Skills
97,222 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Validates cross-section ID consistency in arc42 documentation that follows this toolkit's conventions. Checks toolkit IF-xx interface IDs (Section 3↔Section 5), building block deployment coverage (Section 5↔Section 7), Q42 quality tag traceability (Section 1↔Section 10), toolkit ADR risk references (Section 9↔Section 11), and aspirational scenario linkage (Section 10↔Section 11). Runs the automated linter script when available, or applies rules manually when not.
Must use when scanning or reviewing OpenHarmony ArkWeb/Chromium C++ single files for thread-safety violations involving PostTask, BindOnce, base::Unretained(this), WeakPtr, scoped_refptr, mojo::Connector, GPU/Audio/DrDC threads, NDK/UI callbacks, NWeb, WebContents, Profile, BrowserContext, NavigationController. Enforces false-positive control and outputs strict JSON schema violations for standard_rule1-standard_rule10 only.
Senior QA Engineer with 10+ years Java testing experience. Use when writing unit tests with JUnit, creating integration tests with Testcontainers, implementing API tests, following TDD methodology, or testing reactive code with StepVerifier.
Comprehensive code review rules for React applications (framework-agnostic). Covers security anti-patterns, performance pitfalls, architecture mistakes, and code quality issues. Use this skill when reviewing, writing, or refactoring React code — especially before merging pull requests. Triggers on tasks involving code review, PR review, security audit, performance review, or quality checks for React/TypeScript projects. Does not cover Next.js-specific patterns (see nextjs-review for that).
Conducts an independent review of a result specification or implementation plan without fixing them. Use when the user asks to check a spec or plan, a CreatePlan card, acceptance criteria, or the scope of a task. Do not use when the user asks to write a specification or plan, implement a task, fix an artifact, or review code changes.
Use PROACTIVELY when users ask about React project structure, Bulletproof React patterns, or need architecture guidance. Covers structure setup, codebase auditing, anti-pattern detection, and feature-based migration planning. Triggers on "bulletproof react", "React structure help", "organize React app", or "audit my architecture".
Headless browser testing via persistent Bun.WebView session. Use when testing frontend UI, verifying page content, filling forms, clicking buttons, taking screenshots, or interacting with local or staging web applications. Triggers on phrases like "test the page", "check the UI", "browse to", "fill the form", "click the button", "take a screenshot".
Daily autonomous classifier for failing PRs across your repos. Runs /ci-debug headless against every open PR with red required checks, posts the verdict as a collapsed PR comment, and appends to a per-repo .sentinel/ledger.jsonl. v1 is propose-don't-apply — NEVER auto-pushes a fix. Use when you're tired of /status sweeps catching the same 10 CI failure patterns over and over.
Activate a 4-stage coding discipline framework that forces Claude to plan before coding, isolate changes on a branch, write tests first, and self-review output twice before presenting it. Use when starting a complex coding task, when past Claude sessions produced broken first drafts, or when you want to prevent rework cycles. Produces a confirmed written plan, isolated feature branch, test-first implementation, and a double-reviewed output with a correctness and code-quality checklist.
Use when receiving code review feedback (especially if unclear or technically questionable), when completing tasks or major features requiring review before proceeding, or before making any completion/success claims. Covers three practices - receiving feedback with technical rigor over performative agreement, requesting reviews via code-reviewer subagent, and verification gates requiring evidence before any status claims. Essential for subagent-driven development, pull requests, and preventing false completion claims.
Before pushing a non-trivial change, spawn read-only subagents on two different model families to adversarially review the same diff in parallel, then merge the findings yourself. Use for "multi-model review", "adversarial review", "challenge this", or a pre-push review of a large or risky diff — not for small or low-risk changes, which don't justify the cost of a panel. Once a PR exists, cloud bot feedback is handled by `pr-review-loop`, not this skill
Review one implementation change against its Phat task, feature spec, acceptance criteria, repository engineering standards, and any accepted prototype evidence. In standalone or final mode record supported task evidence/status; in delegated mode return a read-only report to the parent. Use after implement-task or when reviewing a working tree, staged change, commit, or branch.
Performs OWASP-based code security audits on any codebase. Analyzes source code against ASVS 5.0.0 verification requirements, API Security Top 10 2023 risk patterns, OWASP CheatSheet secure coding practices, and WSTG testing methodologies. Input is a codebase to review; output is a detailed Markdown security audit report. Use when the user requests a security audit, security review, vulnerability assessment, or code security analysis.
