Skills
97,501 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Use when testing REST, GraphQL, gRPC, or WebSocket APIs against the OWASP API Security Top 10 — object- and function-level authorization (BOLA/BFLA), excessive data exposure, mass assignment, unrestricted resource consumption, and GraphQL-specific abuse. For apps you own or are authorized to test.
Uses the Codacy Cloud CLI to query repositories, issues, security findings, pull requests, tools, and patterns on Codacy Cloud. Use whenever the user mentions Codacy, asks about code quality metrics, wants to check issues or findings in a repo, inspect a pull request analysis, browse security vulnerabilities, enable or disable tools, search patterns, trigger a reanalysis, or interact with any remote Codacy data — even if they don't say "Codacy CLI" explicitly.
Delegate browser/UI verification and computer-use tasks to Codex — launching the app, clicking through flows, verifying UI/UX changes visually. Use when a change needs to be seen working in a real browser and screenshots would burn main-loop tokens.
Product-interface quality gate for evidence-based UI decisions. Use when designing or implementing a user-facing UI, reviewing its usability, refining an existing interface, or changing responsive, stateful, overlay, or cross-platform behavior.
Invoke when the user wants feedback on a game design document, GDD review, design evaluation, or consistency check on an existing design. Triggers on: "review my GDD", "design feedback", "evaluate design", "design document review", "GDD critique". Do NOT invoke for brainstorming new ideas (use game-brainstorm) or balance tuning (use game-balance-check). Part of the AlterLab GameForge collection.
Audit Go module dependencies: detect outdated packages, check for known vulnerabilities, review go.mod hygiene, identify unused or redundant deps, and evaluate dependency quality. Use when auditing dependencies, checking for CVEs, cleaning up go.mod, upgrading modules, or evaluating third-party packages. Trigger examples: "check dependencies", "audit deps", "go.mod review", "update modules", "vulnerability scan", "govulncheck". Do NOT use for code-level security issues (use go-security-audit) or architecture review (use go-architecture-review).
Test/validate a Juspay payment integration after jp-executor has built it. Detects the repo's existing test stack and replicates it (Playwright, Cypress, Jest, Vitest, pytest, supertest, …), falling back to inline curl/bash when none exists. Risk-prioritized coverage of order/session creation, server-to-server status reconciliation, webhook signature + idempotency, per-method process payloads, constraint boundaries and error-code paths — backend and frontend/SDK as the built surface dictates. Ends with a traceability matrix, a PASS/CONCERNS/FAIL quality gate, and a written test report. Use after jp-executor, or standalone against an already-built integration.
Security review for Omarchy Quattro plugins (Quickshell/QML bar widgets with bash, python or node helpers) before submitting to the plugin marketplace. Use when writing, auditing or hardening an Omarchy plugin, when a marketplace issue gets needs-fixes or security-needs-fixes, when preparing a [Plugin] or [Verify] submission, or when the user asks whether a plugin is safe to publish. Based on every maintainer review comment in the marketplace repository.
Review code against the canonical architecture quality Rule set, including boundaries, dependency direction, cohesion, cycles, contract stability, coupling, composition, change surface, unreachable code and deprecation discipline. Cognitive-only atomic skill; output is a findings list.
Best practices for Dart unit tests, Flutter widget tests, and golden file tests, covering group and test naming, setUp lifecycle and isolation, mocking with package:mocktail, and the shared pumpApp helper. Use when writing, modifying, or reviewing tests, goldens included, that use package:test, package:flutter_test, package:mocktail, or package:bloc_test, and when no package is named: adding a golden test, matchesGoldenFile, tagging or updating goldens, writing a unit or widget test, or adding a test helper or mock. A one-line golden or widget test request is in scope, including under "Dart code only"; a widget in a UI package is ui-package's. Use it too when the request asks for what these standards forbid: package:mockito, a raw string test tag instead of TestTag, an inline pumpWidget(MaterialApp(...)), asserting padding, color or font size in a widget test, or state shared between tests.
Refactor codebases using Design by Typed Holes methodology - iterative, test-driven refactoring with formal hole resolution, constraint propagation, and continuous validation. Use when refactoring existing code, optimizing architecture, or consolidating technical debt through systematic hole-driven development.
Execute and analyze Unity Test Framework tests from the command line. This skill automates test execution for Unity projects by detecting the Unity Editor, configuring test parameters (EditMode/PlayMode), running tests via CLI, parsing XML results, and generating detailed failure reports. Use this when running Unity tests, validating game logic, or debugging test failures.
