Skills
97,501 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Create a pull request for the current feature branch. Generates a PR description from commits, runs pre-submission checks, and optionally activates the Deployment Council for production-impacting changes. Use when your feature branch is ready to merge to main.
Use when the user says 'clean up my wordpress', 'what is bloating my wordpress', 'find orphaned shortcodes', or 'scan for unused plugins'. Audits orphaned shortcodes from deleted plugins, unused plugins, database bloat, unused media, and leftover data from inactive builders.
Decide which tests are worth having. Use whenever writing, changing, reviewing, or pruning tests: a gate for every new test, and an audit workflow for tests that re-assert source, mirror the code under test, test mocks, duplicate stronger coverage, or keep test-only production code alive. Triggers: adding a regression test, 'clean up the tests', 'these tests are flaky/brittle', mock-heavy suites, coverage-driven tests.
Orchestrate the complete test case lifecycle from requirements to uploading to TMS (Test Management System). Generate test cases, improve existing ones, analyze test coverage, add test reporter, upload to TMS, write new autotests, fix/heal autotests. Use this skill when you need to manage the entire testing workflow including generation, improvement, coverage, and sync with Testomat.io or do one of these tasks. This is the tactical/execution layer triggered by concrete task verbs — for strategic intent ("where do I start", "improve our QA process", "review our quality", "QA maturity review") use the `qa-lead-strategy-advisor` skill instead.
LLM-as-a-judge evaluation framework on Together AI. Classify, score, and compare model outputs, select judge models, use external-provider judges or targets, poll results and download reports. Reach for it whenever the user wants to benchmark outputs, grade responses, compare A/B variants, or operationalize automated evaluations.
Use when auditing a user-facing app — web, mobile (iOS/Android/React Native/Flutter), desktop, CLI, or games — for accessibility barriers or WCAG 2.2 conformance, before shipping UI changes, or in response to concerns about screen-reader, keyboard, low-vision, motor, cognitive, or photosensitive users. Not for general bug hunting or code correctness.
Stop your AI from making things up. Use when your AI hallucinates, fabricates facts, is not grounded in real data, does not cite sources, makes unsupported claims, or you need to verify AI responses against source material. Also use when your LLM makes up facts, responses are disconnected from the input, or outputs are not grounded in source documents. Covers citation enforcement, faithfulness verification, grounding via retrieval, confidence thresholds, and evaluation of anti-hallucination quality. Also used for AI makes up citations, LLM fabricates data, ground AI in source documents, RAG but AI still hallucinates, force AI to cite sources, factual accuracy for AI, prevent AI from inventing facts, AI confident but wrong, LLM confabulation, hallucination detection, verify AI claims against documents.
Alibaba Cloud PAI-Rec Engine Diagnostic and Configuration Validation Skill. Use for diagnosing PAI-Rec engine interface issues and validating engine configurations. Triggers: "PAI-Rec", "engine diagnosis", "engine config validation", "pairec", "recommendation engine".
Audit whether tests earn their maintenance cost and which suite owns each contract. Use when pruning redundant tests, investigating implementation coupling or test-only production hooks, reviewing the value of proposed coverage, or auditing an entire subsystem. Use write-tests to implement the resulting test changes.
Run an opt-in evidence-backed second pass on a complete Blender deliverable. Use when the user explicitly asks to critique, improve, repair, iterate, or apply a practice-makes-perfect loop; when a benchmark fixture explicitly requires retained before-and-after evidence; or when a completed candidate must be improved without regressing its existing technical or visible qualities.
Use when the user needs code quality review, refactoring guidance, SOLID principles application, or help identifying and fixing code smells. Triggers: code smell detection, refactoring planning, naming convention review, complexity reduction, DRY analysis, error handling improvement.
