Skills
97,222 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Audit PHP web application source for critical vulnerabilities using PHP's specific sink and footgun catalog — object injection via unserialize and phar:// POP chains, type-juggling and magic-hash auth bypass, LFI/RFI through php:// and phar:// wrappers, dynamic includes and extract()/superglobal trust, SQL injection in string-built and legacy mysql_* queries, command-execution sinks, and SSRF. Use when reviewing a PHP codebase, a WordPress/Magento/Laravel app, or a plugin for exploitable bugs. Defers general audit methodology to auditing-code-for-vulnerabilities.
Adds and runs data quality checks (dbt-test style assertions) on a project's warehouse tables and saved-query views, and HogQL catalog metrics: not-null, uniqueness, accepted values, referential integrity, row-count bounds, freshness, and custom HogQL. Metrics support custom SQL checks only. Use when asked to test a model, validate a view, check for nulls or duplicates, add data quality checks, find out why a number looks wrong, or judge whether a warehouse table is trustworthy before using it in an analysis. To describe what data *means* (metrics, certifications, joins), see setting-up-data-catalog instead. Trigger terms: data quality, data test, dbt test, not null check, uniqueness check, freshness check, referential integrity, row count check, validate model, is this table trustworthy.
AI-powered E2E web testing — eyes and hands for AI coding tools. Declarative YAML scenarios, Playwright execution, visual matching (OpenCV + OCR), platform auto-detection (Flutter/React/Vue), learning DB. Install: npx skills add ksgisang/awt-skill --skill awt -g
Turn a set of flagged production call logs into evaluator scenarios for a Cekura agent — cluster the failures into reproducible modes and create one scenario per cluster. Use when the user says "create scenarios from failed calls", "build evaluators for prod failures", "turn call logs into scenarios", "simulate the failures we saw in prod", "replay these bad calls as tests", "regression-test the agent on prod issues", or hands over a set of flagged call IDs to harden the agent against. The flagged set normally comes from `cekura-flag-call-log-failures`; if the user hasn't triaged yet, run that skill first. This skill takes the flagged calls as given — it does NOT re-mine or re-triage — clusters by failure mode, drafts one scenario per cluster, and optionally creates them via the scenarios API (or the call-logs → scenarios endpoint). Also supports a single-call fast path: given one call log ID (or an observe URL), reproduce just that call as one evaluator scenario.
Check ABAP code for compliance with Clean ABAP principles. Use this skill when users ask to check, validate, review, or analyze ABAP code for clean code compliance, code quality, best practices, or adherence to Clean ABAP guidelines. Triggers include requests like "check this ABAP code", "is this clean ABAP", "review my ABAP for clean code", "validate ABAP against clean code principles", or "analyze ABAP code quality".
Generate a tailored code review checklist for any pull request based on the language, type of change, and risk level. Use when asked to review code, check a PR, review a pull request, or generate a code review checklist. Produces a focused checklist with language-specific checks, risk-level-appropriate depth, and a clear approve/request-changes recommendation.
Apply a disciplined engineering workflow to any code change. Use whenever implementing a feature, fixing a bug, or refactoring — before writing code, not after. Walks orient → baseline → smallest change → test → verify → self-review, and enforces language-agnostic hard gates (don't mass-reformat, keep the linter and type-checker clean, keep the build and tests green, make interface changes additive, protect security invariants).
Drive a GitHub pull request through ChatGPT Codex's online PR review to a clean merge: trigger a review, poll for the verdict (findings vs clean), fix each finding with local verification, and merge only after TWO consecutive clean reviews on the same commit. Use when iterating a PR against Codex review comments, or when asked to "run the Codex review loop", "handle Codex review findings", or "get this PR clean and merge it". Precondition: the repo has ChatGPT Codex's GitHub integration enabled (bot: chatgpt-codex-connector[bot]); also needs `gh` (authenticated) and `jq`.
Use when the user says "copilot review", "review with copilot", "delegate to copilot", "have copilot fix this", "copilot agent task", "set up copilot", "generate copilot instructions", "bootstrap copilot for this repo", or invokes `/copilot`. Three modes: `review` (run a code review on a PR and route fixes to Copilot via inline `@copilot fix this` comments), `delegate` (create a `gh agent-task`, poll until the coding agent opens a PR, optionally hand off to review), and `setup` (one-time bootstrap that writes `.github/copilot-instructions.md` and the per-role `.github/instructions/*.instructions.md` files). `review` and `delegate` are routine; `setup` is a one-time repo bootstrap loaded on demand from `references/setup.md` only when the user explicitly asks. Do NOT use for plain GitHub PR work — that is `/gh`'s job.
