Skills

O

ohos-chromium-security-review

openharmonyinsight / openharmony-skills

Deep code audit skill for OpenHarmony/Chromium - focused on thread safety, lifetime management and logic flaws. Based on rigorous systems-level programming experience, deeply reviews C/C++ source code for: - thread safety issues (data races, deadlocks, cross-sequence access) - lifetime issues (UAF, dangling pointers, WeakPtr misuse) - OpenHarmony/Chromium-specific pattern risks - high-order security risks that static analysis tools cannot find. Core features: - extremely rigorous review style - follows 14 strict user-defined rules - generates structured JSON and Markdown reports - divides issues by team ownership

O

owasp

claude-dev-suite / claude-dev-suite

OWASP security guidelines and Top 10 vulnerabilities USE WHEN: user mentions "OWASP", "security audit", "vulnerability scan", asks about "injection", "XSS", "CSRF", "access control", "authentication security" DO NOT USE FOR: OWASP Top 10:2025 specific - use `owasp-top-10` instead

P

perform-preflight

bitwarden / ai-plugins

Quality gate checklist to run before committing or creating a PR. Use when finishing implementation, checking work quality, or preparing to commit. Triggered by "preflight", "self review", "ready to commit", "check my work", "quality gate".

P

performance-profiling

akillness / jeo-skills

Guide performance profiling for Apple platform apps with Instruments, Xcode diagnostics, and MetricKit. Use when investigating app hangs, stutters, high CPU, memory leaks, memory growth, OOM crashes, slow launch, battery drain, thermal issues, App Store performance readiness, or when adding os_signpost and measurement hooks

P

performing-multi-agent-code-review

bitwarden / ai-plugins

Perform a rigorous, multi-agent code review with architecture-compliance, parallel quality/security analysis, finding validation, and severity audit. Use when the user asks for a structured, deep, thorough, multi-pass, or multi-agent code review — or a review that includes architecture/pattern compliance, confidence-scored findings, or a severity audit. Use when the user asks for a code review across a commit range, time window, or N most recent commits in a locally checked-out repo.

P

playwright-expert

cin12211 / orca-q

Playwright E2E testing expert for browser automation, cross-browser testing, visual regression, network interception, and CI integration. Use for E2E test setup, flaky tests, or browser automation challenges.

P

playwright-skill-v2

willmarple / playwright-skill

Browser automation for web projects using playwright-cli

P

PR Review

midudev / autoskills

Guidelines and tools for reviewing pull requests in the Angular repository.

P

pre-commit

julianobarbosa / claude-code-skills

Pre-commit hooks framework for multi-language code quality automation. USE WHEN setting up pre-commit OR configuring git hooks OR adding linting OR code formatting OR security scanning OR Terraform validation OR Kubernetes manifests OR Helm charts OR Python linting OR JavaScript formatting. Manages .pre-commit-config.yaml, hook installation, and CI integration.

P

prek

paulnsorensen / skillz-that-grillz

Onboard prek (Rust-powered pre-commit) into any project and suggest hooks tailored to the language/framework. Use when the user says "add prek", "set up pre-commit hooks", "configure prek", "what hooks should I use", or when you notice a project without a prek.toml that would benefit from pre-commit checks. Also trigger when the user wants to add new hooks to an existing prek.toml, audit their hook config, or migrate from pre-commit to prek. Covers Rust, Python, TypeScript/JavaScript, Go, Ruby, and Shell projects. Do NOT use for husky, lint-staged, or CI pipeline hook configuration — this skill is specifically for prek.

Q

qa

borkweb / skills

Test a web application and fix reproducible bugs within the requested scope, with browser evidence and appropriate regression checks. Honors report-only and no-commit requests.

R

rails-code-review

midudev / autoskills

Reviews Rails pull requests, focusing on controller/model conventions, migration safety, query performance, and Rails Way compliance. Covers routing, ActiveRecord, security, caching, and background jobs. Use when reviewing existing Rails code for quality, conducting a PR review, or doing a code review on Ruby on Rails (RoR) code.

R

reality-check

boshu2 / agentops

Audit claims that work is done or shipped against the diff or repo. Use when: asked whether something really got done, even if it looks obvious.

