Skills
97,905 packaged capabilities and playbooks for agents. Install any of them with one command.
Development
Diagnose a broken or untrusted codebase and plan the fix. Runs the app for real, fans out parallel specialist sub-agents (security, database, core logic, frontend/UX, architecture), audits the git/CI/deploy setup, verifies the headline claims independently, then gives a plain-English findings list ranked by real-world cost, writes FINDINGS.md into the repo, and delivers a rebuild-or-fix-in-place verdict (fix in place wins by default, and having real users can veto a rebuild outright) before handing off to cs-build-import-codebase and creating the Kanban tasks. Works on any codebase in any language. Triggers, "my app is a mess", "audit my codebase", "what's wrong with my app", "diagnose this codebase", "should I rebuild or fix this", "find the bugs in my app", "review my whole app".
Turn an idea into a CodeSpring plan — from a sales-call recording, a transcript, a voice note, or someone just talking at you about what they want. Interviews the person (or mines the recording) for the job the app does, walks the screens with them, picks the platform from what the app actually needs to do, finds the one technically hard part and names a real solution for it (including existing open-source prior art), cuts to a v1 that can be sold, then writes the map — core features, sub-features, notes — and hands off to cs-build-create-prd and cs-build-create-tasks. The no-code-yet counterpart to cs-build-import-codebase. Triggers, "plan my app", "generate a plan", "turn this recording into a plan", "I have an idea for an app", "design my app in CodeSpring", "map out this idea", "I've got a client call recording, make the plan", "plan from scratch".
Build, repair, tune, and validate interactive cursor-trail mask reveal hero effects in frontend projects. Use when implementing canvas-based base/reveal compositing, soft radial cursor masks, fading cursor trails, reveal debug controls, full-screen hero scenes without site text, or browser smoke checks for cursor reveal, hover reveal, before/after reveal, and mask compositing effects.
Guide users building apps, scripts, CI pipelines, or automations on top of the Cursor TypeScript SDK (`@cursor/sdk`). Use this skill whenever the user mentions integrating, installing, or writing code against the Cursor SDK; whenever they say `Agent.create`, `Agent.prompt`, `Agent.resume`, `agent.send`, `run.stream`, `CursorAgentError`, or `@cursor/sdk`; whenever they ask to run Cursor agents programmatically from a script, CI/CD pipeline, GitHub Action, backend service, or any other code that isn't the Cursor IDE itself; and whenever they want to pick between local and cloud runtime, configure MCP servers for an SDK agent, or handle streaming, cancellation, or errors from an SDK agent. Also trigger when a user is wiring Cursor into an automation, writing a bot that runs Cursor, or porting REST `/v1/agents` calls to the SDK, even if they don't explicitly name the package. Use this eagerly rather than answering from memory; the SDK surface evolves and this skill plus its references are the source of truth for the external package
Architecture and hard-won debugging lessons for customization enablement (plugins, MCP servers, agents, skills, instructions) in the agent host. Use when changing how customizations are discovered, published, enabled/disabled, or handed to a provider SDK; when a customization shows the wrong enabled state in the UI; or when a disabled MCP server or plugin is still reaching the model.
Create interactive data visualizations using d3.js. Use this skill when creating custom charts, graphs, network diagrams, geographic visualizations, or any complex SVG-based data visualization that requires fine-grained control over visual elements, transitions, or interactions. Use it for bespoke visualizations beyond standard charting libraries, whether in React, Vue, Svelte, vanilla JavaScript, or any other environment.
Execute database migrations across ORMs and platforms with zero-downtime strategies, data transformation, and rollback procedures. Use when migrating databases, changing schemas, performing data transformations, or implementing zero-downtime deployment strategies.
Use when drawing or auditing model boundaries — phrases like "bounded context", "where do we draw the line between X and Y", "this model is getting muddled", "should this be one service or two", "the same word means different things in different places". Defines what a bounded context is, what it isn't, and the signals that say a boundary should exist. Pairs with ddd-context-mapping for the relationships across boundaries.