WooYun business logic vulnerability methodology — 22,132 real cases across 6 domains (authentication bypass, authorization bypass, payment tampering, information disclosure, logic flaws, misconfiguration) and 33 vulnerability classes. Use for ANY security testing, auditing, or code review of web apps, APIs, or business systems — even without explicit "security" keywords. Triggers: penetration testing, security audit, vulnerability, bug bounty, payment security, IDOR, password reset, weak credentials, unauthorized access, race condition, parameter tampering, code review, 渗透测试, 安全审计, 漏洞挖掘, 支付安全, 越权, 逻辑漏洞, 业务安全, SRC, 代码审计. Also triggers on implicit intent: "test this endpoint", "find bugs", "can I bypass this", "帮我测测这个接口", "这个参数能不能改", "帮我找bug".
Validate and fix mini program AI SKILLs artifacts. Triggered in the following scenarios: static validation of the skills/ directory, running atomic interfaces end to end, verifying atomic component rendering, fixing validation errors, and outputting delivery documents. Relies on WeChat DevTools for real-device verification.
Periodically lint the full OpenSpec archive for cross-change decision drift, index/spec reconciliation, and structural over-coupling, the gap nothing else in the QRSPI/OpenSpec stack covers, since every other drift check (accelint-onboard-openspec, accelint-architecture-doc, accelint-qrspi-apply Phase 4) only looks forward from a single change's own artifacts. Use this skill when the user wants to "run archive synthesis," "lint the openspec archive," "check for decision drift," "audit the spec archive for contradictions," "find stale specs," "reconcile the specs index," "check capability coupling," or when accelint-qrspi-archive has surfaced its own suggestion that 15+ changes have archived since the last synthesis run. Also use when the user asks whether an old design decision still holds given everything decided since, whether specs/INDEX.md still matches the actual spec.md files on disk, or whether some capability has become an over-coupled refactor candidate. This skill never runs automatically and never blocks another skill — it is always either a human-invoked audit or an offered suggestion the human accepts explicitly.
Answer questions about evaluating GenAI / AI tools and products using the AI Evaluation Playbook (eval.playbook.org.ai; The Agency Fund with CGD and IDinsight, 2026) — the 4-level framework (Model / Product / User / Impact), Minimum Viable Evaluations, golden datasets, LLM-as-judge, engagement funnels, guardrail metrics, level linkages. Use when Ane asks how to evaluate an AI tool, chatbot or GenAI product, "how do I know this AI is working", "what should we measure for this AI tool", "where do I start with AI evals", or an MA/partner AI tool proposal needs an evaluation appraisal. NOT for programme or MEL evaluation design (/ann, /grill-mel, indicator-designer, evidence-synthesis own that lane) and NOT for AI used by evaluators as a working tool (wiki page ai-mel-framework governs that).
App Store review readiness audit for iOS apps. Scans the codebase, entitlements, Info.plist, privacy manifests, paywall/subscription UI, and metadata for anything that could trigger a warning or rejection during App Store review. Invoke explicitly when preparing a submission. Do NOT trigger automatically.
Use when auditing cross-component reference contracts on a Datex Studio branch — verify that hubs, grids, forms, editors, selectors, and their referenced peers wire together correctly. Catalogs three silent-failure traps: wrong Module/moduleId, mismatched configParameters (missing declared inParam, extra unsupported entry, value-binding to undeclared var), and component variables used in flow code but undeclared in the top-level vars array. Triggers: "wire xxx into yyy", "audit the reference contracts", "fix the Module / moduleId", "fix the configParameters mismatch", "declare a hub/form/editor/grid var", silent-failure dropdowns/filters/dialogs.
Generate tests that do not exist yet. Analyzes coverage gaps, then writes and runs new test files across three tiers (unit, integration via testcontainers, Playwright E2E), one test-generator agent per tier, healing failures for up to 3 iterations. Use when code has no tests or when raising coverage after implementation. Do NOT use to grade tests that already exist (use /ork:verify) or to run a suite without writing anything new.
Guides seeding deterministic Fusion Framework module state in tests — mockFramework, mockAppModules, and module-owned enableXMock helpers (msal, service-discovery, context, bookmark, feature-flag, analytics, telemetry, http, app) — while keeping each module''s real configurator, provider, validation, and lifecycle. USE FOR: signing in a mock user, seeding context/bookmarks/feature-flags, faking HTTP/OpenAPI responses, choosing a mock boundary, adding a mock for a custom module. DO NOT USE FOR: configuring vitest.config.ts, rendering React components/hooks, or Vitest Browser Mode setup (use fusion-framework-testing); dev-server-time API mocking/proxying in dev-server.config.ts (use fusion-developer-app); backend/service-repo mocking.
