Skills
96,981 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Audit and reconcile drift across Beads, designs, delivered records, documentation, tests, code, and migration state. Use when asked to audit project consistency, investigate disagreeing artifacts, verify a migration, or prepare for major planning.
Audits web typography for punctuation, font selection, sizing, spacing, OpenType features, hierarchy, layout, typeface pairing, brand identity, and display type. Use when writing CSS/HTML for text, selecting or pairing typefaces, reviewing typography in web designs, configuring font-feature-settings, building a type system, or auditing typographic quality. Triggers on tasks involving font-family, font-size, line-height, letter-spacing, @font-face, font pairing, or typographic correctness.
Find what a change could break somewhere else before it ships, beyond the diff, and prove the one fact it's safe because of by running real code instead of writing it up. Use for 'blast radius of X', 'what could this break', or reviewing a small diff you don't trust.
8-step disciplined bug-fix protocol that treats every production bug as two failures — the code defect itself and the testing system that allowed it through. Use when fixing a production bug, investigating a regression, writing a post-mortem, or auditing a missed defect. Triggers on "fix this bug", "production bug", "regression test", "post-mortem", "test gap", "why did the tests miss this".
Use when testing application-specific workflow and business-rule flaws that scanners cannot find — price/quantity/parameter tampering, workflow and state-machine bypass, race conditions and TOCTOU, replay, and abuse of coupons/refunds/limits. Requires understanding what the app is supposed to do.
Full-workflow management tool for LLM security evaluation. Supports creating/updating model and agent evaluation assets, querying available resources, initiating compliance evaluation tasks, initiating security evaluation tasks, and analyzing evaluation results.
Audit an entire project for bugs, security vulnerabilities, code quality problems, performance issues, missing tests, documentation gaps, and concrete improvement or feature ideas—then produce a prioritized, actionable report with file:line references. Read-only by default; only edits or commits when the user explicitly asks for a fix afterwards. Use when someone says “review my project”, “audit the codebase”, “find bugs”, “check for security issues”, “what could be improved”, “suggest improvements”, “are there any vulnerabilities”, “do a code quality review”, or the Hungarian equivalents “nézd át a projektet”, “auditáld a kódot”, “találj hibákat”, “milyen biztonsági problémák vannak”, “javasolj fejlesztéseket”, “mit lehetne javítani”. Trigger whenever the user wants a holistic assessment of a project rather than a fix to one specific thing—even without the word “audit”. Not for reviewing a single diff or PR, debugging one known error, or carrying out a refactor.
End-to-end code quality workflow for evidence-backed code review, full repository reviews, architecture reviews of software and character-card systems, refactor decisions, authorized minimal changes, and verification. Use for 全量审查、架构审查、全量架构审查, code or diff audits, cleanup triage, or a scoped quality fix. Preserve coverage gaps and keep audit-only requests read-only. Soul/persona voice does not change review ownership.
Set up and write contract-based tests using the test-contractor library (*.contract.yaml). Use this skill whenever the user wants to write tests, create a contract.yaml file, define test terms for a function or class, mock dependencies in contracts, mentions contract-based testing, or wants to set up a project to run contract tests — even if they don't explicitly say "contract yaml" or "test-contractor". Also use when the user asks to add vitest config for contracts, set up a test:contract script, or configure contract testing in a new or existing package. Always prefer contract.yaml tests over Vitest unit tests. Only fall back to Vitest for test cases that contract.yaml cannot express.
Writes Pest feature tests for Laravel HTTP controllers with repeatable patterns for web/session and API/JSON flows. Activates for controller-focused feature tests (especially under tests/Feature/Http/Controllers/**), CRUD action matrices, nested route binding checks, authorization outcomes (403 vs 404), validation datasets, and persistence assertions. Takes precedence over pest-testing for controller-focused feature tests.
Find the mistakes agents keep repeating in this repo and make each one impossible. Try architecture first, then types, then a lint whose error names the fix, then a test, and write docs last. Prove each check fails on a real past mistake. Repeat this each time the operator corrects you. Use for /correct.
Review and compare UX designs, flows, prototypes, specifications, or implementations against user goals, evidence, interaction behavior, accessibility, design-system fit, content, and engineering intent. Use when a designer asks for critique, comparison, tough feedback, review before approval, or wants to check whether implementation preserved the intended experience.
Diagnose one bug by reproducing it, testing hypotheses, locating the root cause, and returning an evidence-backed diagnosis report. Use when the user wants root-cause analysis before implementation, or when triangulate-diagnosis delegates an independent diagnostic pass.
Inspect code diffs before opening a pull request or merging. This skill MUST be used when the user provides a code diff, pastes code changes, asks for a code or PR review, or when code is about to be submitted as a PR or merged. It MUST NOT be skipped solely because the diff is small. It SHOULD also be used before committing or handing back substantial or high-risk code changes. It MUST NOT be used when changes are limited to non-code content such as documentation, prose, images, or formatting. For small, low-risk self-changes, perform only a lightweight review without specialist dispatch. Checks requirement scope, correctness, security, compatibility, and test coverage. Triggers on: 幫我看程式 diff, 看一下程式改了什麼, review 程式碼, PR review, diff review, code review, 看看程式有沒有問題
Open a Diffo code review of the current git changeset, or of a GitHub pull request the user links, in the reviewer's browser and drive the feedback loop from this session, using the diffo CLI. Use when the user wants to review your changes, asks to open a code review, hands you a PR to review with them, or when you finish a large or multi-file change worth a human read before it lands.
