Skills
96,981 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Runs a smell-first audit on a user-chosen path set: measures structure metrics, applies a named size profile, and reports code smells and test smells with evidence strength. Use for smell audit, code smell scan, whole-repo audit, tech debt scan, test smell check, maintainability audit, or duplication and nesting checks. Do not use for PR review, merge advice, implementing fixes, writing new features, or lint/format-only passes.
Statistical Process Control (SPC) — select the correct control chart, interpret out-of-control signals using Western Electric rules, calculate and interpret Cp, Cpk, Pp, Ppk. Use when setting up SPC for a new characteristic, interpreting control chart signals, responding to special cause variation, or auditing SPC implementation. Covers AIAG SPC 2nd edition and IATF 16949 §8.3.3.
The spec-driven-tdd delivery workflow (orchestrator) - runs the full lifecycle for an OpenSpec change: OpenSpec planning/tracking + Superpowers TDD, simplify, and code review. Invoked by using-spec-driven-tdd; run it once implementation starts
Tests observable behavior against explicit requirements through the real interface. Use when asked to test or verify that a change meets its specification or acceptance criteria, when the user runs /test-against-spec, or when a delivery workflow needs real-interface acceptance evidence.
Write tests for existing code: unit tests, integration tests, UI tests, edge cases and error paths, plus coverage analysis to find what is still untested. Detects the project's test framework from its build files and follows that project's conventions — Kotlin/KMP (kotlin.test, coroutines-test, Turbine, MockK, Kover), Compose Multiplatform, Flutter/Dart, Swift (Swift Testing, XCTest, XCUITest), Rust (cargo test, proptest, criterion), C++ (GoogleTest, Catch2), and secondarily Jest/Vitest, pytest, Go and JUnit. Use when someone says 'write tests for this', 'add unit tests', 'test this function', 'add an integration test', 'scaffold a test suite', 'what is not covered', 'improve test coverage', 'write a regression test for this bug', or the Hungarian 'írj teszteket', 'teszteld le ezt a függvényt', 'mi nincs letesztelve'. Not for auditing a whole project for bugs and missing tests in general (that is code-analyzer), nor for diagnosing a crash or a failing test's root cause (that is error-debugging).
Build, review, debug, configure, migrate, or plan Testcontainers integration tests with real Docker dependencies and current docs. Use for testcontainers (Node/Java/Python/Go/.NET/Rust), GenericContainer, DockerContainer, modules (@testcontainers/*, org.testcontainers, modules/postgres), PostgreSQL MySQL Redis MongoDB (Atlas Local) Kafka LocalStack Elasticsearch ClickHouse InfluxDB Mosquitto, Wait strategies, PullPolicy, Network, Docker Compose, Ryuk, reuse, TESTCONTAINERS_* env vars, Vitest Jest JUnit pytest go test fixtures, CI DinD Colima Podman OrbStack, and Testcontainers Cloud.
Scaffolds comprehensive testing setup for Next.js applications including Vitest unit tests, React Testing Library component tests, and Playwright E2E flows with accessibility testing via axe-core. This skill should be used when setting up test infrastructure, generating test files, creating test utilities, adding accessibility checks, or configuring testing frameworks for Next.js projects. Trigger terms include setup testing, scaffold tests, vitest, RTL, playwright, e2e tests, component tests, unit tests, accessibility testing, a11y tests, axe-core, test configuration.
Reviews React web apps for iPad and touchscreen usability with Tailwind CSS fixes. Audits touch targets, hover failures, touch-over list highlighting (Headless UI data-focus, Radix data-highlighted, inline rows), Safari/iPadOS quirks, layout fluidity, and FMC cursor conventions. Use when the user asks to review an app for touch, iPad, tablet, or touchscreen-optimized usage.
Audit UI implementations against Nielsen's 10 Usability Heuristics for User Interface Design. Produces a structured issue log with severity ratings, heuristic mappings, and remediation guidance. Use when conducting heuristic evaluations, reviewing UI code for usability compliance, or auditing existing interfaces.
Verify whether a GitHub issue is fixed in the local codebase. User provides a GitHub issue URL, the skill fetches it, extracts reproduction steps, builds the product from source, runs the reproduction steps, and reports whether the issue still exists or not.
Use before declaring a task complete, after code/content/config changes, or when the user asks to verify, QA, smoke test, validate, or inspect whether something really works. Inspect the changed scope, run the right checks, verify runtime behavior when needed, and report evidence without inventing results.
Use when tasks need real-browser web automation in Chrome/Chromium via CDP: open or navigate URLs, click/type/select in forms, run page JS, wait for selectors, scrape structured content, capture screenshots, validate UI flows, or run measured web-browser latency checks (`bench:eval`, `bench:all`) for perf regressions.