Comprehensive Go/Golang development best practices covering project structure, error handling, concurrency, testing, performance optimization, and code quality. Use this skill when writing Go code, refactoring Go projects, setting up new Go applications, implementing Go patterns, optimizing Go performance, or reviewing Go codebases. Triggers include Go file extensions (.go), mentions of goroutines/channels, Go modules, or requests for Go-specific guidance.
Provides comprehensive guidance for Jest testing framework including test writing, matchers, async testing, mocking, snapshots, configuration, and CLI. Use when the user asks about Jest, needs to write JavaScript/TypeScript tests, mock dependencies, or configure Jest for projects.
Give first-time users a short, value-first Kitaru tour with the PydanticAI returns agent example in the Kitaru repository. Use when someone has no agent or traces of their own, arrives from Kitaru onboarding, asks for a demo, tutorial, quickstart, or guided example, needs the quickstart example cloned or prepared, wants the coding agent to prepare trace annotations before they judge sessions, or wants to experience Kitaru's value before learning the full investigation method. Prepare a three-session frontend review, let the human provide verdicts, turn one accepted finding into a deterministic evaluator, and finish with one approved bounded replay experiment. Route real agents, open-ended discovery, and production evidence to kitaru-investigation instead.
Framework-independent LLM serving benchmark skill for comparing SGLang, vLLM, TensorRT-LLM, TokenSpeed, or another serving framework. Use when a user wants to find the best deployment command for one model across multiple serving frameworks under the same workload, GPU budget, and latency SLA.
Analyze performance issues based on reproducible baselines and profiler evidence. Use when the user asks to locate slow endpoints, slow tasks, slow queries, memory or network bottlenecks, formulate optimization plans, or verify optimization gains; distinguish measured conclusions from static inference, do not fabricate durations or improvement ratios, and require explicit authorization for production operations.
Run a structured quality audit on a product spec, PRD, or requirements document. Produces a severity-rated issue list with concrete fixes—catches untestable requirements, happy-path-only flows, missing scope exclusions, absent dependencies/constraints/assumptions, implementation details leaking into functional specs, and unvalidated assumptions presented as facts. Use when reviewing a spec, PRD, or requirements doc, or as the validation step after writing one.
Predicts defect-prone code using change frequency, complexity metrics, and historical bug patterns. Use when predicting defects before they escape, analyzing root causes of test failures, learning from past defect patterns, or implementing proactive quality management.
Run a supervised multi-agent code review by composing a task directory and driving the revmux CLI, then report or act on the findings it returns. revmux spawns and watches parallel claude and codex subprocesses with stall detection, retry, per-agent progress and a full run archive; this skill is the caller that writes the review context, launches it, reads the JSON back, and re-runs it after fixes. It also triages a filed issue, proposal or discussion instead of a diff, running a four-way panel over it — grounding, the case for, the case against, and cost — and putting the maintainer's six answers to him with the arguments behind each. It also has a self mode that reads what past rounds produced and tells the user what the record says about the review itself — which stage is filtering, which lens rates hardest, whether rounds converge — then proposes one change to the local prompt text at a time, with the number behind it. It fetches a pull request into a throwaway worktree, reviews it there and cleans up after. Also answers questions about revmux itself — profiles, lenses, task directories, flags, the JSON shape, exit codes and the run archive. Activates on "revmux", "run revmux", "multi-agent review", "supervised review", "review with revmux", "revmux this branch", "revmux the last commit", "revmux pr 123", "revmux this PR", "review PR 123 with revmux", "run a revmux round", "re-review after fixes", "revmux it and show me", "revmux this, I want to watch", "run it visible", "show me the review", "triage this", "triage issue 123", "is this worth doing", "should we accept this", "should I close this", "revmux self", "self-improve revmux", "tune revmux", "revmux profiles", "revmux lenses", "what does revmux return", "revmux exit codes", "revmux task directory".
Runs security audits on codebases — full scans, diff reviews, threat models, vulnerability triage, remediation guidance, and finding tracking. Activate when the user says "security scan", "audit this repo", "review this PR for security", "threat model", "triage vulnerabilities", "fix this vuln", or "track findings".
Use when setting up SDK testing, configuring contract tests, writing Arazzo test workflows, or running integration tests. Triggers on "SDK testing", "test SDK", "contract testing", "Arazzo tests", "integration tests", "speakeasy test", "mock server", "test generation", "ResponseValidationError"
Install and work with uifork, a CLI tool and React component library for managing UI component versions. Use when the user wants to version components, test UI variations, gather stakeholder feedback, or work with uifork commands like init, watch, new, fork, promote.
React and Next.js performance optimization guidelines from Vercel Engineering. This skill should be used when writing, reviewing, or refactoring React/Next.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.