Skills
96,981 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Use only when the user explicitly names tdd or an upstream task explicitly invokes it to implement a feature or bug fix test-first. Execute vertical red-green-refactor cycles against the repository's real contract; proceed without redundant approval when an authoritative brief is ready, and stop before writes only when a material behavior, scope, interface, or authority decision remains unresolved.
Create test cases (TC-XXX) from the acceptance criteria of any specification artifact that has them with a coded identifier: a user story (US-XXX), a work item (WI-XXX), an already implemented feature (FT-XXX), or any other specification document whose criteria are numbered or coded (AC-001, 1.1, R-3, etc.), following the IEEE 29119-4 standard. Activate when the user asks to "define test cases", "create test cases", "generate TCs", "tests for the US/WI/FT", "tests for this spec/document", "document tests", "test cases for the acceptance criteria", or any variant that implies producing test documentation from already specified requirements. Also activate when the user mentions "test-define" or "/test-define".
Use only when the user explicitly asks for a TestDino audit of Playwright automated test code. Routes through the audit tools the TestDino MCP server exposes (get_audit_report + submit_audit_report, or the legacy test_audit). For generic code review or non-Playwright targets, do a normal review instead.
Use when the user wants to check TestDino connection status, validate their PAT, discover available organizations and projects, or find the right projectId. Always call this first when the project context is ambiguous before any other TestDino tool.
Use when the user wants to manage a manual execution run or update case-level results inside a run — listing runs, creating runs for a release, inspecting a run, assigning cases, or marking case results (passed/failed/blocked/skipped/retest/untested). Accepts counter-style IDs like RUN-12 and TC-156.
Use when the user wants to inspect automated test runs, list failed or flaky tests, debug a failing testcase with historical context, or filter runs by branch, commit, author, environment, browser, status, or tags. Includes list_testruns, get_run_details, list_testcase, get_testcase_details, and debug_testcase.
Capture baseline evidence from a live website URL: screenshots, scroll states, hover/click behavior, parallax, timers, and transition recordings. Use when reference artifacts are needed before implementation or comparison; not to build or diagnose a clone.
Confirms or rejects findings from review-llm-artifacts before deletes or risky refactors. Loads review-verification-protocol-style checks per finding. Use after a review run, when the user wants to reduce false positives, before fix-llm-artifacts on dead code, or when validating a full-project scan.
Verify that sign-in takes the user to the right place, sign-out truly ends the session so a protected page redirects them to sign in, and an expired session prompts them to sign in again instead of breaking. Use when auth, a login form, a logout button, route guards, or token refresh were added or changed, or when a user reports being unexpectedly logged out or left signed in.
Fact-check LLM-drafted technical content against primary sources — source hierarchy, programmatic existence probes for tool and plugin names, class-before-instance error triage, the truncated-negative trap, adversarial re-checking, and the verified-stamp discipline. Use when auditing a SKILL.md for factual errors, before stamping a skill verified, when a command or artifact claim needs confirming against upstream documentation, or when reviewing any drafted content whose specifics were written from model memory.
Review repository-native specs, code diffs, PRs, docs, workflow artifacts, or skill changes as a shared readiness gate. Use when deciding whether a spec can move to planning, whether a code change is safe to continue or commit, whether a workflow artifact is coherent, or whether review findings should block the next step.
Entry-point for the `@mizchi/vlmkit` toolkit — VLM-driven frontend kit covering visual regression (snapshot / diff / regression-watch), markup synthesis from screenshots, design-token / theme / a11y / i18n audits, and a 2-stage VLM + LLM CSS auto-repair loop. Use when a coding agent has edited HTML/CSS and needs to know whether the visible output changed, where it changed, and which CSS properties drove the change — or when the task is markup-from-image / token / theme audit / fix-loop driven by VLM. This skill orients you to the 5 detailed sub-skills (vrt-visual-diff / vrt-migration-eval / vrt-markup-synth / vrt-regression-watch / vrt-css-fix-loop) and the verb-group CLI; pick the matching sub-skill once the task shape is clear.
