Skills
96,770 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Multi-perspective code analysis using three AI personas (RYAN, FLASH, SOCRATES) for comprehensive decision-making. Use when complex code decisions need analysis from multiple viewpoints, or when avoiding single-perspective blind spots is critical.
This skill should be used when the user asks about “ArchiMate naming conventions,” “model quality,” “EA smells,” “anti-patterns,” “ArchiMate best practices,” “model review,” “abstraction levels,” “viewpoints,” “model organization,” or needs guidance on creating high-quality ArchiMate models.
Browser automation via Puppeteer CLI scripts (JSON output). Capabilities: screenshots, PDF generation, web scraping, form automation, network monitoring, performance profiling, JavaScript debugging, headless browsing. Actions: screenshot, scrape, automate, test, profile, monitor, debug browser. Keywords: Puppeteer, headless Chrome, screenshot, PDF, web scraping, form fill, click, navigate, network traffic, performance audit, Lighthouse, console logs, DOM manipulation, element selector, wait, scroll, automation script. Use when: taking screenshots, generating PDFs from web, scraping websites, automating form submissions, monitoring network requests, profiling page performance, debugging JavaScript, testing web UIs.
Use this skill as the FINAL step after writing or modifying code — reviews for logic bugs, architecture violations, security issues, and performance problems. Trigger after completing a feature, fixing a bug, before merging, or when asked to "review this code", "check my changes", or "is this ready to merge". Fixes issues directly and runs quality gates (lint, typecheck, build, tests). Delegates style to automation, focuses on what matters.
Validates code against project skills and standards. Use this skill when the user asks for a "code review", "review this PR", "check this code", "security audit", or wants to verify code matches project conventions. This skill does not define its own architectural or styling standards — it checks code against FDD-architecture, tailwind-v4-best-practices, and frontend security best practices. Also use this when merging, approving PRs, or when the user asks "does this follow our standards?"
Perform a deep, scoped review of diffs, pull requests, working trees, files, or pasted code. Use for `/code-review`, merge-safety assessment, or one bounded post-implementation review. Produce a product-grounded report with coverage and issue lineage; keep review read-only and continue already-authorized fixes only after freezing the report.
HTTP request construction and API testing with curl and HTTPie. Use when user asks to "test API", "make HTTP request", "curl POST", "send request", "test endpoint", "debug API", "upload file", "check response time", "set auth header", "basic auth with curl", "send JSON", "test webhook", "check status code", "follow redirects", "rate limit testing", "measure API latency", "stress test endpoint", "mock API response", or any HTTP calls from the command line.
Audit existing UI code for consistency with your design system. Use this skill whenever the user wants to review, audit, check, or validate their UI implementation against design system standards. This includes checking for raw color values instead of tokens, missing states, spacing inconsistencies, accessibility gaps, dark mode support issues, or general design system compliance. Also trigger this when the user says things like 'does this look right', 'review my CSS', 'check this component', 'audit my UI code', or 'is this following the design system'.
Implementation orchestrator for guardrails projects — dispatch every plan task to a subagent under develop-tdd, merge the task branches, then run one review-conformance review per guidelines file and dispatch the fixes. Use when implementing any feature, fix, or refactor.
Finds where consuming code has drifted from what the design system intended: local re-implementations, token overrides, forked patterns, classified by cause. Use it whenever someone asks where a codebase, product or team has drifted or gone off-system. One component vs spec: design-to-code-check.
Generate deterministic INSERT SQL seed data from Go Ent schemas and mixed inputs. This skill is REQUIRED whenever you need to create seed SQL for development or testing - it handles entity inference, relationship integrity, stable IDs, and dialect-specific SQL generation including JSON, arrays, and complex types. Use this skill for any task involving seed data, test fixtures, demo initialization, or database population from Ent schema definitions, even if the user doesn't explicitly mention "seed" or "SQL".
Analyze LLM experiment results. Handles single or comparative experiments, exploratory or Q&A modes. Use when user says "analyze experiment", "compare experiments", "analyze against baseline", or provides one or two experiment IDs for analysis.
Continuous formal verification of architectural constraints and code quality. Use when asked to verify, audit, or validate codebase integrity. Runs automatically via hooks on every edit (structural) and pre-commit (full). Catches ownership violations, boundary crossings, state machine bugs, and code smells that grep ratchets miss. Triggers: "verify", "formal verify", "check architecture", "audit code quality", "run verification", "/verify", "/verify --bootstrap", "/verify --grade".
Use when dynamically testing whether untrusted input reaches an interpreter — SQL/NoSQL injection (incl. blind/time-based), OS command injection, server-side template injection (SSTI), XXE, LDAP/XPath, and CRLF/header injection. Confirms on a running app what security-code-audit finds in source.
Use this skill for ANY LangSmith/LangChain observability question. Covers two topics: (1) Adding tracing to your application (LangChain/LangGraph or vanilla Python/TS with @traceable), and (2) Querying traces for debugging, analyzing execution flow, and exporting trace data.
PR reviewer with one binary verdict, where an approval is just 🦎. Sizes the review to the diff, from a quick pass to cross-model, checks claims against tickets, posts inline fixes; --local reviews a branch with no PR. Use when asked to "lizard" a PR or branch, or for a "lizard sweep".
Use host-side WeChat DevTools automation to inspect GUI-only runtime and interaction failures that do not show up in CLI `preview`. Trigger when page entry, taps, websocket-based DevTools automation, or run-directory evidence such as `report.json` and `trace.log` are needed to separate repo bugs from IDE session problems, local service blockers, or remaining visual-only issues.
Review code changes from multiple specialist perspectives in parallel. Use when you want a thorough review of a PR, branch, or set of changes covering security, performance, correctness, edge cases, and ripple effects. Spawns parallel reviewer agents that each focus on a different lens, then synthesizes into a unified review.
Audit component and pattern naming for consistency and clarity, with rename suggestions. Triggers: naming review, are our component names consistent, fix our naming. Token names: token-audit. Prop names: component-api-validator. Figma variable names: figma-variable-audit
Use when an OpenHarmony C++ change must be checked for call-chain completeness, especially for data propagation, IPC/proxy/stub paths, virtual overrides, callbacks, or dlopen/dlsym boundaries. Produces evidence tables and modification coverage matrices; the helper script only discovers candidate edges.
Use when measuring RAM/ROM impact of OpenHarmony multimodal input (MMI) subsystem changes on DAYU200 (RK3568). Covers ROM measurement via readelf section analysis and file size comparison, RAM measurement via /proc/PID/smaps, smaps_rollup, hidumper --mem, and baseline/current .so swap methodology. Includes code-level theoretical analysis for heap-allocated data structures.
OpenAPI contract validation between frontend and backend. Covers type sync, endpoint validation, and contract-first development. USE WHEN: user asks about "OpenAPI validation", "API contract", "swagger sync", "frontend backend types", "API mismatch", "contract testing" DO NOT USE FOR: GraphQL - use `graphql-contract` skill, authentication - use `auth-flow-validation` skill
Checks an Android app project against Google Play's Developer Program Policies before submission. Works with native (Kotlin/Java), Flutter, React Native, Expo, Kotlin Multiplatform, .NET MAUI, Cordova, Ionic, Capacitor, and Unity projects. Use when the user wants to verify their app complies with Google Play rules, or when they mention “play store review,” “google play policy,” “play console rejection,” or “app removal”
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.