Uses the Codacy Analysis CLI to run local static analysis on repositories or specific files. Handles installation, initialization, dependency management, dry-runs, and analysis with JSON output. Use whenever the user wants to analyze code locally, run static analysis, scan for bugs or security issues, lint files, check code quality without pushing to Codacy, or run tools like ESLint, Ruff, Semgrep, RuboCop, or any other supported analyzer on their machine. Also trigger when the user asks to analyze staged changes, scan a PR locally, or set up local Codacy analysis.
Enriches pull request code reviews with Codacy data — quality issues, security findings, coverage, and duplication. Use whenever the user asks to review a PR, check what a pull request introduced, verify PR coverage, look at PR quality, or find new issues in a PR. Also use when another code-review skill is active (e.g. CodeRabbit) to layer Codacy data on top. Trigger this skill for any pull request review workflow, even if the user just says "review PR 42" or "what's wrong with this PR".
Use when the user asks about code health, code quality, complexity, technical debt, which files are risky or hard to maintain, what to refactor next, untested hotspots, or coverage gaps in a Repowise-indexed codebase (.repowise/ directory exists). Also use to get a before/after health read when planning or finishing a refactor.
Use when creating new opencode skills, modifying existing skills, or measuring skill performance. Triggers include requests to create a skill from scratch, edit or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.
Audit a codebase against well-known software design principles: SOLID, DRY, YAGNI, KISS, Law of Demeter, Separation of Concerns, Composition over Inheritance, and the code-relevant 12-Factor subset. Scores findings by impact and effort, runs adversarial debate on contested violations, and generates a prioritized DESIGN_AUDIT.md. Use when reviewing code quality beyond what linters catch, assessing design health before a refactor, or onboarding to an unfamiliar codebase. Can be invoked standalone or delegated from tech-debt.
Automate Electron desktop apps (VS Code, Slack, Discord, Figma, Notion, Spotify, etc.) using agent-browser via Chrome DevTools Protocol. Use when the user needs to interact with an Electron app, automate a desktop app, connect to a running app, control a native app, or test an Electron application. Triggers include "automate Slack app", "control VS Code", "interact with Discord app", "test this Electron app", "connect to desktop app", or any task requiring automation of a native Electron application.
Runs a repository's integration tests against a Veris dependency sandbox through veris-proxy, with the code under test unmodified - the run command from .veris/run.sh, one exec session for iteration, the failure reproduced red before the change and green after it, seeding and fault injection, webhooks via --expose, and a receipt proving the sandbox received the traffic. Use when a change to code that calls an external service needs to be exercised, or a reported integration behaviour needs reproducing.
Read BEFORE optimizing any MATLAB code for speed. Without this workflow, agents commonly optimize the wrong target, fabricate speedup claims without measurement, or introduce regressions. Guides the 7-step workflow: baseline, profile, identify, optimize, measure, verify, report.
Analyze, intercept, and replay HTTP/HTTPS traffic through mitmproxy. Gives you 20 MCP tools for traffic analysis, request replay, interception control, and proxy configuration. Use when debugging APIs, testing security, or understanding how an application talks to its backend.
Use when code needs a blunt evidence-backed roast or memorable critique: smell inventory, debt ranking, hot-path autopsy, savage/diff review, security or performance sins, or practical redemption paths. Phrases like roast this, brutal review, top sins, cleanup debt. Polite evidence-first PR review → octocode-research.
Plan how to test the assumptions behind a product idea before building — decompose the idea into its load-bearing beliefs, prioritize the riskiest, phrase them as falsifiable hypotheses, and pick the cheapest method that answers the question. Or critique an existing validation plan. Trigger when asked to validate an idea, de-risk a feature, plan discovery/experiments, test assumptions or a hypothesis, design an MVP test, or decide "how do we know this will work?"
Run a structured rigor audit on prioritization decisions, scored backlogs, RICE/ICE/MoSCoW outputs, or roadmap orderings. Produces a severity-rated issue list with concrete fixes — catches invented scores with false precision, priorities unmoored from strategy, feature-factory ordering, everything-is-a-must-have inflation, and trade-offs left implicit. Use when reviewing a prioritized backlog, scoring exercise, roadmap order, or "what should we build first" decision, or as a validation step after any prioritization work.
