Skills
96,981 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Synthesizes accumulated QA learnings from .qa-learnings/ledger.md into prioritized, actionable plugin improvements. Use when the user says "review learnings", "what have we learned", "improve the plugin", "learnings report", or "synthesize QA feedback".
RYUX - design intelligence for AI agents and designers. Tell it what you are doing and it routes to Analyze (understand an existing interface), Design (create or improve UI and UX in Figma, pen.dev, or mockups), Build (implement in code), Critique (find what to change first, with evidence, or run a heuristic evaluation), or QA (verify a build against the design), reads only the knowledge the task needs (product, UX, UI, interaction, forms, content, accessibility, responsive, design system, frontend, anti-slop), and closes with quality gates. Use for any UI, UX, copy, frontend, design review, or design analysis task, and for product visuals: illustration, 3D, imagery, icons, logos, and motion, even when the request does not name RYUX.
Comprehensive QA and testing skill for quality assurance, test automation, and testing strategies for ReactJS, NextJS, NodeJS applications. Includes test suite generation, coverage analysis, E2E testing setup, and quality metrics. Use when designing test strategies, writing test cases, implementing test automation, performing manual testing, or analyzing test coverage.
Create new skills, modify existing skills, and validate skill quality for the FlagOS skills repository. Use this skill whenever someone wants to create a skill from scratch, improve or edit an existing skill, scaffold a new skill directory, validate skill structure, or run test cases against a skill. Trigger when the user says things like "create a skill", "make a new skill for X", "scaffold a skill", "improve this skill", "validate my skill", or simply "/skill-creator-flagos". Also trigger when users mention turning a workflow into a reusable skill, or want to package a repeated process as a skill.
Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, update or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy. Don't use for running skills themselves, generating prose/blog content, or scaffolding unrelated Python projects — this is only for authoring and evaluating skill-packaged capabilities.
BDD-style behavior specification engine for the skill system. Use when: (1) defining a new skill's behavior before implementation, (2) validating a spec against the schema, (3) generating a behavior contract (Mermaid DAG) from a spec, (4) running structural acceptance tests against a built skill. Workflow: Spec → Test → Develop → Contract.
Smoke test identification, authoring, and CI integration for HTTP APIs — using Hurl or curl only. TRIGGER when: smoke test, smoke testing, critical path test, CI gate, gate before full suite, write smoke tests, add smoke test, smoke test template, which tests are smoke tests, hurl, .hurl file, curl smoke test. DO NOT USE when: user needs full testing strategy or philosophy — use `testing` instead.
Hardhat 3 development workflow for Solidity smart contracts. Use when building, testing, or deploying with Hardhat 3.x (hardhat, ignition, EDR). Covers ESM-first project setup, defineConfig, Solidity-native tests, TypeScript tests, multichain support, Hardhat Ignition deployment, and hook-based plugin system. Triggers on tasks involving hardhat init, hardhat build, hardhat test, hardhat ignition, or Hardhat-based Solidity development.
Audit SwiftUI iOS feature code for accessibility against WCAG 2.2 Level A/AA and return patch-ready fixes. Use when reviewing SwiftUI views/screens (including auth, forms, settings, and custom controls) and you need both standards traceability (WCAG + WCAG2Mobile interpretation) and practical, minimal code changes in a concise priority-grouped Markdown format with user follow-up checks for code-indeterminate behavior.
Test-driven development workflow enforcement for Python and React projects. Use when the user requests TDD, test-first development, or red-green-refactor methodology. Enforces strict cycle: write ONE failing test -> implement minimum code to pass -> refactor while green -> repeat. Applies to both backend (pytest) and frontend (Testing Library). Changes agent behavior to write tests before code. Does NOT provide testing patterns (use pytest-patterns or react-testing-patterns for how to write tests).
Hard discipline for behavior-changing work: write a failing test first, observe the failure, then write minimal production code; delete production code written before a failing test was observed. Distinct from test-suite-ensure (post-hoc coverage/scaffold). Referenced by PDCA execution stages. Triggers — 「测试先行」「先写失败测试」「红绿重构」「TDD 铁律」「test-first」 / test-first discipline, failing test first. Do NOT use as a name alias for tdd or test-driven-development.