Sets up GitHub Actions CI/CD workflows for WordPress plugins — coding standards (WPCS/PHPCS), PHP/JS/CSS linting, PHPUnit testing, static analysis (PHPStan), Composer security scanning, WordPress Playground PR previews, and automated deployment to WordPress.org. ALWAYS use this skill when a user wants to create, add, set up, or configure GitHub Actions, CI/CD, automated checks, or deployment workflows for a WordPress plugin — even if they don't use the exact phrase "GitHub Actions". This includes any request to: add automated coding standards or PHPCS/WPCS checks to a WP plugin repo; set up linting (PHP, JS, CSS) for a WordPress plugin; configure PHPUnit testing in CI for a plugin; auto-deploy a plugin to WordPress.org from GitHub; add Playground previews to pull requests; add security scanning or static analysis to a plugin pipeline; or generally "add CI", "add automated checks", "set up workflows", or "automate" anything related to a WordPress plugin's GitHub repository. Also trigger when someone mentions wanting to stop doing manual SVN deploys, wants quality gates on PRs, or is setting up a new WordPress plugin repo and wants best practices for automation. If the user is inside a WordPress plugin repository and mentions anything about automated testing, code quality, deployment, or GitHub workflows, use this skill.
Automates browser interactions for web testing, form filling, screenshots, and data extraction. Use when the user needs to navigate websites, interact with web pages, fill forms, take screenshots, test web applications, or extract information from web pages.
Guides adversarial testing of AI systems—prompt injection, jailbreaks, tool abuse, data exfiltration, bias and harmful output probes, multi-turn attacks, and automated red-team harnesses for LLM applications. Use when red-teaming chatbots, agents, RAG systems, or copilots before launch, designing safety eval suites, reproducing reported vulnerabilities, or validating mitigations after incidents—not for writing corporate AI policy (ai-risk-governance), building production features (ai-engineer), or general network or app penetration testing (penetration-tester, network-pentester), enterprise adversary simulation or purple-team campaigns (red-team-specialist), authorized web/API OWASP testing (web-pentester), or binary/firmware RE (reverse-engineer). Production safeguard serving and gateways: ml-infrastructure-engineer-safeguards. Safety classifier R&D and benchmarks: ml-research-engineer-safeguards.
Use when the user asks to answer, address, or reply to review comments on one or more GitHub pull requests — “answer the review on #12”, “address the comments on my PRs”, “reply to the review findings” — in Claude Code, Codex, or any other agent. Not for reviewing a pull request, and not for feedback given in the conversation.
Test API integrations by mocking responses, intercepting requests, and monitoring network traffic. Use when the user wants to mock backend APIs, simulate errors, test offline behavior, intercept requests, or add authentication headers.
Diagnose existing UiAutomator2 session-startup, app-activity, adb transport, helper-server, native or hybrid locator failures, and XCUITest WebDriverAgent, session-startup, app install or launch, device or simulator state, alert, element-source, or locator failures. Use when a session or command under one of those drivers already fails. Do not use for first-time setup, pre-failure real-device provisioning, or Espresso, Chromium, Gecko, Safari, or Mac2 failures.
Use this skill when the user needs hardware-level management, testing, or diagnostics for Huawei Ascend NPUs. Typical scenarios: checking an NPU card's status, temperature, and utilization; testing memory bandwidth (h2d/d2h/d2d/p2p); running compute/power benchmarks (TFLOPS, TOPS); diagnosing NPU hardware faults or performing health checks; stress testing NPU cards (aicore, memory); resetting or recovering stuck or abnormal NPU cards. Typical user questions (trigger even if ascend-dmi is not mentioned): "help me test this server's compute and bandwidth", "check the NPU temperature and utilization on 192.168.1.50", "run an fp16 compute test and see the TFLOPS", "is the d2d bandwidth up to spec", "card 3 seems to have a problem, help me diagnose it", "the NPU is stuck, reset it", "stress test all 8 cards", "run a power test, edp mode". Use this skill whenever the user wants to measure, diagnose, or manage Ascend NPU hardware directly — including checking server NPU performance (compute/bandwidth/power), diagnosing hardware faults, or resetting NPU cards. Trigger even when the user only mentions "server" + "compute/bandwidth/NPU status" without saying "ascend-dmi". Do NOT use for: writing NPU code, installing frameworks, debugging training issues, or Docker configuration.
Comprehensive Chrome DevTools automation for performance testing, Core Web Vitals measurement (INP, LCP, CLS), network monitoring, accessibility validation, responsive testing, and browser automation. Uses Chrome DevTools Protocol via MCP to provide professional-grade web application testing, debugging, and analysis capabilities including performance tracing, HAR export, device emulation, and multi-page workflows.
Use when testing advanced browser-side and HTTP-layer attacks beyond basic XSS/CSRF — DOM XSS, CSP bypass, CORS misconfiguration exploitation, postMessage abuse, prototype pollution, DOM clobbering, clickjacking, web cache poisoning, and HTTP request smuggling. On apps you own or are authorized to test.
Writing, refactoring, or reviewing code for maintainability or design — keeping what you change readable, cohesive, and cheap to change next time. Triggers on "readable", "too long", "refactor", "abstraction", "cohesion", "magic number", "dead code", "what should this be called", or "should this live elsewhere". While authoring, each concern is a practice to uphold; while reviewing, a finding to raise against the diff. Covers cohesion as the test of what belongs in one unit, naming and file organization, abstraction boundaries, complexity limits, dead code, and SOLID/DRY/KISS/YAGNI judgment.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.