Skills
96,981 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Multi-agent code review run as a debate. Critics raise findings in parallel, an Author defends the change, Critics concede or maintain, and a Judge rules on what stays contested. Findings are classified by kind and blocking, and handled durably when previously decided. Use `rq` to request a review of diffs (defaults to main branch), `rs` to respond to findings and record intentional non-fix decisions beside the relevant code. Triggers on "review this", "review my code", "code review", "check for bugs", "audit this", when examining PRs, pull requests, branches, or diffs. Always asks user before applying fixes or adding decision comments
Review the changes since a fixed point (commit, branch, tag, or merge-base) along two axes: Standards (does the code follow this repo's documented coding standards?) and Spec (does the code match what the originating issue/spec asked for?). Runs both reviews in parallel sub-agents and reports them side by side. Use when the user wants to review a branch, a PR, work-in-progress changes, or asks to "review since X".
Comment-hygiene-only reviewer — flags ephemeral review-ID references, historical change-narration, stale comments, reviewer-appeasement, redundant restating, verbose rationale essays, and diff-level comment density in the scoped diff, and normalizes findings into the verify pipeline format
Generate a project-local verification skill that drives your app the way a user does — any language, framework, or platform. Use for /create-verification-skill, "make a control skill for this repo", or when a project has no scripted way to prove UI/CLI/service behavior.
Edit and review developer documentation for technical accuracy, completeness, structure, clarity, brevity, peer feedback, technical review, technical verification, QA procedure testing, and feedback integration. Use when reviewing, editing, refactoring, or preparing developer docs for release, especially docs with procedures, examples, prerequisites, or high-risk technical claims.
Plan prototype interactions and flows for user testing in Figma. Use when asked to plan a Figma prototype, set up prototype interactions, define what to prototype for a user test, or prepare a Figma prototype for usability testing. Produces a prototype scope, interaction specification, test task scripts, and Figma setup guide.
Full FlagRelease pipeline orchestrator. Runs the complete LLM deployment, verification, and benchmarking pipeline for multi-chip GPU backends. Executes: install-stack → env-verify → model-verify → perf-test in sequence, passing state between steps and producing a final structured report. Assumes gpu-container-setup (Step 1) is already done — a running container with PyTorch + GPU access must exist.
Create comprehensive test suites for Frappe Framework v15 applications. Triggers: "create tests", "add tests", "frappe test", "write tests", "test coverage", "/frappe-test". Generates unit tests, integration tests, fixtures, and factory patterns following testing best practices.
Adapt fragment shaders or runtime-shader snippets into standard GLSL, render them with glslViewer in headless mode, and inspect PNG output for shader debugging. Use when Codex needs to validate SDFs, gradients, masks, edge contours, or intermediate shader math by producing reproducible preview images from `.frag` files or translated shader snippets.
Conventions for the Jev judgment tools. Use when screening fetched or pasted content, verifying claims against evidence, ranking or classifying items by meaning, comparing passages, extracting fields, auditing extracted values, reviewing a patch, gating completion, or judging how likely a proposition is — and when choosing between Jev and rg, curl, or plain reading.
Audit project documentation quality across 8 categories (Hierarchy, SSOT, Compactness, Requirements, Actuality, Legacy, Stack Adaptation, Semantic Content). Delegates to ln-601 for deep semantic verification of project documents. Use when documentation needs quality review, after major doc updates, or as part of ln-100-documents-pipeline. Outputs Compliance Score X/10 per category + Findings + Recommended Actions.
Verify the serving stack with a user-specified target model. Runs twice: first with FlagGems/FlagCX disabled (isolate model-specific errors), then with full multi-chip stack enabled. Diffs the two runs to pinpoint which layer caused any failure.
Synthesize outputs from multiple AI models into a comprehensive, verified assessment. Use when: (1) User pastes feedback/analysis from multiple LLMs (Claude, GPT, Gemini, etc.) about code or a project, (2) User wants to consolidate model outputs into a single reliable document, (3) User needs conflicting model claims resolved against actual source code. This skill verifies model claims against the codebase, resolves contradictions with evidence, and produces a more reliable assessment than any single model.
Systematic performance optimization and regression debugging for OneKey mobile app (iOS). Use when: (1) Fixing performance regressions - when metrics like tokensStartMs, tokensSpanMs, or functionCallCount have regressed and need to be brought back to normal levels, (2) Improving baseline performance - when there's a need to optimize cold start time or reduce function call overhead, (3) User requests performance optimization/improvement/debugging for the app's startup or home screen refresh flow.
