Skills
97,501 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Adversarial pre-execution gate. Activates before any plan, proposal, or side-effecting action (create, edit, delete, run, deploy, migrate, call a tool/MCP/agent, git write) and before architecture, product, UX, data, vendor, or strategy decisions. Scales its depth to the real risk of the action — a one-line note for trivial work, a short evidence-based critique for normal changes, a hard stop with targeted questions for critical ones — and ends with a gate that waits for the user's explicit approval before acting. Read-only requests and trivial, instantly reversible edits pass with at most one line. Use whenever the user shares a plan, asks "is this a good idea", "review this", "what could go wrong", or asks to execute a change.
ALWAYS-ON: audits plans and code for KISS, YAGNI, DRY, SOLID, and testability; maintains .heyeddi/docs/engineering/. Use on every chat that plans or changes code, before merge, refactor, ADRs, or reuse-catalog work. Not for visual UX (ux-flow-auditor) or full CI (pre-merge-gate includes this audit).
Diff-aware AI browser testing — reads the git diff, maps changes to affected pages via the route map, generates a targeted test plan, and executes it via agent-browser (Rust daemon + CDP, ARIA-tree-first) with pass/fail reporting. Use when testing UI changes, verifying PRs before merge, or running regression checks on changed components.
Set up the Fallow app in Codex after the plugin is installed: check the fallow installation, choose the default analysis scope, run the first analysis, and show the user where the dashboard, the Code Health tab, @Fallow mentions and the config editor are. Use when the user chooses Set up for Fallow in Codex, or asks to onboard or configure the Fallow app. Do not use for setting up lint, format or CI tooling; use fallow-setup for that.
Use when you need to visually interact with a GUI: test buttons, fill forms, verify visual layouts, fuzz web pages, automate user flows, take screenshots, or perform end-to-end QA on any application. Works on cloud VMs, Docker containers, local machines, and sandboxes. Needs the `cua` CLI (curl -fsSL https://cua.ai/install.sh | sh).
Guide for using MassGen to develop and improve itself. This skill should be used when agents need to run MassGen experiments programmatically (using automation mode) OR analyze terminal UI/UX quality (using visual evaluation tools). These are mutually exclusive workflows for different improvement goals.
A dedicated skill for security code review of OpenHarmony distributed systems. Triggered when the user requests "check the code security implementation", "code security review", "security code review", or similar distributed-system code security review requests. This skill provides detailed review guidance for 18 OpenHarmony distributed business security design rules, covering authorization control, state machines, data transmission, permission management, trusted relationships, and other security domains. Using this skill enables dedicated security review for OpenHarmony distributed systems on top of general network security rules.
Use when user asks to "deep review the code", "thorough code review", "multi-pass review", or when orchestrating the Phase 9 review loop. Provides review pass definitions (code quality, security, performance, test coverage), signal detection patterns, and iteration algorithms.
Discover the pull requests this Paperclip instance opened (never community contributions), report what each is for and how confident we are that it is merge-ready, and automatically drive the non-ready ones back to green with /prepare-paperclip-pr — without ever merging.
Create clear, polished before-and-after screenshots from the actual running product for a GitHub pull request. Use when a UI change needs visual proof: capture matching product states, crop to the relevant UI, stitch and caption one comparison image, attach it natively to the PR, and keep the image out of the repository.
Apply context-driven testing principles where practices are chosen based on project context, not universal 'best practices'. Use when making testing decisions, questioning dogma, or adapting approaches to specific project needs.
Orchestrate security finding validation through graduated exploitation. 4-phase pipeline: recon (SAST/DAST), analysis (code review), validation (exploit proof), report (No Exploit, No Report gate). Eliminates false positives by proving exploitability.
Use when a Meta Quest app drops frames, judders, overheats or must be profiled: frame budget per refresh rate, Dynamic Resolution, foveation, SpaceWarp, OVR Metrics, Perfetto or RenderDoc captures. NOT for the render loop itself (quest-native), Store VRCs (quest-store) or phone and desktop profiling. Opt out: no xr, без xr. Triggers - "dropped frames" / "просадка кадров", "Quest performance" / "производительность на Quest", "шлем греется".