Use when the user is modeling something whose identity matters beyond its attributes — phrases like “entity”, “this thing has an ID”, “two of these are the same if their IDs match”, “tracked over time”, “lifecycle”. Distinguishes entities from value objects by identity continuity. Pairs with ddd-value-object (the opposite distinction).
Use when the user wants to transform existing code toward DDD — phrases like "refactor this to use aggregates", "extract a value object from this primitive", "split this god aggregate", "make this domain model less anemic", "introduce a bounded context boundary here". Sequences refactor steps and points at the pattern skill that explains the target shape. Do NOT use for code review (route to ddd-review) or initial design (route to ddd-design).
Guide for recording significant architectural and design decisions in docs/decisions.md. Use this skill when clearly significant architectural decisions are made (database choices, frameworks, core design patterns) or when explicitly asked to document a decision. Be conservative - only suggest for major decisions, not minor implementation details.
Deduplicates code by finding one single source of truth and sharing it across call sites. Works on a named target or the full first-party codebase. Collapses duplicated logic, types, schemas, constants, UI, and tests that represent the same knowledge—without inventing false abstractions. Use when the user says "deduplicate", "dedupe", "DRY this up", "remove duplication", "single source of truth", "extract shared", or asks to consolidate repeated code into one place.
When a feature is requested, use this skill before implementation to clarify requirements, design direction, and acceptance criteria through dialogue with the user, then create a requirements definition document (Markdown). Use when the user says “I want to build…”, “add or modify a feature…”, “make it possible to…”, or “define the requirements”, as well as when implementation is requested before the specifications are settled. Do not implement. For plan reviews, see review-plan.
Creates and edits Defold resource and component files that use Protobuf Text Format (.collection, .go, .atlas, .sprite, .gui, .collisionobject, .convexshape, .label, .font, .material, .model, .mesh, .particlefx, .sound, .camera, .factory, .collectionfactory, .collectionproxy, .tilemap, .tilesource, .objectinterpolation). Use when asked to create, modify, or configure any Defold proto text format file.
Only use when the user explicitly invokes /dependabot-sweep (or $dependabot-sweep in Codex). Never auto-invoke. Batch-analyzes dependency update PRs created by Dependabot and creates a single PR integrating all updates into one branch. Instead of merging each dependabot PR individually, it consolidates them into an integration PR, leaves a comment on the original PRs, and closes them.
Design and audit developer tools, APIs, SDKs, CLIs, libraries, platforms, dashboards, docs, examples, onboarding, quickstarts, pricing, usage limits, telemetry, changelogs, support, and community growth. Use when building developer-facing products, improving developer experience, launching APIs/SDKs, or reviewing docs-to-activation funnels.
This skill should be used when the user asks to "set up unfold admin", "django admin", "customize admin", "admin dashboard", "htmx admin", "unfold theme", or mentions Django admin customization, admin dashboards, or Unfold configuration. Provides Unfold admin patterns with 1-admin-per-file organization and HTMX customization.
Opinionated Django development patterns for well-structured, maintainable projects. Use when writing Django models, migrations, views, admin configuration, Celery tasks, or external service integrations. Also use when reviewing or refactoring Django code or creating new Django apps. Do NOT use for: Django Ninja API endpoints (use django-ninja skill), FastAPI, Flask, general Python (use python skill), test files (use pytest skill), or frontend code.
Create an Architecture Decision Record (ADR) - Layer 5 of the SDD flow, documenting one architecture decision with Context-Decision-Consequences. Use after BDD when an architectural choice needs recording. Single-document authoring primitive; for end-to-end or batch generation the autopilot (`doc-adr-autopilot`) drives this skill.
Use when the user wants to generate technical documentation for ADVPL/TLPP code on TOTVS Protheus -- Protheus.doc header blocks (@type, @param, @return, @author, @since, @history), complete routine documentation (tables read/written, MV_* parameters, entry points, execution flow, dependencies), or REST API endpoint documentation (path/query parameters, request/response JSON, status codes). Also triggers on Portuguese phrasing like "documentar rotina", "gerar cabecalho Protheus.doc", "documentar endpoint", "documentar API REST", or requests to add documentation to legacy/undocumented code.
