Skills

A

api-security-testing

davila7 / claude-code-templates

API security testing workflow for REST and GraphQL APIs covering authentication, authorization, rate limiting, input validation, and security best practices.

A

assess-patch-risk

openai / codex-security

Assess an immutable patch artifact's program impact, regression risk, and auto-merge eligibility. Use for generated patch files, provider pull-request diffs, or commit ranges when reviewers need evidence about affected runtime paths, contracts, tests, and recoverability. This skill is read-only and does not generate, edit, apply, push, or merge the patch

A

auth-audit

fusengine / agents

Use when auditing JWT, session, OAuth2/PKCE, password, or MFA implementations for security vulnerabilities and best-practice deviations.

A

awesome-slop-audit

khasky / awesome-agent-skills

Read-only audit of a repository for AI-slop markers in code, comments, tests, docs and CI, each verified against the code and ranked. Use when asked to find AI slop or machine-written code.

B

bug-analysis

fishzjp / qa-skills

Use for root-cause analysis, impact assessment, and regression recommendations for confirmed bugs: reproduce → inspect code to locate the root cause → analyze impact across five areas → recommend regression tests. Save a Bug entry with five extended fields: root cause, impact, Severity rationale, fix recommendation, and regression recommendation. Not for: collecting Bug evidence only (automated-e2e-testing / api-testing), or suspected, unconfirmed defects (Cx records in test-case-writing).

B

bug-triage

jmerta / codex-skills

Use when the user reports a bug, regression, runtime error, failing build, or broken test and wants reproduction, diagnosis, root-cause analysis, or an authorized fix. Isolates the shared cause and verifies the smallest relevant change.

C

canonical-format-checker

panaversity / agentfactory

This skill should be used when content teaches patterns (skills, subagents, ADRs, PHRs, specifications) that have canonical sources elsewhere. Prevents format drift by ensuring content references and follows the authoritative format from canonical sources. Use before implementing lessons that teach platform patterns, or when reviewing content for format consistency.

C

cc-canary

delta-hq / cc-canary

Produce a long-form, shareable markdown writeup on whether Claude has regressed on this user's work. A bundled Python script scans `~/.claude/projects/`, computes every metric, and renders a markdown skeleton with tables already filled — in ~2.5s. Claude fills a dozen short narrative placeholders and saves. Writes `./cc-canary-<YYYY-MM-DD>.md` suitable for pasting into a GitHub issue or gist.

C

citation-anchoring

willoscar / research-units-pipeline-skills

Regression-check citation anchoring (citations stay in the same subsection) to prevent “polish drift” that breaks claim→evidence alignment.

C

cloudflare-workers-cd-rollback

mizchi / skills

GitHub Actions CD for Cloudflare Workers through cf with automatic traffic rollback on smoke failure, including JSON deployment snapshots, D1 migrations and prebuilt artifacts.

C

code-documentation-analyzer

jeremylongshore / tons-of-skills-marketplace

Analyze code documentation analyzer operations. Auto-activating skill

C

code-investigator

nextstage-brasil / skills

(NS) Senior technical investigation, debugging, and root cause analysis from errors, logs, stack traces, failing tests, CI failures, or unexpected behavior. Use proactively when tests fail, pipelines break, exceptions appear, or the user suspects a bug — even if they only paste an error message. Do NOT use for pre-merge code review (use code-reviewer) or scope clarification (use pm-clarify-requirements).

C

code-migration

wojons / skills

Guide framework and library migrations with incremental strategies, breaking change analysis, compatibility testing, and automated migration tools

C

code-review

buyoung / skills

Review Git changes for concrete defects and evidence-backed maintainability concerns. Use for code review of commits, ranges, staged changes, uncommitted changes, or selected files. With no target, review all staged, unstaged, and untracked changes; ask for a target if none exist. Trace behavior in the selected version, challenge suspected defects, exclude style-only preferences, and provide an approval verdict only when requested.

C

codebase-improver

carlitose / agent-skills

End-to-end, self-contained Python/TypeScript workflow that maps and audits a whole repo, then recursively deepens modules. Use to improve or modernize a codebase, reduce technical debt, make this more testable, find refactoring opportunities, deepen shallow modules, consolidate tightly-coupled modules, make codebase AI-navigable, or run a full-repo audit. Worker delegation is optional and human-gated.