Use when preparing Meta Quest testing, Horizon Store submission, monetization, launch assets or post-launch operation (release channels, VRCs, purchases). NOT for a product roadmap (quest-lifecycle), app code, profiling (quest-perf), machine setup (quest-tooling) or PWA packaging (quest-webxr). Opt out: no xr, без xr. Triggers - "Horizon Store", "App Lab", "VRC", "publish to the store" / "выложить в стор", "Quest monetization" / "монетизация Quest".
Prepare R packages for CRAN submission by checking for common ad-hoc requirements not caught by devtools::check(). Use when: (1) Preparing a package for first CRAN release, (2) Preparing a package update for CRAN resubmission, (3) Reviewing a package to ensure CRAN compliance, (4) Responding to CRAN reviewer feedback. Covers documentation requirements, DESCRIPTION field standards, URL validation, examples, and administrative requirements.
Internal tech-debt transform pass of the agentic-workflow review pack — composed in-turn by review-change and product-audit; not a menu entry. Transforms the synthesized findings table into explicit debt items, each with a re-trigger condition; it does not rescan the diff. Findings only; never edits code.
Internal run-it verification review pass of the agentic-workflow review pack — composed in-turn by review-change and product-audit; not a menu entry. Runs the project's gate and the changed behavior for real — commands, exit codes, observed output — instead of assuming; what cannot be executed goes to the manual checklist. Findings only; never edits code.
Use when the user needs production-grade React/Next.js/TypeScript development with rigorous component architecture, state management, performance optimization, and >85% test coverage. Triggers: React component development, Next.js page creation, state management design, frontend performance audit, component library setup.
Evaluate any agent skill against a merged framework — Anthropic's Claude Code best practices plus Matt Pocock's writing-great-skills methodology — across 4 axes (Trigger, Structure, Steering, Pruning). Produces an evidence-cited scorecard (0–100), a weighted overall score, and diagnosed failure modes with prioritized fixes. Use when the user asks to evaluate, rate, or audit a skill ("evaluate this skill", "skill scorecard", "review SKILL.md"), or to compare two skills.
squirrelscan audits websites for SEO, performance, security, accessibility, content, and structured data issues (260+ rules) and scores site health, via the squirrel CLI. Use when the user wants to check, audit, or improve a website's SEO, ranking, speed, or health, and for anything squirrelscan itself, installing or updating the CLI, login and API keys, running audits, publishing and sharing reports, cloud credits, MCP server setup, configuration, or troubleshooting.
This skill should be used when a task explicitly asks for TDD, test-first development, or the Red-Green-Refactor cycle. It guides incremental implementation with concrete Red-Green-Refactor examples, including Effect service patterns with mock layers.
typescript-eslint - ESLint plugin for TypeScript. USE WHEN: user mentions "typescript-eslint", "TypeScript linting", "type-aware rules", asks about "no-floating-promises", "TypeScript ESLint config", "@typescript-eslint rules". DO NOT USE FOR: ESLint 9 full setup - use `eslint-biome` skill, Biome - use `eslint-biome`, general quality - use `quality-common`
Use when the user says 'why is my checkout broken', 'audit my woocommerce store', 'cart problems woocommerce', or 'losing sales woocommerce'. Diagnoses checkout and cart failures, AJAX mismatches, caching conflicts, payment gateway setup, and SSL enforcement.
Use this skill to gate Elixir, OTP, Ecto, and Phoenix code with a pass/fail adversarial review — a single blind reviewer subagent judges a diff or file set against 19 decidable rules that catch architecture ported from an alien paradigm, covering enterprise layering (repository wrappers over Ecto, service-object tiers, DI behaviours with a single implementation, logic trapped in effectful callbacks), processes as objects (GenServer-per-entity, Agents as mutable variables, leaked message protocols, singleton managers), anemic data (bare maps as entities, boolean-flag state, hand-rolled type dispatch, 32+-field structs), defensive control flow (raise/rescue as branching, nil-guard swallowing, raw input past the boundary), transliterated loops, and needless metaprogramming (macro DSLs for data, use-as-import, compile-time coupling). Trigger it before merging Elixir work, or to check agent-authored code. It renders verdicts only, never fixes; Ecto-dependent rules go N/A without Ecto.
