Skills
97,501 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Generate test and suite specifications in the strict FinalRun YAML format. Handles automated test planning, folder grouping by feature, repo app configuration, environment-specific overrides in .finalrun/env/*.yaml, and validation via finalrun check.
Compares current live GTM container against last known state from gtm-implementation-log.json. Shows what tags, triggers, and variables have been added, deleted, or modified since the last skill run. Read-only, no changes made. Prevents accidentally overwriting manual GTM changes. Trigger on - "what changed in GTM", "gtm diff", "check for manual changes", "gtm drift", "what's different in my container", "has anything changed".
Use to validate code against common security rulesets and standards (OWASP Top 10, OWASP ASVS, OWASP API Security Top 10, CWE Top 25) by reviewing the code, a module, or the current branch's changes control-by-control. Produces a traceable compliance report marking each control pass/fail/N-A with evidence, plus prioritized remediation pointers. Invoke standalone to audit against a standard, or from another flow (incu-way-development at validation, incu-way-bugs) to check new code before merge. This is a standards-driven manual review — it complements snyk-remediation (automated SAST/SCA scanning), it does not replace it.
Writes MATLAB performance tests using the matlab.perftest.TestCase framework. Use when asked to write, create, or add performance tests for MATLAB code, benchmark functions, measure execution time with statistical rigor, or use runperf.
Nuxt adapter for embedding emulators directly in a Nuxt app via @emulators/adapter-nuxt. Use when the user needs to embed emulators in Nuxt, set up same-origin OAuth for preview deployments, create an emulate catch-all server route, configure persistence for embedded Nuxt emulators, or wrap nuxt.config with withEmulate. Triggers include "Nuxt emulator", "adapter-nuxt", "embedded emulator", "same-origin OAuth", "createEmulateHandler", "withEmulate", or any task requiring emulators inside a Nuxt app.
Use when writing Playwright tests, fixing flaky tests, debugging failures, implementing Page Object Model, configuring CI/CD, optimizing performance, mocking APIs, handling authentication or OAuth, testing accessibility (axe-core), file uploads/downloads, date/time mocking, WebSockets, geolocation, permissions, multi-tab/popup flows, mobile/responsive layouts, touch gestures, GraphQL, error handling, offline mode, multi-user collaboration, third-party services (payments, email verification), console error monitoring, global setup/teardown, test annotations (skip, fixme, slow), test tags (@smoke, @fast, @critical, filtering with --grep), project dependencies, security testing (XSS, CSRF, auth), performance budgets (Web Vitals, Lighthouse), iframes, component testing, canvas/WebGL, service workers/PWA, test coverage, i18n/localization, Electron apps, or browser extension testing. Covers E2E, component, API, visual, accessibility, security, Electron, and extension testing.
Provides comprehensive guidance for pytest testing framework including test writing, fixtures, parametrization, mocking, and plugins. Use when the user asks about pytest, needs to write Python tests, use pytest fixtures, or configure pytest for Python projects.
Interactive QA session where user reports bugs or issues conversationally, and the agent files GitHub issues. Explores the codebase in the background for context and domain language. Use when user wants to report bugs, do QA, file issues conversationally, or mentions "QA session".
Detects common LLM coding agent artifacts across four categories (tests, dead code, abstraction, style) over the project or changed files — using parallel subagents when the agent supports them, otherwise four sequential passes. Scans files changed since main by default; use --all for full-project scan. Triggers on LLM cruft cleanup, agent-generated code review, dead code sweeps, test-quality passes, or when the user asks to scan the whole repo.
Use this skill to run instrumented Android tests directly through `adb shell am instrument -w -r` without going through Gradle. Covers the required `-w` (wait — REQUIRED for meaningful exit codes) and `-r` (raw output) flags, the `-e` argument table (`class`, `class#method`, `package`, `size`, `numShards`/`shardIndex`, `debug`, `annotation` / `notAnnotation`, `listener`, `clearPackageData`, `targetInstrumentation`), the canonical runners `AndroidJUnitRunner` and `AndroidTestOrchestrator`, the orchestrator wrapping pattern (target = orchestrator, `-e targetInstrumentation <pkg>/<runner>`), and the output framing (`INSTRUMENTATION_STATUS_CODE` 1=start, 0=ok, -1=error, -2=failure, -3=ignored, -4=assumption-failure; `INSTRUMENTATION_RESULT`; `INSTRUMENTATION_CODE`). Use when the user mentions `am instrument`, `AndroidJUnitRunner`, "run tests from CI without Gradle", "Orchestrator", `clearPackageData`, `targetInstrumentation`, exit codes from `am instrument`, or `INSTRUMENTATION_STATUS_CODE`.