Code review for ACE Engine (OpenHarmony ArkUI) covering C++/JS/TS/ArkTS. Analyzes 19+ dimensions: stability, performance, threading, security, memory, Modern C++ practices, SOLID principles, design patterns, robustness, testability, maintainability, observability, API design, technical debt, backward compatibility. Reports severity levels, refactoring suggestions, and ACE Engine checks (Pattern/Model/Property, component lifecycle, RefPtr/WeakPtr, four-layer architecture). Use when: reviewing PRs, analyzing code quality, enforcing standards, identifying technical debt, validating architecture, generating quality reports.
Check test coverage for unstaged changes. Use when user asks to "check coverage", "/coverage", or wants to see which unstaged changes lack test coverage. Don't use for projects without lcov coverage output, running the full test suite without coverage, or checking coverage of already-committed changes.
Diagnose a reported bug, task failure, or performance regression with a symptom-specific reproduction and evidence-driven probes. Use standalone for diagnosis or inline within implement-task/auto-implement when the cause is unclear; leave production fixes, verification policy, and task status to the owning workflow.
A disciplined diagnostic loop for hard bugs and performance regressions. Reproduce → minimise → hypothesise → instrument → fix → regression test. Use when the user says "diagnostica isso" / "debuga isso", reports a bug, says something is broken/throwing/failing, or describes a performance regression. Use when user says "diagnose this" / "debug this", reports a bug, says something is broken/throwing/failing, or describes a performance regression.
Autonomous harness for building complete applications from a single prompt. Uses dkod for parallel agent execution with AST-level semantic merging. Orchestrates a Planner that decomposes work by symbol into parallel units, N Generator agents that implement simultaneously via isolated dkod sessions, and a skeptical Evaluator that tests the live result via Playwright CLI (preferred) or chrome-devtools MCP (fallback), plus dk_verify. Fully autonomous — zero user interaction from prompt to working, tested PR. Use this skill whenever the user provides a build prompt ("build a...", "create a...", "make a...") or invokes /dkh.
Specialist skill for containerized database testing with Testcontainers. Use when testing real database behavior, using SQL Server/PostgreSQL/MySQL containers, or testing EF Core/Dapper. Covers container startup, database migrations, test isolation, and container sharing. Make sure to use this skill whenever the user mentions Testcontainers database, SQL Server container, PostgreSQL container, EF Core integration test, Dapper testing, or Collection Fixture, even if they don't explicitly ask for container-based database testing. Keywords: testcontainers, container testing, database testing, MsSqlContainer, PostgreSqlContainer, MySqlContainer, EF Core testing, Dapper testing, Testcontainers.MsSql, Testcontainers.PostgreSql, GetConnectionString, IAsyncLifetime, CollectionFixture
(NS) Generate E2E test task markdown for Cypress/TypeScript during SDD planning after frontend tasks exist. Use when planning Cypress coverage per feature — not for writing specs (use create-e2e-tests). Requires data-testid contract from frontend task. Device-aware desktop/tablet/mobile structure.
Use when the user wants to analyze EKS application logs during or after a FIS experiment. Triggers on "analyze app logs", "application log analysis", "check application behavior", "分析应用日志", "查看应用表现", "应用日志分析". Supports two modes: real-time monitoring (during experiment) and post-hoc analysis (after experiment). Reads experiment context from aws-fis-experiment-prepare/execute outputs.
Perform comprehensive, deep analysis of a system and its subsystems to identify bugs, race conditions, stale documentation, dead code, and correctness issues. Use when asked to "audit this system", "exhaustive analysis of X", "analyze for correctness", "root out issues in...", "deep dive into...", "verify this code is correct", "find bugs in...", or when reviewing agent-written code for production readiness. Automatically decomposes systems into subsystems, applies appropriate analysis checklists, and produces structured findings with severity classification.
Writes, runs and debugs EventCatalog architecture fitness functions — TypeScript rules in `*.fitness.ts` files that check the documented architecture (ownership, naming, domain boundaries, dependencies, data access, schemas) and fail CI when it drifts. Turns an architecture rule described in plain language into a working fitness function, places it globally or beside the domain, system, service, message or data store it governs, runs `eventcatalog fitness check`, verifies the result, and wires it into CI. Use when user asks to "write a fitness function", "add an architecture rule", "enforce that every event has an owner", "check domain boundaries", "stop services sharing databases", "detect circular dependencies", "fail the build when the architecture breaks a rule", "run fitness checks in CI", or "why is my fitness function failing".
