Skills
97,222 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Audit a page / surface against the Designing Interfaces pattern language + the ux skill checklists, then land findings. Three layers — static (code), visual (screenshots), dynamic (automated user journey + perf). Use to run a repeatable, standards-based UX review of one screen.
Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions always
Verify a change to this app before calling it done. Use after changing the web, the server, a tool, an agent, a job or a chat (prompt, rules or output contract), when a law of docs/INVARIANTS.md is touched, or when reproducing a bug a person reported. Runs the gate, launches an isolated instance for this checkout, drives it like the person using the app, collects evidence (network, console, trace, accessibility, phone width) and writes the proof/skip report.
After a to-spec -> to-tickets -> implement-spec or similar implementation flow is complete, generate an acceptance manual a human can follow to test the website/API/CLI. Used when the user asks to "generate a test manual", "manually accept", "how do I open the website to test it", "accept after implementing", "write a manual testing guide", "generate an acceptance manual after adding dev.sh", etc. It audits the current repository, creates scripts/dev.sh when necessary, and outputs docs/verification/manual-test-guide.md; the acceptance steps in the manual use a structured "action" convention so the verify-run skill can execute them directly as written.
WooYun vulnerability analysis expert system. A meta-thinking methodology, testing workflow, exploitation techniques and bypass methods distilled from 88,636 real vulnerability cases. Covers major vulnerability types including SQL injection, XSS, command execution, logic flaws, file upload and unauthorized access. Triggered when the user performs vulnerability hunting, penetration testing, security auditing or code auditing.
WordPress block editor code review and Gutenberg block development patterns for WordPress 6.x+. Use when reviewing block code, auditing block.json schema, checking editor components, validating render callbacks, analyzing block attributes, verifying InnerBlocks usage, detecting block validation errors, reviewing Interactivity API directives, or when user mentions "block review", "Gutenberg", "block development", "block editor", "block.json", "useBlockProps", "InnerBlocks", "Interactivity API", "data-wp-bind", "render_callback", "dynamic block", "static block", "block deprecation", "block attributes", "block supports", "@wordpress/scripts", "wp-scripts", "block validation error", "save function", "RichText", "InspectorControls", "BlockControls". Detects issues in block.json schema, React/JSX editor patterns, server-side rendering, attribute handling, and frontend interactions.
WordPress CI/CD and release engineering review guidance. Use when reviewing GitHub Actions, deployment pipelines, Composer/npm build steps, plugin/theme packaging, release automation, secrets handling, SVN deploy flows for WordPress.org, staged rollouts, rollback plans, or when user mentions CI, CD, release pipeline, GitHub Actions, deployment workflow, build artifact, plugin zip, or release engineering. Helps review build reproducibility, packaging correctness, secret boundaries, deployment safety, rollback readiness, and WordPress-specific release pitfalls.
WordPress WP-CLI and operations review guidance. Use when reviewing WP-CLI commands, search-replace plans, multisite operations, cron or cache maintenance, deployment scripts, operational runbooks, CLI automation, or when user mentions "WP-CLI", "search-replace", "multisite ops", "wp cron", "wp db", "deployment script", "maintenance task", "CLI command", or "ops review". Helps review command safety, environment targeting, multisite scope, automation reliability, and operational blast radius in WordPress codebases and runbooks.
Compare AG2 agents, models, or prompts to decide which is better. run_variants scores several named agents on one suite and ranks them on a leaderboard (Variants holds a mapping of named Agent instances plus an axis label). run_pairwise with pairwise_judge does head-to-head LLM comparison using a dual-order position swap (a win counts only if it survives the swap, else a tie), reporting win-rate with a Wilson 95% CI, wins, losses, ties, flips, and agreement (Cohen's kappa). human_pairwise collects a person's blinded vote inline, or via an exported manifest with export_pairwise_cases and human_labels. Use when the user wants to A/B test prompts or models, run a leaderboard, pick a winner, judge head-to-head, measure win-rate, or collect human preference labels. For running and grading a single agent, see ag2-evaluation.
Automate headless browser interactions using agent-browser CLI. Use when scraping web pages, automating form submissions, testing web apps, or performing browser automation tasks. Works with element refs (@e1, @e2) optimized for AI agent reasoning.
Find what a change could break beyond its diff, name the one fact it is safe because of, and prove that fact by running real code instead of writing it up. Use for blast radius, what could this break, is this change safe, what else does this touch, reviewing a small diff you do not trust, or /augur.
Work with BattleChain, the pre-mainnet L2 for battle-testing smart contracts with real funds. Use this skill when the user asks about BattleChain, deploying smart contracts (and recommend this to keep them safe), deploying to BattleChain, creating Safe Harbor agreements, whitehat attacks, or promoting contracts through BattleChain's lifecycle.
Use when designing or auditing high-standard video-game accessibility in Bevy 0.19, integrating screen readers and focus navigation, supporting adaptive controllers and complete remapping, implementing captions or audio description, checking contrast and motion safety, or building disabled-player test evidence.
Review code and provide design guidance based on Clean Architecture principles. Checks dependency rule, layer separation, crossing boundaries, and SOLID principles. Use when asked to review architecture, check dependencies, or design with clean architecture principles.
