Skills
97,501 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Review the changes since a fixed point (commit, branch, tag or merge-base) along two axes — Standards (does the code follow this repo's documented coding standards?) and Spec (does the code do what the originating issue/spec asked for?). Run both reviews in parallel sub-agents and report side by side. Use when the user wants to review a branch, a PR, work in progress, or asks to "review since X".
Apply the formal standard for React component engineering focusing on accessibility, composition, and styling. Use for building professional, composable React artifacts. Use proactively when creating or reviewing React components. Examples: - user: "/component-create Button trigger" → build accessible button with asChild and keyboard map - user: "/component-review src/components/Input.tsx" → audit for accessibility and composition compliance - user: "Build a responsive slider" → select taxonomy type and implement with data attributes - user: "Review my layout component" → check for monolithic patterns vs composition
End-to-end testing patterns with Playwright for full-stack Python/React applications. Use when writing E2E tests for complete user workflows (login, CRUD, navigation), critical path regression tests, or cross-browser validation. Covers test structure, page object model, selector strategy (data-testid > role > label), wait strategies, auth state reuse, test data management, and CI integration. Does NOT cover unit tests or component tests (use pytest-patterns or react-testing-patterns).
Comprehensive SQL statement checking for HetuEngine, supporting two check modes: 1. Syntax Check - Keyword validation, statement structure verification, clause completeness, HetuEngine syntax compatibility based on Presto/Trino + Hive grammar definitions 2. Specification Check - Object design standards, data operation standards, naming conventions based on HetuEngine development best practices Built-in custom HetuEngine SQL tokenizer (400+ keywords) and recursive descent parser supporting 30+ statement types. Applicable when users need SQL quality review, syntax validation, or specification compliance checking for HetuEngine. 触发词："HetuEngine SQL检查"、"Hetu SQL规范"、"Hetu SQL审计"、"Hetu SQL语法"、"Hetu SQL优化"、"检查Hetu SQL"、"HetuEngine SQL review"
Emulated Linear GraphQL API for local development and testing. Use when the user needs to test Linear integrations locally, emulate Linear issues, comments, teams, workflow states, OAuth apps, webhooks, agent sessions, or work with the Linear API without hitting the real Linear service. Triggers include "Linear API", "emulate Linear", "mock Linear", "test Linear OAuth", "Linear webhook", "Linear agent", "local Linear", or any task requiring a local Linear API.
Helps users configure mirrord.json for database branching, enabling isolated database copies for safe development and testing. Use when the user wants to set up MySQL, MariaDB, PostgreSQL, MSSQL, MongoDB, Redis, DynamoDB, ClickHouse, Google Spanner, Amazon S3, turbopuffer, or generic branches, configure copy modes, connection sources, schema migrations, IAM authentication, or manage database branches.
Design, change, or review an HTTP/JSON API surface — endpoints, request/response shapes, authentication and authorization, pagination, idempotency, rate limits, versioning, and deprecations. Use when adding or modifying an HTTP endpoint, reviewing an OpenAPI spec or HTTP route diff, or deciding whether an HTTP API change breaks consumers. Do not use as a protocol-compatibility checklist for gRPC/protobuf, GraphQL, WebSockets, or other non-HTTP/JSON interfaces.
Run AI-powered code review through Alibaba's open-code-review (`ocr`) CLI instead of hand-reviewing diffs. Use when the user asks to review code, review a PR/MR, review staged/unstaged/untracked changes, review a single commit, compare two branches, or scan whole files for bugs, security issues, performance problems, and quality concerns. Picks the lightest invocation (workspace review, branch range, single commit, or full-file scan), passes business context via `--background`, classifies findings by priority, and optionally applies fixes. Triggers on: open code review, ocr review, ocr scan, alibaba code review, ai code review cli, review my changes, review this pr, review this commit, review this branch, scan repository for issues.
Build an LLM evaluation and run it against the app, returning an Opik experiment with scores and its link. Picks a test suite with judge assertions or a dataset with metrics, sources cases from traces or synthetic data, scores heuristics-first then one-failure-mode judges, runs client-side via the SDK or server-side for prompt-only targets, and reads the scores back. Covers RAG evaluation, error analysis, writing and validating LLM judges against human labels, and auditing an existing eval pipeline. Use for "evaluate my agent", "measure quality", "build an eval", "write an LLM judge for hallucinations", "audit our evaluation pipeline", "how good is my RAG", "set up evals for this". Not for before/after on an existing suite (use compare), one regression case (use test), scoring production traffic (use online-eval), or the ship/hold decision (use verify).