Use when the user asks to "create an agent", "create a new agent", "set up an agent", "walk me through creating an agent", "connect my agent", "create a main agent", "set up a main agent", "add my main agent to Cekura", "configure my main agent", "connect my main agent", "import my agent from another platform", "create an agent from an exported config", "set up mock tools", "add tools to my agent", "upload knowledge base", "configure integration", "connect VAPI", "connect Retell", "connect LiveKit", "connect ElevenLabs", "add dynamic variables", or needs to connect a voice AI agent to the Cekura platform for testing or observability. Covers the full agent setup flow: project selection, provider selection, basics and connection type, description, main agent creation, mock tools, knowledge base, dynamic variables, and advanced configuration.
Use when the user says "get started with Cekura", "set up Cekura", "onboard to Cekura", "I'm new to Cekura", "help me set up my agent", "how do I use Cekura", "walk me through Cekura", "configure my project", "first time using Cekura", or needs guidance on initial platform setup, or types the command /cekura-onboarding. Not for adding an agent, more scenarios or more metrics to an existing workspace — those are cekura-create-agent, cekura-eval-design and cekura-metric-design. Covers two onboarding paths: **testing** (default — build evaluators and run simulated calls) and **observability** (ingest production call logs and evaluate them).
Performs a thorough code review of the current changes or a specified file / pull request. Covers correctness, security, performance, readability, and adherence to project conventions. Outputs prioritised, actionable feedback. TRIGGER when the user writes /code-review or asks for a code review, PR review, or feedback on their code.
CodeRabbit AI code review. Covers CLI usage, .coderabbit.yaml configuration, supported linters/tools, PR commands, and triage workflow. Use when running AI-powered code reviews on pull requests or local changes, configuring review rules, or triaging CodeRabbit findings. Keywords: @coderabbitai, code review, CLI, .coderabbit.yaml.
Generate realistic synthetic evaluation datasets by analyzing the user's codebase, prompts, production traces, and reference materials. Interactive and consultant-style. Asks clarifying questions, proposes a plan, generates a preview for approval, then delivers a complete dataset uploaded to LangWatch. Use when user asks to generate, create, or build a dataset for evaluation, testing, or benchmarking.
Strip AI-generated slop from a codebase, product, and prose. Code slop — console statements, `any` types, unused imports, commented-out code, redundant comments, needless defensive try-catch on trusted paths, over-nesting. Product slop (with --product) — marketing-filler copy, generic AI phrasing, default-shadcn look, unstyled loading/error states, dead buttons and half-wired flows. UI slop (`ui`) runs a project-derived design-system primitive pass. Prose slop (`prose`) cuts AI tells from writing. Can scope to the current branch's diff or sweep the whole tree. Use when asked to clean up AI-generated code, unslop writing, remove slop, or make an app feel finished before shipping to customers.
Create new DingTalk skills (dingtalk skill). Use this skill whenever the user mentions "create a new skill", "new skill", "develop a DingTalk skill", "add a DingTalk feature", "add DingTalk API support", "I need a DingTalk xxx skill", "DingTalk to-do", "DingTalk check-in", "DingTalk attendance", "DingTalk approval", "DingTalk calendar", and so on, wanting to package a DingTalk API domain into a reusable skill. This skill covers the complete skill creation workflow: SDK exploration → SDK Python testing → pure HTTP Python testing (both steps must pass) → writing SKILL.md. Do not create a skill unless all tests pass.
Write django-modern-rest (dmr) code with the recommended patterns, covering controllers, routers, typed DTOs with msgspec or pydantic, auth, throttling, error handling, OpenAPI, and tests. Use whenever a project depends on django-modern-rest, imports `dmr`, or asks for a typed Django REST API, and when reviewing dmr code for mistakes.
When writing or reviewing code to eliminate duplicated knowledge and business logic. Use when the user says "this is duplicated," "we have this in two places," "single source of truth," "DRY this up," or "shotgun surgery." For premature abstraction concerns, see yagni.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.