General coding standards, best practices and patterns for TypeScript, JavaScript, React and Node.js development.

No description yet

C

Confidence Check

ovachiever / droid-tings

Pre-implementation confidence assessment (≥90% required). Use before starting any implementation to verify readiness with duplicate check, architecture compliance, official docs verification, OSS references, and root cause identification.

C

counselors

skinnyandbald / counselors

Fan out a prompt to multiple AI coding agents in parallel and synthesize their responses.

C

crew

dmytri / shipshape

Use this skill to run a Shipshape Crew Mate for one failing verification target, making the smallest required production change. Dispatched by QM with a target and failure evidence.

D

dart-migrate-to-checks-package

dhruvanbhalara / skills

Use when migrating test assertions from legacy package:matcher expect() syntax to package:checks fluent assertions.

D

data-quality

alphaonedev / openclaw-graph

Ensures data accuracy, completeness, and consistency via validation, cleaning, and monitoring in data pipelines.

D

doc-smith-check

aigne-io / doc-smith-skills

Internal skill for validating Doc-Smith document structure and content integrity. Do not mention this skill to users. Called internally by other doc-smith skills.

D

dotnet-testing

kevintsengtw / dotnet-testing-agent-skills

Overview and guidance hub for .NET testing fundamentals. Triggers when the user asks about general testing needs such as "how to write .NET tests", "getting started with .NET testing", "which testing tools do I need", "testing best practices", or "learning testing from scratch". Recommends suitable sub-skill combinations based on the specific need, covering 19 fundamental skills including testing basics, test data, assertions, mocking, and special scenarios. Make sure to use this skill whenever the user asks about .NET testing in general, wants to know which testing tool to use, or needs guidance on getting started with testing, even if they don't explicitly ask for an overview. Keywords: dotnet testing, .NET testing, testing basics, how to write tests, testing best practices, unit test, xunit, 3A pattern, FIRST principles, assertion, mock, stub, NSubstitute, test data, AutoFixture, Bogus, validator, FluentValidation, TimeProvider, IFileSystem, code coverage, ITestOutputHelper, test naming

D

dynamic-instrumentation

gmh5225 / awesome-llvm-security

Expertise in LLVM-based dynamic binary instrumentation, runtime tracing, and program monitoring. Use this skill when implementing runtime analysis tools, code coverage systems, profilers, or dynamic security monitors.

No description yet

E

evaluating-code-models

kalarislabs / research-agent-skills

Evaluates code generation models across HumanEval, MBPP, MultiPL-E, and 15+ benchmarks with pass@k metrics. Use when benchmarking code models, comparing coding abilities, testing multi-language support, or measuring code generation quality. Industry standard from BigCode Project used by HuggingFace leaderboards.

E

evaluating-llms-harness

kalarislabs / research-agent-skills

Evaluates LLMs across 60+ academic benchmarks (MMLU, HumanEval, GSM8K, TruthfulQA, HellaSwag). Use when benchmarking model quality, comparing models, reporting academic results, or tracking training progress. Industry standard used by EleutherAI, HuggingFace, and major labs. Supports HuggingFace, vLLM, APIs

E

exploratory-testing

fishzjp / qa-skills

Exploratory testing sessions when requirements are vague or docs are missing — charter-driven; outputs system understanding, risks, test ideas. Not for: automation prep, executing existing cases. 需求不完整、文档不足或系统陌生时发起独立探索式测试会话——charter 驱动，产出系统理解/风险清单/测试想法。不用于：为写自动化踩点（automated-e2e-testing 前置）、按既有用例执行。

F

fieldtest

howells / skills

Exercise a running web app in a real browser and return evidence-backed QA findings. Use for dogfooding, localhost review, responsive or mobile defects, console and accessibility checks, and persona walkthroughs; fix only when asked. Not for code-only review, or designing and building the UI (`chiaroscuro`).