Run a saved Salla App Function on a demo store with `salla_functions action=preview` (app_id, trigger, store_id, and the trigger's form fields as REAL ids). Use after save to verify behavior before publishing; poll `salla_functions action=deploy_status` while it is still deploying. Routed from salla-app-functions; uses salla-api-core to fetch real ids.
REQUIRED before saving a Salla App Function: keep the template's wrapper exactly — its first AND last line — with all code inside the wrapper (no hoisted const/helper), and type-check the handler with the TypeScript compiler against the trigger's `types` (.d.ts URLs) at the editor's bar — non-strict, ignoring unused (TS6133) — plus validate any documented Admin API call against its OpenAPI schema (salla-api-core loop). `salla_functions action=save` validates ONLY those wrapper lines. Routed from salla-app-functions; release with salla-app-functions-release.
Keep an eye on this PR. Review and resolve pull request comments and fix build failures autonomously. Use when asked to review PR feedback, address reviewer comments, fix CI failures, resolve PR threads, or handle PR maintenance tasks like "review PR comments", "fix the build", "address PR feedback", "clean up PR", or "resolve comments". Handles comment triage (resolve false positives, fix trivial issues, flag complex ones), build/lint/type errors, and e2e snapshot updates.
Ship a NEW capability to vigiles so it actually reaches a user — a new export, public function, subpath, CLI flag, or hook-vocabulary word. Use when about to add, or having just added, a feature / export / public API to this repo. Runs the executable checks a green `npm run check` does NOT make — reachable from a public door, API-surface diff READ, a public doc home, the experimental_ decision, a gate on a frozen tree. NOT for bug fixes, refactors, doc-only or test-only edits.
Use when you suspect duplicate or near-duplicate Rust code — writing a utility function that might already exist, copy-paste-modifying a function, creating near-duplicate structs or enums, or running `similarity-rs 0.5` with flags like `--threshold`, `--cross-file`, or `--min-lines`. Also triggers on `cargo install similarity-rs`, reviewing CI duplication gates, or tuning false-positive thresholds.
Use this skill after implementation and before testing to run a quality gate. Reviews changed files against the task document, checks maintainability standards, classifies plan deviations, and decides whether the work can proceed to verification.
Invoke FIRST, before creating, editing, or deleting components, stories, styles, CSS, themes, colors, or design tokens — anything that changes how the UI looks, no exceptions. Also for starting or previewing Storybook to verify UI, requests to show, browse, or list components, stories, or UI states, and docs, props, or usage lookups.
Use when executing multi-task plans where each task can be implemented independently by a subagent. Triggers when a plan has 3+ independent tasks, when speed of execution is important, when tasks have clear acceptance criteria suitable for delegation, or when two-stage review gates (spec compliance and code quality) are needed for iterative fix cycles.
Use when an extension has to work with a newer or the current TYPO3 LTS, when a version bump breaks compatibility or leaves deprecated APIs behind, when upgrading v11->v12, v12->v13 or v13->v14 (v14.3 LTS is the current target), when one codebase must stay compatible with two versions, when running Extension Scanner, Rector, Fractor or PHPStan against a target version, or when a specific v14 breaker bites - Fluid 5 strict ViewHelpers, HashService removal, the ext_tables.php split.
Web accessibility and interface standards guide. Covers WCAG compliance, semantic HTML, keyboard navigation, screen readers, forms, touch targets, and internationalization. Use when building, reviewing, or auditing web interfaces for accessibility and UX quality.
