Skills
97,222 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
This skill should be used when the user asks to "review architecture", "analyze project structure", "check dependencies", "find circular imports", "analyze code patterns", "understand codebase structure", "map dependencies", "evaluate design patterns", or mentions architectural analysis.
Use when testing login, sessions, password reset, OAuth/OIDC/SAML/SSO, MFA, and JWTs for weaknesses that lead to account takeover — credential attacks, session fixation, reset-token poisoning, MFA bypass, and token forgery. On apps you own or are authorized to test.
Reports a bug or files feedback about the azuresql-db-* agent skills themselves, or about the Azure SQL Database container (Private Preview). Use when the user says a skill or the container "did not work", hit an error, behaved unexpectedly, or is missing something; and when they say "report a bug", "file an issue", "open a GitHub issue", "request a feature", "give feedback", or "tell the team". Also use when you, the agent, had to deviate from an azuresql-db-* skill or work around a defect in one to finish a task: that is a bug worth reporting even if the task succeeded. Decides whether the problem belongs to the SKILL or to the CONTAINER, since they use different issue templates, then builds a complete prefilled GitHub issue from context you already have. Never submits anything without explicit confirmation from the user.
Manage Bitbucket repositories, pull requests, branches, tags, commits, projects, and admin settings using the orbit CLI. Use this skill whenever the user asks about Bitbucket repos, PRs (pull requests), branches, tags, commits, code review, project management, default reviewer conditions, required approvals, merge restrictions, or PR approvals on Bitbucket Server/Data Center or Bitbucket Cloud. Trigger on phrases like 'list PRs', 'show pull requests', 'create a branch', 'open a PR', 'view the latest commits', 'list repos in project X', 'merge the PR', 'decline the PR', 'approve the PR', 'unapprove', 'request changes', 'find a repo', 'search repos', 'which repos are Go', 'search the code', 'needs work', 'mark as needs work', 'reject the PR', 'block the merge', 'check PR activity', 'bypass merge check', 'required approvals', 'reviewer conditions', 'who needs to approve', 'can this merge', 'why can't it merge', 'merge status', or any Bitbucket-related task — even casual references like 'what PRs are open', 'show me the repos', 'tag a release', 'check if it merged', 'who approved it', 'list branches', or 'why can't I merge'. Also trigger when the user provides a Bitbucket Server URL (e.g., https://git.example.com/projects/PROJ/repos/my-repo/) or mentions Bitbucket Data Center. The orbit CLI alias is `bb`.
Model technical capacity, unit cost, and budget constraints connected to demand, performance, and reliability decisions. Use when projecting capacity from growth forecasts, sizing for peak events, designing cost-aware scaling policies, defining budget thresholds or quota/rate-limit enforcement, running or planning load/soak tests as capacity evidence, resolving SLO-cost tradeoffs, or modeling multi-tenant demand distributions, hot-tenant skew, pooled or siloed headroom, fairness evidence, and tenant-variable unit cost. Do NOT use for financial P&L statements, fundraising scenarios, or SaaS metrics (route to financial-modeling); for infrastructure implementation or cloud-resource provisioning (route to platform-engineering); or for generic cloud-cost tips and universal utilization targets — this skill does not prescribe fixed savings rates or one-size-fits-all thresholds.
Qualitative senior-engineer-style code review of a branch diff against its base, including uncommitted work: intent (does it solve the requested problem?), architecture and design per ISO/IEC 25010 (SOLID, Clean Architecture, coupling, duplication, reliability, security, performance) and actionable feedback that explains WHY and proposes changes. Returns findings with severity, verdict (approved/rejected/incomplete) and next actions. It does not require artifacts from this plugin: the intent can come from a US-XXX/WI-XXX/FT-XXX, an external ticket or spec, or the branch and its commits. Activate when the user asks "revisa este código", "code review", "revisión de código", "¿está bien resuelto esto?", "revisa el diseño antes del PR/merge", "revisa lo que llevo antes de commitear", or when another skill (work-integrate, pr-create) invokes it. Closing process, not proactive. Does NOT run tests, linter or build — that is quality-check's job. Never fixes without authorization.
