching trap that makes a broken chain look fine. Needs a live TLS handshake. Full file in an agent skill for SSL and certificate work.

DNS migration. Pre and post checks for moving a zone or a provider, with TTL planning. Needs lookups and propagation checks.

description: Plan and verify a DNS change or provider migration,
  including TTL reduction beforehand and resolver agreement afterwards.
  Use before or after changing nameservers, A records or MX records.

Domain intake. Everything you want to know about a domain you have just been handed. Needs lookups. Auditing an unfamiliar domain in one query covers the ground.

Security review

Header and transport review. What is missing, what is misconfigured, what is obsolete, and which recommendations can break the site. Needs a live request. Full file in an agent skill for web security header reviews.

Dependency triage. Turn an advisory list into an ordered set of actions by asking whether the vulnerable path is actually reached. Instructions only given the audit output, and the judgement is the whole value: most advisories in a typical report are not reachable.

Secret scan follow up. A found credential is an incident, not a lint finding. The order is revoke, then rotate, then purge history, and the skill exists to stop anyone starting with the commit.

description: Respond to a credential or API key found in source control
  or logs. Use when a secret is committed, leaked, or found by a
  scanner, and the question is what to do about it.

Access review. Who has what, what looks wrong, what to ask about. Needs access to your identity provider.

Content and SEO

AI visibility. Whether assistants can fetch and read your pages, and the several things people get wrong about the controls. Needs a live fetch. Full file in an agent skill for AI crawler and visibility checks.

House style. Your conventions, applied without being restated every time. Instructions only, and the most immediately useful skill for anyone who writes. Not the generic advice, the specifics: the words you do not use, how you handle headings, whether you allow contractions.

description: Apply our house style to drafts and edits, covering tone,
  heading conventions, banned words and formatting. Use when writing or
  editing any copy, documentation or published text.

Internal linking. Given a new page, find the existing pages that should link to it. Needs access to the content, which for most sites means the repository.

Metadata review. Titles and descriptions against real length limits, with the duplicates found. Instructions only given the pages.

Data and analysis

Query conventions. Your warehouse's quirks, the tables that look right and are deprecated, the join keys that are not obvious. Needs database access to run, and is worth having even as instructions only, because naming the three deprecated tables prevents most wrong answers.

Metric definitions. What "active user" means here, so two analyses agree. Instructions only, and it settles arguments rather than starting them.

Report format. The shape of output you actually want: the caveat first, the number second, the method last. Instructions only.

Code review and testing

Review checklist. What your team cares about, in priority order, rather than everything a model can notice. Instructions only. The good version is short and opinionated.

Test writing. Your framework, your fixtures, your naming, and the kinds of test you consider worthless. Instructions only, and it stops the most common complaint about generated tests, which is that they assert the implementation back at you.

Skill testing. How to tell whether a skill you wrote actually works. Covered in how to test an agent skill.

Writing the description line

Every entry above leads with the description rather than the body, and that is deliberate. It is the only part of a skill that is always loaded, and it is what the request gets matched against. A good body behind a vague description never runs.

Three rules that hold:

Say what it does and when to use it. Both halves. The second is what routes the request.

Use the words people actually type. Not "TLS certificate chain validation" but "untrusted certificate", "expired cert", "works in Chrome but curl fails". Write the symptom, not the diagnosis, because the symptom is what someone has when they ask.

Name the nouns. GPTBot, SPF, DMARC, CSP, nameservers. Specific terms match specific requests. Generic verbs match nothing.

Which of these to write first

Pick by frequency, not by interest. The skill worth writing is the one for the thing you explained twice last month.

In practice that is usually one of three: your house style, your deploy failures, or your incident order. All three are mostly instructions only, so they work immediately with no setup, and all three are things no generic skill can contain because the content is specific to you.

The network skills in this list need live access, which is the one thing instructions cannot provide. Skills on the Claude API run in a sandbox with no network access at all, so that capability has to come from an MCP server. toolhq runs one with eight read only checks, added in a single command:

claude mcp add --transport http toolhq https://toolhq.io/api/mcp

The division of labour, and how to tell which half your problem is in, is in when to use a skill and when you need an MCP server.