Use this skill to gate Elixir/OTP systems on BEAM runtime architecture with a pass/fail adversarial review — a single blind reviewer subagent judges a diff or file set against 23 decidable rules covering supervision and failure design (restart strategy vs child dependencies, blocking init, durability in terminate, restart amnesia, unsupervised fire-and-forget), backpressure (cast on externally-driven ingest, push pipelines without demand, silenced or retried call timeouts, unbounded fan-out), event delivery semantics (PubSub treated as durable, jobs enqueued outside the creating transaction, non-idempotent consumers under at-least-once delivery, cross-source ordering, telemetry handlers that block or detach), shared-state races (check-then-act on ETS/Registry, hot reads through one mailbox, persistent_term churn), distribution (global singletons in netsplits, node-local uniqueness assumed cluster-wide), and runtime mechanics (wall-clock durations, sub-binary leaks, minted atoms). Verdicts only, never fixes.
Use this skill to gate SwiftUI code with a pass/fail adversarial review — a single blind reviewer subagent judges a diff or file set against 31 decidable rules — data modeling and observation (@Observable over ObservableObject, @State ownership, task(id:) re-init guards, environment closures and high-frequency values), view update cost (computed-var extraction, whole-model dependencies, init side effects, uncached derivations, structs on rows), structural identity (applyIf branching, AnyLayout), task lifecycle (.task over onAppear+Task, scalar ids, @concurrent offloading), lists and geometry (ForEach view count, AnyView rows, GeometryReader measurement, feedback loops, visualEffect), animation scope, and accessibility (button semantics, style protocols, accessibilityRepresentation, semantic styling, ScaledMetric spacing). Trigger before merging SwiftUI work or to audit agent-authored views. Verdicts only, never fixes; targets without a SwiftUI surface abort.
Use this skill to gate Zod 4 schema code in TypeScript and TanStack Start apps with a pass/fail adversarial review — a single blind reviewer subagent judges a diff or file set against 24 decidable rules covering silent Zod 3-to-4 semantic breaks (defaults, enum-keyed records, boolean coercion), removed APIs (including the z.interface hallucination), unified error customization, deprecated method forms, recursion and codec composition, adapter-free TanStack Start validators, and packaging. Trigger it before merging Zod schema work, when asked to gate, adversarially review, or pass/fail Zod usage, or as a currency check that agent-authored schemas use the latest Zod 4.x surface. It renders verdicts only and never fixes the work; for teaching-style Zod feedback use the curated zod skill instead.
Use this skill to design an OpenAPI spec from scratch, assess an existing spec for AI agent readiness, security, or design quality, or fix issues found in a spec. Trigger when the user describes an API they want to build, asks to "design", "create", "draft", or "scaffold" an OpenAPI spec, or mentions building a REST API for a service or domain. Trigger when the user says things like "I want to expose endpoints for X", "help me design an API for Y", or "I need an OpenAPI spec for Z" — even without saying "OpenAPI" explicitly. Trigger when the user asks to evaluate, review, check, or assess an OpenAPI spec for agent compatibility, API quality, security, OWASP compliance, WSO2 guidelines, or REST best practices — or when they share a .yaml/.json OpenAPI file and ask how good it is. Trigger when the user asks to fix, correct, remediate, or apply fixes to issues in an OpenAPI spec — including "fix issue spec-001", "fix all HIGH severity issues", "apply autoFixable fixes", or "fix the spec issues from this report".
Debug HarmonyOS ArkWeb applications using Chrome DevTools Protocol. Use when Claude needs to: (1) Start ArkWeb debugging sessions, (2) Connect Chrome DevTools to HarmonyOS apps via hdc, (3) Inspect webview elements, console, and network, (4) Test ArkWeb applications with Chrome DevTools MCP, (5) Troubleshoot webview debugging issues, or (6) Manage port forwarding and debugging sessions. Automatically detects project configuration, device connection, and debugging sockets. Works with ohos-app-build-debug skill for complete workflow.
Assess cognitive load across a complete multi-step process and produce a load map. Chains: cognitive-load-assessment, memory-load-reduction, wayfinding-navigation. Use when evaluating a checkout flow, onboarding sequence, application process, or any multi-step journey.
Review backend code for quality, security, maintainability, and best practices based on established checklist rules. Use when the user requests a review, analysis, or improvement of backend files (e.g., `.py`) under the `src/backend/` directory. Do NOT use for frontend files (e.g., `.tsx`, `.ts`, `.js`). Supports pending-change review, code snippets review, and file-focused review.
