Skills
97,501 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Use before pushing, force-pushing, marking ready for review, or claiming checks pass on a deepseek-harness branch, and immediately after gh stack sync publishes rewritten branches, to select the smallest tests and checks that cover the outgoing or just-published diff without reflexively running the full repository suite.
A method for having an unbiased executor run agent-facing text instructions (skill / slash command / task prompt / CLAUDE.md section / code generation prompt) and evaluating them from both sides (the executor's self-report + instruction-side metrics) to improve iteratively. Repeat until improvements plateau. Use right after creating or heavily revising a prompt or skill, or when you want to attribute an agent's unexpected behavior to ambiguity on the instruction side.
Author and run a project-TAILORED pre-launch audit as a bounded multi-agent workflow — a real launch verdict, not a checklist skim: fill the bundled workflow template from the repo's real stack and hard rules, then run Gates (typecheck / test / lint / build in parallel) → Find (one read-only finder per applicable audit dimension) → Dedup (merge shared-root-cause findings) → Verify (adversarial agents try to refute every finding; blockers get a code lens plus a spec lens) → Critic (name uncovered areas, spawn follow-up finders) → a GO / NO-GO / GO-WITH-FIXES report, all fanned out under a MAX_PARALLEL cap. Finders and verifiers stay read-only — the skill audits and reports, never fixes; a gate that didn't actually run is treated as a blocker, never counted clean; secret values are redacted to type and location. Confirms scope and warns about the agent count (typically 40-80) before running.
Audit Go nolint directives for staleness and lazy justifications. Mechanically verifies each suppression with golangci-lint, then runs adversarial Red/Blue/White debates on the top candidates for removal. Use when inheriting a Go codebase, during periodic cleanup, or when nolint count is growing unchecked.
Gatekeeping Git/PR by classifying change essence and recommending granularity, naming, and strategy; the `ship` recipe also executes PR delivery (create, CI watch, merge, cleanup) with Ask First on merge. Use when PR preparation, commit strategy, or gated PR delivery is needed.
Use MQTTX CLI for MQTT connections, publishing and subscriptions, MQTT 5 features, TLS and SCRAM authentication, payload codecs and schemas, benchmarks, built-in or custom data simulation, configuration, installation and troubleshooting. Use when operating or testing MQTT through the mqttx command. Does not operate MQTTX Desktop or administer a broker.
Use this skill when the user wants to write Apex or LWC tests for code that calls Nebula Logger. Covers observing that the right entries were buffered, controlling logging levels inside tests, isolating tests from persisted `Log__c` / `LogEntry__c` / `LogEntryTag__c` / `LoggerScenario__c` / `LoggerTag__c` records, and Nebula Logger APIs that are safe to call from a subscriber's own test suite.
Combined OpenHarmony XTS build and run commands. Completes the build and run of an XTS test project in one stop. Use this Skill when the user needs to run the full XTS test flow: (1) build the XTS test project to generate a HAP file, (2) run the XTS tests and display the results. Supports passing the --package and --api parameters through to the run stage.
Provides comprehensive guidance for Playwright testing including browser automation, test writing, page objects, and cross-browser testing. Use when the user asks about Playwright, needs to write E2E tests, automate browsers, or test web applications across browsers.
Gate-oriented safety audit for code changes before landing, using a checklist with two-pass severity triage. Triggers on: "is this safe to land", "pre-landing review", "safety check before merge", "gate check", "/pre-landing-review". NOT for diff review, use pr-review.
Apply to multi-step work (sweeps, migrations, runs of similar edits) and to how you stack commits and PRs. Break work into small units that each end in a verifiable state, check each before the next, and order delivery so the sequence proves itself to a reviewer.
Ensures HeyEddi projects have the right engineering stack: Vue (Vite/Vitest), FastAPI backend, or Firebase tooling. Audits gaps, scaffolds as needed, installs deps, runs tests, documents local dev servers. Use when the repo is thin or before design/feature work on any HeyEddi app.
Captures and compares screenshots across viewports, runs axe-core accessibility scans, and detects visual regressions with pixel-diff analysis. Use when detecting UI regressions, validating responsive layouts, testing WCAG compliance, or ensuring visual consistency after CSS or component changes.
