Skills
96,981 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Vulnerability hunting gateway. Orchestration: identify targets and input surfaces → coverage-guided fuzzing → crash analysis → reverse-engineering and localization → report. Sub-skills: [[re-fuzzing]] [[re-crash-triage]] [[re-exploit]]. Trigger terms: vulnerability hunting, find vulnerabilities, fuzz, fuzz testing, AFL, libFuzzer, crash analysis, crash, vulnerability hunting, fuzzing
Record non-obvious decisions behind behavior others rely on — a bug fix, a requirement change, or an architecture choice — as Agent Notes bound to regression tests so later AI-driven changes cannot silently undo them. Use when fixing a bug a future change could plausibly revert, changing a requirement, reviewing such a change, verifying a notes tree, or asking when to write a postmortem. Do not use for routine fixes a test and commit message already explain, feature docs, or changelogs.
Turn a brief or existing feature into testable requirements: behavior, acceptance criteria, quality constraints, and data and permission rules. Use when notes or a concept need FR/NFR requirements or acceptance criteria before design or build, or when checking which requirements a shipped feature meets.
Request/execute structured code review: use after completing important tasks, at end of each execution batch, or before merge. Based on git diff range, compare against plan and requirements, output issue list by Critical/Important/Minor severity, and provide clear verdict on merge readiness. Trigger words: request code review, PR review, merge readiness, production readiness.
Only use when the user explicitly invokes /review-pr-check (or $review-pr-check in Codex). Never auto-invoke. A skill that orchestrates PR review handling by splitting it into a collection worker, a classification subagent, and an execution worker. Collection is delegated to the collection worker running gh pr-review-check; classification, grouping and work-packet generation to the classification subagent (the default example being Oracle); and actual work such as implementation, replies and resolves to the execution worker, while the parent manages the completeness gate, fallback triggering and the polling loop. In environments without a subagent mechanism, the parent degrades to running it itself.
Triage code-review findings as the code's owner. Use when findings arrive from any source (adversarial reviews, human PR comments, CI, scanners) and before applying a fix. Validate each, weigh fix cost against deployed complexity, and return dispositions (fix / defer / reject / escalate). Not for producing reviews or applying fixes.
Comprehensive fullstack development skill for building complete web applications with React, Next.js, Node.js, GraphQL, and PostgreSQL. Includes project scaffolding, code quality analysis, architecture patterns, and complete tech stack guidance. Use when building new projects, analyzing code quality, implementing design patterns, or setting up development workflows
Validate SEO and LLM-readability claims against live HTML, local fixtures, and generated artifacts. Use this skill when the user asks to prove whether title, meta description, canonical, hreflang, JSON-LD, NewsArticle.image, OpenGraph, Twitter cards, RSS autodiscovery, robots.txt, llms.txt, sitemap, news-sitemap, crawler access, or performance evidence is actually present, and when subjective audits must become timestamped pass/fail reports.
Use this skill when the user asks to test, validate, regression-check, or safely repair an existing Codex/agent skill's trigger, workflow, resources, or evaluation coverage. Do not use it to create a new skill, QA an application, or run open-ended skill optimization.
Implement SPC charting, process capability analysis, and control chart interpretation. Covers control chart selection, capability indices, and out-of-control rules. USE WHEN user says 'SPC', 'Cpk', 'Ppk', 'control chart', 'process capability', 'X-bar R', 'statistical control', or 'out of control'. Integrates with ControlPlan, MSA, and AutomotiveManufacturing skills.
Optional skill. Reconstruct a human-review-preparation file from an existing pull request, merge request, branch diff, or commit range in a repository the user trusts. Use when the user wants retrospective understanding of already-implemented changes, AI-side assessment and recommendations, and an optional provider-specific sharing variant written to a local file when needed.
Shared review-stage flow for PDCA hosts: full decision review, code-design review for code-affecting solutions, Standards∥Spec dual-axis verdicts (no cross-axis merge rank), binary pass/fail, bounded auto optimization, design summary, and verification-report honesty composed with completion-evidence-discipline. Used by PDCA workflows. Triggers — 「阶段审查流程」「方案审查编排」「审查闭环」「验证报告诚实」「双轴审查」 / staged review flow, dual-axis review, verification honesty. Do NOT use as a standalone task workflow.
