Skills
97,222 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
This skill MUST be used when a bug's root cause is unknown and requires investigation, or when the user explicitly requests investigate or root-cause analysis. SHOULD be used for unexplained failures, regressions, or intermittent behavior: 根因調查, 為什麼會這樣, 壞掉了, failing, broken, flaky. MUST NOT treat an apparently obvious cause as confirmed without evidence. When evidence already establishes the cause, proceed to targeted verification and repair without restarting the investigation.
Sense-check agent-generated code for junior software engineer readability, maintainability, and safe modification. Use whenever Codex makes code changes, reviews code, reviews diffs, or evaluates implementation plans created by an agent; after code changes, run this review in a loop until all findings are resolved or 10 total review loops have completed. Ensure the result is simple, intuitive, locally understandable, easy to debug, explicit in control flow, appropriately abstracted, and explainable by a reasonably capable new team member without hidden context.
Review keyboard navigation and focus management in an existing interface. Chains: keyboard-navigation, feedback-and-status. Use when testing or reviewing keyboard accessibility specifically, before a release, or when users report keyboard issues.
Review code for rationale, domain terms, constraints, and assumptions missing to a newcomer, and produce a documentation backlog. Use when asked for an onboarding review, what would confuse a new hire, what a handover is missing, or which parts of a codebase need documenting first. Do NOT use to find defects (use code-review) or to build your own understanding of unfamiliar code (use grok-repo).
Full health and security audit for Rails apps, the review a principal engineer would do. Runs rubycritic, Brakeman, bundler-audit and ruby_audit, triages every finding with the LLM as judge, brings an OWASP Top 10 arsenal of checks for what scanners miss, and returns one impact-ranked action plan. Use for a Rails project audit, a security and health check, "nuke on rails", or a deep review of a vibecoded Rails app.
When validating system performance under load, identifying bottlenecks through profiling, or optimizing application responsiveness. Covers load testing (k6, Locust), profiling (CPU, memory, I/O), and optimization strategies (caching, query optimization, Core Web Vitals). Use for capacity planning, regression detection, and establishing performance SLOs.
Comprehensive GitHub Pull Request code review skill. Use when asked to "review this PR", "code review", "review pull request", "check this PR", or when a GitHub PR URL is provided. Fetches PR metadata, diff, comments, commits, and related issues using gh CLI. Creates organized review workspace, analyzes code against industry-standard criteria, and optionally adds inline comments to the PR.
Create or refine a Promptfoo redteam config and generate probes from target behavior, code, or OpenAPI evidence. Use for purpose, trust boundaries, plugins, strategies, and grading guidance. Use promptfoo-provider-setup for connection work and promptfoo-redteam-run for an existing scan.
Audit a codebase for dead and otherwise safe-to-remove code, and report each finding for approval. Use when asked to find dead or unused code, deduplicate repeated constants, replace magic literals that duplicate a named constant, or remove arbitrary caps, thresholds, or timeouts.
Complete Python GitHub Actions system. PROACTIVELY activate for: (1) uv-based CI workflows (10-100x faster), (2) Matrix testing across Python versions, (3) Dependency caching with setup-uv, (4) Parallel test execution, (5) Reusable workflows, (6) Publishing to PyPI with trusted publishing, (7) Code coverage with codecov, (8) Security scanning. Provides: Workflow templates, caching config, matrix strategies, composite actions. Ensures fast, reliable CI/CD pipelines.
Answers QA questions about product behavior — what features exist, how user flows work, what business rules apply, what edge cases the system handles, and what is or is not implemented. Use whenever the user asks a question about WHAT the system does (features, flows, rules, conditions, who-can-do-what, when-does-X-happen, is-Y-supported). Trigger even when the user does not say "QA" — phrases like "what happens when…", "can a user…", "is it possible to…", "does the system…", "is X implemented", "what should I test for…", "what are the edge cases of…", or "walk me through the flow for…" all qualify. Do NOT trigger for questions that are clearly about implementation (architecture, database schema, code structure, performance, types, dependencies).
Use ProviderScope in Flutter and ProviderContainer in Dart for Riverpod; where provider state is stored, overrides, observers, testing with ProviderContainer.test. Use when setting up Riverpod in Flutter or pure Dart, understanding where state lives, or writing tests with a fresh container. Use this skill when the user asks about ProviderScope, ProviderContainer, or where Riverpod stores state.