Writing, reviewing, refactoring, or running end-to-end tests, or verifying a change through the e2e suite — whole-system checks that drive a running build the way a real user or client does. Triggers on snapshots, test IDs, selectors or locators, polling and waiting, flaky tests, scenario coverage, a runner (Playwright, Cypress, Maestro, Detox, WebdriverIO, Vitest), or a failing e2e run. For a test that mocks its dependencies to isolate one unit, use a unit-testing capability; for the runner's own config and reporters, that runner's own. Covers the test-id then role then copy locator hierarchy, poll-not-sleep waiting, and server lifecycle.
Evaluates NVIDIA Cosmos Policy on LIBERO and RoboCasa simulation environments. Use when setting up cosmos-policy for robot manipulation evaluation, running headless GPU evaluations with EGL rendering, or profiling inference latency on cluster or local GPU machines
This skill should be used when taking a single software feature from intent to shipped as a solo developer — goal-first, TDD, deterministic verification, evidence only where it earns its keep, and human judgment at the two moments that matter (goal approval, merge). Trigger when the user says "let's build feature X", "ship this feature", "run this through the factory", "write a goal contract", "feature-factory", or wants a disciplined intent→merge loop that resists process bloat. NOT for whole-product planning, multi-feature roadmaps, or autonomous multi-agent swarms.
Evaluate model predictions against ground truth using COCO, Open Images, or custom protocols. Use when computing mAP, precision, recall, confusion matrices, or analyzing TP/FP/FN examples for detection, classification, segmentation, or regression tasks.
Use when testing file-upload handling, server-side request forgery (SSRF), and insecure deserialization — upload bypasses (type/extension/content, polyglots, path traversal), SSRF to cloud metadata and internal services, and unsafe deserialization sinks. On apps you own or are authorized to test.
Audit and improve Flutter accessibility, inclusive interaction, localization safety, and RTL behavior. Use for screen-reader semantics, focus and keyboard navigation, text scaling, contrast, touch targets, reduced motion, form errors, RTL, localization, or accessibility acceptance checks.
Build or audit Flutter accessibility for semantics, screen readers, focus, keyboard access, text scaling, contrast, target size, and motion preferences. Pair with flutter-responsive-layout when large text causes reflow, clipping, or overflow across constraints.
Comprehensive Go code review skill for PR reviews, architecture assessment, and test quality analysis. Use when reviewing Go code to ensure adherence to Go best practices, security standards, and project-specific patterns. Applies to full PR reviews, single file/function reviews, architecture evaluation, and test code quality checks.
Design, implement, and integrate generalized validation harnesses across a producer-consumer boundary after a local harness contract exists. Use when refactoring custom validation CLIs/MCPs for large polyrepos, extending Steward across sibling repos, or deploying a local tool to a consumer project for dogfooding and testing; use mcp-harness-repo-maintainer first for initial steward.yaml adoption and cold-start proof.
HBuilderX CLI command line tool skill. Use when the user needs to start a uni-app development environment from the command line, view run logs, run automated tests, configure the HBuilderX CLI environment, or integrate HBuilderX workflows into npm scripts. Covers multi-platform development for Web, Android, iOS, HarmonyOS, mini programs and more.
Installs, configures, or upgrades Dazbo's PR code review & issue triage GitHub Action (gemini-review-action) in a target repository. Use when the user wants to set up, configure, or update automated AI code reviews, issue triaging, or Gemini model workflows for their GitHub repository.
Use this skill when starting a new project and defining baseline repository rules, especially for optional devcontainer setup, mise-first tooling, pnpm security settings, Vite+ workflows, kiso.css adoption, pre-push test gates, and project-local post-edit lint/format hooks that run after AI agent file edits.
Interact with Litefuse and access its documentation. Use when needing to (1) query or modify Litefuse data programmatically via the CLI — traces, prompts, datasets, scores, sessions, and any other API resource, (2) look up Litefuse documentation, concepts, integration guides, or SDK usage, or (3) understand how any Litefuse feature works. This skill covers CLI-based API access (via npx) and multiple documentation retrieval methods.
Periodic pass that keeps a project's verification skill and feature map honest: parallel source readers per feature, one live session driving every feature, at most one PR of proven corrections. Use for /maintain-verification-skill or "audit the verify skill".
Maintains repo-local action contracts and harness repositories where product CLI and MCP adapters stay thin over core libraries. Use when adopting or improving steward.yaml actions, capability-level adoption evidence, cold-start proof loops, probes, benchmarks, CLI/MCP/core parity, adapter refactors, packages/core boundaries, or sibling harness layout; use repo-quality-system-lifecycle first for general app/library/tool stewardship baselines.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.