Skills
97,222 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Use when reviewing code security, auditing dependencies for CVEs, checking configuration or secret security, assessing authentication and authorization patterns, identifying OWASP vulnerabilities (injection, XSS, CSRF), or addressing security concerns about implementations.
Scientific method expert for systematic bug investigation and root cause analysis. Use when users report bugs, crashes, unexpected behavior, or debugging requests. Applies hypothesis-driven investigation, controlled experiments, and rigorous validation across any programming language or platform.
Detects anemic domain models, validates and refactors them into rich domain models, and enforces tactical DDD patterns (Entities, Value Objects, Aggregates, Domain Services, Domain Events). Use when the user asks to validate, review, or check domain models or DDD code; detect anemia; refactor domain objects; improve encapsulation; or mentions terms like "anemic model", "rich domain", "aggregate", "value object", "domain event", "ubiquitous language", "is this good DDD", "does this follow DDD", or "check my domain". Do NOT use for module or service boundary design, architectural decomposition, strategic DDD context mapping, or code outside the domain layer (DTOs, controllers, infrastructure adapters).
Structured review of agent-generated code: a fixed pass order (behavior → structure → taste → security → performance → accessibility), severity-ranked findings, diff discipline, and a review checklist that stops "it works" from being the bar. Use when auditing any generated or changed code. Stack on the design-taste core skill.
Acceptance-first TDD workflow for solo implementation work. Use when handling a coding change directly and you want to follow a disciplined sequence: read context, define acceptance criteria, write failing tests when feasible, implement, verify, and conclude with passed, failed, or skipped with reason.
Apply Google Testing on the Toilet (TotT) rules when writing tests, reviewing a test diff, choosing mocks vs fakes, diagnosing brittle or change-detector tests, DAMP vs DRY test structure, SMURF/pyramid layer choice, or flaky time/sleep/shared-fixture tests. Instructs what a good test asserts and what to refuse. Not a Vitest/runner cookbook and not an E2E authoring workflow.
Use when capturing outbound email in development or staging without delivering to real recipients, inspecting HTML or headers, running spam or structure checks, or automating tests against a fake inbox. Use when testing outgoing mail from an app without committing to a production ESP yet. Use when using Mailtrap Email Sandbox, Sandbox API, or sandbox-mode sending.
Rigorously evaluate whether a prompt or document will produce the expected output when processed by an LLM. Use when user says "evaluate this prompt", "review my prompt", "will this work?", "critique this", or "check my instructions". Adversarial analysis with expectations scorecard and actionable recommendations.
Use to AUDIT a repository, site, or page against WCAG 2.2 AA or a country standard such as RGAA; produce a dated conformance report, criterion grid, PRD backlog, or tickets; AUTHOR accessible markup; fix accessibility; or wire a repo gate and rendered-DOM capture pipeline. The bundled install-free engine runs 93 static checks tied to success criteria, while the agent adjudicates judgment criteria and routes rendering criteria to browser scans; check/verify reject invented non-conformities. Use `review-a11y` instead for a review scoped only to a diff, branch, or PR.
Embody a user persona and walk through ONE usage flow of a web application THROUGH THE UI (starting from the flow's entry point, never typing internal URLs), judging whether the journey is usable and recording actionable findings. Takes the flow as an argument. Use when you want to "test as a user", "check if it's usable", "walk flow X as a persona", "validate the usability of a screen/journey", or run a flow with Webwright-style replayable screenshots/log evidence.
Run, inspect, and document validation evidence for AI-native development work. Use after or during implementation when checking current test cases, reviewing observable-behavior test coverage, running automated or manual validation, capturing evidence, deciding whether validation passed, identifying blockers, recommending test improvements, or connecting validation results back to specs, plans, commits, and CI.
Analyze existing code and write comprehensive unit and integration tests for it. Detects the test framework, identifies untested code paths, and generates tests with proper mocking, edge cases, and assertions. Use when the user asks to add tests, improve coverage, or test a specific module.
Generate a WCAG 2.2 accessibility audit checklist and remediation suggestions for any UI or design. Use when asked to audit for accessibility, check WCAG compliance, review a design for a11y issues, or create an accessibility remediation plan. Produces a prioritised checklist with pass/fail assessments and specific fixes.
Audits SaaS and usage-based web apps for adversarial usage patterns — accidental, opportunistic, and deliberate. Use this when the user says "adversarial audit", "abuse case audit", "idiot-proof this app", "find usage exploits", "business logic audit", or "how could users break this". Explores the codebase to map the economic surface area (pricing tiers, usage limits, free trials, costly resources), then generates abuse cases where user behavior — intentional or not — could break assumptions, bypass limits, amplify costs, or corrupt state. Produces a prioritized markdown report with findings, code locations, and fix recommendations, then optionally verifies findings interactively in a browser.
Automates browser interactions for web testing, form filling, screenshots, and data extraction. Use when the user needs to navigate websites, interact with web pages, fill forms, take screenshots, test web applications, or extract information from web pages.
Set up, integrate, build, debug, and ship AgentMark prompts, datasets, experiments, and evals. TRIGGER: setting up / integrating AgentMark into any app or agent, including when an SDK is named (raw Anthropic/OpenAI, Vercel AI SDK, Bedrock, a framework) — the named SDK is the integration TARGET, never a reason to skip; any `.prompt.mdx`, `agentmark.json`, `agentmark.client.ts`, `agentmark_client.py`, an `agentmark/` or `.agentmark/` dir, or `@agentmark-ai/*` imports; `npx create-agentmark` or any `agentmark` command (`init`, `dev`, `doctor`, `run-prompt`, `run-experiment`, `generate-types`, `link`, `pull-models`); driving AgentMark Cloud (`agentmark-mcp`, headless provisioning, git deploys); any mention of AgentMark, prompt versioning, experiments, evals, deployments, or trace observability. SKIP only with NO AgentMark intent or markers: provider-neutral prompt code; generic prompt-engineering or observability questions; competing platforms (Langfuse, LangSmith, Phoenix, Braintrust, Traceloop).