Browser runtime debugging toolkit — prioritize browser DevTools and CDP tools for runtime inspection and control when debugging UI/CSS/DOM layout, frontend interaction, and rendering issues. Default channel: ego-browser (macOS, runtime-checked) — full interaction, js(), raw cdp(), inherited login state, isolated task space, human-AI handoff. On unavailability or failure degrade along: playwright-mcp → agent-browser (non-macOS); web-access CDP Proxy (lightweight control + login state, curl-parallel); chrome-devtools-mcp (DevTools panels: computed style, network, perf trace). Triggers: 「浏览器调试」「UI 调试」「DOM 检查」「CSS 调试」「页面布局问题」「前端运行时调试」「chrome devtools」「CDP 调试」「登录态调试」 / browser debug, devtools, dom inspect, css debug, runtime debugging, login-state debug.
Classifies a single piece of text (an AI-coding human input, optionally with its paired assistant reply and previous-assistant tail) into the current v2 human-input category + topic taxonomies, returning the primary category, the full priority-ordered categories array, one topic, topic_reason, and topic_confidence — a pure reasoning check against uid.core-product's classify rules (gpt-4o production prompt, postprocess off), no CawPlan data or API calls involved. Use when: asked to classify/categorize a specific sentence or human input against the current category and topic rules — e.g. "what category/topic is this: ...", "classify this with this assistant reply" — or as the per-row classification step used by cawplan-internal-qa-coding-humaninputs-test. NOT for: bulk/batch accuracy testing across many already-uploaded human inputs, or fetching data from CawPlan at all (use cawplan-internal-qa-coding-humaninputs-test for that), submitting reports, or creating tickets.
Internal QA check for the AI-coding human-input classifier: pulls already-uploaded human inputs via the cawplan CLI, classifies each one via cawplan-internal-qa-coding-humaninputs, and compares category and/or topic against persisted cloud labels — in category-only, topic-only, or both-together mode — reporting accuracy and concrete mismatches for manual review. Use when: asked to test/verify/check human-input classification accuracy — e.g. "test today's category accuracy", "check topic only for spx last week", "compare both category and topic for the last 2 days" — optionally scoped to one person, one product, or both. NOT for: classifying a single ad hoc sentence (use cawplan-internal-qa-coding-humaninputs directly), submitting coding reports (use cawplan-coding-commit), general cost/usage insights or prompt-quality scores (use cawplan-coding-insights), or creating tickets.
Internal QA check for the new AI-coding session-summary feature: fetches one session's full conversation via the cawplan CLI and generates a narrative summary yourself using the same rules uid.core-product's session-insights prompt uses, so you can eyeball the summary's quality before/without needing the cloud enrichment pipeline to have run. Display-only, no comparison against any cloud value (the field is new and may not be backfilled yet). Use when: asked to test/check/try out the session summary prompt — e.g. "test the summary for yupeng's session today", "see what the summary would look like for entry <id>", "try the session summary on a random recent session". NOT for: human-input category classification (use cawplan-internal-qa-coding-humaninputs[-test]), bulk accuracy testing, submitting reports, or general session cost/usage insights.
Manually link existing TestRail Cases or Plans/Runs back to CawPlan mappings after QA hand-imported or hand-created TestRail artifacts. Link matches requirement_id + test_point_id in refs only (no hash validation). Use when: linking CSV-imported cases by refs; binding hand-made TestPlan/TestRun to CawPlan tickets; 用例回链、refs 映射、Plan Run 绑定、手工导入后 link. Ideal path after A3 CSV import: auto Suite → AutoScan → one confirm. NOT for: creating TestRail cases (use `cawplan-testcase-import`); creating Plans/Runs (use `cawplan-testplan-layout`); generating/exporting cases (use `cawplan-testcase-generate`); execution progress or defect filing.
Analyze codebases for anti-patterns and code smells via ast-grep structural matching across JS, TS, Python, Vue, React. Use when reviewing code quality, identifying tech debt, or doing broad code analysis. Pairs with /code-antipatterns.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.