Skills
97,501 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Debugging-method traps: run the discriminating experiment first, read build logs bottom-up, treat an empty actual as unwritten, audit shared handles before removing a feature, read commit history critically. Use when a fix is not converging.
Audit a PostHog A/B experiment for a customer — verify config, exposure, attribution, and metrics. Trigger phrases include \"audit [customer]'s experiment\", \"audit the [name] experiment\", \"check experiment setup for [customer]\", \"validate this A/B test\", or any request to review whether an experiment is correctly wired up. Assumes you already have MCP access to the customer's project (typically via the impersonation flow set up by the `impersonate-audit` wrapper that ships with this plugin).
Expert guidance for ffuf web fuzzing during authorized penetration testing. Covers directory discovery, subdomain enumeration, parameter fuzzing, authenticated fuzzing with raw requests, auto-calibration, and result analysis. Use when running ffuf scans, analyzing ffuf output, or building fuzzing strategies for web targets.
Evaluate a repo agent harness (AGENTS.md, rules, skills, skill refs) for broken paths/commands, redundant instructions, and usefulness using a stack-agnostic dual-judge protocol with planted traps. HIGH PRIORITY questionnaires at top: Q1 optional docs, Q2 B/C budget before Track A (certainty/tokens). A always runs after Q2; B/C opt-in. ADRs/RFCs excluded from T2. Mixed apply uses 11-mixed-apply.md (KEEP/CUT). Use when the user says harness eval, harness-eval, harness debug, audit AGENTS.md, audit skills/rules, instruction audit, redundancy of agent instructions, usefulness of skills, Ship/Review/Hold/Slim/Keep-core for harness, or wants Track A/B/C harness evaluation. Do NOT use for harness setup or init, feature spec-driven work (tlc-spec-driven), or applying Ship/Slim trims unless the user explicitly asks after the report.
Guide users from their own agent code or recorded traces through Kitaru setup, session import or recording, human review, an accepted behavior, a versioned cohort, and evaluator selection, then hand one bounded change to the replay-experiment skill. Use when a user wants to connect or inspect an existing agent, import real traces from files or provider APIs, follow up on a post-import insight, investigate a known bad or surprising session, discover recurring failure modes, learn the evidence-led review flow, resume an investigation, create a cohort from reviewed evidence, or author an evaluator for an accepted behavior. When a first-time user has no agent or evidence and wants a fast demonstration with the PydanticAI returns agent example, use the `kitaru-guided-tour` skill instead.
Mutation testing quality gate with scenario coverage enforcement and structured evidence output. Detects project type and runs the right tool (cargo-mutants, Stryker, mutmut, Muzak), analyzes surviving mutants by mutation type (arithmetic, comparison, boolean, return value, statement removal), enforces scenario coverage check before recommending tests, produces MUTATION_RESULT JSON evidence packets, and enforces a 100% kill rate quality gate. Use when running mutation testing, validating test quality, preparing PRs, or analyzing surviving mutants. Triggers on: "run mutation testing", "mutation score", "surviving mutants", "kill rate", "cargo mutants", "stryker", "pre-PR quality check", "are my tests good enough". NOT for: writing tests (use tdd), debugging test failures (use debugging-protocol).
LLM prompt engineering: analyzes failure modes, generates variants (direct, few-shot, CoT), designs rubrics, produces test suites. Triggers on: "prompt engineering", "generate prompt variants", "A/B test prompts", "optimize prompt", "improve this prompt". NOT for SKILL.md files, use skill-evaluator.
Use when an agent builds, fixes or tests anything in Roblox Studio: "make a Roblox game", "Roblox Studio", a Luau script, "my Roblox game lags", agent control of Studio, the Studio MCP server (execute_luau, start_stop_play, screen_capture), Rojo or Script Sync projects, offline Luau checks, playtests driven by code; when the MCP server lists no Studio, a playtest hangs, or 2019 to 2023 Roblox code breaks; or when a Roblox brief (UI, data, networking, combat, monetization, assets, performance) must go to the right scenario-roblox-* specialist.
Run a comprehensive security audit combining automated SAST scanning, STRIDE threat modeling, and attack tree analysis. Use before major releases, after security-sensitive changes, or on a regular cadence. Can audit the full codebase or specific directories.
Active runtime recovery for coding agents: when something breaks mid-task, diagnose the root cause, write a fix, VERIFY by re-running the broken thing, then file a `HEAL-` entry to `.learnings/HEALS.md` with proof. Use whenever a command, test, build, or lint fails or exits non-zero; on missing tooling, dependency/lockfile mismatch, wrong runtime version, venv or permission errors, port conflicts, dirty git state, or a missing `.env`; when the agent needs a helper or one-off script that doesn't exist yet; when an external API, tool, or MCP errors or rate-limits; or when a test flakes. Search `HEALS.md` by `Pattern-Key` first — most heals are recurrences, so increment `Recurrence-Count` instead of duplicating. Verify is mandatory: mark `pending-verify` honestly if sandboxed, `abandoned` if the fix can't be made to work. Pairs with `self-improvement` (which promotes recurring heals to durable memory) but owns the verify-before-persist discipline self-improvement doesn't.
