Skills
97,501 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Comprehensive vitest testing patterns covering test structure, AAA pattern, parameterized tests, assertions, mocking, test doubles, error handling, async testing, and performance optimization. Use when writing, reviewing, or refactoring vitest tests, or when user mentions vitest, testing, TDD, test coverage, mocking, assertions, or test files (*.test.ts, *.spec.ts).
Use this skill to gate Swift language code with a pass/fail adversarial review — a single blind reviewer subagent judges a diff or file set against 36 decidable rules covering concurrency (unresumed continuations, cancellation checks, async let, TaskGroup, @concurrent), property invariants (stored-derived state, private(set), observers skipped in init, discard self), error handling (underlying errors preserved, rethrows, Result.get(), #file/#line capture), enum evolution (@unknown default, CaseIterable, synthesized Comparable, caseless namespaces), API surface (memberwise inits, OptionSet, opaque returns, unavailable stubs, Never, @autoclosure), collections (reduce(into:), mapValues, count(where:), dictionary default subscripts), and control flow and strings (branch-assigned let, raw strings, validated bytes). Works on any Swift target including server-side and CLI; verdicts only, never fixes. For SwiftUI use adversarial-swift-ui.
Expert iOS App Store submission and approval system. 9 specialized agents provide senior App Review Team-level expertise across compliance, design, privacy, monetization, metadata, technical requirements, timing, rejection recovery, and learning. Triggers on keywords like app store, iOS submission, apple review, app rejection, aso, privacy manifest, privacy labels, ATT, iap, in-app purchase, subscription, storekit, review guidelines, HIG, testflight, app store connect.
Static security review for authentication and authorization vulnerabilities. Use when the user invokes /auth-review, asks to audit auth, find identity breaches, review access control, hunt for IDOR/BOLA, or check authorization. Framework- and vendor-agnostic. Enumerates every route/endpoint, builds an authorization matrix, applies a vulnerability catalog, and writes a triage report ready to turn into issues or PRs.
Create and check long-running video material evaluation tasks. Use this skill when the user wants to submit videos for evaluation, check an existing video evaluation task list, or fetch the result of a previously created video evaluation task. This skill is not a general-purpose video upload skill because upload is allowed only as an internal step of task creation. Authentication uses an API key passed as an Authorization bearer token.
Use this skill to capture visual artefacts from a device for test failures, golden image generation, QA repro, and demo videos. Covers `adb shell screencap -p` (PNG screenshot), `adb exec-out screencap -p > out.png` (binary-clean stream that avoids CRLF translation on Windows), `adb shell screenrecord` with `--size`, `--bit-rate`, `--time-limit`, `--rotate`, `--bugreport`, `--verbose` flags, the 3-minute hard cap, scoped-storage rules for `/sdcard/` on API 30+, and the JUnit4 TestWatcher capture-on-failure pattern that grabs a screencap plus `logcat -d` on failure. If the user mentions "screenshot device", "screencap PNG", "raw RGBA dump", "screenrecord 3 minute limit", "scrcpy / Vysor streaming", "exec-out vs shell", or "bugreport overlay timestamp", use this skill.
Use when completing a task, implementing a feature, or before committing to verify work meets requirements and coding standards. Triggers: task completion, pre-commit check, pre-merge validation, plan alignment verification, post-refactor quality gate.
Generate a project-local verification skill that drives your app the way a user does — any language, framework, or platform. Use for /create-verification-skill, "make a control skill for this repo", or when a project has no scripted way to prove UI/CLI/service behavior.
Run a 5-dimension expert design review on any HTML artifact in the project — Philosophy / Visual hierarchy / Detail / Functionality / Innovation, each scored 0–10. Outputs a single self-contained HTML report with a radar chart, evidence-backed scores, and three lists: Keep / Fix / Quick-wins. Use when the brief asks for a "design review", "design critique", "5 维度评审", "design audit", or "what's wrong with my design".
OpenHarmony soft bus code security review expert - comprehensively checks C/C++ code against secure coding and logging standards. Covers 40+ security rules, including pointer safety, memory management, lock management, and sensitive information protection. Provides cross-file call analysis and control flow analysis, and generates detailed code review reports. Triggered only when user input contains "软总线安全卫士". Important: this skill is a read-only review tool and does not modify source files.
