Skills
97,222 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Ultimate AI-powered cybersecurity code review skill. Performs comprehensive security audit across 8 dimensions: vulnerability detection (OWASP Top 10:2021, CWE Top 25:2024), secret scanning, dependency/supply chain analysis, IaC security, threat intelligence (malware/backdoor/C2 detection, MITRE ATT&CK mapping), authorization verification, AI-generated code audit, and compliance mapping. Spawns 8 parallel specialist agents with weighted scoring (0-100). Framework-aware false-positive suppression. STRIDE threat modeling. Complements GitHub Advanced Security. Use when user says "security audit", "security review", "cybersecurity", "check for vulnerabilities", "OWASP check", "secure this code", "find security issues", "pentest review", "threat model", "security scan", "check security", "vulnerability scan", "code security", "appsec review", "supply chain check", "secret scan", "hardcoded credentials".
Detect, suggest, and evaluate GoF design patterns in TypeScript/JavaScript codebases. Use when refactoring code, applying singleton/factory/observer/strategy patterns, reviewing pattern quality, or finding stack-native alternatives for React, Angular, NestJS, and Vue.
[Beta] Creates permanent eval cases from promoted learnings and runs regression checks against them. Turns failures into test cases that prevent silent regression. This is the outer loop's regress-test step. Use when a learning is promoted and has a clear pass/fail condition, or on cadence to verify promoted rules still hold.
Write, fix, review, debug, and validate Flutter tests for apps, packages, and plugins. Use when adding unit tests, widget tests, integration tests, MethodChannel or plugin mocks, Mockito or mocktail test doubles, golden or accessibility checks, CI test commands, test failures, MissingPluginException, pump or pumpAndSettle problems, finder errors, build_runner mock generation, device integration testing, web integration testing, or flaky Flutter tests.
Google Gemini CLI orchestration for AI-assisted development. Capabilities: second opinion/cross-validation, real-time web search (Google Search), codebase architecture analysis, parallel code generation, code review from different perspective. Actions: query, search, analyze, generate, review with Gemini. Keywords: Gemini CLI, second opinion, cross-validation, Google Search, web research, current information, parallel AI, code review, architecture analysis, gemini prompt, AI comparison, real-time search, alternative perspective, code generation. Use when: needing second AI opinion, searching current web information, analyzing codebase architecture, generating code in parallel, getting alternative code review, researching current events/docs.
Full health check of all your skills in one report. Use when the user wants to check for errors, find duplicates, detect broken skills, or get a complete overview of skill health. Pass --brief for inventory only. Trigger with '/janitor-report'.
Review Kafka schema changes (Avro, Protobuf, JSON Schema) for compatibility and evolution best practices using the Lenses MCP server. Detects breaking changes, missing defaults, schema drift and naming issues. Use when user says "review schema changes", "check schema compatibility", "will this schema break consumers" or asks about schema evolution. Do NOT use for creating new schemas from scratch or registering them in the cluster.
Use this skill to launch, drive, and tear down an Activity from an instrumentation test using `ActivityScenario` and the JUnit4 wrapper `ActivityScenarioRule`. Covers `ActivityScenario.launch<A>()`, `launch(intent)`, `launchActivityForResult`, `moveToState(Lifecycle.State.*)`, `recreate()`, `onActivity { }`, the `Closeable` / `use { }` idiom, and the manifest declaration trap. Establishes that `androidx.test.ext.junit.rules.ActivityScenarioRule` is the single canonical FQN — `androidx.test.rule.ActivityScenarioRule` does NOT exist; the package only ships the deprecated `ActivityTestRule`. Use when the user reports `ActivityNotFoundException`, `ActivityTestRule deprecated`, "how do I rotate the activity in a test", "how do I read setResult from a test", "how do I survive recreate", "Cannot run onActivity since Activity is not alive", or "test deadlocks on launch".
