Skills
97,501 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Observability and monitoring validation patterns for dashboards, alerting, log aggregation, APM traces, and SLA/SLO verification. Use when testing monitoring infrastructure, dashboard accuracy, alert rules, or metric pipelines.
Audit the whole product across code, quality, process, docs, roadmap, and tooling; it owns the repo-wide bug hunt, security research, and broken-version investigation (scoped and budgeted per dimension, as distinct from `review-change`'s change-scoped review). Persist one severity-ranked, F-numbered report with proposals; never fix or file work. Triggers: "product-audit", "audit the product", "full health check", "are we product-ready", "CTO review".
Validates acceptance criteria for testability, traces requirements to test cases, and generates BDD scenarios from user stories. Use when validating acceptance criteria, building requirements traceability matrices, managing Gherkin scenarios, or ensuring complete requirements coverage before development.
Use when reviewing or judging a finished or amended developer guide — the adoption + integration narrative for a developer-tool product (SDK/library/CLI/framework/API platform). Decides whether a developer can install, integrate, and operate the tool from the guide alone. A gate, not authoring. Judges it against a single-sourced 14-condition adoptability + accuracy bar: a signposted start-here + a verifiable first success; concepts before recipes; how-tos cover the handed-in scenarios; samples runnable + accurate to the CURRENT tool (no fabricated/stale endpoints); LINKS INTO the api-reference, never duplicates it; Diataxis modes typed; a troubleshooting path; an amend reviewed delta-scoped. Emits exactly `VERDICT: approve|revise` + actionable findings; approves a guide meeting the bar (no false-revise on a thin one), revises only on a named gap. Not for authoring it, the end-user user-guide, the endpoint catalog (api-reference review), or engineering design docs (design-review).
Use when reviewing/judging a release runbook (the go-to-production procedure for shipping a system to production) — deciding whether an unfamiliar engineer can execute, verify, and roll back from it alone. A gate, not authoring. Judges a single-sourced 11-condition executability + safety bar: every step copy-paste-safe + idempotent with an expected result; a go/no-go gate; a complete rollback (a revert per forward change, measurable triggers, roll-forward if irreversible); post-deploy verification reusing the test-plan criteria; escalation + monitoring; NO secret inlined (an embedded token/key is a finding); stateful-change safety (proportional); a comms window for a user-impacting deploy (proportional); commands spot-checked against the upstreams; nothing fabricated; a delta-scoped amend. Emits `VERDICT: approve|revise` + actionable findings; approves a runbook meeting the bar (no false-revise), revises on a named gap. Not authoring it, not the QA test-plan, not engineering design docs (design-review).
Use when reviewing/judging an end-user product guide — the consumer-facing help a typically non-technical person reads to accomplish product goals (tutorial, how-tos, explanation, a product feature/settings reference, troubleshooting, glossary) — deciding whether a real user can accomplish every supported goal from the guide alone. A gate, not authoring. Judges a single-sourced 12-condition usability + accuracy bar: one how-to per goal; the four Diataxis modes correctly typed (not conflated); a complete product reference (NOT the HTTP API); accurate steps named by their exact UI label; symptom-keyed troubleshooting; plain language a non-technical reader can follow; accessibility + findability; surfaced assumptions, no fabrication; a delta-scoped amend. Emits exactly `VERDICT: approve|revise` plus actionable findings; approves a guide meeting the bar (no false-revise), revises only on a named gap. Not authoring it, the developer adoption guide, the endpoint catalog, or engineering design docs (design-review).
SonarQube/SonarCloud integration for continuous code quality. Setup, configuration, quality gates, and CI/CD integration. USE WHEN: user mentions "SonarQube", "SonarCloud", "quality gates", asks about "code coverage", "technical debt", "code smells", "sonar-project.properties", "SonarScanner" DO NOT USE FOR: ESLint/Biome - use linting skills, OWASP security - use security skills, testing tools - use Vitest/Playwright skills
Static security review for Flutter mobile apps and Dart code: hardcoded secrets, insecure storage, unsafe network calls, leaky logs, vulnerable dependencies. Use when reviewing or writing code handling secrets, user data, network communication, authentication, or cryptography, or adding validation to user input in login, sign-up, or payment forms before it reaches a repository or an API. Also when asked to implement the insecure change rather than review it: moving an API key to --dart-define, String.fromEnvironment, a .env file, or CI secrets, or "our reviewer flagged this line". Also for dependency vulnerability review and security audits that never say "security": whether a pubspec is safe to release, checking dependencies for known vulnerabilities or CVEs, an ignored_advisories entry, or pinned versions we're exposed to.