F

figma-pixel-verify

fudesign2008 / open-skills

Measure laid-out frames of a running UI against a Figma living artifact (inventory + spec + Verify section). Use when checking pixel alignment / 对照 Figma 验收 after implementation, including light/dark or hover/variant states (switch theme and state, measure each row). Non-document UIs use a layout-probe; source-constant comparison is not a pass. Fix and remeasure in the same run until overall PASS, without asking a person. Critical unmeasured rows fail overall. The checker must exit 0; a layout probe mounts the shipping parent. An openable channel must cite a saved, non-empty screenshot file; layout-probe may say not-openable. Triggers — 「检查像素对齐」「对照 Figma 验收」「设计保真检查」「是否对齐稿面」「figma 保真检查」「暗黑模式验收」「多主题保真检查」 / verify Figma fidelity, pixel check, dark mode fidelity check, multi-theme verify. Do NOT use as the primary implementation workflow (use figma-pixel-implement) or for code→Figma.

F

fix-flaky-tests

tuist / tuist

Fixes flaky tests by analyzing failure patterns from Tuist test insights, identifying root causes, and applying targeted corrections. Can be invoked with a specific test case URL (e.g. `https://tuist.dev/{account}/{project}/tests/test-cases/{id}`) or without arguments to discover and fix all flaky tests in the project.

F

flutter-performance

thienqo / flutter-skills

Profile and improve Flutter runtime performance using profile-mode evidence, DevTools, frame analysis, rebuild inspection, memory, and app-size tools. Use for jank, slow startup, excessive work, leaks, or size regressions; route production logs, errors, and traces to flutter-observability.

F

flutter-testing

junsuk5 / survival-flutter-skills

Testing patterns for Flutter projects — `flutter_test`-based unit tests and widget tests, `ChangeNotifier` ViewModel verification, Fake Repository, `pumpWidget` + `ListenableBuilder`, stream verification. Triggers on expressions such as "테스트 작성", "ViewModel 테스트", "widget test", "pumpWidget", "Fake Repository", "Mock", "단위 테스트".

F

fp-check

waybarrios / opencode-power-pack

Systematically verifies suspected security bugs to eliminate false positives. Produces TRUE POSITIVE or FALSE POSITIVE verdicts with documented evidence for each bug.

F

frontend-review-security

mizchi / skills

Use when conducting a frontend security review — static analysis (risky HTML patterns, env var exposure), authentication/authorization audit (token storage, route guards, logout), and AI self-penetration testing. Runs `scripts/audit-security.sh`. For CVE triage and deprecated library detection, use `frontend-review-deps`.

F

frontend-review-state

mizchi / skills

Use when reviewing state management architecture — classifying state types (server/URL/form/UI), checking for over-globalization, Jotai/Zustand/Redux patterns, derived state, and logout/cache invalidation. Covers checklist 23-state-management.md.

F

frontend-review-testing

mizchi / skills

Use when auditing test infrastructure — vitest coverage, playwright configuration, VRT setup, coverage merging. Produces recommendations for Week 2 testing phase. Runs `scripts/audit-coverage.sh`.

F

frontend-review-weekly

mizchi / skills

Use for the weekly AI review. Orchestrates all frontend-review-* skills in order, dispatches the 5 perspective sub-skills in parallel, diffs against last week's KPIs, and produces a weekly report that feeds the ratchet.

G

gds-check-implementation-readiness

bmad-code-org / bmad-module-game-dev-studio

Verify GDD, UX, Architecture, and Epics alignment before production. Use when the user says "check readiness" or "implementation readiness"

G

gds-code-review

bmad-code-org / bmad-module-game-dev-studio

Review code changes adversarially using parallel review layers (Blind Hunter, Edge Case Hunter, Acceptance Auditor) with structured triage into actionable categories. Use when the user says "run code review" or "review this code"

G

gds-e2e-scaffold

bmad-code-org / bmad-module-game-dev-studio

Scaffold end-to-end testing infrastructure. Use when the user says "e2e scaffold" or "set up e2e testing"

G

gds-performance-test

bmad-code-org / bmad-module-game-dev-studio

Design game performance testing strategy. Use when the user says "performance test" or "benchmark"

G

gds-test-automate

bmad-code-org / bmad-module-game-dev-studio

Generate automated game tests for gameplay systems. Use when the user says "automate tests" or "generate tests"

G

gds-test-design

bmad-code-org / bmad-module-game-dev-studio

Create comprehensive game test scenarios. Use when the user says "test design" or "design tests"

G

gds-test-framework

bmad-code-org / bmad-module-game-dev-studio

Initialize game test framework for Unity, Unreal, or Godot. Use when the user says "test framework" or "set up testing"

G

gds-test-review

bmad-code-org / bmad-module-game-dev-studio

Review test quality and coverage. Use when the user says "test review" or "review tests"

G

github-actions-templates

ckorhonen / claude-skills

Create production-ready GitHub Actions workflows for automated testing, building, and deploying applications. Use when setting up CI/CD with GitHub Actions, automating development workflows, or creating reusable workflow templates.