Iterative codebase quality audit with multi-agent validation and escalating-depth SEEK/VALIDATE/FIX/RECURSE cycle. Enforces fix-all-per-cycle rule — every confirmed finding must be fixed before moving to the next cycle. Use for quality audit, code audit, codebase review, technical debt audit, refactoring opportunities, module quality check, or architecture review.
Use this skill to grade a SKILL.md whenever the user wants to rate, audit, or score one. Triggers include "rate this skill", "grade this skill", "give my skill a letter grade", "audit my SKILL.md", "score this skill against best practices", or "is this SKILL.md up to spec", even if they don't use the word "rate". Returns a letter grade A-F, weighted category scores, and prioritized paste-ready patches. Do NOT use this skill for code review (see code-review) or for authoring a new skill (see generate-skill).
Activate a brutally honest, skeptical architectural partner that stress-tests ideas, architectures, and assumptions. Use when the user says "reality check", wants their design challenged, asks if their idea is sound, wants a devil's advocate review, or wants architectural critique without hand-holding.
Deep security review of a diff or a specific file, grounded in 20 evidence-based pattern libraries extracted from 400+ real-world bugs in major open-source projects (Linux kernel, OpenSSL, Chromium, Firefox, curl, Go, Rust, Kubernetes, Next.js, etc.). Use when the user says "security review", "security audit", "audit this for vulnerabilities", "threat model this", "check for CVEs", "check for injection/auth/crypto issues", or when a diff touches buffer handling, parsers, authentication, authorization, cryptography, state machines, CI/CD, dependencies, or trust boundaries. Also usable as a reference library — `/review` links here when a diff touches a security-sensitive area.
Design, implement, audit, and report lossless Java-to-Rust migration tests without promoting green tests into false completion claims. Use when porting 100% of JUnit tests and concrete parameterized/dynamic cases, SHA-256-verifying source fixtures/resources/scripts/data, requiring complete per-case golden or live differential MATCH results, validating object/test ledgers, reviewing oversized Rust test files, organizing inline unit versus integration tests, adding Rust-specific obligations, comparing coverage, or building property, fuzz, mutation, concurrency, lifecycle, adapter, host, load, security, and rollback evidence. Enforces a 500-line cohesion-review threshold, an 800-line authored-file blocker, and idiomatic Rust test placement.
Scout Rule — identify the top 3 highest-impact improvement opportunities in files you're already touching. Analyzes entire file content, not just changed lines. Focuses on pre-existing code quality, not PR bugs. Use when preparing a PR, during code review, or after completing a feature.
SEO drift monitoring: capture baselines of SEO-critical elements, detect changes, and track regressions over time. Git for SEO — baseline, diff, and track changes to your on-page SEO. Use when user says "SEO drift", "baseline", "track changes", "did anything break", "SEO regression", "compare SEO", "before and after", "monitor SEO changes", or "deployment check".
Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy
Storybook (UI component catalog and testing tool) reference. story, CSF (Component Story Format), args, argTypes, decorators, play function, interaction tests, autodocs, main.ts / preview.ts configuration, addons (a11y, controls, viewport, themes).
Reviews SwiftUI code for best practices on modern APIs, maintainability, and performance. This skill should be used when the user asks to review SwiftUI code, check for deprecated iOS/macOS APIs, validate data flow patterns, or audit accessibility compliance in Swift projects.
Systematic technical debt analysis across architecture, testing, documentation, and infrastructure. Investigates the codebase, scores findings by impact and effort, and generates a prioritized TECH_DEBT.md remediation plan. Delegates to specialized skills for code quality (scout) and linting (lint-fix). Use when assessing overall project health, planning cleanup sprints, or onboarding to an unfamiliar codebase.
Generate and verify unit or integration tests based on real code contracts. Use when the user asks to add tests for functions, classes, interfaces or bugs, improve coverage, generate regression cases or refine a testing strategy; read existing tests and callers first, do not guess null, exception or timeout behavior, and do not install frameworks or access production dependencies automatically.
TypeScript type-checking workflow. Use this skill whenever the user works with TypeScript and mentions type errors, type checking, or says "类型检查" (type check), "type-check", "tsc", "检查类型" — even if they don't explicitly ask for a "type check" but are encountering compilation or type issues in a TypeScript project.