Review existing work against the user's actual goal and surface evidence-backed strengths, gaps, risks, and next fixes. Use when asked to eval, evaluate, review, assess, or check current/this/my/our work; decide whether a task is complete; build a definition-of-done checklist or rubric; or perform grading, LLM-as-judge, Qworld, or RET evaluation. Treat plain eval/review requests as qualitative: resolve "current work" from the conversation, artifacts, files, or diff, and never assign numeric scores unless the user explicitly requests scores, grades, points, ratings, weighted criteria, Qworld, or RET. Do not use for implementing automated eval suites, tests, graders, or benchmarks.
Check whether reported paper metrics are consistent with outputs from the local code artifact. Use for result reproduction checks, artifact evaluation, reproducibility checklists, code-versus-paper audits, table or claim metric comparisons, and badge-readiness review.
Audit and enable security-oriented Xcode build settings. Progressively enables compiler warnings, static analyzer checkers, and Enhanced Security features. Use when: user wants to secure their Xcode project, audit security settings, enable hardening, review security posture of build configuration, set up security-focused static analysis, enable static analysis, improve warning coverage, harden diagnostics, or catch more bugs at compile time in C/C++/Objective-C/Swift. SKIP: network security (TLS/ATS), code signing, privacy APIs.
Pre-deployment security audit of Solidity smart contracts in a Foundry project. Combines static analysis (Slither, Aderyn), symbolic execution (Mythril), and property-based testing (forge fuzz + invariant tests with handlers) to catch reentrancy, access-control, oracle/price manipulation, and arithmetic bugs BEFORE deploying to an EVM chain. Also enforces key hygiene (no plaintext private keys, encrypted cast keystore) and a secure deploy workflow. Use when writing, reviewing, testing, or deploying Solidity/Foundry contracts, building a dApp, or working with forge/cast/anvil, MetaMask, or Web3/DeFi code.
Use when the user asks to collect, submit, upload, or summarize CawPlan QA session daily JSON — e.g. 提交 QA 日报, QA 日报, 测试日报, 提交测试日报, QA 会话上报, or /cawplan-qa-commit. NOT for: coding/代码日报 (use cawplan-coding-commit), git commits, viewing insights, querying costs, or searching tickets.
Use on CI in non-interactive mode after a failed CodeceptJS run — attempts safe fixes only (locator drift, missing waits), reruns failing scenarios, rolls back edits that didn't help, reports at `output/ci-fix.md`. No refactors, no config edits, no flake-masking. Trigger on "ci fix tests", "auto-fix failing tests", "attempt repair on CI", or as a CI step after a failed run.
Check for and correct dont-do-that packaging issues, including over-encapsulation, over-abstraction, thin helpers, thin type splitting, single-use enums/constants, passing parameters around via instance properties, misplaced React component responsibilities, disorganized React frontend utils, and incorrect Node.js backend layering responsibilities. Use when the user asks to review or modify code structure, inline small functions, merge thin types, pull back single-use constants, tidy up React hook / TSX / frontend util responsibilities, check Node.js service / logic / query layering, or judge whether code follows project conventions.
Use when Codex is building, revising, or reviewing a frontend UI, web app screen, responsive layout, component surface, dashboard view, form flow, visual system, or no-template product interface that needs visual polish, accessibility, screenshots, or browser QA.
Expert in observing, benchmarking, and optimizing AI agents. Specializes in token usage tracking, latency analysis, and quality evaluation metrics. Use when optimizing agent costs, measuring performance, or implementing evals. Triggers include "agent performance", "token usage", "latency optimization", "eval", "agent metrics", "cost optimization", "agent benchmarking".