Diagnose PostHog Surveys configuration and responses across all five SDKs (web/posthog-js, iOS, Android, Flutter, React Native). Use whenever a Surveys support ticket is pasted ("survey not showing", "fewer responses than expected", "responses disappeared", "responses are incomplete", "only the first question was answered", "the user says they didn't mean to submit", "survey shows on wrong platform"), or when diagnosing why a survey does or doesn't display. Covers the eligibility pipeline, how a response actually gets stored (partial responses, branching, optional questions, auto-submit), cross-SDK feature parity, the known-cause catalog, read-only diagnostic queries, staff access, and the customer-reply style guide.
Midscene frontend UI automated testing Skill driven by QA XMind or same-level Markdown: AI decides whether business state preparation is needed based on the complete QA and optional Feature, then uses activity configuration and act-cli to verify constructed candidates and run page tests. Use when the user mentions "ai-test", "page testing", "frontend page testing", "frontend automated testing", "frontend AI automated testing", or asks to test pages according to QA cases.
Use when a client asks whether a Flow Builder flow is ready for production, wants it audited or checked, or asks something like "did I forget anything — triggers, products, variables?", "is this ready to publish?", or "check my paywall/flow". Answers one question — is this flow safe to put in front of paying users — with a verdict and ranked findings. Read-only: never writes to a flow. Complements `flow-generator` (which owns writes) and `paywall-teardown` (which owns conversion advice).
Analyze and address unresolved feedback on a GitHub pull request. Use when the user has received PR review comments and wants to systematically address each piece of feedback, or when the user mentions PR feedback, review comments, or addressing reviewer concerns.
Use when asked to set up, install, or refine an agent quality framework in a repository (rules with gates, architecture contracts, proven-red tests, ratchets, playbooks), or when the user says "gap-trap", "gap-trap setup", "gap-trap refine", "gate the rules", or "make the agents' code match the rules".
Use when a user asks to debug or fix failing GitHub PR checks that run in GitHub Actions. Use `gh` to inspect checks and logs, summarize the failure context, draft a fix plan, and implement only after explicit approval. Treat external providers (for example, Buildkite) as out of scope and report only the details URL.
Use when the user asks to review a pull request by number, URL, or branch ("review this PR", "review PR 123"). Fetches PR details, reads diff and failing checks, and produces structured feedback across code quality, security, performance, testing, docs, architecture, dependencies, CI/CD coverage, and completeness. Accepts optional $ARGUMENTS for the PR reference.
GitHub Actions CI/CD. Covers workflows, jobs, and deployment. Use for automating builds, tests, and deployments. USE WHEN: user mentions "github actions", "workflow", "ci/cd", ".github/workflows", "actions/checkout", "github workflow", asks about "automate tests", "deploy on push", "build pipeline", "ci pipeline", "continuous integration", "github automation" DO NOT USE FOR: GitLab CI/CD - different syntax and features, Jenkins pipelines - different tool, Container orchestration - use `docker` or `kubernetes` skills, Local builds - workflows run on GitHub runners
Use when planning tests for Arduino, ESP32, ESP32-S3, Pico, or Pico W firmware; deciding what can run off-target; using Wokwi or simulation; writing host fakes; or accepting a physical hardware feature without confusing compile proof with system proof.
Investigates a specific CI failure to a verdict: whose fault, which commit, who wrote it, and whether it's fixed. Use for "who broke master", "why did this test fail in CI", "is this failure my PR's fault or everyone's", "is this test flaky or actually broken", "when did this failure start". Works from the engineering_analytics warehouse views (engineering_analytics_ci_failures, engineering_analytics_ci_job_history) plus the CI failure logs. Not for aggregate CI health, cost, or merge bottlenecks (use diagnosing-ci-and-merge-bottlenecks) and not for building saved insights (use turning-engineering-analytics-into-insights).
Write, refactor, and review Rails code using layered architecture principles from “Layered Design for Ruby on Rails Applications”. Use when writing or refactoring Rails code—models, controllers, services, jobs, mailers, policies, forms, query objects, presenters, view components, state machines, serializers, or AI/LLM features—to apply correct patterns and avoid layer violations; and when reviewing Rails code, PRs, or diffs for layer violations, fat controllers/models, anemic models, callback misuse, god objects, or specification-test failures. Triggers on “layered design”, “architecture layers”, “abstraction layer”, “specification test”, “layer violation”, “fat controller/model”, “god object”, “anemic model”, “extract service/callback/policy/concern”, “service object”, “form/policy/query/value object”, “presenter”, “view component”, “state machine”, “Active Delivery”, “callback scoring”, “Rails refactor/review”, “Rails patterns/best practices”, “archspec”, or “architecture linter/enforcement”.