Dual-axis (Standards∥Spec) multi-perspective PR review with confidence ≥80 filtering, severity calibration, plan alignment, and optional GitHub/GitLab review comment. Best-of: Claude /code-review pipeline + mattpocock dual-axis + Superpowers plan/severity habits. Triggers — 「PR 代码审查」「审查这个 PR」「code-review」「/code-review」「审 PR」「pull request review」「双轴审查 PR」 / pr code review, review this PR. Do NOT use as a name alias for mattpocock code-review or Superpowers requesting-code-review.
Senior Quality Documentation Manager for comprehensive documentation control and regulatory document review. Provides document management system design, change control, configuration management, and regulatory documentation oversight. Use for document control system implementation, regulatory document review, change management, and documentation compliance verification.
AI model security assessment and forensics (behavioral layer): extraction assessment (API black-box extraction assessment), fingerprint verification (behavioral fingerprinting and attribution verification), privacy leakage evaluation (membership inference/privacy leakage assessment), and robustness evaluation (adversarial robustness assessment). Triggers: API model theft, black-box model replication, model fingerprinting, membership inference, adversarial examples, behavioral watermarking, model security assessment, privacy leakage assessment.
Review the changes since a fixed point (commit, branch, tag, or merge-base) along two axes: Standards (does the code follow this repo's documented coding standards, plus baselines for code smells, duplicated code, and N+1 or otherwise repeated work?) and Spec (does the code match what the originating ticket or spec asked for?). Runs both reviews in parallel sub-agents and reports them side by side. Use when the user wants to review a branch, a PR, work-in-progress changes, or asks to "review since X".
Reproduces, diagnoses, and fixes a defect in a Backstage plugin inside the rhdh-plugins or community-plugins repositories: resolve the report from a RHIDP, RHDHBUGS, RHDHPLAN or RHDHSUPP Jira key, a GitHub issue, or plain prose; locate the owning workspace; write a throwaway reproduction test that fails for the stated reason; record before and after Playwright video evidence for a UI defect; then apply the smallest fix and verify it. Use for "fix this plugin bug", "reproduce RHIDP-1234", a plugin that renders the wrong thing, or a regression that needs evidence before and after.
Use when you need to test a Roblox game under conditions a solo Studio playtest can't reach — mobile/tablet/phone (device emulation, TouchEnabled), multiplayer features (parties, co-op, trading, anything needing a 2nd player), or any client state that normally requires another person. Covers driving Studio's Test menu via AppleScript and simulating multiplayer by firing real remotes from the Server VM. Load this INSTEAD of telling the user "I can't test that myself".
Autonomous browser control with Cowork-style skill recording. Use when user requests "control my screen", "record workflow", "verify Lovable", "test scrapers", "debug DOM", "autonomous testing", or any browser automation task. Uses CDP + Accessibility Tree for 10x faster, 100% reliable element targeting. NO screenshots.
Systematically reviews code for SQL injection, XSS, SSRF, broken access control, cryptographic failures, and other common OWASP Top 10 vulnerabilities, providing vulnerable code examples and ready-to-use remediation guidance. Trigger this skill when users ask for a security review, vulnerability scan, or penetration testing assistance, or mention keywords like OWASP, SQL injection, XSS, code audit, or security checklist.
Review code for security issues before merge — authz gaps, injection, secrets, unsafe defaults, SSRF, path traversal. Use when reviewing a PR, auditing a diff, shipping auth/payments/uploads, or when the user asks for a security review or OWASP check.
AI-agent commit protocol that establishes a Shadscan baseline and reruns the audit immediately before every agent-created commit without installing dependencies or configuring Git. Use when an agent is asked to commit work in a React shadcn project, prevent UI regressions during an agent task, or run Shadscan before commits.
Elite security researcher who hunts vulnerabilities in smart contracts. Has found critical bugs worth millions in TVL. Specializes in reentrancy, access control, oracle manipulation, and economic exploits across EVM and Solana. Use when "audit, security review, vulnerability, exploit, reentrancy, access control, oracle manipulation, flash loan attack, smart contract security, slither, mythril, formal verification, invariant testing, security, audit, smart-contracts, solidity, vulnerabilities, defi, exploits, reentrancy, access-control, oracle-manipulation" mentioned.
Passive skill enforcing strong typing when writing or reviewing PHP, TypeScript, Python, C#, Kotlin, Go, Rust, or other typed code. Bans any/mixed, untyped signatures, blind ??/|| fallback chains; prefers DTOs, enums, generics, strict flags. Do NOT force typing onto untyped languages.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.