Use this skill to test a `Fragment` in isolation using `FragmentScenario`, `launchFragmentInContainer<F>()`, and `launchFragment<F>()`. Covers the `androidx.fragment:fragment-testing` + `androidx.fragment:fragment-testing-manifest` artifact split, the `EmptyFragmentActivity` host (`android:Theme.WithActionBar` parent — not AppCompat), the `themeResId` override, the `FragmentFactory` survival across `recreate()` via the ViewModelStore-backed holder, the `containerViewId = android.R.id.content` vs `0` distinction (in-container vs headless), and the `findNavController()` limitation. Use when the user reports `You need to use a Theme.AppCompat theme (or descendant)`, `Fragment ... does not have a NavController set`, `Cannot set initial Lifecycle state to DESTROYED for FragmentScenario`, or asks "how do I test a fragment in isolation" / "headless fragment test".
xUnit testing guidance for .NET MAUI apps — ViewModel testing, mocking MAUI services, test project setup, code coverage, and on-device test runners. USE FOR: "unit test MAUI", "xUnit test", "ViewModel testing", "mock MAUI services", "test project setup", "code coverage", "on-device test runner", "test MAUI app", "IServiceProvider mock", "Moq MAUI". DO NOT USE FOR: UI automation testing (use appium-automation), performance profiling (use maui-performance), or dependency injection setup (use maui-dependency-injection).
Merge changes from another branch while reviewing them against the project's principles — a merge is a review gate, not a mechanical operation. Use when the user asks to merge a branch, bring changes in from another branch, or resolve a merge. Flags unclear intent, unnecessary complexity and likely bug sources before merging, asks the user about any product decision a conflict would settle, and recommends merging the main integration branch into the other branch first when that is the easier direction.
Use this skill to migrate a codebase off the deprecated `android.test.*` testing classes that ship in the Android platform SDK onto AndroidX Test. Covers `InstrumentationTestRunner` → `AndroidJUnitRunner`; `InstrumentationTestCase`/`AndroidTestCase` → `@RunWith(AndroidJUnit4)` + `InstrumentationRegistry`/`ApplicationProvider`; `ActivityInstrumentationTestCase2` → `ActivityScenario`/`ActivityScenarioRule` + Espresso; `ServiceTestCase`/`ProviderTestCase2` → `ServiceTestRule`/`ProviderTestRule`; `MoreAsserts` → Truth/Hamcrest; `ViewAsserts`/`TouchUtils` → Espresso matchers/actions; `android.test.UiThreadTest`/`FlakyTest`/`suitebuilder.annotation.*` → `androidx.test.*`; `android.test.mock.*` → real test contexts or Mockito; and JUnit3 `extends TestCase` → JUnit4 `@Test`. Use when the user sees `@Deprecated` on `android.test.*`, asks how to replace `ActivityInstrumentationTestCase2` / `InstrumentationTestCase` / `MoreAsserts` / `TouchUtils`, or "old Android tests won't run on AndroidJUnitRunner".
Always invoke for training, validating, tuning, benchmarking, or claiming readiness of a predictive model. Covers leakage audits, spatial and grouped splits, metrics, reproducibility, and honest reporting. Invoke especially when spatial dependence, split design, or deployment geography is unknown; uncertainty is a reason to use this skill. Do not trigger for descriptive EDA or non-predictive statistical inference.
Use when asked to fix, build, refactor, review, verify, or release software and the work is non-trivial — including delivering a change request through planning, gates, implementation, review, verified PR, and authorized release; continuing work started elsewhere with no packet via evidence-based position assessment; or operating tracked work items in Linear, Jira, or Notion via their tooling skills. neckbeard routes the change through framing, discovery, design, implementation, review, verification, and learning — choosing the smallest *safe* intervention, proving it at the real delivery boundary, and leaving an inspectable evidence ledger. For issue-to-PR work, conditionally loads a 9-phase journey with gates and lifecycle integration. Composes specialist catalog skills rather than replacing them. Not a persona or LOC-minimizer. Do not use this skill for unrelated requests; route to the nearest named specialist.