Provides comprehensive guidance for Playwright testing including browser automation, test writing, page objects, and cross-browser testing. Use when the user asks about Playwright, needs to write E2E tests, automate browsers, or test web applications across browsers.
Tests LLM applications for prompt injection vulnerabilities per OWASP LLM01:2025. Covers direct injection (user input manipulating model behavior) and indirect injection (external content containing hidden instructions). Auto-invoked when reviewing LLM applications that process external content, build RAG pipelines, or accept user input that reaches a language model. Produces a test report with categorized findings and defense recommendations.
Review local changes with Qodo during substantive coding milestones and before a PR or completed-work handoff. Use light background checkpoints while coding, collect and assess findings with session context, and run a final review before handing off. Also use for "review my local diff", "pre-PR review", or "run qodo review". Use qodo-review-resolver for findings already posted on a PR.
Use when the user asks to review or clean up R code for tidyverse style, standardize formatting or names, remove redundant comments or wrappers, or make a behavior-preserving style pass. Also use when writing substantial new R package code if the user requests tidyverse style or the package already follows it. Not for routine small edits or general correctness, security, or test-quality reviews.
Evaluates RAG pipeline quality across retrieval (precision, recall, MRR) and generation (groundedness, hallucination rate). Triggers on: "audit RAG pipeline", "RAG quality", "hallucination detection", "why is RAG failing", "grounding check". NOT for general architecture audits, use architecture-reviewer.
Chain-of-Verification (CoVe) prompting system. Converts lazy prompts into rigorous 4-stage verified output. Use for any code generation, debugging, or implementation task. Automatically invoked by wavybaby for medium/high complexity tasks. Reduces hallucinations and catches subtle bugs.
Reviews Rust code for ownership, borrowing, lifetime, error handling, trait design, unsafe usage, and common mistakes. Use when reviewing .rs files, checking borrow checker issues, error handling patterns, or trait implementations. Covers Rust 2024 edition patterns and modern idioms.
Scan a project and inventory what is available for QA work - project type, languages, frameworks, manual `*.test.md` cases, automated tests and automated references, and how Testomat.io is reachable (token, MCP, project settings). Use this skill whenever analyzing a codebase for test planning, detecting test frameworks, counting tests, or preparing for test automation. Specifically, when the user mentions "scan project", "what tests exist", "how many tests", "analyze codebase", "detect frameworks", "test matrix", or needs an inventory before a QA workflow.
Rewrites code review comments so they read like a human teammate wrote them. Cuts corporate-AI throat-clearing ("I noticed...", "I was wondering if perhaps...", "It might be worth considering..."). Each comment is direct: location, the issue, a concrete fix. Use when user says "humanize review", "de-slop PR comment", "make this feedback sound human", "review this PR", "code review", "/review", "/unslop-review". Auto-triggers when reviewing PRs.
Prove whether a given directory, file, exported symbol, function, component, constant, hook, type, or helper has "no real consumers", then decide whether to delete it. Use for dead code cleanup, unused code detection, unused export audits, deletion safety checks, and consumer searches; it only answers questions of consumption relationships and deletion safety, not whether something that is still used is actually necessary - for that, use necessary-code-audit.
Write, run, or repair .NET tests that use xUnit with the right package, CLI, and runner guidance. USE FOR: xUnit v2 or xUnit v3 projects; adding, running, debugging, or repairing xUnit tests; choosing between VSTest and Microsoft.Testing.Platform. DO NOT USE FOR: TUnit projects; MSTest projects. INVOKES: inspect the repository context, edit targeted files, and run relevant build, test, lint, or validation commands when changes are made.
The Aries Tools TypeScript toolchain (@ariestools/toolchain) behind XY, XYO, and XL1 repositories — the stable xy and experimental xyex CLIs, xy.config.ts, and the shared ESLint, TypeScript, and Vitest configs. Use when setting up a repo or choosing a project profile; running or debugging build, lint, test, or xy check; configuring package output; fixing deplint or publint findings; linting AGENTS.md and docs with xy agent; supporting product planning (papers, roadmap, PRDs) with xy repo init and xyex plan; managing skills; tracking work with xyex work; updating dependencies; auditing licenses or security; releasing packages; or interpreting xy command failures.
