Skills
96,981 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Provides comprehensive code review covering 6 focused aspects - architecture & design, code quality, security & dependencies, performance & scalability, testing coverage, and documentation & API design. Use this skill for deep analysis with actionable feedback after significant code changes.
(NS) Senior Tech Lead code review on SOLID, clean code, performance, security, and testability. Use proactively after writing or modifying code, before opening PRs, after implementation closure, or when the user asks for a code review, PR review, or issue review gate — even if they do not name this skill. For GitLab issue execution with ISSUE_URL, use Issue review mode. Do NOT use for root-cause debugging (use code-investigator).
Diagnose a broken or untrusted codebase and plan the fix. Runs the app for real, fans out parallel specialist sub-agents (security, database, core logic, frontend/UX, architecture), audits the git/CI/deploy setup, verifies the headline claims independently, then gives a plain-English findings list ranked by real-world cost, writes FINDINGS.md into the repo, and delivers a rebuild-or-fix-in-place verdict (fix in place wins by default, and having real users can veto a rebuild outright) before handing off to cs-build-import-codebase and creating the Kanban tasks. Works on any codebase in any language. Triggers, "my app is a mess", "audit my codebase", "what's wrong with my app", "diagnose this codebase", "should I rebuild or fix this", "find the bugs in my app", "review my whole app".
Run a full review of an Elastic documentation PR against the docs team review checklist — user focus, technical accuracy, applicability, maintainability, language, and style. Runs the companion review skills and merges everything into one report with a recommended approve, comment, or request-changes call. Use when reviewing a docs PR, checking a branch before requesting review, or deciding whether a docs change is ready to merge.
A skill for verifying and syncing documentation consistency alongside code changes. It classifies change categories from git diff, determines per category whether documentation sync is needed, regenerates auto-generated documentation, checks for broken links, and reports in table form. Use when you need documentation sync, documentation consistency checks, or detection of missed updates. When the subject is generating or updating the AGENTS.md hierarchy itself, use agents-md-sync (explicit invocation).
Review public site content for editorial quality, source support, prompt residue, duplicate blocks, translation drift, hidden filler, and human usefulness before SEO or LLM-friendly publication. Use this skill when the user asks to quality-gate news briefs, longform explainers, blog posts, topic pages, project pages, translated content, or generated article drafts without changing the live publishing pipeline.
Sets up GitHub Actions CI/CD workflows for EmDash plugins — TypeScript type-checking, ESLint linting, Vitest testing, npm publishing, and automated releases. ALWAYS use this skill when a user wants to create, add, set up, or configure GitHub Actions, CI/CD, automated checks, or deployment workflows for an EmDash plugin — even if they don't use the exact phrase "GitHub Actions". This includes any request to: add automated type-checking or linting to an EmDash plugin repo; set up testing in CI for a plugin; auto-publish a plugin to npm from GitHub; add security scanning or dependency auditing to a plugin pipeline; or generally "add CI", "add automated checks", "set up workflows", or "automate" anything related to an EmDash plugin's GitHub repository. Also trigger when someone wants quality gates on PRs or is setting up a new EmDash plugin repo and wants best practices for automation. If the user is inside an EmDash plugin repository and mentions anything about automated testing, code quality, deployment, or GitHub workflows, use this skill.
Audit a Figma component library for consistency, coverage gaps, and naming issues. Use when asked to audit components, review a design system, check component consistency, identify missing components, or assess Figma library health. Produces a structured audit report with issues prioritised by impact, naming recommendations, and a fix plan.
Use when executing coding tasks with a strict delivery workflow: build a full plan, implement one step at a time, run tests continuously, and commit by default after each step (`per_step`). Support explicit commit policy overrides (`final_only`, `milestone`) and optional BDD (Given/When/Then) when users ask for behavior-driven delivery or requirements are unclear.
Generic contract/schema boundary audit across authoring, discovery, validation, and execute—detecting split-brain between listings and invoke paths, gateway divergence, and permissive placeholders. Use when changing tool registration, RPC/plugin registries, dynamic tools, MCP or WebMCP surfaces, CLI exec aliases, OpenAPI or JSON Schema contracts, migrators/codegen, bridge argument encoding, or platform docs that describe API contracts.
