Skills
96,981 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Load and performance testing. k6 (Grafana), Artillery, Apache JMeter, Locust (Python). Scenario design, thresholds, ramp-up patterns, and CI/CD integration. USE WHEN: user mentions "load test", "performance test", "stress test", "k6", "Artillery", "JMeter", "Locust", "throughput", "benchmarking" DO NOT USE FOR: unit/integration testing - use testing skills; monitoring in production - use `opentelemetry`
Converts a markdown PR writeup or code review (one with ```diff fenced blocks and severity-tagged GFM callouts [!BLOCKER]/[!MAJOR]/[!MINOR]/[!NIT] callouts) into a single-file 2-column HTML review — unified-diff on the left, severity-tagged annotation cards on the right, top jump-nav listing every finding, mandatory named reviewer footer. Triggers when the markdown-html-orchestrator classifies an input as REVIEW, or when invoked directly via /cs-md-review. Refuses without explicit --reviewer (a code review must name a human), refuses if no diff hunks present (route to md-document instead), and refuses to encode severity in color only (every badge ships color + icon + aria-label per WCAG 1.4.1). Use after orchestrator routing.
Create a Pull Request (PR) or Merge Request (MR) from the current branch to a target branch asked of the user, with mandatory blocking quality gates before creating it: run quality-check, code-review, and trace-validate (all three must return an approved verdict) and, if docs/policies/definition-of-done.md exists, verify the code against that Definition of Done. Works on any git repository with a remote: auto-detects the platform (GitHub, GitLab, Bitbucket, Gitea, Azure Repos, etc.) from the remote and uses the available CLI. Auto-generates the title and description from the commits and creates the PR in a single pass. Always use whenever the user asks to create, open, generate, raise, or submit a PR, MR, pull request, or merge request, even if they only say "create the PR" or "push it to develop" without naming the platform.
Run a change-gated, branch-scoped lint preflight (ESLint / markdownlint / actionlint) on the files a branch changes versus its base, classify each violation as introduced vs pre-existing, and drive the fix/defer loop via an exit-code contract (0 pass, 1 introduced/blocking, 2 pre-existing only). Use when asked to run preflight, check whether a branch will pass lint before pushing, or as the lint gate inside a ship/PR flow. Lints only the categories the branch touched — not a whole-repo lint — with linted workspaces and the base branch auto-detected, so a consuming repo configures nothing in the common case.
Expert Python backend code reviewer that identifies over-complexity, duplicates, bad optimizations, and violations of best practices. Use when asked to review Python code quality, check for duplicate code, analyze module complexity, optimize backend code, identify anti-patterns, or ensure adherence to best practices. Ideal for preventing AI-generated code from creating unnecessary files instead of imports, finding repeated validation logic, and catching over-engineered solutions.
Authors GitHub Actions quality-gate workflows for a Python repo — lint/type/test jobs, version matrices, uv caching, an all-checks-passed aggregator, required checks, rulesets, merge queues, SHA pinning, zizmor hardening. Use for 'set up continuous integration quality gates', 'make checks required', 'move branch protection to rulesets', 'harden the workflows'. Not for release pipelines or commit hooks.
Read a customer's live LangSmith runs, traces, threads, and feedback scores via the LangSmith MCP server (or langsmith SDK fallback), pattern-match against the shared finding catalog, and write a findings report split into Ratel-flavored improvements and stack-agnostic low-hanging fruit. Use to scan the LangSmith dashboard, dig into the run tree or failed runs, review this week's runs, audit their observability, see what the agent's doing wrong, or `/ratel-langsmith-analyze`. Writes to <repo>/.ratel/ (accumulates); fails fast without a reachable server or API key, honest-skips clean data, never edits code. Follow-up to /ratel-langsmith-integrate.
A strict interface review with evidence. Resolves the scope, recons the stack and its conventions, inspects in a fixed order from function to polish, reports findings only with a file and line and a concrete change, ranks by user impact, caps at fifteen, and returns a single table plus a verdict. Use when asked to review, critique, audit, or QA a screen, component, branch or pull request for interface quality.
Diagnose Roblox gameplay, replication, performance, and runtime issues. Use when debugging Roblox bugs, Luau errors, replication issues, RemoteEvent problems, DataStore failures, UI not updating, physics/network ownership issues, memory leaks, or performance regressions in Roblox experiences.