Audit horizontal scaling topology — declarative partitioning fit for large/time-series tables, hot-partition / skewed partition-key risk, and premature sharding that adds complexity before it is justified. Module M16. Feeds the Performance & Scale score.
Managed-platform fitness (M21) — checks the project against the realities of its hosting platform (Supabase, Neon, PlanetScale, Turso, Cloudflare D1, CockroachDB, Yugabyte, DynamoDB, RDS/Aurora). Engine version currency (without fabricating EOL dates), honest pricing / vendor lock-in trade-offs, and per-platform feature support — most importantly foreign-key support (PlanetScale Vitess historically restricts FKs; D1/SQLite, serverless drivers, connection limits). Feeds the Design & Integrity AND Performance & Scale scores.
Specialized-engine fitness (M20) — checks whether a vector, time-series/OLAP, graph, or search store is configured correctly for its job. M20a vector (dimensions match the embedding model, distance metric matches how the model was trained, HNSW/IVFFlat params present), M20b time-series/OLAP (hypertable/partition fit, continuous aggregates, compression), M20c graph (edge modeling, supernode risk, index-backed lookups), M20d search (analyzer/mapping, FTS config). Feeds the Design & Integrity AND Performance & Scale scores per sub-module.
Assesses an open Dependabot pull request and emits a recommendation (Merge / Review before merging / Do not merge) plus confidence (High / Medium / Low) with concise prose grounded in upstream source changes. Advisory only: it posts a single comment and never merges, approves, or labels. Designed to run as a scheduled reconciler that comments exactly once per PR state and re-comments only when the PR head commit changes.
Finds non-obvious corner cases of a task through the intersection of states, data, order of actions, failures, and concurrent changes; turns them into expected behaviour and verifiable scenarios. Use before implementing or reviewing a non-trivial product, UX, or technical task; when stateful/async behaviour, persistence, synchronisation, permissions, integrations, and multi-step flows change; when the user asks to think through edge cases, corner cases, extreme cases, or to check the completeness of the requirements. Do not use for small mechanical edits or before choosing the task itself or the scope of the solution — run nodumb first.
Guides work on `packages/frontend/editor-ui` experiments. Use when creating, extending, wiring, testing, reviewing, or retiring editor-ui experiments, PostHog feature flags, experiment key indexes, variants, stores/composables, persisted experiment state, or experiment telemetry.
Adversarial pass/fail review gate that enforces the feature-arch skill's React feature-based architecture rules. Use when a diff, branch, PR, or src/ tree must be judged for architecture conformance before merge — feature folder structure, import boundaries, cross-feature isolation, data-fetching, state, testing, and naming rules. A single blind reviewer renders per-rule PASS/FAIL verdicts with cited evidence, and the reviewer's structured output is the verdict fail-closed. Use the feature-arch skill itself to design or migrate an architecture; use this gate to judge whether work conforms to it.
Use when GitHub Actions PR checks are failing on a pull request and need to be diagnosed or fixed. Inspects checks / logs via `gh`, drafts a fix plan, and implements only after explicit approval. Trigger on red checks, failing workflow runs, `pr is failing CI` reports — even if the user does not name a specific check. Out of scope: external CI (e.g. Buildkite) — report only the details URL.
Generate hybrid cloud tests for the Sentry codebase. Use when asked to "generate HC test", "create hybrid cloud test", "write HC test", "add HC test", "write RPC test", "test RPC service", "silo test", "cross-silo test", "outbox test", "API gateway test", or "endpoint silo test". Covers RPC service tests, API gateway tests, outbox pattern tests, and API endpoint tests with silo decorators.
Find logic bugs in a single file or function via semi-formal execution tracing (Premises → Trace → Divergence → Trigger → Remedy). Trigger when a user shares code and suspects something is wrong without naming a concrete failure — phrases like "review this", "does this look right", "check this function", "audit this code", "tests pass but prod fails". SCOPE HARD RULE: one file or one function only. For a directory or whole module use logic-health; for a confirmed failure (stack trace, failing test, specific wrong value) use logic-locate; for two versions use logic-diff; for repo-wide autonomous fixing use logic-fix-all. Do NOT trigger for: style/formatting, security scanning, performance, test generation, architecture or design questions.