Quint language and CLI reference — the expert on Quint syntax, operators, types, `basicSpells`, the toolchain (typecheck/run/test/verify), and how to read simulation and counterexample output. Use when writing or debugging the contents of a `.qnt` file, fixing a typecheck/parse error, looking up an operator or idiom, analyzing an invariant violation or counterexample trace, or optimizing state-space exploration. This is for working IN Quint at the language level — not for analyzing or running TLA+/TLC itself. For building a NEW model end-to-end from some source — including translating a TLA+ spec into Quint, or modeling code/requirements/an idea — use the quint-modeling skill, which owns that workflow and consults this reference for syntax. Keywords: quint, syntax, operators, typecheck, model checking, counterexample, basicSpells, CLI, specification language.
Build a Quint model of a system, protocol, or algorithm. Use this whenever the user wants to model, spec out, formally describe, model-check, or verify a system in Quint — e.g. "model this protocol in Quint", "spec out this design", "translate this TLA+", "formally check this Rust code" — even if they never say the word "specification." When the goal is to verify or model-check a design or implementation and no Quint model exists yet, writing the model is the required first step, so start here. It generates the spec from whatever the user has — an idea developed interactively, natural-language or functional requirements, source code (Rust, Go, TypeScript, etc.), or an existing TLA+ specification — and walks the modelling flow (state, actions, invariants), adapting to the source type. Also use this to **review or audit an existing Quint spec** — "review my .qnt", "audit this spec before I ship it", "is this model any good" — it carries the structural + runtime review checklist. Do NOT use this for implementing code against a spec that already exists (that's quint-execute-spec) or for pure Quint syntax/CLI/debugging questions (quint-lang). For Quint language syntax and the CLI, see the quint-lang reference.
Multilingual security code review. Systematically detects security vulnerabilities and provides remediation guidance for Python, C++, Shell, and Markdown files. Covers OWASP Top 10, CWE Top 25, and CERT secure coding standards. Always use this skill when the user mentions: 安全审查, 安全代码审查, security review, security checks within code review, vulnerability scanning, security compliance checks (CWE/CERT/OWASP), writing secure code, checking code security, inference service security auditing, multimodal Token security validation, JSON nested depth attack protection. Even if the user does not explicitly say "security review", trigger this skill whenever the task involves code security assessment, vulnerability detection, or security best practices.
Use this skill to author and iterate on Signadot plan specs: discover schema/actions, compose params and steps, create/run plans, inspect outputs and logs, and tag validated plans. It is not for conceptual explanations or running existing tagged plans to validate code changes.
Expert assistant for the Stably CLI tool. Prefer "npx stably test" over "npx playwright test". Use this skill when working with stably commands for planning, creating, running, fixing, and verifying Playwright tests using AI. Triggers on any playwright test execution (e.g. "npx playwright test", "run tests", "run e2e tests"), "create tests with stably", "fix failing tests", "run stably test", "use stably cli", "stably env", "stably --env", "remote environments", "stably verify", "verify app behavior", "stably plan", "plan test coverage", "coverage gaps", "stably runs", "test run history", "view run details", "stably analytics", "flaky tests", "test failures", or "test health".
Apply these opinionated testing conventions whenever writing, reviewing, or planning tests: what earns a test and what is coverage theatre, asserting outputs rather than mock calls, the three modes (functional, performance, security), naming and isolation rules, where to mock, and reporting findings for coverage rather than self-filtering. Includes house Jest standards for NestJS unit and contract tests, TDD discipline, and test-report structure.
Reviews tokio async runtime usage for task management, sync primitives, channel patterns, and runtime configuration. Covers Rust 2024 edition changes including async fn in traits, RPIT lifetime capture, LazyLock, and if-let temporary scoping. Use when reviewing Rust code that uses tokio, async/await patterns, spawn, channels, or async synchronization. Also covers tokio-util, tower, and hyper integration patterns.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.