Use this skill whenever auditing, reviewing, or testing Python web applications (FastAPI or Flask) for OWASP A09:2025 — Security Logging & Alerting Failures. Trigger this skill when the user mentions: logging security, audit trails, log injection, sensitive data in logs, alerting gaps, insufficient logging, SIEM integration, log monitoring, incident detection readiness, or any request to audit or fix logging/alerting in a Python backend. Also trigger when a user asks "are we logging the right things?", "how do I detect attacks?", or "what should we be alerting on?". Do NOT skip this skill just because the request sounds simple — log-related security issues are consistently underestimated and require systematic coverage across all five CWEs.
Implement an agreed software specification, finish a partial implementation, or correct implementation and PR review findings. Use for scoped delivery with meaningful TDD where practical and evidence of complete behavior. Bring a disproved spec design to the user with options before replacing it.
Ship workflow: detect + merge base branch, run tests, review diff, bump VERSION, update CHANGELOG, commit, push, create PR. Use when asked to "ship", "deploy", "push to main", "create a PR", or "merge and push". Proactively suggest when the user says code is ready or asks about deploying.
Ship workflow: merge base branch, run tests, review diff, bump VERSION, update CHANGELOG, commit, push, create PR. Use when asked to "ship", "deploy", "push to main", "create a PR", "merge and push", or "get it deployed". Proactively invoke this skill when the user says code is ready, asks about deploying, wants to push code up, or asks to create a PR.
Orchestrate data-driven SillyTavern rolecard live development, iteration, validation, JSON packaging, PNG payload embedding, release auditing, and delivery by adapting to tools already present in the target project. Use when discovering or running a project-provided watch build for Tavern Helper real-time editing; creating or checking a profile, manifest, operation plan, or contract; choosing validation from changed-file impact; detecting a card type and runtime dependency inventory; enforcing required embedded regex/schema/helper assets and regional loader policy; composing version components; packing or re-packing a card; synchronizing card-bound worldbook versions; generating final JSON or PNG artifacts; verifying embedded payload parity; or preparing an explicit checkpoint or public release. Do not use for exploratory card disassembly or shared component-library design; use sillytavern-card-components instead.
Reproduce, diagnose, collect execution evidence for, and close acceptance of rolecard behavior inside a real SillyTavern runtime using any capable browser driver. Use when the primary task requires live execution of imports, required regex/helper scripts, host extensions, Git/CDN or regional loaders, MVU/Zod capabilities, opening pages, status bars, control centers, iframes, real-time reload, console, responsive, or interaction checks that static previews cannot prove. Do not use as the primary skill for designing or implementing embedded UI source; hand those changes to sillytavern-embedded-ui, then resume runtime validation on the rebuilt artifact.
Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, update or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.
Diagnose and improve an existing Claude/agent skill without changing its core purpose or original input/output contract. Use whenever the user wants to optimize, refine, clean up, debug, restructure, or improve an existing skill and needs contract-first review, hypothesis-driven proposals, representative test prompts, or conservative before/after validation instead of a blind rewrite.
Security testing skill for OWASP A08:2025 — Software or Data Integrity Failures in Python web applications (FastAPI and Flask). Use this skill whenever the user wants to audit, detect, test, or fix integrity vulnerabilities including: insecure deserialization (pickle, yaml, jsonpickle, dill), mass assignment flaws, untrusted CDN/module inclusion, unsigned updates, CI/CD pipeline integrity, or Subresource Integrity (SRI) checks. Trigger this skill for ANY task involving pickle/deserialization security, CWE-502, CWE-915, CWE-829, CWE-345, or CWE-494, even if the user doesn't explicitly mention OWASP A08.
Foundry development workflow for Solidity smart contracts. Use when building, testing, or deploying with Foundry (forge, cast, anvil). Covers project setup, foundry.toml configuration, testing patterns, fuzz testing, invariant testing, fork testing, cheatcodes, deployment scripts, and debugging. Triggers on tasks involving forge build, forge test, forge script, cast, anvil, or Foundry-based Solidity development.
