Skills
96,981 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Guides authorized web application and API security testing—scoping and rules of engagement, OWASP-oriented testing (injection, auth/session, access control, SSRF, XSS, CSRF, business logic), REST and GraphQL API security, Burp/ZAP-style manual methodology without requiring commercial tools, evidence and remediation reporting, and retest validation. Emphasizes written authorization and safe boundaries. Use for web pentest, OWASP web assessment, web app security test, API pentest, Burp-style testing, XSS or SQL injection testing when authorized—not network/AD/infra pentest (network-pentester), general multi-domain pentest orchestration (penetration-tester), LLM or agent adversarial testing (ai-redteam), enterprise adversary simulation or purple-team campaigns (red-team-specialist), SOC alert triage (soc-analyst), incident command (incident-responder), or CI/CD security gates and SBOM programs (devsecops).
Research and synthesize findings into a structured report (RS-XXX). A generic skill with six flows depending on the input: free-form research on a topic; pending decisions in a US-XXX/TK-XXX/WI-XXX before planning; analysis of an issue or bug (reproduction, root cause and test diagnosis, with a WI bug-fix deliverable); audit of a test case TC-XXX; legacy analysis (discovering FT-XXX features and their tests from existing code); and cross-project migration discovery. Activate when the user asks "investiga", "research", "¿es viable?", "¿cómo funciona X?", "¿qué impacto tiene?", "compara opciones", "¿qué falta por decidir?", "hay un bug", "falla en producción", "analiza el bug #1234", "revisa este caso de prueba", "analiza este código legacy", "ingeniería inversa de requisitos", "migración entre proyectos", or mentions "RS-XXX". If an artifact or a project-management tool identifier is in context, use it without asking.
Master accessibility audit skill that scans every screen with axe-core, tests keyboard navigation, checks focus visibility, audits ARIA and semantic structure, then fixes every violation from critical down to minor. Works screen by screen in priority order with visual and programmatic verification. Use when user wants to fix accessibility issues, meet WCAG 2.1 AA, improve keyboard nav, or invokes /a11y.
Design and audit AI eval regression operations, golden datasets, prompt/model release gates, rubric governance, judge drift, safety cases, quality monitoring, cost/latency guardrails, failure triage, provider/model changes, human review, and rollback. Use when AI features, agents, copilots, recommendations, or automation need reliable improvement without silent regressions.
Use this skill when the user wants to give feedback on, collect, organize, categorize, or template issues encountered while using AI tools — in any scenario such as coding agents, chat assistants, office assistants, search, writing, data analysis, or internal AI systems. The skill turns free-form descriptions into structured feedback reports and outputs clear issue categories, labels, severity, scenario, impact, and suggestions for additional information.
A testing reference for Android app development (Kotlin). Covers JUnit4, AndroidJUnit4, Truth, Espresso (cheat sheet), the test pyramid, test doubles, Mockito, MockK, Robolectric; coroutines/Flow/ViewModel testing, ActivityScenario, FragmentScenario, UiAutomator, AndroidTestOrchestrator; createComposeRule, runComposeUiTest, ComposeUiTestConfig, Compose UI test synchronization, CI, and Window Testing (by screen size).
Reviews any arc42 section or the full document for accuracy, completeness, cross-section consistency, and alignment with arc42 standards. Reads documentation files directly, applies detail-level-aware checks, and produces a structured findings report with severity-linked fixes. Offers to resolve Critical issues immediately using the relevant section skill.
Must use when scanning or reviewing OpenHarmony ArkWeb/Chromium C++ single files for thread-safety violations involving PostTask, BindOnce, base::Unretained(this), WeakPtr, scoped_refptr, mojo::Connector, GPU/Audio/DrDC threads, NDK/UI callbacks, NWeb, WebContents, Profile, BrowserContext, NavigationController. Enforces false-positive control and outputs strict JSON schema violations for standard_rule1-standard_rule10 only.