Use when receiving code review feedback, processing PR comments, or needing to evaluate suggestions before implementing - requires technical verification not blind agreement

R

receiving-code-review

shipshitdev / skills

Evaluates incoming review feedback technically before changing code: verifies each point, pushes back when wrong, avoids empty agreement. Use when you receive a review.

R

refactor-flow

vladm3105 / aidoc-flow-framework

Improve code quality, reduce technical debt, restructure for maintainability

R

remix-submission-rules

farworld-labs / remix-skills

Validation and publish constraints for Remix game submissions

R

report-analyzer-issue

seqra / opentaint

Write a self-contained OpenTaint engine-issue report from an analysis diagnosis or a full-scan failure. Use when an engine-side issue needs a report

R

review-llm-annotations-and-improve-prompt

coval-ai / coval-external-skills

Analyze development-set disagreements between human annotations and one Coval text LLM judge, then propose a focused prompt revision. Use coval-calibrate-metric for independent trust measurements.

R

review-r

pedrohcgs / claude-code-my-workflow

Read-only R code review protocol for `.R` scripts. Checks code quality, reproducibility, domain correctness, tidyverse idioms, and professional standards; produces a report without editing. Use when user says "review this R script", "check the R code", "audit the analysis code", "code review on the R", or when an R file is touched as part of a paper submission. NOT for running the code — pair with `/audit-reproducibility` for numeric verification.

Comprehensive code review workflow - parallel specialized reviews → synthesis

R

roblox-studio-workflow

flatbedj / roblox-skills

Use when developing, editing, or testing a Roblox (Luau) game — the disk + Rojo + selene + Studio-MCP dev loop, the sync cycle, how to test with execute_luau/screenshots, and the engine gotchas that waste hours (200-local ceiling, stale-code syncs, duplicate-instance drift). Load at the start of any Roblox coding/testing task.

R

rs-validate

rootspec / rootspec

Run tests against a validated RootSpec specification and report results. Use this when a user wants to run tests, check what's passing, get a test report, or verify their implementation works.

R

run-rust-tests

redisearch / redisearch

Run Rust tests after making changes to verify correctness. Use this when you want to verify your changes to Rust code.

S

sanitize-artifacts

kotek-7 / dotfiles

Inspect and revise generated artifacts so they read as natural, standalone deliverables, without leaking prompt instructions, conversation history, implementation constraints, or production process artifacts into user-facing content.

S

sdd-review

sivaprasadreddy / sdd-skills

SDD step 5. Reviews the implemented feature code against language and framework best practices, checks for code duplication, security vulnerabilities, performance issues, test coverage, and alignment with feature.md acceptance criteria. Use after /sdd-implement or on any existing feature implementation.

S

setup-ts-deep-modules

leandrocfe / skills

Wire dependency-cruiser into a TypeScript repo so each package is a deep module — implementation hidden in subfolders, reachable only through its entry-point files. User-invoked.

S

shortcut-audit

xiaolai / vmark

Audit keyboard shortcuts in VMark code vs dev docs. Use when asked to review, reconcile, or optimize shortcuts, or when updating shortcut documentation.

S

siege

simota / agent-skills

Verifying system resilience via load testing, contract testing, chaos engineering, and mutation testing. Use for limit verification, non-functional testing, or reliability validation.

S

simplify

steveclarke / dotfiles

Review recently changed code for reuse, simplification, efficiency, and consistency cleanups, then apply the fixes. Quality only — doesn't hunt for bugs. Triggers on 'simplify', 'clean this up', 'simplify this diff'.

S

skill-creator

netease-youdao / lobsterai

Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, update or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.

Test engineer skill, responsible for software quality assurance and testing work. Applies to the following scenarios: (1) writing test cases and test plans (2) executing functional and regression tests (3) filing defects and tracking fixes (4) performing API testing and automated testing (5) executing user experience testing (6) analysing test results and quality assessment

S

smart-debug

oimiragieo / agent-studio

AI-assisted debugging specialist with deep knowledge of modern debugging tools, observability platforms, and automated root cause analysis. Implements Cursor Debug Mode methodology — structured hypothesis ranking, targeted code instrumentation, human-in-the-loop reproduction gate, log-confirmed root cause, and mandatory cleanup.