Pressure-test a stateful system or replacement design through Rich Hickey's simplicity and complection, Greg Young's deletability, Ousterhout's deep modules, DDD boundaries, typed effects, explicit lifecycle modeling, and Lauren Tan's agent-sized context. Use when the user asks "what would Rich Hickey do", "optimize for deletion", "make this simpler", "define this error out of existence", "review this state machine", "design it twice", or wants to replace a working prototype without preserving its accidental architecture.
Traces user task flows with Playwright: click depth, step success, friction: and writes reports to .heyeddi/docs/ux-flows/. Use when measuring ease of use, clicks to complete a task, or onboarding friction. Not for static visual critique (use heyeddi-design critique) or layout screenshots (use visual-auditor).
Verify test cases in all test files modified since branching out from base branch. Checks that test cases make sense, have no duplications, and provide meaningful coverage. Spawns parallel agents for multi-file analysis. After the user confirms test-case changes, runs coverage (npm test:coverage or Jest/Vitest fallback) and fixes tests until coverage passes.
Fix PageSpeed Insights/Lighthouse accessibility "!" errors caused by contrast audit failures (CSS filters, OKLCH/OKLAB, low opacity, gradient text, image backgrounds). Use for accessibility-driven SEO/performance debugging and remediation.
Use when validating that implementation meets specification requirements — applies acceptance-driven backpressure with behavioral validation gates that prevent completion claims without passing tests. Triggers: spec-to-code validation, feature completion verification, pre-merge acceptance gate, release readiness check.
EXPERIMENTAL. Use when code needs a security review against the OWASP Top 10:2025 — access control, misconfiguration, supply chain, cryptography, injection, insecure design, authentication, integrity, logging and alerting, and mishandled exceptional conditions. Not for penetration testing a running system, not for infrastructure-only scanning, and not for fixing what it finds.
Manage beta app review submissions and review contact details for TestFlight external testing using the `asc` CLI tool. Use this skill when: (1) Submitting a build for beta app review: "asc beta-review submissions create --build-id ID" (2) Checking beta review submission status: "asc beta-review submissions list --build-id ID" (3) Getting a specific submission: "asc beta-review submissions get --submission-id ID" (4) Getting beta review contact details: "asc beta-review detail get --app-id ID" (5) Updating beta review contact info or demo account: "asc beta-review detail update --detail-id ID ..." (6) Managing the per-locale **Beta App Description** and feedback metadata shown to TestFlight testers: "asc beta-app-localizations {list,get,create,update,delete}" (7) User says "submit for beta review", "TestFlight review", "beta review status", "beta review contact", "external testing review", "beta app description", "TestFlight description", or any beta app review task
Grades a repository's GitHub Actions configuration against CI best practices (the CI Score: eleven pass/fail configuration facts computed from the repo's own workflow YAML) and hands back concrete fixes for every gap, ranked by impact and risk, each with an apply-now option and a paste-able agent prompt. Use when: (1) the user asks to grade or score their CI, or audit CI configuration against best practices ("grade my CI", "CI score", "CI best practices audit", "how healthy is my CI config"), (2) re-scoring after workflow changes. Requires a local checkout of the target repository. Do NOT trigger for: CI speed, cost, or wall-clock audits, "why is CI slow", or optimization-opportunity analysis (use ci-speedup); security audits or posture review (ci-score is not a security audit — exactly two rubric checks, action pinning and OIDC token scoping, happen to be security-related); writing new workflows from scratch; non-GitHub-Actions CI.
Day-to-day CircleCI from the terminal with the circleci CLI — authenticate, validate config before you commit, watch the run your push triggered, review pipeline/workflow/job status, read job logs and failed tests, download artifacts, and rerun/cancel/trigger. Use when a developer asks to authenticate CLI access, check their build or pipeline status, watch a run after pushing, see why CI failed, read job output/logs, find failing tests, rerun failed jobs, cancel or re-trigger a run, validate a config change locally, or look up a project's environment variables, contexts, triggers or pipeline definitions. For first-time project connection / pipeline-definition setup use the onboarding skill; for the diagnose-and-fix methodology on a failing build use circleci-builds.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.