Skills
97,222 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Only use when the user explicitly invokes /review-plan (or $review-plan in Codex). Never auto-invoke. Rigorously review a pre-implementation or work plan from multiple independent review perspectives (review subagents if a delegation mechanism is available), running at least 3 cycles of review → validity check → adoption decision → proposal to reflect adopted findings in the plan document. Do not directly edit the plan document itself or implement source code; present revision proposals in chat.
Use when writing, reviewing, or cleaning up RSpec tests for Ruby and Rails codebases. Covers spec type selection, factory design, flaky test fixes, shared examples, deterministic assertions, test-driven development discipline, and choosing the best first failing spec for Rails changes. Also applies when choosing between model, request, system, and job specs.
Senior Business Logic Analyst (15+ years) specialized in SaaS systems (YC/SV standard). Activate when user needs: (1) Audit business logic in code, (2) Detect revenue leakage or billing bugs, (3) Review subscription/billing/multi-tenant logic, (4) Analyze edge cases with business impact, (5) Evaluate code for scaling/pivot readiness, (6) Due diligence on SaaS codebase, (7) Identify invariant violations, (8) Assess organizational/knowledge risks in code. Triggers: "audit business logic", "review billing code", "check subscription logic", "find revenue leakage", "SaaS code review", "multi-tenant security", "pricing logic", "analyze edge cases", "due diligence", "business logic analyst".
Connect a real Slack workspace to local PostHog Conversations (the SupportHog Slack app) so Slack messages become support tickets and replies post back. Use when the user wants to test the conversations Slack integration locally, hits "Support Slack OAuth client ID is not configured", gets a white screen or "Network error" on the OAuth callback, or asks how to set SUPPORT_SLACK_APP_CLIENT_ID / a tunnel for supporthog Slack events. Covers the Slack app + scopes, the SUPPORT_SLACK_* dynamic settings, and the key split: localhost for OAuth and the UI, a public tunnel only for inbound events.
Shepherd a GitHub pull request all the way to merge-ready by relentlessly polling status and only acting once all automatic reviewers have finished. NEVER merges without explicit human approval. Use when the user says things like "shepherd this PR", "babysit this PR", "get this PR merge-ready", "wait for Cubic", "wait for Bugbot", or asks to drive a PR through review.
Create, edit, evaluate, and package agent skills. Use when building a new skill from scratch, improving an existing skill, fixing a skill that never triggers or fires unreliably, running evals to test a skill, benchmarking skill performance, optimizing a skill's description, reviewing third-party skills for quality, or packaging skills for distribution — even if the user doesn't explicitly say "skill" (e.g. "teach Claude to do X", "make the agent always follow Y"). Not for using skills or general coding tasks.
Evaluates agent skills against Anthropic's best practices. Use when asked to review, evaluate, assess, or audit a skill for quality. Analyzes SKILL.md structure, naming conventions, description quality, content organization, and identifies anti-patterns. Produces actionable improvement recommendations.
[AUTO-INVOKE] MUST be invoked BEFORE any on-chain operation (cast send, forge script --broadcast). Systematic 6-layer verification checklist: permissions, dependencies, parameters, security, testing, and knowledge capture. Trigger: any task involving sending transactions, deploying contracts, or interacting with on-chain state.
Corrects the wrong defaults a model has when standing up self-hosted SonarQube Server as a continuous gate on AI-generated code, verified against docs.sonarsource.com in July 2026 (Server 2026.3, LTA 2026.1). Use when configuring SonarQube, designing a quality gate, or wiring a scan step into CI for AI-assisted work. Covers the setups that run green while measuring almost nothing — the fudge factor skips duplication and coverage conditions below 20 new lines and is on by default; duplication is never measured on test code; no `new_cognitive_complexity` metric exists to gate on; `sonar.host.url` now defaults to sonarcloud.io rather than localhost; a shallow clone degrades new-code attribution to timestamps. Also covers AI Code Assurance — the project flag, gate qualification, the deprecated Copilot autodetection — and that Community Build cannot analyze pull requests at all. NOT for SonarQube Cloud, IDE connected mode, or authoring custom analyzer rules.
Perform a non-destructive cross-artifact consistency and quality analysis across spec.md, plan.md, and tasks.md after task generation. Use when a Spec Kit workflow calls for this step (based on the official GitHub Spec Kit template).
Audit a codebase for adherence to the Spectrum design system and React Spectrum S2 best practices. Use when a developer asks to audit, review, lint, or check a project for Spectrum/S2 correctness, configuration, styling, accessibility, or component-usage issues
Expertise in LLVM-based static analysis including dataflow analysis, pointer analysis, taint tracking, and program verification. Use this skill when implementing security scanners, bug finders, code quality tools, or performing program analysis research.