Audits Dart and Flutter package dependency licenses using the Very Good CLI packages_check_licenses MCP tool, flags non-compliant or unknown licenses, and produces a compliance summary report. Use when the user says "check licenses", "license audit", "check dependency licenses", "license compliance", "review package licenses", "are our dependencies compliant", "scan for license issues", or "pre-release license check". Use it especially when the request asks for a compliance verdict without a scan, as in "read the licenses off this pubspec", "confirm we're compliant", "just tell me if these packages are safe to ship", "I'd rather not run anything", or "which of these are GPL", because refusing to certify compliance from a dependency list is the call this skill governs. A pasted pubspec is a trigger, not a substitute for the audit.
Review changes to Chinese Markdown documentation and decide whether the English translation should be updated. Use when comparing baseline and updated Markdown, evaluating translation triggers, or distinguishing substantive content changes from frontmatter, whitespace, and channel-tag changes.
This skill should be used when the user asks to evaluate, validate, compare, explain, or debug model performance. PROACTIVELY activate for: (1) metrics selection for classification, regression, ranking, NLP, CV, recommender, forecasting, and generative AI, (2) train/validation/test splits, cross-validation, grouped or time-series validation, (3) confusion matrices, ROC/PR curves, calibration, thresholds, error analysis, (4) ablation studies, statistical significance, confidence intervals, bootstrap tests, (5) bias, fairness, explainability, robustness, leakage detection. Provides: rigorous evaluation methodology and production-readiness checks.
Builds unit and integration test infrastructure for Node/TS/React - Vitest or node:test with explicit config, Jest-to-Vitest migration, v8 coverage gates that fail CI, React Testing Library, mocking discipline, flaky-test triage. Use when the user asks to set up tests, add coverage thresholds, pick a test runner, or fix a flaky setup. Not for E2E browser suites, lint rules, or CI workflows.
Check a papercut reel's stills against the style DNA and the storyboard. Renders contact sheets at a few timestamps, runs the full checklist, then writes the delivery summary. Use for "QA the reel", "check my scenes look like paper", "is this ready to post"
Fresh-context review of staged changes, branches, PRs, or file sets. Delegates to a fresh reviewer; routes to external CLIs (Copilot, Codex) via --model. Use when: user says "peer review" ("peer review PR 5", "peer review staged"), "fresh review", "another set of eyes", "sanity check", "quick review before I push", "review with Copilot", or "review using Codex". Do NOT trigger on bare "review" phrases ("review my changes", "review PR N", "review staged") — those route to code-review.
Design practical pilots and evaluation protocols for industry R&D, AI, ML, analytics, LLM, banking, fintech, or enterprise solutions. Use when the user has a proposed method or solution direction and needs to validate it with offline tests, backtests, human evaluation, A/B tests, baselines, metrics, ablations, guardrails, and a go/no-go decision. Especially use after publication-grounded-solution-design or industry-problem-framing.
Canonical Playwright hub for E2E tests and ad-hoc browser automation. Use when the user explicitly mentions "Playwright", "@playwright/test", "npx playwright", "playwright.config.ts", "PWDEBUG", "trace viewer", or "toHaveScreenshot". Avoid using for generic browser automation unless Playwright is requested, and avoid using for pure web scraping.
Use when: reviewing the quality of requirement documents such as PRD/BRD/MRD, checking completeness/clarity/feasibility/metrics/risks/consistency, and gatekeeping documents before development. Do NOT use when: the document does not exist yet (generate it with /pm-docs first); or only a verbal discussion is needed with no written review
Pytest testing standards emphasizing the AAA pattern, fixtures, and parametrize. Use when writing or reviewing Python tests with pytest, including Django tests. Covers fixture organization, database access patterns, API testing, and mock clients. Do NOT use for: JavaScript/TypeScript tests, unittest-style tests, or non-pytest frameworks.
Use when investigating a bug, error, or regression in a Ruby on Rails codebase. Creates a failing RSpec reproduction test, isolates the broken code path, and produces a minimal fix plan. Trigger words: debug, broken, error, regression, stack trace, failing test, RSpec, bug report, Rails app.
React hooks best practices for React application code and custom hook design across DX, optimization, and logic. Use when writing components with hooks, creating or refactoring custom hooks, reviewing hook usage/APIs/internals, checking effects/dependencies/state/refs/callbacks, or improving hook correctness, ergonomics, and performance.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.