Support Go services by keeping infrastructure, security boundaries, and automated tests aligned with the application architecture. Use when working on Terraform, Cloud Run, Cloud Build or CI, docker-compose environments, integration or component test setup, repository authorization boundaries, service-to-service authentication, or secure internal operations.
Use when monitoring Android app health metrics from Google Play. Make sure to use this skill whenever the user mentions gpc vitals, gpc watch, gpc status, crash rate, ANR rate, startup time, Android vitals, crash monitoring, threshold alerting, vitals gating, rollout monitoring, auto-halt, breach notification, webhook alerting, frame rate, battery usage, memory issues, error tracking, app quality, user reviews, review replies, Play Store reviews, star rating, negative reviews, review export, financial reports, stats reports, gpc reports, reports list, reports download, bulk reports, earnings report, sales report, play balance, installs report, subscriptions report, reports bucket, GPC_REPORTS_BUCKET, pubsite_prod, REPORT_ACCESS_DENIED, download bulk reports permission, or wants to check app health, monitor a staged rollout, respond to reviews, or download Play Console reports. Also trigger when someone asks about gating deployments on crash data, monitoring app performance after a release, watching a rollout for regressions, or tracking review sentiment — even if they don't mention GPC. For releases, see gpc-release-flow. For CI gating, see gpc-ci-integration.
Analyze code dependencies, call graphs, and architecture using the graph-it CLI. Use this skill whenever the user wants to understand how their code is connected — even if they don't say "dependency graph" explicitly. Trigger for: "what calls this function", "who uses this class", "is it safe to delete X", "what breaks if I change Y", "show me the architecture", "trace the execution from main", "find circular imports", "give me an overview of this module", "what imports this file", "impact analysis", "refactoring safety", "review this PR", "review this diff", "is this change risky", breaking changes, unused exports, dead code detection, codemap, file logic, module resolution, graph-it, dependency graph, reverse dependencies.
GraphQL schema design and review. Use when designing new GraphQL schema changes (types, mutations, queries, connections, enums, errors), reviewing schema diffs, planning schema evolution, or auditing nullability and naming. Triggers on 'graphql schema design', 'design a mutation', 'design a query', 'design a type', 'new type', 'new mutation', 'review schema', 'review schema diff', 'schema review', 'schema evolution', 'audit the schema', '/graphql-schema-design'.
Use when reviewing PRs, simplifying over-engineered code, judging architecture, or renaming unclear concepts — inline fake helpers, delete meatless ceremony, rename lying names, merge over-split files, reject premature abstraction, say no to speculative config/modes/layers, then end with the smallest safe next change. Triggers when code is too fancy, too abstract, too clever, too many files/helpers/layers, or too well-factored but painful to change. Embody Grug brain: complexity very bad, small words, no consultant speak, no hard pivot to opposite dogma.
Show Honey's benchmark scoreboard — the committed quality and token results per task tier (code, user-facing, agent-to-agent) from bench/. Reports only the reproducible committed figures, never invents per-repo numbers. Use when asked how much Honey saves, how it compares to Caveman / Ponytail / no-skill baseline, or for the headline numbers.
Generate, verify, refine, and accelerate C/C++ or CUDA code from MATLAB with MATLAB Coder, Embedded Coder, GPU Coder, or MATLAB Test. Also covers writing codegen-ready MATLAB code: language constraints, coder.* directives, and optimization patterns. Triggers on: codegen, MEX, deploy MATLAB as C/C++, GPU Coder, coder.screener, coder.config, coder.gpuConfig, coder.typeof, coder.runTest, matlabtest.coder.TestCase, SIL, embedded config, no dynamic memory, EnableMexProfiling, coder.timeit, coder.perfCompare, %#codegen, writing codegen-ready MATLAB, code generation readiness, coder.varsize, coder.unroll, coder.noImplicitExpansionInFunction, coder.ceval, coder.inline, coder.extrinsic, coder.const, coder.classSignature, class codegen limitations, temporal types codegen, DMA-off, stack-only, host-target InstructionSetExtensions, SIMDAcceleration, OptimizeReductions, host SIMD tuning, host OpenMP, codegen performance
Diagnose WeChat DevTools failures through the official CLI instead of relying only on GUI screenshots. Use when Codex needs to run `open`, `preview`, or related commands, discover the live service port, classify whether a failure is CLI-visible, host-side, or outside preview scope, and apply or suggest only safe repo-level fixes.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.