Skills
96,981 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Test-driven development, from unit to end-to-end tests. Use when the user wants to build features or fix bugs test-first, mentions "red-green-refactor", or wants integration or end-to-end tests (Playwright, Cypress). Don't use to backfill tests on existing code (/refactor) or diagnose an unknown bug (/debug).
Universal test-driven development methodology and test design craft. Background knowledge for writing behavior-focused tests, mocking strategy, vertical slicing, and tracer bullet execution. Auto-loaded when writing tests during implementation, review feedback, or standalone test authoring. Triggers: writing tests, test design, mocking strategy, test quality, behavior testing, integration testing, test-first, red-green-refactor.
Run five independent max-effort reviews (Fable 5.1, Opus 5.5, GPT-6 Astra, GPT-6.1 Sol, Muse Wonder), merge their findings, and fix only what the user approves. Manual only: run when a human types /total-review; agents must never invoke it on their own.
Triage an EF Core issue with a safety scan, classification, area labels, minimal reproduction, regression verification, and duplicate search. Use for bug reports, feature requests, or issue assessments. Supports sandbox triage that writes only a local Markdown report without requiring GitHub write permissions.
Triage a UI Verify build from your coding agent via the UI Verify MCP: classify changed stories as real regressions, cosmetic reflows, or rendering noise; summarize real regressions for a PR comment; and accept baselines in bulk. Use after a UI Verify build reports changes when you want the agent to review, summarize, or accept them from the terminal instead of clicking through the dashboard. Triggers: “triage this build,” “summarize the visual regressions,” “accept all the new baselines.”
Audits and implements TYPO3 accessibility patterns for WCAG 2.2 AA, including Fluid templates, PHP helpers, JavaScript widgets, forms, focus states, ARIA, and go-live checks. Use when building or reviewing TYPO3 templates, content elements, extensions, or frontend code for accessibility, keyboard support, screen readers, WCAG, ARIA, or a11y readiness.
React and Next.js performance optimization guidelines from Vercel Engineering. This skill should be used when writing, reviewing, or refactoring React/Next.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements.
Run comprehensive triage-first verification pipeline with specialized skills. Detects scope, discovers toolchain, triages files to relevant skills, runs static analysis, invokes review skills in parallel, exercises the app, and produces a unified report. Supports interactive, report-only, and auto-fix modes.
Verify that a UI that updates before the server responds restores the previous state and reports the failure when the request fails, and keeps the change when it succeeds. Use when a like, toggle, rename, reorder, delete, or add-to-cart action updates instantly, when an optimistic update was added or changed, or when a user reports that a change that "saved" disappeared after a reload.
Verify that the next page of a list, or the next batch in an infinite scroll, loads NEW rows from the server without repeats, and that the end of the list is handled. Use when pagination or infinite scroll was added or changed, when a list shows duplicate rows or skips some, or when the last page still offers a next control.
Security intelligence for code analysis. Detects SQL injection, XSS, CSRF, authentication issues, crypto failures, and more. Actions: scan, analyze, fix, audit, check, review, secure, validate, sanitize, protect. Languages: JavaScript, TypeScript, Python, PHP, Java, Go, Ruby. Frameworks: Express, Django, Flask, Laravel, Spring, Rails. Vulnerabilities: SQL injection, XSS, CSRF, authentication bypass, authorization issues, command injection, path traversal, insecure deserialization, weak crypto, sensitive data exposure. Topics: input validation, output encoding, parameterized queries, password hashing, session management, CORS, CSP, security headers, rate limiting, dependency scanning.
Vision-based visual QA reviewer — captures rendered output (live web pages, static HTML artifacts, PDFs) as screenshots, inspects them with a designer's eye for layout defects a human catches instantly, and normalizes findings into the verify pipeline format
Run an autonomous Humanize-governed vLLM SOTA performance loop for one LLM model: first perform the fixed fair vLLM/SGLang/TensorRT-LLM deployment search and benchmark, then start one RLCR loop that repeatedly decides the gap, profiles the current bottleneck, runs layer/kernel pipeline analysis, patches vLLM code, optionally uses ncu-report-skill for kernel evidence, and revalidates until vLLM matches or beats the best observed framework under the same workload and SLA.
This skill should be used when a QA engineer wants to test or verify a completed task, run through acceptance criteria, check Gherkin scenarios against the implementation, record pass/fail results, or sign off on a ticket before merge. Triggers on phrases like "verify task #42", "run QA on this issue", "test the acceptance criteria", "sign off on task", "check if this task is ready to merge", "does this task meet its acceptance criteria", "run acceptance tests for task #X", "walk through the Gherkin for task #X", or "I want to test this task".