Boot 4 renamed @MockBean to @MockitoBean, moved test slice annotations to new packages, and changed context caching behavior. Read for correct AssertJ/BDDMockito idioms and Boot 4 migration. Default fallback when no specific slice annotation is present. Triggers: assertThat, BDDMockito, ArgumentCaptor, @MockitoBean, @MockitoSpyBean, @DirtiesContext, UnnecessaryStubbingException, testing pyramid, context cache.
Decide whether planned vertical implementation work should ship as independent pull requests or as a stack of small ordered pull requests, then plan, build, review, update, and merge the stack safely. Use when one slice is too large for effective review, when later slices should proceed on the same evolving baseline before earlier pull requests merge, when AI-generated code volume needs deliberate review boundaries, when a plan already defines dependent pull request boundaries or non-trunk bases, or when the user mentions stacked PRs, PR stacks, dependent PRs, gh-stack, bottom-up review, or splitting an implementation across branches. Do not use this skill to split epics or invent horizontal backlog stories; use story-splitting first.
Technical debt detection and remediation. Run at session end to find duplicated code, dead imports, security issues, and complexity hotspots. Triggers: 'find tech debt', 'scan for issues', 'check code quality', 'wrap up session', 'ready to commit', 'before merge', 'code review prep'. Always uses parallel subagents for fast analysis.
Review existing test cases (legacy, others', AI) for coverage and executability: build a testable-points baseline, assess independently, revise in place with records. Not for: writing cases from scratch (test-case-writing), pipeline. 审查已有用例（存量/他人/AI 产出）的覆盖与可执行性：先建基准再独立评估，修订留审查记录。不用于：从零写用例、写时自审、流水线。
Drive a pull request from draft with failing CI to merge-ready. While the PR is a draft, inspect and fix in-scope CI failures (lint, manifest-lint, build, tests) using the gh CLI and GitHub Actions logs — never weakening CI config to greenwash, and never editing lint config or adding an ignore directive unprompted (those are gated for the developer's sign-off and reported, not applied). After the PR is marked ready-for-review, wait for AI reviewers, verify each finding, then apply dispositions per `humanEnvelope`: when `true`, halt for a human envelope; when `false`, post the plan as a PR comment and act without Yes/No. `--auto-apply` forces the unattended path for one run. Use when asked to triage a PR, fix failing CI or red checks on a PR, address or respond to PR review comments, action Claude or CodeRabbit review feedback, get a PR green, or take a draft PR to merge-ready. Handles base-branch drift and in-scope merge conflicts; escalates ambiguous ones.
Use when building or debugging Typer/Rich CLI applications. Activates on Rich table rendering, console output in non-TTY environments, CliRunner testing with Rich output, snapshot testing, Typer command wiring, exception chain prevention with AppExit/AppExitRich patterns, table width at 80-column wrapping, Progress/Live in non-interactive contexts, stderr/stdout separation, or force_terminal vs width configuration. Grounds AI-generated CLI code in verified correctness patterns and prevents known Typer/Rich integration mistakes.
Turn a screen recording of a UI (page load, navigation, redirect/auth flow, app startup) into an interactive paint timeline page. You get a full-window video, a timeline of each visual paint with timestamps and durations, and on-video flashes of what was painted (pink) versus what only moved (blue). Use when the user shares a screen recording (.mp4/.mov) and asks for a timeline of paints, frames, or visual changes, a filmstrip, load-performance breakdown, "what painted when", or how long each screen was shown.
Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions always
Analyzes web performance using Chrome DevTools MCP. Measures Core Web Vitals (FCP, LCP, TBT, CLS, Speed Index), identifies render-blocking resources, network dependency chains, layout shifts, caching issues, and accessibility gaps. Use when asked to audit, profile, debug, or optimize page load performance, Lighthouse scores, or site speed.
Use when 王建硕 wants to evaluate whether a change to VoiceDrop's 挖矿 system prompt is actually better than the live version — runs the local eval harness (golden fixtures × champion-vs-candidate, same input), dispatches blind pairwise judge subagents, aggregates a win-rate verdict, and on approval promotes the candidate into agent/src/prompts/mine.js. Triggers — "评估 prompt"、"挖矿 prompt 改好了吗"、"eval prompt"、"比一比两版 prompt"、"/wjs-evaling-voicedrop-prompts".
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.