Skills
96,981 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Use when auditing dependency health — outdated packages, CVE triage with attack-vector weighting, deprecated/declining library detection (trend-watch). Runs `audit-deps.sh` and `audit-trend-watch.sh`. Pairs with `frontend-review-security` for the full security picture.
Use when starting a frontend review engagement or when the user asks for an initial assessment ("triage", "day 0", "what's the state of this repo"). Reads package.json, README, gh issues, and produces a scorecard covering lockfiles, TypeScript strictness, testing, CI, and known issues. Runs `scripts/audit-triage.sh`.
Audit a game, feature, failure loop, combat encounter, reward system, progression wall, or high-variance mechanic for perceived fairness and frustration. Use when diagnosing whether players feel cheated, whether difficulty feels deserved, whether randomness, feedback, and challenge interact badly, or why a design remains technically functional yet still produces anger, blame, or refusal to retry
Rules for writing and reviewing GC-safe C++ code in the Hermes VM runtime. Use when writing, modifying, or reviewing C++ runtime VM code that uses internal Hermes VM APIs (as opposed to code using JSI). This includes working with GC-managed types (HermesValue, Handle, PinnedValue, JSObject, StringPrimitive, etc.), Locals, GCScope, PseudoHandle, CallResult, or any function with _RJS suffix. Typically in lib/VM/, include/hermes/VM/, API/hermes/, or API/napi/.
Consolidated game developer for story execution, code implementation, code review, QA/test authorship, and sprint orchestration. Use when the user asks to talk to Link Freeman, the Game Developer, the Game QA, or the Game Scrum Master.
Capture the "Why" behind code changes during AI-assisted development. Creates branch-scoped markdown journals preserving reasoning, tradeoffs, and context. Also maintains living business-level QA docs in docs/ for self-healing tests and requirements clarity. Use before commits, PRs, or multi-file changes. Use when the user says "remember to journal", "anything to journal?", "journal this", "update the docs", or "anything to document?".
Identifies the local user's GitHub account and git identity before performing code reviews. Load this skill at the start of any PR review, code review, or commit log analysis so findings can be framed relative to the user's own prior comments, commits, and approval status.
Use this skill when the user asks to “test for insecure direct object references,” “find IDOR vulnerabilities,” “exploit broken access control,” “enumerate user IDs or object references,” or “bypass authorization to access other users’ data.” It provides comprehensive guidance for detecting, exploiting, and remediating IDOR vulnerabilities in web applications.
Periodic pass that keeps a project's verification skill and feature map honest: parallel source readers per feature, one live session driving every feature, at most one PR of proven corrections. Use for /maintain-verification-skill or "audit the verify skill".
A security testing methodology for the MCP (Model Context Protocol) protocol. Triggers when the target environment uses MCP Servers to integrate external tools, when the security of MCP tool descriptions needs to be assessed, or when testing the security boundaries of Agents invoking tools via MCP. Covers: tool description poisoning, rug pull attacks (dynamic tampering), instruction override (Shadow Tool), hidden instructions (ANSI/Unicode), cross-Server attacks, token theft, schema manipulation, and context overflow.
Detect, analyze, and remediate OWASP A10:2025 — Mishandling of Exceptional Conditions in Python web applications (FastAPI and Flask). Use this skill whenever the user asks about error handling security, exception management, fail-open vulnerabilities, stack trace exposure, uncaught exceptions, transaction rollback safety, or resource leaks in exception paths. Also trigger for any OWASP A10 audit, security code review involving try/except blocks, global exception handlers, or HTTP error responses that may leak sensitive information. If the user mentions CWE-209, CWE-248, CWE-636, CWE-703, CWE-754, or CWE-476 in a Python context, use this skill immediately.
Sets up and tunes the linter and formatter for Node/TypeScript - Biome as the fast one-tool option or ESLint flat config plus Prettier, rule tuning, import sorting, unused-import removal, eslintrc-to-flat and ESLint-to-Biome migrations. Use when the user asks to set up or fix linting, formatting, a slow linter, ESLint, Biome or Prettier. Not for Next.js apps, type checking, or test setup.
Scan a repository for Opus-4.6-era patterns that break or degrade on Opus 4.7 — fixed-budget Extended Thinking parameters, retired model ID aliases, and prompts that assumed verbose default output or eager sub-agent delegation. Produces a categorized report with file:line references and migration actions. Triggers on: "opus 4.7 migration", "migrate to opus 4.7", "audit for opus 4.7", "opus 4.6 to 4.7", "scan for budget_tokens", "find retired model IDs", "adapt repo to opus 4.7". NOT for implementing migrations — this skill identifies candidates.
Build, review, debug, configure, migrate, teach, or plan Oxlint JavaScript/TypeScript linting with current Oxc docs and a full usage guide. Use for oxlint how-to, oxlint.config.ts, defineConfig, .oxlintrc.json, categories correctness suspicious pedantic style, plugins react import typescript unicorn vitest jest jsx-a11y nextjs, React Compiler react/immutability react/purity (1.79+ split from react/react-compiler), type-aware linting, oxlint-tsgolint, eslint-plugin-oxlint, @oxlint/migrate, jsPlugins alpha, Vite+ vp lint (lint block in vite.config), ignorePatterns, oxlint-disable comments, --fix, --debug timings, CI formats, progressive adoption, and ESLint-to-Oxlint migration.