Stack-agnostic testing principles, strategies, and patterns for building reliable test suites. Use when the user asks to design a test strategy, choose between unit/integration/e2e tests, apply TDD, fix flaky tests, improve test quality, use test doubles (mocks, stubs, fakes, spies), or review tests for antipatterns. Covers the testing pyramid, test design heuristics, arrange-act-assert structure, test isolation, property-based testing, and common testing pitfalls.
Use only when the user explicitly requests verification that a security fix remediates a reported vulnerability. Do not invoke automatically while implementing fixes, reviewing ordinary code changes, or running tests. Do not use for non-security fixes, candidate finding validation, or full repository scans.
Create accessible, production-grade frontend interfaces that conform to WCAG 2.2 AA standards while maintaining high design quality. Use this skill when building any web component, page, dashboard, or application where accessibility compliance (WCAG, ADA, Section 508, EN 301 549) is required or desired, or when auditing/fixing accessibility issues in existing UI code. Combines comprehensive W3C WAI accessibility knowledge with distinctive frontend design principles.
Use when you want pedantic, nitpicky, opinionated feedback on a site or project — the kind of feedback you'd get from Hacker News commenters, typography snobs, grammar pedants, and standards purists. Finds the things that professional reviewers skip because they're "too minor."
Audit Windows app release readiness including installer/MSIX identity, code signing, SmartScreen reputation, services, startup tasks, tray behavior, registry and file associations, notifications, credential storage, AppData/ProgramData, firewall prompts, auto-update, rollback, uninstall cleanup, crash logs, Microsoft Store certification, and support diagnostics. Use when shipping or reviewing Windows desktop apps and utilities.
Publish a GitHub PR or GitLab MR, or steward one through CI, conflicts, and review feedback until ready for a human merge decision. Use publication mode to commit, push, create, or update; use stewardship mode to watch or get an item ready. Exclude independent review verdicts, approval, and merging.
Use when the user wants to write, run, or troubleshoot automated regression tests for Protheus routines with ADVPR (Advanced Protheus Robot) -- covering FWTestHelper API, TestSuite/GPS de Testes setup, headless execution via FwExecSuite, and per-pattern scripting (MVC, ExecAuto/MSExecAuto, reports, processing routines, webservices, SmartLink, Smart View, single-message/TOTVS Message) plus routine preparation (screen bypass) and best practices. Also triggers on Portuguese phrasing like "teste automatizado", "robo de testes", "automacao de testes Protheus", "rodar suite de testes", "FWMyTestRunner", "GPS de testes", or "preparar rotina para teste automatico". The referenced files are written in Brazilian Portuguese.
Use this skill whenever you need to audit, test, or fix Authentication Failures (OWASP A07:2025) in Python web applications — especially FastAPI and Flask. Triggers include: any mention of JWT security, session management, brute force protection, credential stuffing, password policy, MFA enforcement, login rate limiting, session fixation, token validation, or auth-related error messages. Also trigger for requests to "check authentication", "audit login flows", "test auth security", "find auth bugs", or any task involving CWEs: CWE-287, CWE-307, CWE-384, CWE-521, CWE-798, CWE-613. Use proactively whenever the user shares auth-related code (routes, middleware, decorators, token handlers) even if they haven't explicitly mentioned security testing.
Analyzes software bugs including root cause identification, severity assessment, impact analysis, reproduction steps validation, and fix recommendations. Performs bug triage, categorization, duplicate detection, and regression analysis. Use when investigating bugs, analyzing crash reports, triaging issues, debugging problems, reviewing error logs, or when users mention "analyze bug", "investigate issue", "debug problem", "bug report", "crash analysis", "root cause analysis", or "fix recommendation".
General BUG fixing workflow and report generation. Use when fixing bugs, investigating errors, locating problems, or fixing issues: it enforces reproduce → locate → fix → verify, and generates a fix report under docs/BUG修复文档/ (including detailed manual verification steps).
Corrective cleanup of AI-generated code — removes LLM-specific patterns while preserving behavior. Use when the user says "deslop", "slop", "clean AI code", "remove AI patterns", or when you spot LLM-generated code smells after any generation session. For general post-change review and fixes ("clean up", "simplify"), use the simplify skill instead.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.