Apply repository-grounded senior engineering judgment to substantial Python work and bounded Python changes with production or cross-boundary risk. Do not use for trivial syntax questions, generic tutoring, or tasks with no Python artifact unless explicitly invoked. Use for writing, review, diagnosis, design, refactoring, or maintenance where correctness, state, effects, concurrency, compatibility, security, reuse, testing, or long-term ownership materially matters.
Scaffold Lightning Web Components with HTML templates, JS controllers, CSS with SLDS compliance, js-meta.xml config, and Jest tests. Use when asked about Lightning Web Components, LWC, component scaffolding, or Jest tests for LWC. Activate on .js-meta.xml files, mentions of "LWC", "Lightning Web Component", "wire adapter", "lightning component", or "@api/@wire/@track decorators".
Toolkit for creating and validating skills and subagents. Use when: creating a new skill (fast or full mode), validating an existing skill, deciding Skills vs Subagents, migrating docs to skills, estimating token cost, or running a security scan. Triggers: "create skill", "build skill", "validate skill", "new subagent", "skills vs subagents", "estimate tokens", "security scan".
Use when setting up or running TypeScript type-checking as a standalone quality gate — writing or tightening a strict tsconfig.json, adding a `tsc --noEmit` (or `tsc -b --noEmit`) check that runs separately from the build, wiring that check into CI, or configuring TypeScript project references for a multi-package (pnpm/Turborepo) monorepo. Covers why a dedicated type-check gate is mandatory (bundlers and transpilers strip types without checking them), the strict compiler-option set worth enabling beyond `strict: true`, the Vite split-config layout, and cross-package type resolution via composite project references. TypeScript 5.x.
Prove that a command-line tool actually did what it said, instead of trusting its exit code and its output. Snapshots the filesystem before and after, names the expected consequence in advance, and returns one of four verdicts with what could not be seen. Use after running a build, a migration, a scaffolder, a formatter, a codegen step, or an AI coding CLI; when a command printed success and you are about to report "done"; when you are about to write "exit code 0, so it worked"; or when a tool claims it edited files. Needs nothing installed.
Use when you must prove an analysis ran on the intended data or lock a dataset version. Builds a deterministic content-hash manifest (file SHA-256, schema, per-column value hashes), verifies later copies against it for drift, and diffs two manifests.
Plan, execute, document, and retest authorized security assessments of AI agents and multi-agent workflows using safe adversarial cases, synthetic identities, canaries, and evidence-based findings. Use when defining red-team rules of engagement, assessing prompt injection or excessive agency, testing tool and identity boundaries, evaluating memory or cross-agent attacks, scoring a campaign, or verifying remediation in an approved environment.
Verify completed implementation against the plan. Checks that all tasks were implemented, nothing was forgotten, code compiles, tests pass, and quality standards are met. Use after "/aif-implement" completes, or when user says "verify", "check work", "did we miss anything".
Designs structured benchmarks comparing algorithms, models, or implementations with metrics, test cases, hardware context, and reproduction steps. Triggers on: "benchmark", "compare performance", "which is faster", "latency comparison", "run benchmark", "throughput test", "speed test".
Auditable agent team: a BMAD fully automated R&D pipeline orchestrator. Orchestrates 9 specialized Agents (PM, Architect, UI Designer, Tech Lead, Scrum Master, Frontend, Backend, QA, DevOps) from requirements to deployment, with event sourcing + non-bypassable gates + deterministic evals at every step — verifiable that tests really run and gates really pass. Supports single-stage slice commands (/boss:plan /review /qa /ship) and a pure Markdown fallback without the CLI. Triggers (full pipeline): 'boss mode', '/boss', '全自动开发', '从需求到部署', '帮我做一个', 'build this', 'ship it', '全流程', '自动化开发', '一键开发', 'start a project', 'new feature' Triggers (single-stage slices, most commonly used on existing projects): - /boss:review — '帮我评审', '代码评审', '技术评审', '看看这段代码有什么问题', '风险评估', 'review this', 'review my PR', 'code review' - /boss:qa — '跑一下测试', '补测试', '检查质量', '测试覆盖够不够', '门禁过了吗', 'run the tests', 'check quality', 'add tests' - /boss:plan — '先出个方案', '写个 PRD', '设计一下架构', 'write a spec', 'plan this feature' - /boss:ship — '可以发布了吗', '部署检查', 'ready to ship', 'deploy checks' Does NOT trigger: - Single-file changes or simple bug fixes (just edit directly) - Pure code reading or explanation (use the read tool) - Repeated invocation while a pipeline is already running - Extremely small tasks (estimated <30 minutes of manual work, no PRD/architecture/gate records needed) Output: complete project code + PRD/architecture/UI/test/deployment documents, written to the .boss/<feature>/ directory
Use this skill when categorizing code review findings into severity levels. Apply when determining which emoji and label to use for PR comments, deciding if an issue should be flagged at all, or classifying findings as CRITICAL, IMPORTANT, DEBT, SUGGESTED, or QUESTION.
