Skills
96,770 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Audits Rails application security against OWASP Top 10, detects vulnerabilities with Brakeman, and verifies Pundit authorization policies. Use when the user wants a security audit, vulnerability scan, or when user mentions security, OWASP, Brakeman, XSS, SQL injection, or authorization. WHEN NOT: Implementing security fixes (use specialist agents), setting up authentication (use authentication-flow), or writing Pundit policies (use policy-agent).
Judge subskill for simmer. Scores a candidate artifact against user-defined criteria on a 1–10 scale and produces ASI (highest-leverage direction) for the next generator round. Supports judge-only, runnable evaluator, and hybrid evaluation modes. Do not invoke directly—dispatched as a subagent by the simmer orchestrator.
The architectural foundation for Stratos skills. Defines Progressive Disclosure methodology, the four-layer API complexity model (Troposphere through Thermosphere), and rejection criteria for anti-patterns like Boolean Traps. Use when designing APIs or reviewing code for Stratos compliance.
Review code structure for unnecessary complexity and insufficient organization. Use when asked whether code is overengineered (speculative abstractions, extra DB columns/fields/helpers, should be simplified) or under-organized (too flat, mixes responsibilities, should be reorganized).
Auto-detect testing framework and run relevant tests. Identifies Jest, Vitest, Playwright, Cypress, pytest, Go test, and others. Can run all tests, specific file tests, or generate basic tests for new code. Usage - /test-detect, /test-detect src/auth/login.ts, /test-detect generate src/utils.ts
A comprehensive guide for using Testcontainers for Go to write reliable integration tests with Docker containers in Go projects. Supports 62+ pre-configured modules for databases, message queues, cloud services, and more. Use this skill when writing Go integration tests, setting up test databases (PostgreSQL, MySQL, Redis, MongoDB), testing with message queues (Kafka, RabbitMQ), or creating container-based test infrastructure. Covers modules, generic containers, networking, cleanup, wait strategies, CI/CD integration, and common anti-patterns.
Capture a Textual terminal UI as an SVG using its headless test harness. Use when asked to make, attach, or preview a screenshot of deepagents-code/dcode or another Textual app, visually verify a TUI state, or render a modal, screen, or widget without a desktop or browser.
Audit how design tokens are defined: tiers, naming, alias chains, raw values, orphans, DTCG readiness. Triggers: audit my tokens, token architecture review, token health check. Not for code consuming tokens (token-compliance), theme parity (theme-audit) or Figma variables (figma-variable-audit).
Audit a whole project for UX problems, architecture weaknesses, data reliability risks, security boundaries, and performance or delivery risks using parallel specialists and a tabbed HTML report. Use when asked to audit project architecture, review system boundaries, audit the frontend, review UI consistency, check data integrity or failure recovery, audit security or authorization, review sensitive-data handling, audit performance, review build or deployment safety, find bloat, find dead code, unused dependencies, or duplicate helpers, ask what can I delete, or /ultima.
Runs an exhaustive, evidence-backed code review of current git changes by default, or of a user-named path, module, feature, or package. Forces loading every relevant available agent skill for the review surface, and requires external docs or research when libraries, APIs, security, or established practice matter. Use when the user says "ultra-review", "ultra review", "deep review", "exhaustive review", "review this diff", "review my changes", or asks for a thorough review of git changes or a pointed codebase area.
(NS) Generate backend unit and integration test task markdown after implementation tasks exist. Use during SDD planning for PHPUnit/Laravel or equivalent backend test coverage per feature — not for E2E (use e2e-test-generator). Requires requirements and related backend task. Documents cross-tenant and auth P0 scenarios when applicable.
Use when reviewing UnoPim code changes or a pull request for standards compliance, or when asked about conventions, best practices, violations or code quality in an UnoPim codebase. Trigger phrases include “review,” “code review,” “PR review,” “standards,” “conventions,” “violations,” “code quality.”
Reviews UX, accessibility, and microcopy for web and React Native (Expo) applications. Analyzes UI code against established UX principles, WCAG 2.2 accessibility standards, platform guidelines (Apple HIG, Material Design 3), and UX writing best practices. Triggers on: "ux review", "review ux", "check accessibility", "improve the UI", "ux audit", "review this component", "is this accessible", "check usability", "ux feedback", "review the design", "improve usability", "check contrast", "review navigation", "ux writing", "improve copy", "review microcopy", "make this more intuitive", "ux best practices", "/ux".
