Skills
97,905 packaged capabilities and playbooks for agents. Install any of them with one command.
Development
Comprehensive Flutter API reference guide covering widgets, Material Design, Cupertino, animations, gestures, navigation, state management, and platform integration. Use when developing Flutter applications and needing detailed API knowledge for widgets, layout, styling, animations, platform channels, or any Flutter SDK functionality. Essential for building cross-platform mobile, web, and desktop applications with Flutter.
Implement approved, production-quality Flutter interfaces with adaptive layout, complete states, project-native architecture, accessibility, and proportionate verification. Use when visual direction and behavior are sufficiently defined and the user asks to build, change, polish, or refactor Flutter UI code.
Build native-feeling Flutter screens with Material 3 and Cupertino. Covers theming, adaptive controls, go_router, SafeArea/MediaQuery, slivers, sheets, animations, icons, and platform conventions grounded in current Flutter stable docs (3.47+ / Dart 3.13+). Use when building Flutter UI, widgets, themes, navigation, screens, lists, forms, dialogs, or sheets; when making an app feel native on iOS or Android; or when the user runs /flutter-native-ui. If the project already has a custom ThemeExtension / house Pressable / branded token file, use flutter-custom-design-system instead of restyling to Material.
Use when assessing code quality hygiene — TypeScript strictness, lint violations, dead code, and duplication. Runs `audit-typescript.sh`, `audit-lint.sh`, `audit-similarity.sh`. Does NOT cover dependency freshness or CVE audit — use `frontend-review-deps` for that.
Use when reviewing React rendering performance — profiler-first diagnosis, memo/useCallback/useMemo correctness, virtual scroll, useTransition/useDeferredValue, and canvas/WebGL separation for data-heavy UIs. Covers checklist 24-rendering-performance.md.
Use for game development tasks: new games, gameplay design, features, fixes, and playtesting. Research comparable games before choosing new mechanics, inspect actual gameplay, and verify changes by playing through real controls. Keep small fixes within the existing design.
Models engine-agnostic games as interacting parts, state, relationships, feedback, and core/meta loops. Use for cross-system architecture, feedback-loop diagnosis, system boundaries, player mental models, systemic prototypes, and design specifications; defer individual mechanic selection to game-mechanics-design and numerical tuning to game-balance.
Generate a FigJam project plan board from a PRD plus codebase context. Interactive flow: research → propose sections → per-section deep research → per-section content + block-shape proposal → create FigJam → skeleton → fill → diagrams → wrap. Each content block (section, nested section, intro callout, table, multi-column text, sticky column, diagram section, metadata strip) has its own subskill reference file. Use when the user asks for 'project plan in FigJam', 'interactive project plan', '/generate-project-plan', or provides a PRD and wants per-section confirmation on content + rendering.
Organize pending git changes into logical, well-structured commits that follow the Conventional Commits specification, in English. Use this skill whenever the user wants to commit work, "organize my commits", "split my changes into logical commits", "commit what we have", "save these changes to git", "tidy up my history before a PR", or invokes /commit — including partial asks like "commit the auth stuff" or "just commit the config". It reads git status and diffs, groups related changes into atomic commits, proposes the messages, and only commits after explicit approval. Optionally it adds gitmoji prefixes, an issue reference (auto-detected from the branch when present), and folder exclusions. It never pushes. Do not trigger for writing code, resolving merge conflicts, or opening pull/merge requests — only for turning pending changes into commits.
Expert Go backend code reviewer specializing in microservices, GORM/DAL patterns, dependency injection, and resource management. Focuses on logic correctness, goroutine leak detection, and Go-specific best practices for production-grade services.
Unified external research for documentation, GitHub code, and package versions. Use when the user needs to look up library docs or API references, search code in a public GitHub repo, check the latest version of a package, verify whether a dependency is deprecated, or any task requiring external knowledge beyond the local codebase and training data.
Unified local codebase search across keyword, structural, and semantic modes. Use when searching a codebase for code patterns, tracing how features work across files, finding structural code issues, answering conceptual questions about a codebase, or exploring unfamiliar projects. Do not use for external library docs or GitHub searches.
Grilling session that challenges your plan against the existing domain model, sharpens terminology, and updates documentation (CONTEXT.md, ADRs) inline as decisions crystallise. Use when user wants to stress-test a plan against their project's language and documented decisions.
Grilling session that challenges your plan against the existing domain model, sharpens terminology, and updates documentation (CONTEXT.md, ADRs) inline as decisions crystallise. Use when user wants to stress-test a plan against their project's language and documented decisions.
Apply the grug brain philosophy to software development - fight complexity, prefer simplicity, and build maintainable code. Use when the user asks to "simplify this code", "is this too complex", "should I abstract this", "review for over-engineering", "grug brain", "keep it simple", or when reviewing code for complexity issues, making architectural decisions, or refactoring code to reduce complexity.
Use when planning tests for Arduino, ESP32, ESP32-S3, Pico, or Pico W firmware; deciding what can run off-target; using Wokwi or simulation; writing host fakes; or accepting a physical hardware feature without confusing compile proof with system proof.
Simplest distributed training API. 4 lines to add distributed support to any PyTorch script. Unified API for DeepSpeed/FSDP/Megatron/DDP. Automatic device placement, mixed precision (FP16/BF16/FP8). Interactive config, single launch command. HuggingFace ecosystem standard.
Implement and ship one agent-ready ticket unattended using its pre-agreed seams, halting instead of guessing when the ticket leaves a decision open. Use for autonomous or cloud-agent coding runs that should end in an unmerged PR ready for human verification.