Verifies API implementations against OpenAPI specifications using the Drift CLI, catching spec drift and supporting Bi-Directional Contract Testing (BDCT). Use when the user mentions Drift, API contract testing, provider contract testing, provider verification, spec drift, API conformance testing, OpenAPI verification, BDCT, drift expressions, drift datasets, drift lifecycle hooks, or Lua scripting in a testing context. Use when the user asks to write, run, or debug Drift test cases. Use when the user wants to test their API against an OpenAPI spec, generate tests from an OpenAPI spec, or check whether their API has drifted from its spec. Use when the user wants full endpoint coverage, wants all tests to pass, or asks to "keep running until everything passes". Also use when the user mentions AsyncAPI, event-driven API testing, Kafka contract testing, SNS or SQS testing, async message contracts, or wants to verify that a service publishes or consumes messages matching an AsyncAPI spec.
Author agentic verification plans for Eve-compatible apps. Use when building structured test suites that verify app correctness AND Eve platform conformance — CLI parity, manifest conventions, SSO auth, managed migrations, fixture-driven ingestion, and agent efficiency.
Run and interpret one safe, bounded Kitaru replay comparison against an accepted cohort and exact evaluators. Use when a user wants to replay a cohort, test or compare a model, prompt, system prompt, parameter, agent version, or tool policy, supervise an experiment run, determine whether one candidate helped, or ask for one bounded change worth testing.
Use when the DSH host itself has been upgraded (or is about to be) and the whole installed fleet of Web/client plugins must be checked against the new host - one or more surfaces broke, vanished, or need their compatibility re-verified and re-released. Also use after a host upgrade to sweep for silent breaks before the user reports them, and to run the per-plugin fix/release loop (branch, bump, changelog, tag, mirrors).
One-stop pipeline to a production-grade frontend with a MACHINE SENTINEL GATE: interview the theme source in a single message (A default macOS glassmorphism preset · B design-doc folder/file · C paste the target page URL), lock the parameters into a single design.md file (read by both hallmark and impeccable), then generate tokens.css + frontmatter with design-sync.py, build a token-only page per hallmark, run fe-gate.sh (impeccable detect 61 deterministic rules rc 0/1/2 + Playwright 4 viewports) and a rubric audit/harden/polish, and do NOT deliver until the gate is green. Trigger when the user says "frontend production", "production-grade frontend", "dựng FE chuẩn production", "giao diện kỷ luật", "prd-grade-fe", "/prd-grade-fe". Different from hallmark (design foundation, no impeccable gate) and from /br (BR→frame pipeline, does not handle the frontend layer separately).
Audits Solidity codebases for smart contract vulnerabilities using a four-phase workflow (cheatsheet loading, codebase sweep, deep validation, reporting) covering 36 vulnerability classes. Use when auditing Solidity contracts for security issues, performing smart contract vulnerability scans, or reviewing Solidity code for common exploit patterns.
Apply repository-grounded senior engineering judgment to substantial JavaScript or TypeScript work and bounded JS/TS changes with production or cross-boundary risk. Do not use for trivial syntax questions, generic tutoring, or tasks with no JS/TS artifact unless explicitly invoked. Use for Node, browser, frontend, worker, and edge work where correctness, contracts, state, effects, concurrency, compatibility, security, reuse, runtime alignment, or long-term ownership materially matters.
Rigorously evaluate an Agent Skill end-to-end across ANY coding-agent CLI — verify its scripts emit the documented numbers (deterministic checks), test whether its description triggers on the right prompts, and measure whether an agent following the SKILL.md beats a no-skill baseline (with/without pass-rate delta, mean ± stddev, benchmarked). Use whenever you need to test, benchmark, validate, grade, or quantify a skill's quality, check if a skill "actually works," compare two skill versions, optimize a skill's triggering, or set up an eval suite — even if the user just says "is this skill any good," "does my skill work," or "benchmark this skill." Drives Claude Code, OpenAI Codex, Antigravity (agy), Cursor, GitHub Copilot, Amp, opencode, or Grok in headless mode.
Transform passive "Verify X" test descriptions into active, observable test actions. Use when test ideas lack specificity, use vague language, or fail quality validation. Converts to action-verb format for clearer, more testable descriptions.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.