Skills
97,222 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Stateless review of an open GitHub PR. Standards hard-require /taste KISS + named principles (including honest names, trust the server, types tell the truth, and naming alignment) and /architecture, plus a correctness hunt and PR extras (body vs diff, migrations, breaking API). Triage historical finding threads, draft one-topic comments, post only after one publish decision.
Design review for existing Motoko backends — judging whether code is well designed, not how to write it. Covers invariants encoded in types (variants over Text, correlated fields, case _ smells), stable vs transient state discipline under enhanced migration, file structure (types.mo/lib/mixins/main.mo), and severity-ranked findings (Blocker/Warning/Note). Use when reviewing, auditing, critiquing, or refactoring existing .mo files, or when asked for code-review feedback on a Motoko canister. Do NOT use for writing new Motoko code or fixing compiler errors (writing-motoko), authoring migration files (migrating-motoko-actors), or deployment.
Continuous security vulnerability scanning for OWASP Top 10, common vulnerabilities and insecure patterns. Use when reviewing code, before deployments or on file changes. Scans for SQL injection, XSS, secrets exposure and auth issues. Triggers on file changes, security mentions and deployment prep
Use this skill to choose between host (Robolectric/JVM) and device (instrumentation) tests for Jetpack Compose, and to configure each correctly. Covers the `androidHostTest` (a.k.a. `src/test/`) vs `androidDeviceTest` (a.k.a. `src/androidTest/`) source set split, what each flavor can and cannot drive (RenderThread, screenshots, accessibility), the `@RunWith(AndroidJUnit4::class) @Config(minSdk = 23)` setup for Robolectric, and why `Thread.sleep` is forbidden everywhere except screenshot tests waiting on the RenderThread. Use when the user reports "tests pass locally but fail on CI", asks "Robolectric vs instrumentation", mentions screenshot tests, ripple animations, accessibility checks throwing on Robolectric, or "should this test live in test/ or androidTest/".
Review a code change, diff, commit, branch, or pull request for actionable defects, regressions, security risks, compatibility breaks, and missing verification. Use when code review is the primary requested outcome. Keep the review read-only unless the user explicitly asks to implement fixes; do not use as a substitute for implementation or a specialized visual audit.
Run the Bitwarden workflow linter (bwwl) against one or more repos and report findings. Strictly read-only — does not modify any files. Categorizes findings as mechanical or judgment using the bitwarden-workflow-linter-rules skill. Supports single repo, multiple repos, or single file/directory scope. <example> User: Run the workflow linter on the server repo Action: Trigger workflow-audit for that repo </example> <example> User: Lint the workflows across server, clients, and android Action: Trigger workflow-audit in multi-repo mode </example>
Provides comprehensive guidance for Appium mobile testing including mobile app automation, element location, gestures, and cross-platform testing. Use when the user asks about Appium, needs to test mobile applications, automate mobile apps, or write Appium test scripts.
Transforms code into clean, testable, and maintainable architecture using SOLID principles, Clean Architecture, and proven design patterns. Use this skill when you need to: design a new feature with proper separation of concerns, refactor legacy or monolithic code, review architecture for SOLID violations, establish dependency-injection boundaries, plan a testing strategy, or document architectural decisions. Language-agnostic; includes concrete Swift/iOS examples from the Essential Developer methodology.
Improve any existing Claude Code skill, CLAUDE.md, subagent definition, slash-command, or prompt markdown file by combining web-researched best-practice rewrites with autonomous Karpathy-style binary eval loops. Use when the user wants to "auto-research", "self-improve", "auto-improve", "optimize", "modernize", or "research-improve" any existing SKILL.md, CLAUDE.md, agent file under .claude/agents/, slash-command file under .claude/commands/, or any prompt markdown file. Triggers on phrases like "use auto-research to improve skill X", "auto-improve this CLAUDE.md", "research best practices and rewrite Y", or "self-research and optimize this agent". Researches authoritative sources (Anthropic docs, anthropic.com engineering blog, anthropics/skills GitHub) in parallel sub-agents, proposes a cited rewrite, runs an autonomous binary-assertion eval loop with git commit and reset bookkeeping for testable artifacts, and asks the user to confirm only at the end with a before-and-after score and full source list.
Fetch unresolved review threads on a GitHub PR, verify the validity of each comment, then pick only the valid points and fix and commit them. Handles comments from all reviewers (bots and humans). Activates on requests such as "apply the code review", "handle the review comments", "apply the PR review", "apply PR review comments", "handle review feedback", "autofix", "/autofix". Rather than applying review comments as-is, it applies only those judged valid in verification, either with user approval (default) or automatically (`--auto`).
Interactive BPA rule generation for Power BI semantic models; guided discovery, model investigation, and expert rule authoring. Automatically invoke when the user mentions "BPA rule", "Best Practice Analyzer", or asks to "create a BPA rule", "audit BPA rules", "recommend BPA rules", "set up BPA for my team", "check model for best practices", "validate BPA rules", "improve a BPA expression".