Answers AI agent evaluation methodology questions with practical, opinionated guidance grounded primarily in Microsoft's agent evaluation ecosystem (MS Learn, Eval Scenario Library, Triage & Improvement Playbook, Eval Guidance Kit) supplemented by select industry sources.
Invoke when the user wants a game-specific code review, architecture check, or technical analysis of game code. Covers frame independence, hot path performance, state machine integrity, and resource lifecycle. Triggers on: "code review", "review my code", "check architecture", "game code quality". Do NOT invoke for design document review (use game-design-review) or general sprint planning (use game-sprint-plan). Part of the AlterLab GameForge collection.
Invoke when the user asks about testing strategy, bug tracking, playtest methodology, regression testing, release certification, QA automation, or bug triage. Triggers on: "testing", "bug", "QA", "regression", "certification", "playtest methodology", "test plan", "release gate". Do NOT invoke for usability testing (use game-ux-designer) or balance validation (use game-balance-check). Part of the AlterLab GameForge collection.
Spec-first REST development in Go with OpenAPI: generating server interfaces and clients with oapi-codegen, request validation middleware, RFC 9457 error bodies, contract testing, and detecting breaking API changes. Use when the API has or should have an OpenAPI document, when wiring code generation into the build, or when a hand-written handler has drifted from its published contract. Trigger examples: "OpenAPI", "swagger spec", "oapi-codegen", "generate a client from the spec", "validate requests against the schema", "breaking API change". Not for: handler structure and shutdown (go-api-design), gRPC and protobuf (go-grpc), GraphQL schemas and resolvers (go-graphql).
Guides developers and testers in writing, fixing, and structuring k6 load test scripts using JavaScript or TypeScript. Use this skill whenever the user mentions k6, Grafana k6, load testing with JavaScript, virtual users, VUs, scenarios, executors, thresholds, checks, SharedArray, ramp-up stages, arrival rate, open/closed workload model, or wants to benchmark an API, WebSocket, or gRPC service using k6 — even if they do not explicitly say "k6" or "load test".
Unified LLM torch-profiler triage skill for `sglang`, including existing traces from SGLang Omni workloads, plus `vllm`, `TensorRT-LLM`, and `TokenSpeed`. Use it to inspect an existing `trace.json(.gz)` or profile directory, or to drive live profiling against a running server when supported and return one three-table report with kernel, overlap-opportunity, and fuse-pattern tables.
Set up and run a documented QA process for a project: initialize tests/docs/ with test-case documents, execution-tracking and bug-tracking CSVs, baseline/weekly metrics templates, P0-P4 bug severity, OWASP Top 10 security test coverage, and a master prompt for autonomous LLM-driven test execution or third-party QA handoff. Use when asked to 「QA プロセス立ち上げ」「テストケース文書化」「QA 引き継ぎ資料」「バグ管理表」, when starting structured QA from scratch, or when a QA team needs handoff documentation. Do NOT use for: writing ordinary pytest unit tests or deciding coverage policy (that lives in rules/testing.md, 75% target).
Interactive QA session where user reports bugs or issues conversationally, and the agent files GitHub issues. Explores the codebase in the background for context and domain language. Use when user wants to report bugs, do QA, file issues conversationally, or mentions "QA session".
Comprehensive WCAG accessibility auditing with multi-tool testing (axe-core + pa11y + Lighthouse), TRUE PARALLEL execution with Promise.allSettled, graceful degradation, retry with backoff, context-aware remediation, learning integration, and video accessibility. Uses 3-tier browser cascade: Vibium → agent-browser → Playwright+Stealth.
AI-assisted pair programming with multiple modes (driver/navigator/switch), real-time verification, quality monitoring, and comprehensive testing. Supports TDD, debugging, refactoring, and learning sessions. Features automatic role switching, continuous code review, security scanning, and performance optimization with truth-score verification.
Test environment provisioning, infrastructure as code for testing, Docker/Kubernetes for test environments, service virtualization, and cost optimization. Use when managing test infrastructure, ensuring environment parity, or optimizing testing costs.
AI-powered testability assessment using 10 principles of intrinsic testability with Playwright and optional Vibium integration. Evaluates web applications against Observability, Controllability, Algorithmic Simplicity, Transparency, Stability, Explainability, Unbugginess, Smallness, Decomposability, and Similarity. Use when assessing software testability, evaluating test readiness, identifying testability improvements, or generating testability reports.