S

software-development

axross / skills

Every task that touches a project—implementing, refactoring, diagnosing failed checks, running a project command, or writing a pull request body. The baseline discipline underneath specialized skills: keep changes scoped, run the format and lint loop, map what the change puts at risk, and find out how the project is actually run. Applies even when the request never mentions formatting, linting, comments, dependencies, docs, or descriptions, and when you need one of the project's operations—tests, dev server, build, lint, deploy—and must find it documented or ask. Change-loop practices own progression after results; the conduct baseline applies when a session touches nothing.

S

sumup-testing

sumup / sumup-skills

Set up and run SumUp sandbox tests. Use when configuring a SumUp test merchant, picking test cards, triggering deliberate failure (`amount = 11`), or building a SumUp end-to-end test harness.

S

swift-testing-expert

midudev / autoskills

Expert guidance for Swift Testing: test structure, #expect/#require macros, traits and tags, parameterized tests, test plans, parallel execution, async waiting patterns, and XCTest migration. Use when writing new Swift tests, modernizing XCTest suites, debugging flaky tests, or improving test quality and maintainability in Apple-platform or Swift server projects.

T

tdd-guide

alirezarezvani / claude-code-skill-factory

Comprehensive Test Driven Development guide for engineering subagents with multi-framework support, coverage analysis, and intelligent test generation

T

tdd

paololeonardi / mattpocock-skills

Test-driven development. Use when the user wants to build features or fix bugs test-first, mentions "red-green-refactor", or wants integration tests.

T

tdd

prowler-cloud / prowler

Test-Driven Development workflow for ALL Prowler components (UI, SDK, API). Trigger: ALWAYS when implementing features, fixing bugs, or refactoring - regardless of component. This is a MANDATORY workflow, not optional.

T

test-driven-development

bbeierle12 / skill-mcp-claude

Use when implementing any feature or bugfix, before writing implementation code. Enforces RED-GREEN-REFACTOR cycle with strict discipline against rationalization.

T

test-generator

ovachiever / droid-tings

Automatically suggest tests for new functions and components. Use when new code is written, functions added, or user mentions testing. Creates test scaffolding with Jest, Vitest, Pytest patterns. Triggers on new functions, components, test requests, testing mentions.

T

test-tier-selection

laurigates / claude-plugins

Automatic selection of appropriate test tiers based on change scope. Guides unit tests for small changes, full suite for larger changes. Use when running tests, discussing testing strategy, or after code modifications.

T

test-web-ui

biggora / claude-plugins-registry

Automated web QA skill: analyzes a website or project, generates end-user use cases, derives a structured test plan, executes tests via Playwright browser automation, and produces a full HTML/Markdown QA report with screenshots and pass/fail results. TRIGGER this skill whenever the user asks to: test a website, run QA on a web app, check if a site works, find bugs on a site, validate a web project, create a test plan for a website, run functional tests, check a landing page, audit a web app for issues, test user flows — or any variation of \"проверить сайт\", \"протестировать сайт\", \"QA сайта\", \"тест веб-приложения\", \"найти баги на сайте\". Even if the user just says \"посмотри работает ли всё нормально на сайте\" — use this skill.

T

testing-patterns

langchain-ai / skills-benchmarks

Unit testing and integration testing best practices

T

tidewave-integration

oliver-kriska / claude-elixir-phoenix

Tidewave MCP runtime tools — debugging, smoke testing, live state inspection, SQL queries, hex docs. Use when evaluating code in a running Phoenix app.

U

unit-testing

folio-org / folio-eureka-ai-dev

Use when writing or reviewing Java unit tests. Enforces Mockito/JUnit 5 best practices - strict stubbing, no lenient mode, specific matchers, complete flow stubbing, Arrange-Act-Assert structure, and clear test naming.

V

verification-before-completion

ganyuanran / aegis

Use when about to claim work is complete, fixed, passing, verified, release-ready, or ready to commit, merge, publish, or hand off.

V

visual-inspection-improvement

jord-jd / jord-skills

Inspects and improves visual presentation using captured user-facing states. Use when asked to visually review or improve an interface, asset, or rendered output.