NestJS best practices and architecture patterns for building production-ready applications. This skill should be used when writing, reviewing, or refactoring NestJS code to ensure proper patterns for modules, dependency injection, security, and performance.
Use before modifying, refactoring, or deleting files in a codebase that has Repowise indexed (indicated by a .repowise/ directory). Activates when Claude is about to edit code, especially shared utilities, core modules, or files the user didn't explicitly mention. Helps assess impact and avoid breaking things.
Read the diff for a change and produce a short, manual QA checklist to run against the deployed app — only the behaviour this change actually touched, written as plain-English steps a person can click through. Use when the user asks for a "QA checklist", "manual test plan", "what should I test", "smoke test steps", or how to verify a change by hand after deploy.
Read a customer's live Langfuse traces, sessions, and scores via the Langfuse MCP server, pattern-match against a known-failure catalog, and write a findings report split into Ratel-flavored opportunities and stack-agnostic low-hanging fruit. Use to scan the dashboard, dig into failures, review recent sessions or the partner's traces, audit their observability, see what the agent's doing wrong, or `/ratel-langfuse-analyze`. Writes to <repo>/.ratel/ (accumulates); fails fast if MCP is down, honest-skips clean data, never edits code. Follow-up to /ratel-langfuse-integrate, reached after /ratel-observability-assessment picks Langfuse.
Review an experience, technical, plan, roadmap, or implementation doc from draft-experience, draft-technical, build-feature or draft-roadmap — you are the reviewer, not the author. Use when the user asks to review a plan, roadmap, design or experience document, or invokes /review-doc <feature>. Reads docs/<feature>/<DOC>.revN.md, writes <DOC>.revN.notes.md grounded in the product shape, the project's principles and the actual code, and iterates with the user until the doc is ready to become <DOC>.final.md.
Use when orchestrating a code review workflow across multiple LLMs or agents, synthesizing review findings, producing checklist-driven fix scopes, applying selected fixes, running regression tests, independently verifying fixes, updating review status, or keeping code review process artifacts isolated under code_review/.
Use this skill to run instrumented Android tests on Gradle Managed Devices (GMD) — emulators that Gradle provisions, boots, runs tests on, and tears down, so CI and every developer get the same device without managing an emulator by hand. Covers the `android.testOptions.managedDevices { localDevices { create(...) { device; apiLevel; systemImageSource } } }` DSL, `ManagedVirtualDevice`, device `groups`, the generated tasks (`<deviceName>DebugAndroidTest`, `<groupName>GroupDebugAndroidTest`, `allDevicesCheck`), Automated Test Device (ATD) images (`aosp-atd`/`google-atd`) for lighter headless CI, test sharding across managed-device copies, where the HTML report and extra outputs land, and how this differs from `connectedAndroidTest` and `adb shell am instrument`. Use when the user mentions "Gradle Managed Devices", "managedDevices", "allDevicesCheck", "ManagedVirtualDevice", "pixel2api30DebugAndroidTest", "ATD image", "automated test device", or "reproducible emulator for tests".
Self-improving skills toolkit that watches real agent sessions, detects missed triggers, grades execution quality, and improves skill packages through evals, replay, baselines, review, and post-deploy watch. Use when verifying or publishing a skill, improving instructions or routing, checking skill health, grading sessions, viewing the dashboard, ingesting agent histories, auditing installed skills, finding and temporarily using local skills for a task, managing the local Skill Library, scaffolding reusable workflow skills, or running autonomous improvement loops. Trigger whenever a user asks about skill performance, health, triggers, undertriggering, overtriggering, evolution, evaluation, or how their skills are doing, even if they do not name SelfTune explicitly.
End-to-end PR shipping workflow for tinyhumansai/openhuman: commit local changes, push to the user's fork, open or reuse a PR against main, then babysit CI and CodeRabbit feedback until the PR is green and clean. Use when the user asks to ship, open a PR, monitor CI, address review comments, or 'babysit' a branch.
