Skills
96,981 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Use when judging a finished security prior-art artifact — a threat-vocabulary map, a per-angle search output, an extract record, or the threat register — to decide whether the research craft is honest, complete against its own contracts, and proportionate. An acceptance gate, not authoring: it runs the producer's validator once, then judges what a validator cannot see — whether a coverage claim is provable, whether a source failure was typed or written as a zero, whether a bail was a confident relevance bail rather than a hedge, whether an evidence tier follows from evidence the record's own body agrees with, and whether a register names threats from a real vocabulary rather than coining them. Emits VERDICT: approve|revise with condition-named findings. Keywords: security prior art review, threat research review, coverage honesty, survey acceptance gate. Judges all three survey waves.
Reviews and grades an agent skill directory (SKILL.md plus supporting resources) for specification compliance, clarity, token efficiency, safety, robustness, and portability. Produces an evidence-cited weighted score and grade, P1/P2/P3 findings with minimal patch text, and a machine-readable verdict with structured findings for generator-critic loops. Offers full, triage, and incremental review depths; single, batch, comparative, forensic, and ensemble modes; and an opt-in behavioral probe. Use when a user wants a skill folder reviewed, graded, audited, or compared. Not for writing or refactoring skills (use writing-skills).
Runs an RHDH nightly ProwJob on demand through the OpenShift CI Gangway REST API, for `periodic-ci-redhat-developer-rhdh-*-nightly` and `periodic-ci-redhat-developer-rhdh-plugin-export-overlays-*-nightly` jobs, with optional image registry/repo/tag, catalog-index, Helm chart, Playwright, fork, and Slack-alert overrides. Use for "trigger the nightly", "run the e2e job now", "kick off the AKS operator job on 1.9", RC or GA image verification runs, or listing the available nightly jobs and quay.io tags.
Inspect an unfamiliar repository, interpret a broad Markdown user journey at runtime, operate the real product through its supported web, API, CLI, desktop, or mobile surface, and produce an auditable pass, fail, or blocked judgment with screenshots, logs, recordings, and a step timeline when available. Use when asked to run smoke tests, validate an end-to-end user journey, dogfood a product, test a release candidate, or execute a non-deterministic workflow that may include authentication or human checkpoints. Do not use as a substitute for deterministic unit, integration, or scenario tests.
Detect, audit, and remediate Security Misconfiguration vulnerabilities (OWASP A02:2025) in Python web applications — especially FastAPI and Flask. Use this skill whenever a user asks about: hardening a Python/FastAPI/Flask app, checking for debug mode leaks, missing security headers, exposed API docs, hardcoded secrets, insecure cookie flags, XXE vulnerabilities, or any OWASP A02 misconfiguration issue. Also trigger for tasks like "security audit", "pen test prep", "production checklist", "find misconfigs", or "harden my app". This skill covers static analysis patterns, runtime checks, tooling (Bandit, OWASP ZAP), and remediation code snippets for each sub-category of misconfiguration.
Installs sonarqube-cli if not already installed, authenticates, and integrates SonarQube with the current agent (installs analysis hooks & SonarQube MCP Server). Use when the user wants to set up SonarQube integration or asks to configure SonarQube
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes - four-phase framework (root cause investigation, pattern analysis, hypothesis testing, implementation) that ensures understanding before attempting solutions
Test-driven development execution workflow with red-green-refactor cycle, increment decomposition, and pause/continue rules. Use when building features or fixing bugs using TDD. Framework-agnostic with language-specific configs for Python, TypeScript, Go, and Ruby delegation.
Unified team skill for tech debt identification and remediation. Scans codebase for tech debt, assesses severity, plans and executes fixes with validation. Uses team-worker agent architecture with roles/ for domain logic. Coordinator orchestrates pipeline, workers are team-worker agents. Triggers on "team tech debt".
Write manual test cases (markmap) from docs, bugs or code — code-first: review code for bugs first; extracts machine-readable schema. Not for: requirement-analysis / test-strategy / test-case-review / automation. 从 PRD/API 文档、Bug 或代码写手动用例（markmap）——代码优先：先查代码找 bug 再写，抽 Schema。不用于：需求建模、策略、评审、自动化。
Write a test strategy document from a feature spec, PRD, or system description. Use when asked to create a test plan, write a test strategy, define QA approach, or plan testing for a feature or release. Produces a complete test strategy with scope, risk assessment, test types, coverage targets, and a prioritised test case outline.
“How should this be tested?” An evidence-backed risk map defining scope and depth across functional domains and 10 testing-type axes; includes carry signals and exclusion reasons. Not for writing test cases, requirement analysis, or the pipeline (qa).
Design and generate layered Kotlin + Spring tests that balance speed, realism, and regression value across unit, slice, and integration levels. Use when adding coverage for business logic, controllers, repositories, security, serialization, or end-to-end workflows, and when generic AI output would otherwise overuse `@SpringBootTest`, misuse mocks, or ignore MockK and coroutine testing idioms.
Use this skill when writing Go integration tests with Docker containers, using testcontainers-go modules (postgres, redis, kafka, etc.), setting up container-based test infrastructure, or configuring container networking and wait strategies. Covers 62+ pre-configured modules, cleanup patterns, and multi-container setups.