Audit store review and platform policy risk across App Store, Google Play, Microsoft Store, Steam, web/direct download, mobile apps, games, SaaS companions, utilities, subscriptions, IAP, ads, UGC, privacy, permissions, health, finance, children, AI features, notifications, dark patterns, refunds, and review notes. Use when preparing submission, launch, major monetization changes, or auditing any product that may be rejected, delisted, or delayed by channel policy.
Ensure the current project has a proper test suite - detect tech stack & framework, scaffold if needed, generate unit tests (required, logic code only), and optionally generate/run E2E tests. Triggers when user says "test-suite-ensure", "complete tests", "generate tests", "ensure tests", "add unit tests", "check test coverage". Also callable by solve-workflow and opsx-solve-workflow in their execution-stage test steps.
Use when the user wants to create, update, or browse manual QA test cases and suites in TestDino — not execution runs. Covers list_manual_test_suites, list_manual_test_cases, get_manual_test_case, create_manual_test_case, update_manual_test_case, create_manual_test_suite.
Use when the user wants to browse, inspect, create, or update exploratory testing sessions in TestDino — by state, status, session type, assignee, release, or tags. Covers list_sessions, get_session, create_session, and update_session. Accepts counter-style IDs like SES-12.
Run an extremely strict maintainability review for abstraction quality, giant files, and spaghetti-condition growth. Use for a thermo-nuclear code quality review, thermonuclear review, deep code quality audit, or especially harsh maintainability review. User-invoked only.
Self-contained orchestration skill for writing high-performance TLE kernels and shipping TLE feature changes with reproducible validation. Use when the user wants to write/optimize TLE kernels, implement TLE API/verifier/lowering features, or debug TLE correctness/performance issues. Trigger on phrases like "write a TLE kernel", "optimize TLE operator", and "debug TLE local_ptr".
Create or review an implementation and validation plan before development starts. Use after a ready or conditionally ready spec, when deciding how to implement a change by vertical slices, identifying affected files and modules, sequencing development tasks, planning TDD or validation before coding, checking architecture fit, or producing a repo-native plan artifact that links specs to tests, commits, and evidence.
Build, run, or review disposable prototypes after a draft spec exists, when one uncertain product, UI, backend, agent workflow, prompt, state-machine, or architecture question needs evidence before spec review or planning can proceed. Use when a spec, review, or plan contains an assumption that text alone cannot resolve, when an interaction must be tried, or when prototype evidence must feed back into the active workflow artifact.
Full browser UAT for web apps — Playwright testing with console/network error capture, accessibility checks, i18n validation, and bug triage. Use when running screen-by-screen UAT or testing specific features in any web or hybrid app (React, Vue, Angular, Ionic, Next.js, etc).
Use when you have a finalized brainstorm-beagle spec at `.beagle/concepts/<slug>/spec.md` and need a bite-sized, TDD-driven implementation plan before any code is written. Triggers on: "write a plan", "plan this spec", "turn the spec into a plan", "now plan the implementation", "write-plan". Reads the spec, designs the file structure, decomposes work into 2-5 minute TDD steps with exact paths and commands, self-reviews against the spec, gets user approval, then writes to `.beagle/concepts/<slug>/plan.md` and offers to generate an execution handoff prompt via the subagent-prompt skill. Does NOT brainstorm specs, write code, or execute the plan — produces the plan document (and an optional handoff prompt) only.
This skill should be used when a developer or QA engineer wants to report a bug, create a bug ticket, document a test failure, log a defect, file an issue found during a QA session, or report something that is broken — for example "report a bug", "create a bug ticket", "I found a defect", "something is broken in trace #X", or "document this test failure". Files a structured GitHub Bug issue that links the originating Trace and Feature, maps failing Gherkin scenarios as reproducible test evidence, and fills every section of the BUG template.
Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking screenshots, extracting data, testing web apps, or automating any browser task. Triggers include requests to “open a website”, “fill out a form”, “click a button”, “take a screenshot”, “scrape data from a page”, “test this web app”, “login to a site”, “automate browser actions”, or any task requiring programmatic web interaction.
Automates browser interactions for web testing, form filling, screenshots, and data extraction. Use when the user needs to navigate websites, interact with web pages, fill forms, take screenshots, test web applications, or extract information from web pages.