This skill should be used when implementing Android code in Bitwarden. Covers critical patterns, gotchas, and anti-patterns unique to this codebase. Triggered by "How do I implement a ViewModel?", "Create a new screen", "Add navigation", "Write a repository", "BaseViewModel pattern", "State-Action-Event", "type-safe navigation", "@Serializable route", "SavedStateHandle persistence", "process death recovery", "handleAction", "sendAction", "Hilt module", "Repository pattern", "implementing a screen", "adding a data source", "handling navigation", "encrypted storage", "security patterns", "Clock injection", "DataState", or any questions about implementing features, screens, ViewModels, data sources, or navigation in the Bitwarden Android app.
Implements a PostHog API (headless) survey inside the user's own codebase so it renders with their UI components and captures the exact events PostHog expects, then verifies the first response arrived. Use when asked to implement a survey, build a headless survey, build a custom survey UI, render a survey in my app, or wire up a survey of type `api` in a browser, server, or custom mobile UI. Covers the posthog-js event contract, server-side SDK capture, and post-implementation verification through MCP. To design or create the survey definition, use creating-surveys instead. For a survey that is implemented but not showing or not recording, use debugging-surveys.
Scaffold a new Tauri v2 project with the cenno/cull house conventions — delegates boilerplate to `npm create tauri-app`, then layers an opinionated core plus opt-in modules (CLI+MCP, SQLite, tray/updater, release/preflight, Swift sidecar). Use when the user wants to start a new Tauri desktop app, "init a tauri project", or "scaffold a tauri app".
Scaffold a standalone SwiftUI app via XcodeGen — pick macOS, iOS, or iOS+watchOS; ships house conventions, a Swift Testing target, swiftformat/swiftlint, optional CloudKit/CI/Release/Push modules, and optional JTBD product context. Use to "init an xcode project", "scaffold a swiftui app", "new mac/ios app".
Detect, analyze, and remediate OWASP A06:2025 Insecure Design vulnerabilities in Python web applications (FastAPI and Flask). Use this skill whenever the user asks about architecture-level security flaws, threat modeling, rate limiting gaps, business logic vulnerabilities, insecure file uploads, race conditions, tenant isolation failures, or client-side enforcement of server-side security. Trigger even if the user doesn't say "Insecure Design" explicitly — common signals include: "missing rate limiting", "file upload security", "business logic flaw", "race condition", "multi-tenant isolation", "threat modeling", "STRIDE", "design review", or "can users abuse this flow". Also trigger for code reviews or audits where architecture-level security controls are being evaluated, not just implementation bugs.
Transform a codebase study guide into a polished interactive web experience. This skill should be used when the user has a completed study guide markdown file (from codebase-study-guide or similar) and wants to turn it into an interactive pedagogical app. Triggers on requests like \"make this study guide interactive\", \"turn this into an interactive experience\", \"visualize this study guide\", \"create an interactive version\", or when a user has a study guide .md file and wants a richer presentation. Produces a Vite-served single-page app with scroll-driven storytelling, interactive architecture diagrams, animated code walkthroughs, and progressive disclosure.
Java and Spring Boot security patterns. Covers Spring Security, dependency auditing, secure coding practices, and OWASP for Java ecosystem. USE WHEN: user works with "Java", "Spring Boot", "Spring Security", asks about "Java vulnerabilities", "Maven security", "Gradle security", "Java injection", "Java authentication" DO NOT USE FOR: general OWASP concepts - use `owasp` or `owasp-top-10` instead, Node.js/Python security - use language-specific skills
Use when building Jigx apps that integrate with Acumatica ERP, including probing an instance, using SOAP/UI probes to understand screens, choosing between generic inquiries and contract REST for mobile, reading a screen's built-in logic and reconciling it with the customer's instance, selector and cascade rules, on-demand and delta reads, custom endpoint creation, REST and OData functions, Acumatica config values, acuerp access tokens, .value payload wrappers, lookup sync, expand selection, local-first sync, command queue retry, file uploads, PDF attachment, and service order submission.
Structured TODO commit workflow using JJ (Jujutsu). Use to plan tasks as empty commits with [task:*] flags, track progress through status transitions, manage parallel task DAGs with dependency checking. Enforces completion discipline. Enables to divide work between Planners and Workers. **Requires the working-with-jj skill**
PRD expert advisor mode. Three well-known PM/CEO personas act as advisors, proactively review the PRD, identify weak points and give improvement plans that can be written directly into the document; the user accepts/rejects to decide whether to adopt them. Triggers: /li-prd-review, 「强化 PRD」「专家顾问」「帮我看看这份 PRD」「让专家来审 PRD」「PRD 有哪些漏洞」「帮我优化 PRD」「PRD 还有什么问题」. Even if the user does not say "PRD", trigger this skill whenever they want expert personas to review a product document and give improvement plans. DO NOT trigger for: PRD generation tasks (use li-prd), content script generation, topic analysis and other content creation tasks.
Large Language and Vision Assistant. Enables visual instruction tuning and image-based conversations. Combines CLIP vision encoder with Vicuna/LLaMA language models. Supports multi-turn image chat, visual question answering, and instruction following. Use for vision-language chatbots or image understanding tasks. Best for conversational image analysis.
Expertise in LLVM security features including sanitizers, hardening techniques, exploit mitigations, and secure compilation. Use this skill when implementing security-focused compiler features, analyzing vulnerabilities, or hardening applications.
Use when working with AdonisJS Lucid ORM and SQL layer: database configuration, migrations, schema generation, schema classes, models, CRUD operations, model query builder, query scopes, hooks, serialization, relationships, transactions, pagination, debugging, validation rules, model factories, seeders, or database query builders. Trigger for tasks involving @adonisjs/lucid, database/schema.ts, app/models, database/migrations, database/factories, database/seeders, db service queries, Lucid relationships, or model behavior.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.