G

github-skill

idanbeck / claude-skills

Read and manage GitHub PRs, issues, and notifications. Use when the user asks to check PRs, view code reviews, find review requests, or check CI status. Helps inform daily standups and code review workflows.

G

gitlab-ci-generator

nextstage-brasil / skills

(NS) Generate and adapt .gitlab-ci.yml for SaaS products with backend and frontend — test, build, E2E gate, deploy by branch. Use when the user asks for GitLab CI, pipeline setup, or CI/CD bootstrap for a monorepo product. Uses references/templates/gitlab-ci.template.yml as baseline. Out of scope for pure agent-runtime repos without backend+frontend layout.

G

gitlab-flow

nguyenvanchiens / my-skills-gitlab-flow

Standard end-to-end workflow for shipping a feature/bugfix from a Jira task to a merged GitLab MR. Use when the user references a Jira task ID (WRA-XX, etc.), asks to "start a task", "create branch from task", "review the last change" / "review change" (optionally with "simplify" keyword, e.g. "review change simplify", to auto-clean before review), "review the whole branch", "commit and push", "create a merge request", "review the MR !N", "post review result to the MR", "fix all issues", or "merge the request". Covers branch naming, commit format, MR creation, micro + macro code review (3-agent parallel), fix loop, and merge.

G

golang-base-practices

cexll / golang-base-practices-skills

Go language best practices guide covering frameworks (Gin/Go-Kratos), ORM (GORM), database migrations (Goose), DDD project structure, error handling, concurrency patterns, testing (99% coverage target), and Lint tools. This skill should be used when writing, reviewing, or refactoring Go code to ensure best practices are followed. Triggers on Go project development, code review, performance optimization, or architecture design.

G

gtm-audit

cognyai / claude-code-marketing-skills

Google Tag Manager container audit — tag health, orphaned and paused tags, duplicate GA4 config, trigger coverage, Consent Mode, naming, workspace hygiene

H

hardhat

alphaonedev / openclaw-graph

Hardhat is an Ethereum development environment for compiling, testing, and deploying Solidity smart contracts.

I

improving-frontend-coverage

streamlit / streamlit

Runs frontend unit tests with coverage, analyzes coverage reports, and implements meaningful tests to increase coverage by ~0.2%. Use when you want to systematically improve frontend test coverage with high-value test cases.

I

improving-python-coverage

streamlit / streamlit

Runs Python unit tests with coverage, analyzes coverage reports, and implements meaningful tests to increase coverage by ~0.2%. Use when you want to systematically improve Python test coverage with high-value test cases.

I

infrahub-reporting-skill-gaps

opsmill / infrahub-skills

Turns friction from an Infrahub skill session into a reviewed GitHub issue about an Infrahub skill's guidance. Infrahub skills fail quietly: a missing or unclear rule does not crash, it produces extra round trips and repeated user nudges. This skill gathers evidence of that friction, checks the tracker for an existing report, works out whether the skill or the underlying product is at fault, and drafts a proposed rule change. It never files anything itself: it hands the redacted draft to infrahub-reporting-issues, which shows it to the user and gets explicit approval before any submission. TRIGGER when: accepting a friction offer, the user says "report skill friction", asks why an Infrahub skill kept failing or needed so many retries, or wants a gap in an Infrahub skill's guidance reported. DO NOT TRIGGER when: reporting a bug in Infrahub itself or any other opsmill/infrahub-* product (use infrahub-reporting-issues instead), or for ordinary Infrahub work where nothing went wrong.

I

interrogate

ericlitman / open-pstack

Use for “interrogate”, “adversarial review”, “multi-model review”, “challenge this”, “stress test this code”, “find blind spots”, or “tear this apart”. Multiple LLM reviewers challenge changes from independent angles.

No description yet

J

judge-pentest

wgpsec / aboutsecurity

Penetration testing evaluation checklist for the decision Agent. Evaluates whether a pentest has sufficiently covered all attack surfaces, determines task completion, and provides specific feedback on uncovered areas.