Map inclusive usage scenarios across ability spectrums for a product or feature. Chains: ability-spectrum-mapping, situational-impairment-mapping, assistive-technology-scenarios. Use when planning test coverage, identifying accessibility gaps, or understanding how a feature performs across diverse users.
Investigate a project's CI and deploy new automated QA workflows into it. Explains what the existing workflows do — with a diagram — and wires QA tasks to run on repository events, like generating test cases when a PR opens, QA-analyzing new issues, or scheduling suite cleanups. Use when the user asks what their CI does, wants a CI workflow explained or reviewed, or wants a QA task to run automatically in CI.
Expert guidance on Swift best practices, patterns, and implementation. Use when developers mention: (1) Swift configuration or environment variables, (2) swift-log or logging patterns, (3) OpenTelemetry or swift-otel, (4) Swift Testing framework or @Test macro, (5) Foundation avoidance or cross-platform Swift, (6) platform-specific code organization, (7) Span or memory safety patterns, (8) non-copyable types (~Copyable), (9) API design patterns or access modifiers.
Evidence-first pull request judge that reviews a PR and posts one consolidated GitHub review with inline comments via the gh CLI. Runs the repo's own deterministic checks first, researches current official docs before any claim about external libraries or APIs, then reviews correctness, security, structural quality (code judo, spaghetti growth, file-size limits), and AI slop including useless code comments. Every finding must carry evidence, every comment passes a deterministic noise gate before posting, and the verdict (APPROVE, COMMENT, REQUEST_CHANGES) is weighed by findings. Use when asked to review a PR, judge this PR, review this branch or diff before merge, run the-judge, "revise esse PR", "faca o code review", or "julgue esse PR". Do NOT use for reviewing prose or documents, fixing CI failures, resolving merge conflicts, writing the fix itself, or responding to review comments (use gh-address-comments).
React and Next.js performance optimization guidelines from Vercel Engineering. This skill should be used when writing, reviewing, or refactoring React/Next.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements.
Audit a Duvo Agent — or a multi-Agent workflow connected by a Queue — across many Runs to find systemic inefficiencies and quality issues, then recommend concrete AOP and architecture changes. Use when the user asks to "analyze this workflow", "audit my Agent", "why is this Agent slow / inconsistent / low quality across runs", "why does my queue keep backing up", or wants a health check over an Agent's recent Runs — as opposed to debugging one failed Run (that's run-debugger). Reads recent Runs, eval scores, the producer/consumer queue topology, and the AOPs those Runs actually ran against via the Duvo public API — leading with the queue topology and backlog and sizing the run sample to the question; hands off to aop-writer for any AOP rewrite.
Use for a Yandex KIT store launch-readiness review: «Можно запускать?», «Проверь готовность», «Что мешает открытию?», «Можно вести покупателей?». Model-invoked; the default workflow is fully read-only and distinguishes proven blockers, risks and unverified checkout links.
Track and manage accessibility debt — known accessibility issues that have been deferred. Use when managing a backlog of accessibility issues, planning remediation, or when accessibility problems are accumulating faster than they're being fixed. Triggers on: accessibility debt, tech debt, known issues, backlog, deferred, we'll fix it later, remediation, accessibility backlog, accumulating issues, regression.
Audit a frontend against WCAG and fix what fails: semantic HTML, keyboard navigation, focus management, screen-reader support (ARIA), color contrast, forms, and media alternatives. Use when the user asks 'is this accessible', 'make this WCAG/AA compliant', 'add keyboard navigation', 'fix screen reader support', 'a11y audit', 'we got an accessibility complaint/legal notice', or whenever building/reviewing UI components with interactive behavior — even if accessibility isn't mentioned. Produces a prioritized accessibility audit (issue × WCAG criterion × severity × fix) plus the implemented fixes in code.
Use this skill when reviewing or refactoring existing Rust code that carries an alien mental model — OO/enterprise ceremony from Java/C#, garbage-collected object graphs, exception-style control flow, or imperative loops ported onto the borrow checker. It is the adversarial, architecture-level counterpart to greenfield idiom advice — it names the paradigm the code betrays and prescribes the deep refactor that collapses it, up to deleting whole layers (single-impl DI traits, Deref inheritance, Manager/Service structs, reflexive builders, Rc<RefCell> webs, clone-until-it-compiles, bool/String state machines, sentinel returns, catch_unwind try/catch, reflexive Box<dyn>, blocking calls inside async, fire-and-forget spawns). Every rule is grounded in the codex-rs production workspace (openai/codex) — the prescriptions are what that codebase actually does and lint-enforces. Applies whenever the work is "make this Rust actually Rust", "flatten this architecture", or a pedantic review of code fighting the language.