Complete browser automation with Playwright. Auto-detects dev servers, writes clean test scripts to /tmp. Test pages, fill forms, take screenshots, check responsive design, validate UX, test login flows, check links, automate any browser task. Use when user wants to test websites, automate browser interactions, validate web functionality, or perform any browser-based testing.
Install and use Playwright via a standalone .mjs script (not through npx playwright test / *.spec.ts) to verify code quickly, one-off: screenshot localhost/file://, read console/pageerror, measure getBoundingClientRect when an element is not visible or not clickable, bypass auth via addCookies+addInitScript; for MULTI-STEP work, use the persistent-session mode connectOverCDP (tabs/cookies persist across turns, no writing the whole scenario blind). Use when the user says 'verify bằng playwright', 'chụp ảnh trang', 'test nhanh UI bằng script', 'verify nhiều bước', 'giữ session giữa các lần chạy', 'claude-in-chrome bị chặn localhost', 'không click được / không thấy phần tử', or invokes /playwright-verify. DIFFERENT from uat-nonit-testcase (UAT test case set for non-IT) and claude-in-chrome (extension, blocked by localhost/file://) — this is the GENERAL guide applicable to every task.
Run PostgreSQL queries for testing, debugging, and performance analysis. Use when you need to query the database directly, run EXPLAIN ANALYZE, compare query results, or test SQL optimizations. Always pass a target — `--prod` or `--dev` — because prod and dev are different databases and the default is prod. Always uses read-only connections unless explicitly directed otherwise.
Connect Promptfoo to a model, live HTTP API, local Python/JavaScript provider, or app code. Use for request/auth mapping, response parsing, OpenAPI setup, and connection smoke tests. Use promptfoo-evals for broader eval coverage and promptfoo-redteam-setup for attack selection.
Generates durable-first tests — invariants, contracts, and property-based tests at boundaries that survive a reimplementation — plus unit, integration, and e2e coverage. Use when creating tests for new or changed code, filling coverage gaps, or migrating test suites between Jest, Vitest, and Playwright.
James Bach's HTSM Product Factors (SFDIPOT) analysis for comprehensive test strategy generation. Use when analyzing requirements, epics, or user stories to generate prioritized test ideas across Structure, Function, Data, Interfaces, Platform, Operations, and Time dimensions.
Collect and submit feedback about Superset — bug reports, feature requests, or general feedback — privately to the Superset team or as a public GitHub issue. Use when the user wants to report a Superset bug, request a feature, or send feedback about Superset.
Test REST and GraphQL endpoint contracts using Playwright request fixture (TypeScript) or REST Assured (Java). Use for standalone API tests covering schemas, auth, status/error handling, pagination, idempotency, rate limits, or contract checks; not for browser E2E specs. Keywords: REST, GraphQL, API contract, schema validation, REST Assured.
Diagnose and fix failing automated tests. Analyzes failures, inspects DOM, identifies root causes, and applies targeted fixes using framework tools and MCP/CLI debug modes. Use when tests fail, are flaky, or behave inconsistently (e.g., pass locally but fail in CI).
Continuous integration for Go projects: GitHub Actions pipelines, caching, golangci-lint setup, test/coverage gates, vulnerability scanning, SAST (CodeQL, gosec), Dependabot, action pinning, build matrices, Makefile targets. Use when: "set up CI", "GitHub Actions for Go", "add lint to the pipeline", "CI is slow", "coverage gate", "build matrix", "write a Makefile", "run govulncheck in CI". Not for: commit conventions (git-commit), choosing or auditing dependencies (go-dependency-audit), writing the tests themselves (go-test-quality), releases and signing (go-build-release).
Use this skill when creating or modifying Biome lint rules or assists, including analyzer queries, semantic bindings, rule state, code actions, fix safety, options, registration, and end-user rule rustdoc. Also load diagnostics-development for substantial message/advice design and testing-codegen for fixture or snapshot mechanics.
Enterprise middleware testing patterns for message routing, transformation, DLQ, protocol mediation, ESB error handling, and EIP patterns. Use when testing middleware layers, message brokers, ESBs, or integration buses.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.