Mandatory coding discipline rules that prevent common AI coding anti-patterns. MUST be loaded for ALL code writing, editing, reviewing, bug fixing, and testing tasks. Trigger on: writing code, editing code, fixing bugs, writing tests, implementing features, refactoring, code review, creating functions, adding error handling, debugging. This skill enforces fail-fast principles, proper error propagation, meaningful tests, and disciplined debugging workflows. Always active when Claude writes or modifies code.
Scans .NET code for ~50 performance anti-patterns across async, memory, strings, collections, LINQ, regex, serialization, and I/O with tiered severity classification. Use when analyzing .NET code for optimization opportunities, reviewing hot paths, or auditing allocation-heavy patterns.
Performs ARA Seal Level 2 semantic epistemic review of an Agent-Native Research Artifact directory, reading PAPER.md, logic/claims.md, logic/experiments.md, and trace/exploration_tree.yaml. Scores six dimensions (evidence relevance, falsifiability, scope calibration, argument coherence, exploration integrity, methodological rigor) from 1 to 5 and writes a severity-ranked level2_report.json with a Strong Accept to Reject grade. Use when Level 1 structural validation has passed and an ARA needs a critique before release. Use when checking whether claims are supported by their cited experiments. Use when auditing falsification criteria or scope over-claiming. Use when judging whether an exploration tree documents real dead ends. Not for structural or reference validation, which is Level 1.
Use this skill ANY time you need to search for code structure, refactor symbols, analyze impact, find dead code, or trace dependencies. ALWAYS invoke BEFORE using grep for structural code analysis. Trigger categories: structural pattern search (e.g. useEffect without deps, async without try-catch, fetch calls outside src/api), bulk code migration/transformation (wrap handlers, replace API calls), dependency & impact analysis (blast radius, transitive deps, which modules depend on X), safe renaming across codebases, dead code & circular import detection, ast-grep rule authoring. Trigger keywords: try-catch, useEffect, async without, circular imports, safe rename, blast radius, bulk migration, never imported, unused exports, ast-grep, enforce pattern, structural search, depends on, which modules. Do NOT trigger for: grep-able string searches, file-name lookups, reading READMEs, writing regex, CSV/data scripts.
Automatically benchmark your custom memory implementation against established systems like Supermemory. Set up a public benchmark, or create your own. Compare solutions against quality, latency, features and cost, easily, with a simple UI and CLI.
Use this skill when writing, running, or debugging tests for BoxLang applications using TestBox: BDD-style describe/it specs, xUnit-style test classes, expectations (expect/toBe matchers), assertions ($assert), life-cycle methods (beforeAll/afterAll/beforeEach/afterEach/aroundEach), MockBox mocking (createMock/prepareMock/$()/$results()), mock data generation (mockData()), async testing, exception testing, focused/skipped specs, attaching files to specs (attach()), spec retries (it retries argument, retries annotation, --retries), rerunning only failures (--failed, the Run Failed button of the HTML reports, TestResult.getFailedTargets()), choosing reporters (HTML reporters with Run Failed and Ask AI, the Agent reporter for AI agents), and running tests via the BoxLang CLI runner. For browser tests (the @browser annotation, ColdBox BaseTestCase with @browser) also load bx-playwright-testing.
Browser automation with two engines: agent-browser CLI (default for interactive work — navigate, snapshot, click, fill, screenshot, diff) and Playwright scripts (for compound operations — console/network capture, a11y audits, video recording, responsive sweeps, GIF pipeline, shadow DOM piercing). Triggers: browser automation, web test, screenshot, responsive test, test the page, automate browser, headless browser, UI test, console errors, network inspection, accessibility audit, a11y test, performance metrics, video recording, browser state, page structure, authenticated testing, annotated gif, dialog handling, tracing, pdf generation, shadow DOM, web components, DOM stabilization.
Use this skill when the user asks to "intercept HTTP traffic", "modify web requests", "use Burp Suite for testing", "perform web vulnerability scanning", "test with Burp Repeater", "analyze HTTP history", or "configure proxy for web testing". It provides comprehensive guidance for using Burp Suite's core features for web application security testing.
Guides implementation of code tasks using test-driven development in an Explore, Plan, Code, Commit workflow. Acts as a Technical Implementation Partner and TDD Coach — following existing patterns, avoiding over-engineering, and producing idiomatic, modern code.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.