This skill should be used when the user asks to “test for XSS vulnerabilities”, “perform cross-site scripting attacks”, “identify HTML injection flaws”, “exploit client-side injection vulnerabilities”, “steal cookies via XSS”, or “bypass content security policies”. It provides comprehensive techniques for detecting, exploiting, and understanding XSS and HTML injection attack vectors in web applications
Assesses and improves a git repository's readiness for AI coding agents with the agentready tool, and reports the score, the certification level, the failing findings, and where the report was written. Covers one repository or every RHDH repository under a directory, and applies the fixes the report supports. Use for "assess agent readiness", "run agentready", "improve our agent readiness score", "prepare this repository for coding agents", or "assess all the RHDH repositories".
A security testing methodology for AI Agent systems. Triggers when the target system uses AI Agents for tool invocation, multi-agent collaboration, or autonomous decision-making. Covers the OWASP Agentic AI Security Top 10 (ASI01-ASI10): goal hijacking, tool misuse, identity and privileges, supply chain, code execution, memory poisoning, multi-agent communication, cascading failures, human-agent trust exploitation, and rogue agents.
API testing from OpenAPI/Swagger or case schemas: parameters, boundaries, auth, idempotency, concurrency, error responses, data consistency; runnable scripts; k6 handoff. Not for: Web UI flows, manual case writing. 接口级测试：参数/边界/鉴权/幂等/并发/错误响应/数据一致性，产出脚本与结果；含 k6 压测。不用于：Web UI、手动用例。
Turn manual cases into Playwright E2E automation run in a browser: page objects, helpers, bug evidence, reports. Not for: API tests, exploratory sessions, bug root-cause. 将手动用例转为 Playwright E2E 自动化并真实执行；含写自动化前的业务熟悉踩点、Page Object/Helper、Bug 证据与报告条目。不用于：API 接口测试、独立探索会话（exploratory-testing）、Bug 根因。
Full delivery pipeline: plan, build, ship, settle. Covers: shape/spec/design, TDD build, commit, PR creation, PR fix (CI/reviews/conflicts), PR polish, simplify, test coverage, verify ACs, walkthrough, issue management. Use when: shipping features, fixing PRs, creating PRs, building issues, simplifying code, checking quality, writing commits, managing issues. Trigger: /autopilot, /build, /shape, /commit, /issue, /check-quality, /test-coverage, /verify-ac, /pr-walkthrough.
Inspect an unfamiliar repository, turn a focused Markdown behavior scenario into a deterministic test in the repository's native test stack, run it, and preserve traceability between intent and code. Use when asked to add scenario tests, compile acceptance criteria or Given/When/Then Markdown into executable tests, reproduce a user-visible regression, or convert a narrow workflow specification into stable web, API, CLI, desktop, or mobile interaction coverage. Do not use for broad exploratory journeys or agent-judged smoke tests.
OpenHarmony XTS test code quality check tool. Scans 23 check rules (Critical + Warning), automatically generates Excel reports, and detects low-level issues and coding-standard violations. Use this skill to check XTS test code quality, scan coding-standard issues, validate test cases, find low-level issues, check getSync interface usage, verify error code assertion formats, check for duplicate test cases, check HAP naming conventions, scan BUILD.gn configuration issues, check signing certificate APL levels, etc. Trigger keywords: XTS, test quality, code check, coding standards, test case check, ACTS, DCTS, HATS.
Evaluate Clojure skills through rigorous real-project testing with and without skills enabled. Use this skill whenever you need to assess whether a Clojure skill (like clj-discover, clj-debug, clj-replace) actually improves development outcomes. Compare behavior differences via context-logs, code quality, documentation depth, and test comprehensiveness. This prevents vague or hypothetical evaluation and forces concrete real-world testing.
Find the pull request for the current branch on GitHub, GitLab, Bitbucket Cloud or Data Center, or Azure DevOps; retrieve unresolved inline CodeAnt AI review threads through the source-control provider; validate each finding; apply safe minimal fixes; verify them; and resolve only fixed threads. Use when asked to address, fix, triage, or resolve CodeAnt PR comments without installing or using codeant-cli.
Retrieves non-contained CCAI Insights conversations (losses), uses agent intelligence to cluster them into common failure patterns, and generates a markdown report. Use when you need to analyze failure patterns and build targeted regression/evaluation reports.
Use early when debugging a medium or hard bug, especially when tests alone may not reveal the real runtime failure. Trigger this before extended TDD iteration when a bug involves runtime state, ordering, persistence, streaming, concurrency, UI/manual reproduction, external services, or when a red or newly passing test may not model the real issue. Skip only when the root cause is already directly proven by a stack trace or deterministic test that exercises the real runtime path.
Create and run LangWatch experiments for pre-deployment batch testing. Use when the user wants to test an agent against a dataset, compare prompts or models, benchmark quality, detect regressions, or add a CI quality gate. Do not use for production monitoring or guardrails.
Maintains showcase/flutter_test_app and intentcall web targets (Chrome, web codegen, WebMCP bootstrap, web-showcase, webmcp verify, Chrome DevTools MCP). Use when editing web/index.html, agent_manifest.json, intentcall_webmcp.generated.js, web platform sync, Chrome dogfood, WebMCP modelContext, or agent WebMCP list/execute.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.