Use this skill to test `rememberSaveable` round-trips with `StateRestorationTester`, the only supported tool for proving Compose state survives process death and configuration change. Covers the constructor (`StateRestorationTester(rule: ComposeContentTestRule)`), why `restorationTester.setContent { }` MUST replace `rule.setContent { }`, the `state = null` between phases trick that proves restoration actually happened, the 1 MB Bundle cap, and what is NOT exercised (Activity lifecycle, configuration changes, plain `remember`). Use when the developer asks "how do I test rememberSaveable", "test state survives rotation", "state is lost after restore", "Bundle exceeds maximum size", or shows a test that re-reads the same state reference after `emulateSavedInstanceStateRestore` and is confused why nothing changed.
Use this skill to mix Compose finders and Espresso `onView` in the same test — for Android `Dialog` windows, IME (soft keyboard) state, `ComposeView` inside an Android View hierarchy, or focus interactions that cross the Compose/View boundary. Covers `createAndroidComposeRule<A>()` setup, the `EspressoLink` bridge that auto-registers Compose's `IdlingResource` with Espresso, the `onRootWithViewInteraction` API, and why `Espresso.onView(...)` MUST run from the test thread (not from `runOnIdle` / `runOnUiThread`). Use when the developer mentions "Espresso onView and Compose at the same time", "ComposeView inside a View", "soft keyboard test", "Dialog focus", "compose interop test", or shows a test that calls Espresso from inside `runOnIdle` and deadlocks.
Use this skill to navigate from one Compose semantics node to its relatives via `onParent`, `onChildren`, `onChild`, `onChildAt`, `onSibling`, `onSiblings`, `onAncestors`, plus the collection helpers `onFirst`, `onLast`, `filter`, `filterToOne`, and the `[index]` operator. Covers when to traverse vs when to add a stable `testTag`, the LazyColumn/LazyRow caveat (only currently composed children appear), the absence of a singular `onAncestor`, and the sticky `useUnmergedTree` flag across navigation. Use when the developer mentions `onChildren`, `onChild`, `onParent`, `onSiblings`, `onAncestors`, `filterToOne`, `onFirst`, `onLast`, brittle child-index chains, or asks how to find the second child of a Row, the parent of a Text, or any sibling of a node. If the developer is dot-chaining navigation through a layout, use this skill.
React and Next.js performance optimization guidelines from Vercel Engineering. This skill should be used when writing, reviewing, or refactoring React/Next.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements.
Verify a claim with fresh local evidence: restate it falsifiably, capture baseline and treatment, compare artifacts, and return VERIFIED, NOT VERIFIED, or INCONCLUSIVE. Use when asked to verify this, prove it works, did this fix it, or show the evidence.
Write basic Cypress visual tests for UI5 web components, placing them in cypress/specs/visuals/. Use this skill whenever the user asks to create, add, or write a visual test (or screenshot test) for any UI5 web component. Also trigger when the user says things like "add a visual spec for X", "create a visual test for X", or "write a cypress visual for X".
Vitest 4+ testing with Vite. Use when configuring vitest.config.ts, writing unit/integration/browser tests, implementing mocks with vi.fn/vi.spyOn/vi.mock, setting up V8 or Istanbul coverage, or migrating from Jest or older Vitest workspace setups. Triggers on vitest, vitest.config.ts, vi.mock, browser mode, vitest/browser, projects, setupFiles, and toMatchScreenshot.
WordPress REST API review and development guidance. Use when reviewing custom REST routes, permission_callback logic, schema design, WP_REST_Request handling, response structure, versioning, controller classes, nonce or auth usage, or when user mentions "REST API review", "register_rest_route", "permission_callback", "WP_REST_Request", "REST endpoint", "custom API", "API schema", "REST controller", "headless WordPress", or "API auth". Detects route registration issues, authorization mistakes, schema drift, input validation gaps, and response design problems in WordPress REST API code.
ZenTao test case management — list test cases, view test case details, query test cases by product/project, and run test cases. Triggers when the user says: 'query test cases', 'test case list', 'what test cases are there', 'testcase list', 'view test case', 'test case details', 'create test case', 'new testcase', 'run test case', 'test case results', 'test cases', 'ZenTao test cases'.
Use when the user is addressing pull request review comments locally and asks for help evaluating, implementing, or drafting responses to reviewer feedback - requires technical rigor and verification, not performative agreement or blind implementation
Use Arena for heterogeneous independent design and cross-review, second opinions, code/bug/plan reviews, and evidence-based analysis. Cues: 用 arena, 讨论一下, 审核一下, 交叉审核, 第二意见, 完全体 arena, 伴随子代理, 边做边检查, companion review. Discussions start with independent proposals; a named draft/diff is reviewed directly. Bare 继续 resumes an unfinished Arena checkpoint. Supports supervised execution and persistent concurrent companion checks. Not for trivial lookups or formatting; an enabled companion still accompanies ordinary work.
Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking screenshots, extracting data, testing web apps, or automating any browser task. Triggers include requests to “open a website”, “fill out a form”, “click a button”, “take a screenshot”, “scrape data from a page”, “test this web app”, “login to a site”, “automate browser actions”, or any task requiring programmatic web interaction.