Pull human-input logs from CawPlan (by product, user/member, date range, count, or session), preprocess prev/assistant context like production classify, and open a local web editor to annotate expected category/topic labels for prompt eval fixtures. Use when: building or extending a labeled human-input sample JSON for classify prompt testing — e.g. "pull 20 turns from spx's Slack session last week and label them", "sample human inputs for core-product". NOT for: running classify accuracy against cloud labels (use cawplan-internal-qa-coding-humaninputs-test), classifying a single sentence (use cawplan-internal-qa-coding-humaninputs), or submitting coding reports.
Diagnose and fix failing CircleCI builds quickly and safely. Use when users ask to investigate failed CircleCI jobs, triage flaky pipelines, identify root causes from logs, and implement minimal fixes in configuration, test setup, or build-related code paths.
Review .NET changes for bugs, regressions, architectural drift, missing tests, incorrect async or disposal behavior, and platform-specific pitfalls before you approve or merge them. USE FOR: reviewing a pull request or patch in a .NET repository; checking for behavioral regressions, API misuse, or missing tests; auditing architectural or framework-specific. DO NOT USE FOR: unrelated stacks; generic tasks that do not need this specific guidance. INVOKES: inspect the repository context, edit targeted files, and run relevant build, test, lint, or validation commands when changes are made.
Use this skill to drive cross-app and system-UI flows from instrumentation tests using UiAutomator 2.3.0 — `UiDevice`, `BySelector` / `UiObject2` (modern), `UiSelector` / `UiObject` (legacy), `Until` conditions, and `Configurator` global timeouts. Covers the singleton acquisition (`UiDevice.getInstance(InstrumentationRegistry.getInstrumentation())`), `pressBack/pressHome/pressRecentApps`, `device.findObject(By...)` cached-node refresh and `StaleObjectException` recovery, the `executeShellCommand` `@Discouraged` path vs `Context.startActivity` plus `<queries>`, and the full `By` factory catalog. Use when the user reports `StaleObjectException`, `Espresso InjectEventSecurityException`, `findObject returns null`, asks "how do I open Settings from a test", "toggle Wi-Fi", "dismiss notification shade", or "test that spans my app and another".
Use this skill to drive Jetpack Compose UI with synthetic touch events through performTouchInput and the TouchInjectionScope DSL — click, longClick, doubleClick, swipe, swipeUp / swipeDown / swipeLeft / swipeRight, swipeWithVelocity, pinch, multiTouchSwipe, plus the low-level down / moveTo / moveBy / move / up / cancel primitives. Covers node-local coordinates, the geometry helpers (center, topLeft, bottomRight, percentOffset), event batching, splitting a gesture across multiple performTouchInput blocks, and why performGesture must not be used. Use when the developer asks "how do I simulate a swipe", "drag a node by 100 pixels", "long-press in a Compose test", "pinch to zoom", "test a fling with velocity", or reports "performGesture is deprecated", a Thread.sleep mid-gesture, or a flaky drag test using hardcoded screen coordinates.
Provides comprehensive guidance for JUnit testing framework including test annotations, assertions, test lifecycle, and best practices. Use when the user asks about JUnit, needs to write Java unit tests, use JUnit annotations, or configure JUnit for Java projects.
Review dead letter queue implementations for completeness using the Lenses MCP server. Checks DLQ topic existence, configuration, monitoring, metadata preservation, retry logic, reprocessing paths and connector DLQ alignment. Use when user says "review dead letter queues", "check DLQ setup", "DLQ audit" or asks about error handling, message failures or reprocessing. Do NOT use for reprocessing DLQ messages or managing consumer offsets.
Stop AI coding agents from shipping sloppy code — over-abstraction, drive-by refactors, obvious comments, extra files, unrequested deps, giant unreadable files, or fishing outside the workspace for “inspiration”. Use when writing or editing code, implementing features, fixing bugs, splitting or organizing files, or when the user mentions slop, cleanup, keep it simple, minimal diff, file too big, hard to navigate, or stay in the repo.
Reverse-engineer raw materials (Sparse idea, Dense idea, experimental log) from an existing AI research paper to build a benchmark case for evaluating paper-writing pipelines. Replicates the PaperWritingBench dataset construction procedure from arXiv:2604.05018 §3 / App. C. TRIGGER when the user asks to "build a benchmark case from this paper", "reverse-engineer raw materials", or "evaluate my pipeline against PaperWritingBench".
A gate that collects quality evidence before work is completed. Verifies test, lint, build, Contract Gate, TEST_ID coverage, and residual risks (TODO, any types, console.log) to decide pass/fail. Auto-invoked when a team skill completes, or runnable manually.
Applies a modified Fagan Inspection methodology to systematically resolve persistent bugs and complex issues. Use when multiple previous fix attempts have failed repeatedly, when dealing with intricate system interactions, or when a methodical root cause analysis is needed. Do not use for simple troubleshooting. Triggers after multiple failed debugging attempts on the same complex issue.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.