Senior QA Engineer with 10+ years Java testing experience. Use when writing unit tests with JUnit, creating integration tests with Testcontainers, implementing API tests, following TDD methodology, or testing reactive code with StepVerifier.
Comprehensive code review rules for React applications (framework-agnostic). Covers security anti-patterns, performance pitfalls, architecture mistakes, and code quality issues. Use this skill when reviewing, writing, or refactoring React code — especially before merging pull requests. Triggers on tasks involving code review, PR review, security audit, performance review, or quality checks for React/TypeScript projects. Does not cover Next.js-specific patterns (see nextjs-review for that).
Conducts an independent review of a result specification or implementation plan without fixing them. Use when the user asks to check a spec or plan, a CreatePlan card, acceptance criteria, or the scope of a task. Do not use when the user asks to write a specification or plan, implement a task, fix an artifact, or review code changes.
Use PROACTIVELY when users ask about React project structure, Bulletproof React patterns, or need architecture guidance. Covers structure setup, codebase auditing, anti-pattern detection, and feature-based migration planning. Triggers on "bulletproof react", "React structure help", "organize React app", or "audit my architecture".
Headless browser testing via persistent Bun.WebView session. Use when testing frontend UI, verifying page content, filling forms, clicking buttons, taking screenshots, or interacting with local or staging web applications. Triggers on phrases like "test the page", "check the UI", "browse to", "fill the form", "click the button", "take a screenshot".
Daily autonomous classifier for failing PRs across your repos. Runs /ci-debug headless against every open PR with red required checks, posts the verdict as a collapsed PR comment, and appends to a per-repo .sentinel/ledger.jsonl. v1 is propose-don't-apply — NEVER auto-pushes a fix. Use when you're tired of /status sweeps catching the same 10 CI failure patterns over and over.
Activate a 4-stage coding discipline framework that forces Claude to plan before coding, isolate changes on a branch, write tests first, and self-review output twice before presenting it. Use when starting a complex coding task, when past Claude sessions produced broken first drafts, or when you want to prevent rework cycles. Produces a confirmed written plan, isolated feature branch, test-first implementation, and a double-reviewed output with a correctness and code-quality checklist.
Use when receiving code review feedback (especially if unclear or technically questionable), when completing tasks or major features requiring review before proceeding, or before making any completion/success claims. Covers three practices - receiving feedback with technical rigor over performative agreement, requesting reviews via code-reviewer subagent, and verification gates requiring evidence before any status claims. Essential for subagent-driven development, pull requests, and preventing false completion claims.
Review one implementation change against its Phat task, feature spec, acceptance criteria, repository engineering standards, and any accepted prototype evidence. In standalone or final mode record supported task evidence/status; in delegated mode return a read-only report to the parent. Use after implement-task or when reviewing a working tree, staged change, commit, or branch.
Performs OWASP-based code security audits on any codebase. Analyzes source code against ASVS 5.0.0 verification requirements, API Security Top 10 2023 risk patterns, OWASP CheatSheet secure coding practices, and WSTG testing methodologies. Input is a codebase to review; output is a detailed Markdown security audit report. Use when the user requests a security audit, security review, vulnerability assessment, or code security analysis.
Code review for ACE Engine (OpenHarmony ArkUI) covering C++/JS/TS/ArkTS. Analyzes 19+ dimensions: stability, performance, threading, security, memory, Modern C++ practices, SOLID principles, design patterns, robustness, testability, maintainability, observability, API design, technical debt, backward compatibility. Reports severity levels, refactoring suggestions, and ACE Engine checks (Pattern/Model/Property, component lifecycle, RefPtr/WeakPtr, four-layer architecture). Use when: reviewing PRs, analyzing code quality, enforcing standards, identifying technical debt, validating architecture, generating quality reports.
Check test coverage for unstaged changes. Use when user asks to "check coverage", "/coverage", or wants to see which unstaged changes lack test coverage. Don't use for projects without lcov coverage output, running the full test suite without coverage, or checking coverage of already-committed changes.