A skill for verifying and syncing documentation consistency alongside code changes. It classifies change categories from git diff, determines per category whether documentation sync is needed, regenerates auto-generated documentation, checks for broken links, and reports in table form. Use when you need documentation sync, documentation consistency checks, or detection of missed updates. When the subject is generating or updating the AGENTS.md hierarchy itself, use agents-md-sync (explicit invocation).
Hard discipline for project domain language: maintain a pure glossary in CONTEXT.md (no implementation details), challenge fuzzy or conflicting terms in-session, create files lazily, keep orthogonal to OpenSpec behavioral contracts. Referenced by PDCA hosts during clarify/analyze when domain terms matter. Triggers — 「领域语言」「CONTEXT.md」「术语表」「统一语言」「领域词汇」 / domain language discipline, project glossary, CONTEXT.md. Do NOT use as a substitute for OpenSpec specs.
Configure ShapeStream and Shape to sync a Postgres table to the client. Covers ShapeStreamOptions (url, table, where, columns, replica, offset, handle), custom type parsers (timestamptz, jsonb, int8), column mappers (snakeCamelMapper, createColumnMapper), onError retry semantics, backoff options, log modes (full, changes_only), requestSnapshot, fetchSnapshot, subscribe/unsubscribe, and Shape materialized view. Load when setting up sync, configuring shapes, parsing types, or handling sync errors.
Constrains Java development to prioritize reusing the capabilities of the 璀璨工坊 unified framework, avoiding reinventing the wheel. Based on 《璀璨工坊统一框架-使用手册-nightly》, it provides guidance on unified framework integration, upgrades, configuration, Starter selection, and troubleshooting. When a capability is covered by the framework, the framework's Starter and corresponding abstraction APIs must be used; falling back to official Spring starters or bypassing the framework abstraction layer (e.g. using StringRedisTemplate directly instead of CacheService for caching) is prohibited. Use when the user mentions "统一框架", "starter清单", "接入步骤", "升级步骤", "系统要求", "Web MVC/服务间调用/Mybatis-Plus/加解密/缓存/多数据源/代码生成器/资源抽象层", or needs to determine "该功能是否应直接使用某个 starter（如 cache-starter）".
Cria e mantém o TRD (Technical Requirements Document) em `docs/trd.md` — stack, arquitetura, requisitos não-funcionais, dependências externas, padrões e decisões globais do projeto. Também cria ADRs (Architecture Decision Records) no Modo Decision: registra uma decisão técnica em `docs/adrs/` e atualiza a seção Decisões Globais. O TRD é o contexto técnico consultado pelas skills do fluxo sdd (`sdd-especificar` em diante). Use ao criar um TRD, documentar a stack, registrar padrões de arquitetura, começar projeto novo sem TRD, quando a stack mudou, ou quando o `sdd-especificar` pedir contexto técnico por falta de `docs/trd.md` — mesmo sem usar o termo "TRD". Use o Modo Decision quando o usuário quiser "registrar uma decisão", "criar um ADR", ou disser "decidimos usar/trocar X por Y" — é decisão técnica/arquitetural, distinta de decisão de produto (que fica no PRD).
Evasion technique integration: implant evasion techniques (API obfuscation, string encryption, syscalls, anti-debugging, AMSI bypass, etc.) into existing Loader code. Use when adding new loading techniques to an existing Loader, or when an existing Loader is detected and its components need replacing. First read references/evasion-techniques-db.json to confirm the component library contains the technique you need, then perform the integration
FastAPI modern Python web framework. Covers routing, Pydantic models, dependency injection, and async support. Use when building Python APIs. USE WHEN: user mentions "fastapi", "pydantic", "async python api", "python rest api", asks about "dependency injection python", "python openapi", "python swagger", "async endpoints", "python api validation", "fastapi middleware" DO NOT USE FOR: Django apps - use `django` instead, Flask apps - use `flask` instead, synchronous Python APIs without type hints, GraphQL-only APIs
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.