Repository structure methodology for maximum AI agent effectiveness. Three pillars — context engineering (repo as knowledge product), architectural constraints (deterministic enforcement), garbage collection (active entropy fighting). Use when setting up repos for AI development, diagnosing repeated agent failures, writing AGENTS.md, or designing CI gates and structural tests.
Steel-manning resolution for tempa-spec's dark mode. Resolves findings that would normally escalate to the user (DECISION/HIGH from hrt-align-consistency-review and hrt-apply-code-review; single-reviewer UNANCHORED from hrt-adversarial-authoring). Always a fresh subagent. Use only when dark.md exists and the calling skill has a finding it cannot resolve on its own evidence.
Use before launch to audit SEO, schema, accessibility, performance, security, analytics, redirects, sitemap, robots, SSL, monitoring, rollback, and approval gates. Evidence-first; do not mark launch ready unless required checks ran or are explicitly skipped with rationale.
Implement comprehensive evaluation strategies for LLM applications using automated metrics, LLM-as-judge, human feedback, and benchmarking. Use when testing LLM performance, measuring AI application quality, comparing prompts/models, or establishing evaluation frameworks. Covers RAGAS for RAG pipelines, evals-as-code CI/CD integration, and modern 2025/2026 practices including structured output evaluation and agentic task success measurement.
Implement-review-fix loop for development tasks. Use when the user invokes $loop, says "loop", "loop this", "run the loop", "implement then review", "review/fix until clean", or otherwise asks Codex to keep cycling through implementation, review, fixes, and re-review until no actionable issues remain.
Review the implementation source code of MCP (Model Context Protocol) servers, clients, and tool handlers against a security baseline — authentication, sessions, rate limiting, input-schema validation, official-SDK usage, RCE vectors, and the OWASP MCP Top 10 — producing a report with file/line evidence. Use this skill when: - Reviewing an MCP server implementation for security before release - Checking a server against the baseline controls (MCP-01 to MCP-05) and the OWASP MCP Top 10 - Auditing tools for RCE vectors (command/code injection, unsafe deserialization, path traversal, SSTI, dependency hijacking, SSRF) - Verifying auth, session, rate-limiting, and input-validation controls on a network-exposed server - Reviewing MCP client code that handles untrusted server responses and session IDs - Requests like "review this MCP server for security" or "is my MCP server implementation secure?"
Prepare Microsoft Store release readiness for Windows apps, desktop utilities, games, PWAs, and packaged software including package identity, MSIX/AppX packaging, Store listing, screenshots, age ratings, privacy, capabilities, in-app purchases, subscriptions, updates, certification, installer behavior, Windows integration, telemetry, crash quality, support links, and release rollout. Use when submitting or auditing products for Microsoft Store.
Port a Protractor test suite to CodeceptJS 4. Trigger when the project contains `protractor.conf.{js,ts}`, `protractor` in `devDependencies`, `*.e2e-spec.{js,ts}` files, an `e2e/` (or `protractor/`) directory with spec files, `@types/jasmine` / `jasmine-spec-reporter` in dependencies, imports from `protractor` (`browser`, `element`, `by`, `ExpectedConditions`), or code calling `element(by.X(...))`, `element.all(...)`, `by.addLocator(...)`, `browser.get(...)` / `browser.executeScript(...)` / `browser.wait(EC.*)` / `browser.waitForAngular(...)` / `browser.ignoreSynchronization` / `browser.params.*`.
Port a TestCafe test suite to CodeceptJS 4. Trigger when the project contains `.testcaferc.{json,js,ts,cjs}`, `testcafe` in `devDependencies`, test files importing from `testcafe` (`Selector`, `ClientFunction`, `Role`, `RequestMock`, `RequestHook`, `RequestLogger`), top-level `fixture('X').page(...)` + `test('y', async t => { ... })` blocks, `Selector(...)` chains (`.withText`, `.nth`, `.find`, `.filter`), `await t.click(...)` patterns, `t.useRole(...)`, `t.eval(...)` / `ClientFunction(...)`, or TestCafe Studio recordings.