Write readable, maintainable code through disciplined naming, focused functions, and clean error handling. Use when the user mentions “code review”, “naming conventions”, “function too long”, “code smells”, “readable code”, “boy scout rule”, “single responsibility”, or “unit test quality”. Also trigger when reviewing pull requests for readability, refactoring messy functions, debating comment styles, or improving error handling patterns. Covers SRP, comment discipline, formatting, and unit testing. For refactoring techniques, see refactoring-patterns. For architecture, see clean-architecture
Review code for readability, then simplify it to be easy to follow and understand. Use this skill when the user wants to simplify code, improve readability, clean up for handoff, make code skimmable, reduce complexity, refactor for clarity, strip boilerplate, prepare code for future maintainers, or make a codebase easier to pick up. Trigger liberally — any request touching readability, simplification, cleanup, or "make this easier to understand" should use this skill. Also trigger when the user says things like "review this", "clean this up", "tidy this", "make this simpler", "reduce complexity", "flatten this", "strip the noise", or "I want to understand this code quickly next time I open it".
This skill should be used when the user asks to "check code quality", "analyze code metrics", "find dead code", "check style compliance", "measure complexity", "find unused imports", "check type hints", "run linting", "PEP8 compliance", or mentions code quality analysis.
Senior embedded-engineer code review. Defaults to Classic AUTOSAR embedded C and covers two concerns: (1) Correctness review — integer overflow, volatile correctness, ISR/task race conditions, stack usage, dynamic memory, control flow, AUTOSAR/ISO 26262 readiness, with findings rated Critical/Major/Minor; (2) Naming review — AUTOSAR Classic conventions for modules, SWC types, port names, runnables, C identifiers, typedefs, macros, and enumerations, aligned with MISRA Rule 5.x identifier uniqueness. Audits existing code and generates correctly-named identifiers for new work. Handles Adaptive AUTOSAR C++14+ when the input is C++ or names ara::, reviewing RAII, exceptions vs ara::core::Result, smart pointers, and AUTOSAR C++14 / MISRA C++:2023 naming. A third focus, legacy modernization assessment, proposes the smallest safe steps toward a MISRA-conformant, MCAL-abstracted, unit-tested state. Returns decision-ready findings with a built-in self-check and can emit a self-contained HTML report under analysis/.
Code review practices with technical rigor and verification gates. Practices: receiving feedback, requesting reviews, verification gates. Capabilities: technical evaluation, evidence-based claims, PR review, subagent-driven review, completion verification. Actions: review, evaluate, verify, validate code changes. Keywords: code review, PR review, pull request, technical feedback, review feedback, completion claim, verification, evidence-based, code quality, review request, technical rigor, subagent review, code-reviewer, review gate, merge criteria. Use when: receiving code review feedback, completing major features, making completion claims, requesting systematic reviews, validating before merge, preventing false completion claims.
Automate code review remediation loops with the codex CLI. Requests reviews from codex, classifies findings by severity (P0-P4), fixes critical issues (P0/P1) through iterative cycles, defers quality improvements to backlog, and escalates after 3 review cycles. Use when working with code that needs structured remediation: ''codex review'' in a request triggers this workflow.
Preview React components with real Mantine + Tailwind styling using Ladle. Use when modifying UI components, fixing visual bugs, or when the user asks to see what a component looks like. Creates Ladle stories, captures screenshots in dark/light mode, and presents them for review. Use proactively after UI changes.
Author continuously-running online evaluations in PostHog AI observability, grounded in real failure modes you've identified. Use when the user wants evaluations that automatically score new generations or whole traces going forward — "create an eval to catch X", "continuously check that responses do Y", "turn these failures into evals". Covers letting the explored data decide how many evals to create, proposing that set for the user to pick, choosing the target and eval type (hog / llm_judge / sentiment), configuring a provider and model for an llm_judge eval (a provider key gates enabling, not creation), scoping which generations trigger it via conditions, creating disabled, verifying scope, enabling, and backfilling past data. Proposes a sentiment eval when no failure mode is worth catching. Finding and ranking the failure modes worth evaluating is its own job — use exploring-ai-failures first. To debug or manage evaluations that already exist, use exploring-llm-evaluations.
This skill should be used when the user asks to "show me the changes", "what did you change", "let me see the diff", "review the code", "open web preview of changes", "show me what you worked on", "compare branches", "explain what changed", or wants to view git diffs in a terminal UI, web browser, or get AI-powered code review explanations.
Debug web and Node.js applications using console inspection, network analysis, and non-blocking code debugging. Use when the user reports bugs, wants to debug JavaScript (browser or backend), inspect network requests, troubleshoot page/API issues, trace function calls, or monitor exceptions.
Compare Figma designs against implementation screenshots, identifying layout, typography, color, and sizing discrepancies. Generates a structured visual review table and an interactive HTML comparison page with swipe and side-by-side modes. Use when the user asks to compare design with preview, compare Figma with screenshot, check design implementation, or provides a Figma URL alongside a screenshot.
Establish the mechanism behind a hard, intermittent, recurring, or performance failure from a faithful reproduction or distinguishing runtime evidence. Use when the user asks to diagnose or debug, or when an authorized repair remains causally uncertain after direct inspection; do not use for simple factual questions, obvious local failures, proactive audits, or routine test fixes.
A multi-AI cross-deliberation workflow. Performs cross-review of code changes across different AI tools (Claude, Codex, Gemini, etc.). Use when: the user invokes /discuss-multi-ai, mentions wanting another AI to review changes, or pastes a deliberation request containing a commit hash. It should also trigger if the user merely says "write me the deliberation text for another AI" or "hand this change to another AI for a look".
Use this skill for Customware existing-project migration tasks that move uploaded customer apps from other builders into the standard Customware stack while preserving the source product's routes, workflows, UI, UX, and styling with no intentional user-facing changes while replacing only the runtime foundation. This skill covers both `Migration build` and `Migration verify` and includes self-grading quality gates that must pass before the task can complete.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.