Rebuild a package's unit test suite around a behavior specification (SPEC.md) derived from the implementation, with every test citing a numbered rule ID. Use when asked to do a spec-driven test rebuild, write a SPEC.md for a package, repeat the state or store spec process (PRs #9158, #9172) for another package, or rebuild tests around a spec.
Use when you need to create defect reports during the verification phase of a Spec Pack that can be pasted directly into an external defect system (without writing bug files to disk inside the Spec Pack), and write defect references back to `{FEATURE_DIR}/verification/report-*.md`.
AI rules for writing tests with Stably Playwright SDK. Use this skill when writing or modifying Playwright tests with Stably AI features. Covers when to use Playwright vs Stably methods, plus minimal patterns for aiAssert, extract, getLocatorsByAI, agent.act, Inbox, and Google auth.
Diagnose and fix SwiftUI rendering performance issues, including unnecessary body re-evaluations, slow or janky views, scrolling/list/grid stutters, view identity bugs, lost state, excessive `Self._printChanges()` output, `@Observable` versus `ObservableObject` observation scope, `AnyView` performance concerns, and expensive work inside SwiftUI `body`.
Support QA and testing work across formats: planning checks, writing test cases, reviewing coverage, designing Playwright browser and component integration tests, creating locators, and keeping automated tests focused on observable product behavior.
Write AST-based code search and rewrite rules using ast-grep YAML. Create linting rules, code modernizations, and API migrations with auto-fix. Use when the user mentions ast-grep, tree-sitter patterns, code search rules, lint rules with YAML, AST matching, or code refactoring patterns.
This skill should be used when the user asks to test, debug, snapshot, validate, reproduce, or automate terminal UIs, curses apps, raw ANSI output, PTY-driven interactions, virtual terminal emulators, ConPTY behavior, resize tests, keyboard/mouse/paste tests, or flaky terminal snapshots. PROACTIVELY activate for: TUI testing, snapshot tests, golden files, pty integration tests, pseudo-terminal automation, ConPTY, Pexpect, node-pty, vt emulators, Textual Pilot, Ratatui snapshots, Bubble Tea tests, terminal debug logs, and CI failures. Provides: layered test strategy, deterministic snapshot rules, PTY/ConPTY patterns, debugging playbooks, and flake prevention.
Use when setting up TYPO3 extension test infrastructure, writing unit/functional/E2E tests, configuring PHPUnit 11/12/13, mutation testing, mocking final classes (v14), CI/CD matrix across TYPO3 12/13/14.3 LTS, dev-dependency consolidation via typo3-ci-workflows meta-package, or debugging CI failures. Also triggers on: testing-framework setup, ensure proper testing, test matrix, integration testing, e2e testing, coverage, test generation.
UiPath Test Manager—manage test projects, requirements, cases, sets, executions, and defects; schedule test sets on a recurring cadence; AI-generate test cases from requirements, evaluate requirements, and find obsolete test cases; run every test in an uploaded package from CI; performance (load) test scenarios; generate reports; package and run external Playwright test suites. For Orchestrator→uipath-platform. For Studio/RPA test automation authoring→uipath-rpa.
Independently review one GitHub story PR against its canonical issue and every acceptance criterion, run risk-relevant verification, request changes or sign off, and merge when repository policy permits. Use for PR QA or as the reviewer in user-story-delivery.
Set up and run automated tests for vvvv gamma packages and C# nodes -- VL.TestFramework with NUnit for library/package authors (CI-ready), test .vl patches with assertion nodes, and lightweight agent-driven test workflows. Use when writing tests for vvvv packages, setting up test infrastructure, creating test patches, running automated compilation checks, or integrating vvvv tests into CI/CD.
Inspect, drive, and verify a running Windows app UI via winapp ui (UI Automation): find elements, click, type, read text/values, wait for state, take screenshots in WinUI, WPF, WinForms, Win32, or Electron apps. Use to check, test, or act on a live app; for WinUI XAML internals, use winui-devtools.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.