Bake hand-drawn boxes, arrows, labels, freeform strokes, and redactions onto a screenshot so a PR reviewer or teammate sees exactly what changed and where to look, instead of reading a caption and hunting for it. Use this whenever a screenshot needs a callout — "point at the new button", "circle the bug", "arrow to the diff", "blur out the API key in this screenshot", "mark up this image before I attach it". Covers both annotating a live page during capture (`uploads screenshot --annotate`, CSS selector targeting) and annotating an image you already have (`uploads annotate`, pixel/freeform coordinates only). For getting the resulting image into a GitHub PR or issue, hand off to the github-screenshots skill — this skill only covers producing the annotated image.
Senior-engineer coding standard for Bun/TypeScript, Next.js, and Java (Quarkus) repos. Enforces strict TDD (primary-port SUT, hand-written fakes, no mocks), Clean Architecture (`src/{domain,use-cases,infra,presenter,composition}`), `Result<T, E>` at IO boundaries, branded types at trust boundaries, Bun-only or Maven toolchains (no `class`/`function` declaration/`interface`/`console.*` in TS), Atomic Design, a logic-free design system (no Tailwind in app code), and production disciplines covering privacy (no PII in logs/URLs), tenant isolation, IO deadlines, soft-delete, expand-contract migrations, optimistic locking, observability, AI ports with evals, delivery, accessibility. Use for ANY code task in a Bun, Next.js, or Java repo, covering writing, scaffolding, testing, refactoring, review, React components, APIs, persistence, debugging, security. Consult even when conventions are not mentioned; rules are non-negotiable; violations are rewritten.
Enforce the replication-protocol.md rule by cross-checking numeric claims in a manuscript against the actual R / Stata / Python outputs. Report PASS/FAIL per claim against tolerance thresholds. Use before submission and before releasing a replication package.
Audit source code for exploitable vulnerabilities using threat-model-driven review, taint tracing, invariant checking, and variant analysis. Use when reviewing a codebase or diff for security bugs, performing a security audit, hunting for vulnerabilities in a target's source, or validating whether a suspected finding is real.
Populates the local Azure SQL Database container's database (appdb) with realistic sample/test data so a developer has something to build against. Use when the user says "seed the database", "add test data", "populate the dev database", "generate sample data", "fake data", "load fixtures", "insert test rows", "write a seed script", or "bulk load a CSV". This is the Azure SQL engine (EngineEdition 5), not the mssql/server SQL Server image. Distinct from azuresql-db-scaffold (which does a single seed.sql step while bootstrapping an app) and azuresql-db-import (which loads a .bacpac). Reach for this whenever an existing appdb needs volume, fixtures, or believable rows.
Writes integration tests that run IN CODE against a real Azure SQL Database container, spun up per test or per suite with Testcontainers and torn down after. Use when the user asks for "integration tests against SQL", "Testcontainers", "spin up a database for tests", "an ephemeral test database", "a test database per test", "xUnit/Jest/pytest with a real database", or "a database fixture". Use this INSTEAD of the Testcontainers MsSql preset (mcr.microsoft.com/mssql/server), because this is the Azure SQL engine (EngineEdition 5). For wiring the engine into a CI pipeline via service containers or workflow YAML instead, use azuresql-db-ci.
Static analysis security vulnerability scanner for Ruby on Rails applications. Use when analyzing Rails code for security issues, running security audits, reviewing code for vulnerabilities, setting up security scanning in CI/CD, managing security warnings, or investigating specific vulnerability types (SQL injection, XSS, command injection, etc.). Also use when configuring Brakeman, reducing false positives, or integrating with automated workflows.
Debugs a failing production call, reproduces the bug with Cekura evaluators, implements a fix, verifies it, runs regression tests, then raises a PR with evidence. Use when the user wants to fix a production call bug, investigate a failing prod call, reproduce and fix a production issue, run regression tests before a PR, or says things like "fix this prod call issue", "debug and fix call ID", "test my fix against prod scenarios", "reproduce this production bug", or "regression test before raising PR".
Write clean, readable, and maintainable code following principles from Robert C. Martin's \"Clean Code\" and Object Calisthenics. Use when writing, reviewing, or refactoring code to improve naming, function design, formatting, error handling, and class structure. Includes code smell detection and refactoring guidance.
Use when the user asks to review code, review changes, review a commit, review a PR, audit code quality, check for security issues, or generate a code review report. Trigger on phrases like "review my changes", "코드 리뷰", "check my code", "review the last commit", "what do you think of this diff", "compare branches", "code audit", "HTML 리뷰 보고서", "styled review report", "/code-review", or "$code-review" — even if they don't say "code review" explicitly. Produces severity-tagged findings as a Markdown report plus a self-contained bilingual HTML report under `.reviews/`, opened in a browser. For a Markdown-only artifact use `code-review-md`.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.