Complete black-box pentest-style web security audit. Runs 70+ tests against any URL (OWASP Top 10, CVEs, CORS, headers, databases, auth, rate limiting, injection) and generates a professional HTML report with vulnerabilities, proofs of concept and an action plan. Use this skill whenever the user mentions security audit, pentest, checking security, finding vulnerabilities, cybersecurity, penetration testing, or wants to verify a website is secure before launch.
Workleap's shared web configuration packages (@workleap/eslint-configs, @workleap/typescript-configs, @workleap/rsbuild-configs, @workleap/rslib-configs, @workleap/stylelint-configs, @workleap/browserslist-config). Use when setting up, customizing, extending, or troubleshooting shared web tooling configs in a Workleap project — including ESLint, TypeScript, Rsbuild, Rslib, Stylelint, Browserslist, and monorepo (Turborepo) strategies. Activate even if only one tool is mentioned, as the packages are designed to work together.
Guides test creation with practical strategies for unit, integration, and e2e tests. Use when writing tests, deciding what to test, setting up test infrastructure, or discussing coverage. Triggers on "write tests", "should I test", "test coverage", or test file creation.
Use this skill when users want to execute this workflow when a user wants to test how a different LLM model would handle existing Agentforce agent conversations. Trigger when users mention agentforce, offline, experimentation
Implement Statistical Process Control charts to monitor production process stability. Use this skill when the user needs to detect process shifts, set control limits, or distinguish common cause from special cause variation — even if they say 'process monitoring', 'control chart', or 'is our process in control'.
Scaffold a new production application with the full agentic-AI guardrail canon baked in from commit #1: a uniform 7-gate interface (lint, typecheck, test, coverage, build, e2e, audit) on each stack's native runner, strict types, maximal static analysis, coverage thresholds with teeth plus seed tests, pre-commit hooks, hardened CI with optional SonarCloud, supply-chain pinning, and an agent-ready AGENTS.md — every gate verified green before the first commit. Native adapters: Next.js, NestJS, Django, Go, Rust, Spring Boot; a discovery method maps the canon to other stacks. USE FOR: creating or scaffolding a new app, service, or API from scratch; bootstrapping a greenfield repo that AI agents will build in. DO NOT USE FOR: retrofitting an existing codebase or scaffolding a new package into an existing monorepo (both assume repo-root ownership), LLM-safety or content-moderation guardrails, or adding a single tool to an existing project.
Auto-review pipeline. Chains the four plan-* reviews (plan-deep-review, plan-design-review, plan-eng-review, plan-devex-review) at full depth with intermediate AskUserQuestion calls auto-decided by 6 principles. Surfaces taste decisions and user challenges at a single Final Approval Gate. Sequential Deep → Design → Eng → DX. Each phase optionally gets an independent Claude subagent voice for cross-model consensus. Use when asked to "autoplan", "run all the plan reviews", "auto-review this plan", or when the user wants comprehensive plan vetting without sitting through every intermediate question.
Procedures for running and investigating baserCMS (CakePHP5 / PHPUnit) unit tests in a local Docker environment. Refer to this when asked to "run the unit tests", "run all the tests", "run just this test", "investigate a test failure", "I want to run tests on a plugin standalone", or "I want to set up a test environment for a plugin". In addition to container names, run commands, command formatting for automatic permission approval, and how to aggregate and isolate failures, it covers the steps to introduce a mechanism for running unit tests on a plugin standalone (composer.json / phpunit.xml.dist / tests/bootstrap.php / the full TestApp set, and the phinx 0.16.10 pinning pitfall).
Build, test, lint, and deploy commands for the Bitwarden Android project. Use when running tests, building APKs/AABs, running lint/detekt, deploying, using fastlane, or discovering codebase structure. Triggered by "run tests", "build", "gradle", "lint", "detekt", "deploy", "fastlane", "assemble", "verify", "coverage".