Generate a project-local skill that formally verifies the code where a bug costs the most and tests reach the least, in any language, with whichever verification tool fits. Use for /create-formal-verification-skill, “model-check this race”, “prove this invariant”, or when concurrency, retries, state machines, parsers, or unsafe code need more than tests.
Diagnose a reported bug, task failure, or performance regression with a symptom-specific reproduction and evidence-driven probes. Use standalone for diagnosis or inline within implement-task/auto-implement when the cause is unclear; leave production fixes, verification policy, and task status to the owning workflow.
A disciplined diagnostic loop for hard bugs and performance regressions. Reproduce → minimise → hypothesise → instrument → fix → regression test. Use when the user says "diagnostica isso" / "debuga isso", reports a bug, says something is broken/throwing/failing, or describes a performance regression. Use when user says "diagnose this" / "debug this", reports a bug, says something is broken/throwing/failing, or describes a performance regression.
Autonomous harness for building complete applications from a single prompt. Uses dkod for parallel agent execution with AST-level semantic merging. Orchestrates a Planner that decomposes work by symbol into parallel units, N Generator agents that implement simultaneously via isolated dkod sessions, and a skeptical Evaluator that tests the live result via Playwright CLI (preferred) or chrome-devtools MCP (fallback), plus dk_verify. Fully autonomous — zero user interaction from prompt to working, tested PR. Use this skill whenever the user provides a build prompt ("build a...", "create a...", "make a...") or invokes /dkh.
Specialist skill for containerized database testing with Testcontainers. Use when testing real database behavior, using SQL Server/PostgreSQL/MySQL containers, or testing EF Core/Dapper. Covers container startup, database migrations, test isolation, and container sharing. Make sure to use this skill whenever the user mentions Testcontainers database, SQL Server container, PostgreSQL container, EF Core integration test, Dapper testing, or Collection Fixture, even if they don't explicitly ask for container-based database testing. Keywords: testcontainers, container testing, database testing, MsSqlContainer, PostgreSqlContainer, MySqlContainer, EF Core testing, Dapper testing, Testcontainers.MsSql, Testcontainers.PostgreSql, GetConnectionString, IAsyncLifetime, CollectionFixture
(NS) Generate E2E test task markdown for Cypress/TypeScript during SDD planning after frontend tasks exist. Use when planning Cypress coverage per feature — not for writing specs (use create-e2e-tests). Requires data-testid contract from frontend task. Device-aware desktop/tablet/mobile structure.
Use when the user wants to analyze EKS application logs during or after a FIS experiment. Triggers on "analyze app logs", "application log analysis", "check application behavior", "分析应用日志", "查看应用表现", "应用日志分析". Supports two modes: real-time monitoring (during experiment) and post-hoc analysis (after experiment). Reads experiment context from aws-fis-experiment-prepare/execute outputs.
Perform comprehensive, deep analysis of a system and its subsystems to identify bugs, race conditions, stale documentation, dead code, and correctness issues. Use when asked to "audit this system", "exhaustive analysis of X", "analyze for correctness", "root out issues in...", "deep dive into...", "verify this code is correct", "find bugs in...", or when reviewing agent-written code for production readiness. Automatically decomposes systems into subsystems, applies appropriate analysis checklists, and produces structured findings with severity classification.
Build an Ishikawa diagram, cause and effect analysis, or 6M fishbone to brainstorm and categorise all possible causes before narrowing to root cause with 5-Why. Covers Man, Machine, Method, Material, Measurement, and Environment (Mother Nature). Essential for 8D D4 brainstorming sessions and CAPA root cause investigations.
Review React, Next.js App Router, TypeScript, Tailwind CSS, shadcn/ui, TanStack Query, and frontend UI code. Use when reviewing a PR, branch, diff, page, component, hook, Server Action, route handler, or API client; debugging frontend behavior; assessing production readiness; or checking runtime bugs, client/server boundaries, data fetching, security, accessibility, UX states, responsive layout, performance, SEO metadata, i18n, and maintainability.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.