Warehouse Management System testing patterns for inventory operations, pick/pack/ship workflows, wave management, EDI X12/EDIFACT compliance, RF/barcode scanning, and WMS-ERP integration. Use when testing WMS platforms (Blue Yonder, Manhattan, SAP EWM).
Review code changes with a small team — two senior engineers review independently, debate their findings, then a team lead reports a consolidated list. Local mode compares the current branch against a base branch; PR mode (auto-enabled when a PR URL or number is supplied) offers to post the findings as PR review comments. PR mode is strictly read-only — no file in the working tree is ever modified, and every developer instruction is interpreted as an update to the comments plan. The agent never checks out a branch in the current working directory; if it needs files at another ref, it creates a temporary worktree and removes it before presenting the report. Local mode lets the developer pick findings to fix, and the same two engineers implement them in auto mode. Engineers read the project's AI documentation (architecture first) before reviewing, and explicitly check for reuse violations and unused established practices.
Review the latest changes and check whether they comply with the project's documented guidelines (AGENTS.md, CLAUDE.md, or equivalent). Use when reviewing local diffs, recent commits, or feature work and you need a findings-first assessment of architecture, reuse, testing, and repo-specific rules.
Review code diffs, commits, branch differences, or commits and fixes recorded in a development plan; not for reviewing a plan alone, auditing an entire repository, or making fixes directly. Check prior issues and new regressions, save a report, and determine whether changes are needed
Check PRD coverage after development is complete. Not for PRD quality, plan design, or reviewing a single diff. Compare completed plans, records and implementation, distinguish omissions from changes, adjudicate differences interactively, and generate a gaps plan if needed
Review Sui Move code that integrates OpenZeppelin Contracts for Sui against the library's own patterns and conventions. Use this when a developer wants their integration checked before shipping. Triggers: \"review my Sui Move code\", \"am I using OpenZeppelin correctly\", \"check this integration\", \"is this idiomatic\", \"review before audit\". Checks correct use of OZ primitives, deviations from examples/doc-comments, upheld invariants, test coverage, and code-quality/style. This is an AI code review, not a formal security audit.
Use when reviewing/judging a finished (or amended) high-fidelity UI design produced AS CODE — an acceptance gate: is the rendered hi-fi a sound build seed? The reviewer RE-RENDERS the code itself (headless browser) and vision-reviews the fresh screenshots — never trusting handed-in images. Judges a single-sourced bar: full coverage vs the wireframes; hi-fidelity + seed-not-over-built; visual execution + objective polish + named aesthetic heuristics (subjective taste never a gap); token-backed/no-DS-drift; real content (no lorem); rendered states; responsive reflow; NUMERIC WCAG 2.2 AA on the render (axe-core + vision, no rule disabled); gaps surfaced; an amend as a scoped versioned delta. Emits `VERDICT: approve|revise` + actionable findings; approves a seed meeting the bar (no false-revise on a thin screen), revises only on a named, rendered gap. Requires a vision-capable runtime. Not for authoring hi-fi, the structure (wireframes), the token system (design-system), or final code.
Adversarially review a Technical Design Document and its ADRs, actively looking for gaps, risks, and weak decisions instead of validating them. Use when the user asks to challenge, stress-test, get a second opinion on, or adversarially review a technical design document, architecture decisions, or ADRs.
Use this skill to test suspend functions and coroutine-using classes on the JVM with kotlinx-coroutines-test. Covers runTest, TestScope, StandardTestDispatcher vs UnconfinedTestDispatcher, virtual time via TestCoroutineScheduler (advanceTimeBy, advanceUntilIdle, runCurrent), the canonical MainDispatcherRule wrapper for Dispatchers.setMain/resetMain, the TestResult Promise contract on KMP, and the runBlockingTest -> runTest migration. If the user mentions runTest, runBlockingTest deprecated, advanceUntilIdle, advanceTimeBy, TestScope, StandardTestDispatcher, UnconfinedTestDispatcher, MainDispatcherRule, "Module with the Main dispatcher is missing", "test hangs forever", dispatchTimeoutMs, viewModelScope test, or a ViewModel that posts state from a coroutine, use this skill.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.