Execute an approved directory of dependency-linked Markdown tickets as a tested integration branch — bounded fresh workers, senior-guide/junior-implementer pairing for risky tickets, risk-based review, deterministic Git integration, resumable run state. Executes approved tickets; never authors them.
Use this skill alongside the primary implementation, review, or workflow skill when the user wants code review, repo scanning, maintainability or architecture feedback, implementation planning, documentation cleanup, readable comparisons, or a clearer structured answer. Apply it when shared formatting, alignment, and response-structure rules must be enforced across touched code or documents. Do not use it as the primary owner of language, framework, runtime, or workflow decisions.
Use when reproducing a UI bug or verifying a fix by driving a real VS Code window end to end and capturing evidence. Writes a scenario file, runs it against a dev build or installed Insiders, and produces a captioned video, per-step screenshots, a Playwright trace, and an HTML report to attach to an issue or pull request.
Diagnose why an existing implementation differs from reference evidence using AE/SSIM, pixel, section, computed-style, and transition diffs. Use for post-implementation mismatch or repair guidance; not baseline capture or full clone generation.
Write and maintain Vitest 5 unit tests for TypeScript utilities, services, stores, and API clients. Use for unit coverage, related mocks and fixtures, and Vitest review, debugging, or performance work. Adapt guidance to the project's version. Browser flows and Playwright tests use the project's browser or E2E test setup.
Implement already-specified work in code, of four types: (1) technical tasks (TK-XXX) under a user story; (2) maintenance tasks (WI-XXX) without a story — bugs, refactoring, technical debt, dependencies, operations; (3) test cases (TC-XXX) — automate the tests already documented by test-define; (4) features (FT-XXX) — automate the TCs of their acceptance criteria. Select the type according to the referenced artifact. Only implement work in State: Ready; it also accepts a bounded correction mode, delegated by quality-check, on any artifact of the branch (US-XXX, WI-XXX, FT-XXX, TC-XXX on a test/ branch, or an artifact external to the plugin), to fix a failing check or test. Always activate when the user asks to "implement", "develop", "execute tasks", "code", "automate the tests", "implement the test cases", "work on the TK/WI/TC/FT", or variants implying writing code from an already-drafted specification.
Close and integrate the work of a user story (US-XXX), a maintenance task (WI-XXX), or a test automation (test/ branch on a US-XXX, WI-XXX, or FT-XXX) by merging the branch into the branch it was created from, after verifying that progress.md has all work units in Done and that the closing quality gates pass (quality-check, code-review, and trace-validate). Activate when the user asks to close, deliver, merge, integrate, finish, or submit the work of a story, a WI, a feature, or the current branch.
This skill should be used when a developer is ready to implement a GitHub Task issue and needs to read the full spec hierarchy (Task + Feature + Epic), explore the codebase, produce a concrete Technical Approach with real file paths, and drive TDD implementation against Gherkin scenarios. Triggers on phrases like "implement task #42", "pick up task", "start working on this task", "build the task", "develop task #X", "code up the task", "write the tests for task #X", "start coding this ticket", "resume task #X", "continue task #X", or "I want to implement this ticket".
This skill should be used when a team wants to create or refine the QA standards document — for example "create the QA steering doc", "document our test strategy", "write the QA standards", "document our definition of done", "set up the QA guidelines", or "update the QA doc". Generates docs/steering/QA.md as a living document capturing test strategy, coverage thresholds, test patterns, definition of done, and environments. Generated once and refined — not regenerated from scratch.
Submit an 8D to a customer, format a Ford 8D report, BMW G8D, VW QMSS, or OEM complaint response for formal submission. Covers OEM-specific format requirements, evidence standards, and discipline-by-discipline writing rules for D0–D8. Use when preparing an 8D report for Ford, BMW, VW/Audi, Stellantis, or any customer requiring formal 8D closure.
Assess review feedback from any source (pull or merge request, issue, ticket, document comments, pasted notes), propose dispositions, then implement and reply. Use when the user shares review feedback to work through, or asks to handle and answer review comments.
Conducts privacy auditing of AI models including training data extraction testing, membership inference attacks, model inversion testing, and attribute inference assessment. Uses ML Privacy Meter and related tools to quantify privacy leakage. Keywords: model audit, membership inference, privacy meter, model inversion, training data extraction.
Calculate Cpk process capability index to assess whether a process meets specification requirements. Use this skill when the user needs to evaluate process capability, compare processes, or determine if quality targets are achievable — even if they say 'can our process meet spec', 'process capability', or 'Cpk calculation'.
The skill should be used when the user asks about Alibaba Cloud AgentLoop platform for onboarding applications into observability, high-code instrumentation with loongsuite-genai-utils and OpenTelemetry SDK (高代码埋点、LLM Trace 字段、上下文传递与链路串联), Live-Debug runtime diagnostics, managing Datasets, building pipelines, and evaluating. Live-Debug covers ServiceTask dynamic logging, snapshots, metrics, spans, and JVM inspection.
Router skill for API penetration testing across REST, GraphQL, gRPC, and WebSocket. Covers OWASP API Top 10 (2023) including BOLA/BFLA/BOPLA, JWT attack chains, GraphQL introspection abuse, and mass assignment. Invoke when the user asks to pentest an API, analyze OpenAPI/Swagger, test auth/authorization, fuzz endpoints, or find API vulnerabilities.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.