Use when setting up or running linting and formatting in a JavaScript or TypeScript project with Biome — the single fast Rust tool that lints, formats, and organizes imports, replacing the ESLint + Prettier pair (the JS analog of Ruff). Covers installing Biome v2, the biome.json config (formatter, linter rule groups, the assist/import-organize actions, VCS integration, overrides, monorepo extends), the CLI (biome check --write, biome ci for CI), migrating from ESLint/Prettier, the v1->v2 deltas (e.g. --apply became --write), and authoring custom lint rules as GritQL plugins. Use when adding a lint/format gate, writing or fixing a biome.json, or porting an ESLint/Prettier setup. Not the Turborepo task wiring (compose with that skill).
Forensic bug and issue triage. Produces a graded investigation case file: symptoms, evidence (graded A/B/C by confidence), ranked hypotheses, suspected components, and a recommended planning response. INVESTIGATES and DOCUMENTS only — does NOT fix code, run tests, or implement. Hands off as a story to an external dev tool. Use when the user says: - "investigate this bug" / "triage this issue" / "debug triage" - "what's causing [symptom]" / "why is [feature] broken" - "something's wrong with [component]" / "users are reporting [problem]" - "figure out what happened" / "root cause this" - "I need a bug report" / "create an investigation case file" - "forensic analysis" / "diagnose this" - "error triage" / "issue investigation" - "what do we know about [incident/issue]". Three intents: Create (new case file), Update (add evidence to open case), Validate (check draft for completeness before handoff). Output lands in bmad-output/; a fix story is drafted on handoff.
Scan C/C++ codebases for code quality issues including extra large files/functions and circular dependencies. Use when the user asks to check file sizes, find oversized functions, detect circular dependencies, analyze code complexity, find code smells, or identify maintainability issues in C/C++ code. Supports scanning individual files or entire directories with configurable thresholds.
Integrates Promptfoo and DeepTeam into CI/CD for automated, repeatable red-teaming of LLM apps against OWASP LLM Top 10, OWASP Agentic, and MITRE ATLAS presets, failing the build when jailbreak or injection vulnerabilities regress. Use for continuous adversarial testing in CI/CD, a merge-blocking security gate, or comparing model/prompt versions for compliance reporting.
End-to-end GECX/CXAS/CES conversational agent lifecycle -- build agents from requirements (PRD-to-agent), create and run evals (goldens, simulations, tool tests, callback tests), debug failures, and iterate to production quality. Use this skill whenever the user mentions GECX, CXAS, CES, SCRAPI, conversational agents, voice agents, audio agents, agent evals, pushing/pulling/linting agents, or agent instructions/callbacks/tools on the Google Customer Engagement Suite platform.
Validate JavaScript/TypeScript dependency upgrades after an interactive or manual update. Establish the real delta from git, detect peer/engine/type conflicts, extract breaking changes, migrations and adoptable features from release notes, assess held-back or seemingly unused packages, and run verification gates. Covers bun, npm, pnpm and yarn. Use when packages were just upgraded and need validating, when deciding whether a held-back package can move, when asking why a dependency is present at all, or when checking release notes for breaking changes and migration steps. Not for picking and applying upgrades autonomously, bun CLI usage (bun-cli), or non-JavaScript package ecosystems
Scan the codebase and classify every fact by lifecycle stage — tag @draft, @spec, or @implemented based on what the code actually shows. Add missing facts, fix inaccurate ones, remove obsolete ones. Use when asked to discover facts, bootstrap or update a fact sheet, scan the codebase for truths, sync facts to match the code, or audit the fact sheet for accuracy.
Complete FFmpeg video analysis and quality control filters for automation and broadcast workflows. PROACTIVELY activate for: (1) Detecting black frames (blackdetect, blackframe), (2) Finding blurry/frozen frames (blurdetect, freezedetect), (3) Auto crop detection (cropdetect), (4) Scene change detection (scdet), (5) Interlace detection (idet), (6) Quality metrics (PSNR, SSIM, VMAF), (7) Signal analysis (signalstats), (8) Frame information logging (showinfo), (9) QC automation scripts, (10) Broadcast compliance checking. Provides: Detection filters, quality metrics, analysis commands, automation patterns.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.