Verify codebase quality — architecture consistency, convention compliance, gap analysis. Triggers: code review, architecture check, quality, gap analysis default: bkit:code-analyzer validate: bkit:design-validator gap: bkit:gap-detector qa: bkit:qa-strategist team: bkit:cto-lead
Complete browser automation with Playwright. Auto-detects dev servers, writes clean test scripts to /tmp. Test pages, fill forms, take screenshots, check responsive design, validate UX, test login flows, check links, automate any browser task. Use when user wants to test websites, automate browser interactions, validate web functionality, or perform any browser-based testing.
Write and maintain Playwright browser and end-to-end tests for web apps, plus direct API tests with APIRequestContext. Use for browser or E2E coverage even when the user does not name Playwright, and for related mocks, fixtures, assertions, and test-performance work
Write and maintain end-to-end tests with Playwright. Use when someone asks to "add e2e tests", "test my web app", "set up Playwright", "write browser tests", "test login flow", "visual regression testing", "test across browsers", or "automate UI testing". Covers test setup, page objects, authentication, API mocking, visual comparisons, and CI integration.
Post Superagent PR security scan findings as inline GitHub pull request review comments using the authenticated gh CLI. Use whenever you need to comment on a PR scan finding, manage Superagent PR labels, complete a GitHub check run, or avoid posting findings as general PR thread comments. Trigger for any Superagent sandbox PR scan handoff that owns GitHub side effects via gh.
Analyzes a PR diff and appends a categorized review guide to the PR description, highlighting where human judgment is needed: security, config/infrastructure, new dependencies, data model changes, novel patterns, concurrency/state, and documentation drift (code renames that leave docs stale). Use whenever a user wants to prepare a PR for human review or flag areas for reviewer attention — including phrasing like "prep this for review", "what should reviewers look at?", or "add a review guide".
Run external coding agents (Codex, Claude Code, OpenCode, native Grok Build, Gemini, Devin CLI) as independent reviewers, stateful repository researchers, or single-agent implementers. Use for multi-model opinions and code review, steerable Grok research, full-access delegation, long-running work, reattaching to delegated runs, or showing current subagents in the optional UI. Not for simple questions answerable directly from docs or the current codebase.
Use when the user provides an original and rewritten version, asks whether a rewrite preserved protected content, or wants a deterministic check for code, frontmatter, quotes, tables, links, paths, numbers, headings, and residual AI-pattern regressions.
ISO 13485 Quality Management System specialist for medical device companies. Provides QMS implementation, maintenance, process optimization, and compliance expertise. Use for QMS design, documentation control, management review, internal auditing, corrective actions, and ISO 13485 certification activities.
After a code change (diff/fix/requirement change), decide what to regression-test: trace changed files → functions → features → cases and output a ranked list. Not for editing test cases (test-case-writing) or long-term strategy (test-strategy). After code changes, determine which tests to regress by tracing the changes and produce a prioritized regression checklist. Not for incremental case edits or long-term strategy.
Design and audit release health dashboards, rollout gates, canary metrics, crash/error monitoring, support signals, store release status, desktop auto-update adoption, rollback triggers, and post-release review for apps, SaaS, games, web, and desktop software. Use when launching releases, patches, experiments, or staged rollouts that need operational confidence.
Model a requirement/system: extract goals, scope, roles, rules, exceptions, dependencies from PRD, docs, bugs, code; outputs a structured model with clarifications. Not for: writing cases, strategy decisions, the pipeline. 建模需求/系统：从 PRD、文档、Bug、代码提炼目标/范围/角色/规则/异常/依赖。不用于：直接写用例、策略、流水线。
Use when user wants to optimize or tune something measurable through repeated experiments — "make X faster", "improve [metric]", "find best config", "iterate overnight", "run experiments until it hits N". Triggers on quantitative goals (build time, latency, pass rate, accuracy) or qualitative ones scoreable against a rubric (prompt quality, doc parsing). Skip for one-shot bugs with a clear fix or tasks where the user wants direct implementation without exploration.
Use to REVIEW changed frontend code for accessibility: staged files, a working diff, branch, or PR; prompts such as 'review a11y', 'is this accessible?', or 'anything to fix before merge?'; and hook or CI findings on a change. Run the bundled install-free engine with cross-file JSX/TSX analysis, then adjudicate candidates and return a severity-ranked WCAG 2.2 AA review with file:line fixes, residual rendering risks, and a verdict. Use `ultra11y` instead for whole-repo audits, dated conformance reports, country standards, PRD backlogs, or authoring accessible markup.
Review code changes in Tenzir projects. Use when auditing diffs or pull requests for bugs, security issues, missing tests, documentation drift, readability problems, performance regressions, user experience issues, or when deciding how to respond to pull request review comments, especially GitHub review comments and threads. Also use this skill whenever the user says "review", "look at this PR", "check my changes", "audit this diff", "what do you think of this code", or asks for feedback on any code they've written or changed — even if they don't explicitly say "code review."
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.