Apidog CLI usage check and version confirmation: use when commands succeed but the client does not show resources, create results cannot be found by list/get, test runs fail, reports are missing, agentHints/help/runtime behavior disagree, or the local CLI may be outdated
Sets up GitHub Actions CI/CD workflows for Astro sites — `astro check` (TypeScript + content schema), ESLint, Prettier, build verification, Vitest testing, Lighthouse CI, link checking, npm audit, and automated deployment to GitHub Pages, Cloudflare Pages, Netlify, or Vercel. ALWAYS use this skill when a user wants to create, add, set up, or configure GitHub Actions, CI/CD, automated checks, or deployment workflows for an Astro site — even if they don't use the exact phrase "GitHub Actions". This includes any request to: add automated type-checking or linting to an Astro repo; set up `astro check` in CI; add Lighthouse or accessibility checks to PRs; configure Vitest in CI for an Astro project; auto-deploy an Astro site to GitHub Pages, Cloudflare Pages, Netlify, or Vercel from GitHub; add link checking or broken-link detection; add security scanning to an Astro pipeline; or generally "add CI", "add automated checks", "set up workflows", or "automate" anything related to an Astro site's GitHub repository. Also trigger when someone wants quality gates on PRs, wants to verify the build still passes, or is setting up a new Astro repo and wants best practices for automation. If the user is inside an Astro project repository and mentions anything about automated testing, code quality, deployment, or GitHub workflows, use this skill.
This skill should be used when the user asks to "audit this codebase", "audit this code", "security audit", "code audit", "find vulnerabilities", "check for bugs", "review code quality", "find dead code", "check for anti-patterns", "performance audit", "check for code smells", "technical debt", or "code health check".
Use when the user asks about chaos engineering, fault injection, resilience testing, or HA verification for a SPECIFIC AWS service (e.g., RDS, EKS, MSK, ElastiCache, DynamoDB, S3, Lambda, OpenSearch, etc.). Triggers on "chaos testing on [service]", "fault injection for [service]", "how to test HA of [service]", "FIS scenarios/actions for [service]", "[service] failover testing", "[service] resilience testing", "[service] 混沌测试", "[service] 故障注入", "[service] 高可用验证", "对 [service] 做混沌实验", "test my [service]", "verify my [service] is resilient". Use this skill even when the user phrases it casually like "test my RDS" or "how resilient is my MSK cluster".
Use when /better-harness reviews the outer coding-agent Harness for lifecycle controls, repeated work, project feedback, agent assets, session outcomes, repair planning, durable reports, finding-bound fixes, or manual direct fixes. Invoke only via slash command.
Automates browser interactions using Playwright for web testing, debugging, and automation. Use when the user needs to navigate websites, take screenshots, fill forms, click elements, extract page content (HTML/text), audit accessibility (ARIA/AX tree), measure Web Vitals performance, monitor console logs and HTTP requests, mock API responses, execute JavaScript in browser, inspect React components, compare UI with Figma designs, or perform non-blocking debugging with tracepoints, logpoints, and exception monitoring.
Write clean, readable, and maintainable code following principles from Robert C. Martin's \"Clean Code\" and Object Calisthenics. Use when writing, reviewing, or refactoring code to improve naming, function design, formatting, error handling, and class structure. Includes code smell detection and refactoring guidance.
Use when reviewing git changes, Review Gate, merge ready, pre-release audits, and quality gates for code, docs, configuration, and scripts. Outputs a structured Pass or Reject conclusion, issue severity levels, a minimum verification matrix, an evidence chain, and a re-check baseline; triggers when the user mentions review, code review, audit, review gate, merge ready, blocker, evidence, pass, reject.
Conducts comprehensive code quality reviews including code smells detection, maintainability assessment, complexity analysis, design pattern evaluation, naming conventions, code duplication, technical debt identification, and best practices validation. Produces detailed review reports with specific issues, severity ratings, metrics analysis, and actionable improvement recommendations. Use when reviewing code quality, analyzing code maintainability, detecting code smells, checking coding standards, measuring code complexity, identifying technical debt, or when users mention "code quality review", "code quality check", "maintainability analysis", "code smells", "clean code", "refactoring candidates", or "technical debt assessment".
Master effective code review practices to provide constructive feedback, catch bugs early, and foster knowledge sharing while maintaining team morale. Use when reviewing pull requests, establishing review standards, or mentoring developers.
Guides secure coding and security-focused code review across languages and infrastructure—OWASP-oriented vulnerability patterns (injection, XSS, auth, crypto, deserialization, SSRF, XXE), secrets handling, and IaC security (Terraform, Kubernetes, Docker, GitHub Actions). Use when writing or reviewing code that handles user input, authentication, files, databases, network requests, cryptography, or infrastructure config—or when the user asks to check for SQL injection, XSS, SSRF, hardcoded secrets, OWASP issues, Terraform security, or GitHub Actions security. Not for authorized penetration test engagements (ai-redteam, cybersecurity), compliance program mapping (compliance-engineer), YARA/malware rules (yara-rule-authoring), or CI pipeline setup only (devsecops).
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.