Fact-check claims and prove completed implementation against direct evidence. Use when claims need validation, cross-examination, or hardening, or completed work needs decisive command proof. Do not use as the owner of broad risk discovery, requirement conformance, or one-sided advocacy.
Senior CAPA Officer specialist for managing Corrective and Preventive Actions within Quality Management Systems. Provides CAPA process management, root cause analysis, effectiveness verification, and continuous improvement coordination. Use for CAPA investigations, corrective action planning, preventive action implementation, and CAPA system optimization.
Ultra-compressed code review comments. Cuts noise from PR feedback while preserving the actionable signal. Each comment is one line: location, problem, fix. Use when user says "review this PR", "code review", "review the diff", "/review", or invokes /caveman-review. Auto-triggers when reviewing pull requests.
Enable CircleCI Smarter Testing features (test impact analysis, dynamic test splitting, auto-rerun failed tests) on top of an existing testsuite, driven by `circleci testsuite doctor`. Use for test impact analysis, dynamic test splitting, auto-rerun, or "smarter testing". Requires `.circleci/test-suites.yml` to already exist — if it doesn't, use the circleci-testsuite skill first.
Recommend, create, preview, and attach Coval trace-based metrics from OpenTelemetry spans. Use when a user has Coval traces and wants custom trace metrics, trace-aware LLM judge metrics with include_traces, latency, token usage, provider failures, tool behavior, vertical-specific workflow signals, or production monitoring based on trace attributes.
Generate a structured onboarding backlog — in Jira, GitHub Issues/Projects, Azure DevOps, or as a manual markdown export — that drives a development team from zero to publishing both consumer and provider contract tests. Use when the user invokes /contract-testing-flywheel or asks to "kick off contract testing for a team", "create the contract-testing onboarding tickets", or "scaffold the BDCT / CDCT rollout backlog for <team>". Asks which scrum tool, and CDCT / BDCT / Both, at runtime and parametrises tickets by stack, broker, CI tool, and consumer/provider pair. Generic — no SmartBear-internal assumptions, no fixed scrum-tool dependency.
qa-skills shared knowledge base—dependency, NOT triggerable: executability standards, evidence grading, risk model, type matrix, templates, scripts. Never invoke standalone; always install with the skills, or references break. Shared knowledge base (dependency unit, not a triggerable skill): holds methods, templates, and scripts referenced across the suite. Never trigger independently for any testing task; install alongside other skills.
Detect, audit, and remediate A04:2025 Cryptographic Failures in Python web applications (FastAPI and Flask). Use this skill whenever the user asks about crypto security, password hashing, JWT configuration, TLS/SSL verification, weak randomness, hardcoded secrets, or any code using hashlib, random, ssl, jwt, passlib, or cryptography modules. Also trigger when the user wants to audit security, scan for OWASP A04 issues, fix crypto bugs, or review authentication-related cryptographic code. If there's any chance a crypto weakness is involved — trigger this skill.
Independently and read-only review a design doc, PRD, spec, or requirements for repository accuracy, material risks, and canonical story readiness. Produces a binary readiness verdict with evidence-backed blocking findings and optional non-blocking suggestions. Use design-doc-review-loop when revisions or feature-delivery readiness are requested.
Disciplined diagnosis loop for hard bugs and performance regressions. Reproduce → minimise → hypothesise → instrument → fix → regression-test. Use when user says "diagnose this" / "debug this", reports a bug, says something is broken/throwing/failing, or describes a performance regression.
Review a Kibana PR for OpenAPI Spec (OAS) and API docs compliance against the Elastic API docs checklist, core guidelines, and Kibana quickstart. Checks availability, summaries, descriptions, parameters, examples, tags, links, defaults, enums, deprecation, and generated YAML correctness. Use when reviewing a Kibana PR that touches API routes or OAS output files, or when asked to check OAS, availability, x-state, or API docs compliance on a PR.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.