W

web-design-guidelines

duc01226 / easyplatform

[Code Quality] Use when reviewing UI code for accessibility, responsiveness, performance, and UX best practices.

W

web-test

nikolay-shirokov / cc-1c-skills

Testing 1С through the web client — automating actions in the browser. Use when the user asks to check, test, or automate actions in 1С through the browser

W

wp-playground-development

jorgerosal / wordpress-skills

WordPress Playground review and development guidance. Use when reviewing Blueprints, Playground JSON setup flows, `@wp-playground/cli` usage, embedded Playground demos, reproducible bug repros, docs examples, or when user mentions "WordPress Playground", "Blueprint", "playground.json", "run-blueprint", "build-snapshot", "embed Playground", or "zero-setup repro". Helps review Blueprint design, local Playground workflows, demo reliability, and reproducible WordPress environments.

W

writing-skills

rsmdt / the-startup

Use when creating new skills, editing existing skills, auditing skill quality, converting skills to markdown conventions, or verifying skills before deployment. Triggers include skill authoring requests, skill review needs, or "the skill doesn't work" complaints.

A

accessibility

exceptionless / exceptionless

Use this skill when building or reviewing frontend components for accessibility compliance. Covers WCAG 2.2 AA standards including semantic HTML, keyboard navigation, ARIA patterns, focus management, screen reader support, and form accessibility. Apply when creating new UI components, fixing accessibility bugs, adding skip links or focus traps, or ensuring inclusive markup — even if the user doesn't explicitly mention "a11y" or "WCAG."

A

acunetix

membranedev / application-skills

Acunetix integration. Manage data, records, and automate workflows. Use when the user wants to interact with Acunetix data.

A

address-review-bots

biw / skills

Close GitHub PR review-bot feedback loops for Claude, Devin, and similar AI reviewers after a push.

A

agent-readiness

tryalan-ai / supa-skills

Evaluate how ready a codebase is for autonomous AI agent work. Generates a scored report across 11 dimensions with a maturity level and prioritized action plan.

A

alibabacloud-safety-checker

aliyun / alibabacloud-aiops-skills

Alibaba Cloud content moderation and AI guardrails automated testing. Tests sample content against moderation APIs, compares multiple services, tracks requestId/traceId, supports manual annotation, deep false-negative analysis, cross-batch comparison, AI guardrails testing (prompt injection, sensitive data, jailbreak), and generates alignment reports. Use when user asks about content safety, moderation testing, moderation strategy, label configuration, content review, batch safety checks, miss analysis, AI guardrails, prompt injection detection, or safety guardrails testing.

A

analysis-core

fudesign2008 / open-skills

Shared analysis-stage methodology for PDCA fix workflows: temporary-change permission and rollback gate, red-capable reproduction loop before hypothesis lists (user-pasted evidence excluded), instrumentation-debug with runtime-evidence-debug as default entry, analysis step skeleton (existence → research routing → phenomenon/locate/root-cause/upstream-eval/impact), mandatory analysis gate output block, and debug-verify loop. Parameterizes the post-analysis exit as {next-stage}. Referenced by PDCA hosts via frontmatter dependencies. Triggers — 「分析阶段核心」「分析核心」「临时改动门控」「红环门控」「打点调试门控」「调试验证闭环」「分析门控」 / analysis stage core, red-capable loop gate, temp-change gate, instrumentation debug gate, analysis gate output block, debug-verify loop.

A

archetype-review-base

avelikiy / great_cto

Shared review framework that every domain reviewer (pci, oracle, gov, edtech, healthcare, mlops, etc.) MUST follow. Defines the output artifact (TM-{slug}.md), mandatory sections, severity scale, verdict format, the workflow scaffold (when-invoked, Step-0 read-inputs, HANDOFF), and the "domain heuristic vs generic check" boundary. Eliminates duplication across the ~30 reviewer prompts.

A

audit-reference-originality

akillness / jeo-skills

Audit a website or digital experience against its supplied source references for originality and plagiarism risk. Use when Codex must compare current or historical site output with reference pages, capture packs, screenshots, copy, brands, numbers, images, assets, videos, layouts, motion, or code; raise evidence-backed red flags; distinguish common visual grammar from distinctive copying; and propose concrete fixes without making unsupported legal claims.