Apply James's AI trust principle to both outputs and autonomous actions. Use when generating or executing consequential changes, delegating tasks or assessing reliability; require independent verification, bounded permissions/time/data/money and recoverability proportionate to impact.
This skill should be used when the user asks to "write tests", "add tests", "test coverage", "run tests", "debug failing tests", "mock functions", or mentions Vitest, unit tests, component tests, test-driven development, or testing utilities. Provides comprehensive Vitest v4 guidance for TypeScript React/Next.js projects.
WCAG 2.2 Web Content Accessibility Guidelines. Covers conformance levels A/AA/AAA, success criteria, testing with axe-core, and common accessibility patterns. USE WHEN: user mentions "accessibility", "a11y", "WCAG", "screen reader", "ARIA", asks about "color contrast", "keyboard navigation", "accessible forms", "compliance", "ADA", "Section 508" DO NOT USE FOR: automated testing implementation - use `axe-core` instead
Use when the user needs to review UI code, run accessibility checks, conduct design audits, or check a website against best practices. This Skill checks compliance against the Web Interface Guidelines and WCAG 2.2 and outputs structured review results.
Professional web application testing and automation using Playwright with support for multiple browsers, mobile emulation, screenshot capture, network interception, and comprehensive test assertions. Use for: (1) E2E testing across browsers, (2) UI automation, (3) Form testing and validation, (4) Visual regression testing, (5) API mocking and interception, (6) Mobile responsive testing
Perform deep WCAG 2.1 AA compliance audits on UI code. Use this skill when the user wants an accessibility review, WCAG audit, a11y check, screen reader compatibility review, or keyboard navigation assessment. Also trigger when the user mentions 'accessibility', 'a11y', 'WCAG', 'screen reader', 'keyboard navigation', 'color contrast', 'ARIA', or asks 'is this accessible'. This goes beyond the design reviewer's basic accessibility checks to provide comprehensive WCAG criterion-by-criterion analysis
Accessibility testing toolkit using Selenium WebDriver 4+ with Java 21+ and axe-core engine. Use when asked to validate WCAG 2.2 AA compliance, scan pages or components for a11y violations, test keyboard navigation, audit color contrast, check ARIA semantics, generate accessibility reports, filter axe rules, debug screen reader issues, or implement POUR principles (perceivable, operable, understandable, robust).
Code review, design support, and refactoring based on DDD Aggregate design rules. Guided comprehensively by Evans Rules, Vernon's 4 Rules, and Design by Contract, it covers aggregate boundary definition, invariant verification, immutable design, ID references, eventual consistency, and domain event collaboration. Use this skill whenever any of the following applies: - New design, implementation, or refactoring of Aggregates (in any language) - Code review of existing aggregates or entity classes from a DDD perspective - Deciding aggregate boundaries ("Should A and B be in the same aggregate?" "Is this aggregate too large?") - Designing invariants and consistency boundaries within an aggregate - Deciding how aggregates collaborate (domain events, eventual consistency, Saga pattern) - Refactoring mutable aggregate code into immutable design - Detecting and fixing encapsulation violations such as public fields, direct references, and push/append Keyword examples: 集約, Aggregate, aggregate boundary, 集約ルート, AggregateRoot, エンティティ設計, DDD実装, Vernon Rules, Evans Rules, 集約の分割, 真の不変条件
Advanced Product Quality Planning (APQP) — plan and track a new product launch through all 5 phases, identify deliverables per phase, run gate reviews, and ensure quality outputs are complete before Start of Production (SOP). Use when launching a new part, managing an APQP project, or auditing APQP completeness. Covers AIAG APQP 2nd edition and IATF 16949 §8.3.
Validates cross-section ID consistency in arc42 documentation that follows this toolkit's conventions. Checks toolkit IF-xx interface IDs (Section 3↔Section 5), building block deployment coverage (Section 5↔Section 7), Q42 quality tag traceability (Section 1↔Section 10), toolkit ADR risk references (Section 9↔Section 11), and aspirational scenario linkage (Section 10↔Section 11). Runs the automated linter script when available, or applies rules manually when not.
Use when enforcing architectural characteristics through automation — phrases like "architecture fitness function", "evolutionary architecture", "architecture tests", "ArchUnit", "dependency rules in CI", "automated architecture checks", "guardrails", "drift detection". Defines fitness functions as automated checks that verify architectural characteristics on every change, catching drift before it accumulates.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.