Interpret validation errors and guide fixing them. Use when encountering validation errors, validation warnings, false positives, operator structure issues, or need help understanding validation results. Also use when asking about validation profiles, error types, or the validation loop process.
Audit and review NetBox data model design choices. Use when evaluating site hierarchy, IPAM organization, device modeling, tenancy patterns, custom field vs tag decisions, naming conventions, and extensibility strategy. Identifies modeling anti-patterns and suggests improvements aligned with NetBox best practices.
Guides engineers and QA professionals in interpreting performance test results, identifying bottlenecks, and producing two types of reports: a technical report (for engineers and QA) and a business report (for stakeholders and executives). Use this skill whenever the user shares load test results, CSV stats, HTML reports, percentile data, or test output from k6, Gatling, Locust, JMeter, Artillery, or any other tool — and wants to understand what the numbers mean, diagnose problems, or communicate findings. Trigger on phrases like "analyze my test results", "what do these numbers mean", "my p95 is high", "error rate under load", "write a performance report", "explain the results to my manager", "how do I present this to stakeholders", or "I found a bottleneck".
Generate an interactive PR review walkthrough as an HTML page. Fetches PR data via gh API, categorizes files into core vs mechanical changes, adds reviewer annotations, and renders diffs with moved-code detection. Use when the user pastes a GitHub PR URL and asks for a review, walkthrough, or summary, or says "review this PR".
Principal-level architecture, system design, trade-off analysis, ADRs, Clean Architecture, GoF, production-ready microservices, Clean Code, algorithms, domain modeling/DDD, distributed data, API contracts, quality attributes/ATAM, SRE/resilience, secure architecture, legacy evolution, C4/arc42 documentation, and engineering ownership. Use for architecture/code reviews, tech strategy, pattern audits, coding standards, algorithm or data-structure choice, Big O/performance, databases, consistency, events, scalability, SLO/reliability, threat modeling, modernization/migration, bounded contexts, aggregates, context mapping, API versioning/deprecation, team topology, platform engineering, multi-service design, or /principal-software-architect. Produces evidence-based findings and only the specialized baselines material to the decision.
Use when the user needs to write or run unit, functional, or integration tests for TLPP code using ProBat (tlppCore's native testing engine) -- covering @TestFixture, @Test, @Setup/@TearDown, @OneTimeSetUp/@OneTimeTearDown, @Skip, @ErrorLog annotations, the full assertion library (assertEquals, assertTrue, assertVector, assertJson, assertIsRegExFull, etc.), SKIPASSERT, and TDD/CI workflows. Also triggers on Portuguese phrasing like "testes unitarios", "criar teste ProBat", "testar rotina TLPP", "cobertura de testes", or requests to add @Test methods to a TLPP class.
Adversarial Quarto-vs-Beamer parity QA. A critic agent compares the Quarto HTML render to the Beamer PDF benchmark for content/visual parity; a fixer agent applies fixes; loops until APPROVED or two consecutive rounds turn up nothing new (fallback cap 5 rounds). Use when user says "qa the quarto", "check parity", "does the html match the pdf?", "quarto matches beamer?", or after a translate-to-quarto run. Requires both the `.qmd` rendered and a `.pdf` benchmark.
Crash and vulnerability sample analysis: deterministic reproduction, ASAN/UBSAN report interpretation, input minimization (afl-tmin/cmin), gdb backtrace localization, rr recording and replay, and PoC generation. Trigger terms: crash, ASAN, UBSAN, undefined behavior, UAF, heap overflow, out-of-bounds, segmentation fault, segfault, core dump, PoC, vulnerability analysis, crash analysis.
Coverage-guided fuzzing: AFL++/libFuzzer/honggfuzz, instrumentation and corpus initialization, afl-fuzz runtime parameters, coverage (afl-cov), dictionaries/structured inputs. Trigger terms: fuzz, fuzzing, AFL, afl-fuzz, libFuzzer, honggfuzz, coverage, corpus, dictionary, vulnerability hunting.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.