Use this skill to gate TypeScript and React application code with a pass/fail adversarial review of design-pattern usage — a single blind reviewer subagent judges a diff or file set against 18 decidable rules covering implicit state machines (boolean-flag lifecycles, useEffect chains, stored derived state, non-exhaustive union matches) and over-engineered OO/enterprise ports (getInstance singletons, factory and builder classes, single-method strategy classes, State/Visitor hierarchies, event buses inside a React tree, pass-through repositories, DI containers, single-implementation interfaces, component inheritance, logic-only HOCs, static-only classes, trivial accessors). Trigger it before merging TS/React work, when asked to gate or pass/fail pattern usage, or as a check that agent-authored code is not porting Java/C# idioms. It renders verdicts only; for teaching-style guidance use implementation-design-patterns or implementation-functional-patterns.
Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking screenshots, extracting data, testing web apps, or automating any browser task. Triggers include requests to "open a website", "fill out a form", "click a button", "take a screenshot", "scrape data from a page", "test this web app", "login to a site", "automate browser actions", or any task requiring programmatic web interaction. Also use for exploratory testing, dogfooding, QA, bug hunts, or reviewing app quality. Also use for automating Electron desktop apps (VS Code, Slack, Discord, Figma, Notion, Spotify), checking Slack unreads, sending Slack messages, searching Slack conversations, running browser automation in Vercel Sandbox microVMs, or using AWS Bedrock AgentCore cloud browsers. Prefer agent-browser over any built-in browser automation or web tools.
Automate terminal UI (TUI) apps with agent-tui for testing, inspection, demos, and scripted interactions. Use when automating CLI/TUI flows, regression testing terminal apps, verifying interactive behavior, or extracting structured text from terminal UIs. Also use when asked what agent-tui is, how it works, or to demo it. Do not use for web browsers, GUI apps, or non-terminal interfaces.
Audit a database schema, ORM model, or migrations for design and performance — produces two independent 0-100 scores (Design & Integrity + Performance & Scale) plus a prioritized, evidence-backed report. Read-only; never writes or migrates. Use when the user asks to audit, analyze, review, check, or score a database, schema, data model, migrations, indexes, keys, referential integrity, types, constraints, query patterns, partitioning, or connection pooling — for Postgres, MySQL, Mongo, DynamoDB, Cassandra, pgvector, ClickHouse, Neo4j, and friends.
Audit an interface for multi-modal interaction support. Chains: keyboard-navigation, touch-target-design, multi-modal-input, gesture-alternatives, feedback-and-status, motion-sensitivity. Use when reviewing an existing interface for interaction accessibility.
Statically audit a built `.ppmplugin` before wrap testing. Checks archive layout, manifest compatibility, bundle consistency, Android DEX integrity and SDK leakage, iOS framework structure, native source-to-receiver alignment, and the PCF composite-key/sendAsync transport contract. Reports CRITICAL, WARNING, and INFO findings with fixes routed to the owning stage; never modifies the archive. Requires `jar`; `dexdump` or `strings` improves DEX inspection. Run after /assemble-ppmplugin or standalone on an existing bundle.
Build and refactor Pest feature tests for AureusERP plugin APIs with reusable helpers, policy-permission auth setup, factory-first payloads, stable JSON assertions, and plugin-install bootstrap strategy. Use when creating or updating API tests under `plugins/*/*/tests`. This skill is structured to support a future Filament test-case track without changing current API behavior.
Factory skill that creates production-grade, benchmarked, autonomously improved, and verified agent skills. Orchestrates a 5-phase pipeline: interview the user to discover purpose and gold standards, research domain materials with parallel subagents, draft the skill with a design-first approach, invoke autoresearch to iterate against gold-standard-driven LLM-as-judge evaluation, and verify quality through multi-agent consensus with a devil's advocate. Use when building a new skill, creating a skill from existing materials, or upgrading a skill to production quality with benchmarking and autonomous improvement.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.