Lint a database migration for safety before it runs — classify lock level, table rewrite, and reversibility; flag destructive/blocking operations; and propose an expand-contract rollout. Read-only analysis by default; any data-loss step requires an explicit token handshake before the writer is involved. Use when the user asks to review, lint, check, or de-risk a migration, an ALTER/DROP, an enum change, a backfill, or a schema change before deploying.
MISRA C:2025 expert that operates in two modes: (1) Review — scan existing C code for violations across all ~223 guidelines (22 directives + ~201 rules), report findings with rule IDs, corrected code, and deviation justification templates; (2) Develop — generate new C functions, modules, or data structures that are MISRA-compliant from the first line, applying the essential type model, safe control flow, and banned-construct avoidance from the start. Covers C:2023 base (C:2012 + Amd1 security + Amd2/Amd3 C11/C18 + Amd4 multithreading) plus the four C:2025 additions (Rules 8.18, 8.19, 11.11, 19.3), Rule 15.5 disapplication, and 69 refined guidelines. Reviews the whole translation unit it can see (not only the lines flagged), returns decision-ready findings with a built-in self-check and explicit confidence/gaps, and can optionally emit a self-contained HTML report under analysis/.
Coach the user on what to fix first — rank the audit findings into a single, ordered to-do list by score impact and effort, and explain why each item is where it is. Read-only; advises, does not change anything. Use when the user asks what to do next, what to fix first, what matters most, how to prioritize, or where to start after an audit.
(NS) Delivery proof after Code Review: Approved: AC tokens, spec-coverage ledger, ui-contract testid/copy, visual checklist vs repo. Approved only at score 10; score 9 = Rejected. Use at version closure, GitLab issue delivery, or ad-hoc after reviewer Approved — even without naming this skill. Do NOT run before Code Review: Approved. Do NOT replace ns-reviewer SOLID/security. Do NOT write product code.
Create, test, evaluate, optimize, and package OpenCode skills with the opencode-skill-creator plugin. Use when users explicitly mention opencode-skill-creator, OpenCode Skill Creator, creating an OpenCode skill, editing an OpenCode SKILL.md, running skill evals, benchmarking skill performance, or optimizing an OpenCode skill description. Do not use for generic Claude Code or Superpowers skill creation unless the user asks to port that workflow to OpenCode.
Run the four paper-quality autoraters from PaperOrchestra (arXiv:2604.05018, App. F.3) — Citation F1 (P0/P1 partition + Precision/Recall/F1), Literature Review Quality (6-axis 0-100 with anti-inflation rules), SxS Overall Paper Quality (side-by-side), and SxS Literature Review Quality (side-by-side). TRIGGER when the user asks to "score this paper draft", "evaluate against the benchmark", "compare two papers", or "run the autoraters".
Optimize CI/CD pipelines by caching Playwright browser binaries and dependencies to speed up test execution. Use when setting up Playwright in CI/CD pipelines, reducing build times by caching browser binaries, or configuring GitHub Actions or Azure DevOps for Playwright tests.
Provides comprehensive guidance for pytest testing framework including test writing, fixtures, parametrization, mocking, and plugins. Use when the user asks about pytest, needs to write Python tests, use pytest fixtures, or configure pytest for Python projects.
Test and benchmark RAG systems with proper metrics and evaluation frameworks. Use this skill when evaluating RAG quality, measuring retrieval performance, using RAGAS metrics, or building RAG test suites. Activate when: RAG evaluation, RAG testing, RAGAS, retrieval metrics, faithfulness, relevance, context precision, RAG benchmarking.
Unified multi-dimensional code review with automated fix orchestration. Routes to session-based (git changes), module-based (path patterns), or fix mode. Triggers on "workflow:review-cycle", "workflow:review-session-cycle", "workflow:review-module-cycle", "workflow:review-cycle-fix".
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.