Skills
96,770 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Validate plans, designs, and implementations before execution to prevent costly mistakes. Cover architecture review, security audit, scalability assessment, cost analysis, compliance check, and risk identification. Produce go/no-go decisions with specific remediation steps. Triggers on "review this plan", "validate architecture", "check for mistakes", "is this production ready", "audit this design", "what could go wrong", "pre-flight check", "build review", "quality gate", "risk assessment", "cost estimate", or "compliance check".
Use when you need to batch-verify whether skills conform to best-practice standards, automatically checking dimensions such as naming, frontmatter, structure, and dependencies, generating a detailed report, and outputting fix suggestions; supports single or batch checks. Trigger words: check skill standards, batch-verify skill quality, scan all skills, full skill quality validation.
Create a comprehensive checkpoint commit with detailed analysis of all changes. Use this skill when the user says "checkpoint", "commit everything", "save my progress", "create a commit", or wants to stage and commit all current changes with a well-crafted message. Also use when the user says "/checkpoint" or asks to snapshot current work. This skill stages all changes and creates a descriptive commit — it does not push.
Reviews Node.js runtime behavior in JavaScript or TypeScript, including server entrypoints, route handlers, middleware, streams, processes, dependencies, and environment configuration. Loads alongside language and CLI checks when applicable; investigates blocking I/O, backpressure, injection, lifecycle leaks, and misleading failure signals.
A standalone adversarial PLAN-review loop where Claude Code (builder) and OpenAI Codex (read-only critic) tag-team an implementation plan before any code is written. Use this when you ALREADY have a plan or a clear idea and just want the cross-model stress-test — no requirements interview first. Claude drafts/loads the plan into PLAN_FILE (default PLAN.md), Codex reviews it in a read-only sandbox and returns VERDICT:APPROVED or VERDICT:REVISE, Claude revises and re-submits to the SAME Codex session (context preserved) until APPROVED or a configurable MAX_ROUNDS cap is hit. Human approves the converged plan before code. Use when the user says "/codex-plan-review", "codex review my plan", "have Codex review my plan", "argue this plan with Codex", "adversarial plan review", "make Claude and Codex argue/fight over the plan", or is about to build something high-stakes (auth, schema, concurrency, migrations, payments) and wants a second-model sanity check on the PLAN before implementation. For a guided requirements interview BEFORE the review, use /grill-me-codex instead. NOT for reviewing already-written CODE (that is /codex-code-review or the Codex plugin's /codex:review) and NOT for trivial changes.
Check preprocessing, splits, leakage, augmentation, label noise, and distribution mismatch before blaming the model. Use for new datasets, suspicious gains, brittle generalization, unexplained train-test gaps, or any result that may be caused by data pipeline bugs rather than model behavior.
A specialist team for the coding agent you already use: 12 roles, 21 workflows and 33 skills that plan, build in parallel, review and debug, leaving plans, ADRs and results as files. Gates wait for your own tests. Also research, slides and video. One .agents/ folder for Claude Code, Codex, Cursor and 11 more.
Systematic debugging methodology, language-specific debuggers, and common scenario playbooks. Use for: debug, debugging, bug, crash, hang, memory leak, race condition, deadlock, bisect, reproduce, root cause, breakpoint, profiling, performance issue, segfault, stack trace, core dump.
Reviews proposed or existing work for unnecessary complexity and triages complexity-increasing recommendations without editing the reviewed targets. Use this skill when asked to simplify or decomplex source, tests, configuration, dependencies, plans, designs, or architecture; challenge over-engineering; audit unnecessary complexity; or triage recommendations that would add complexity. Do not use for general defect review, implementation or fixes, style-only cleanup, or conceptual explanations that need no durable review report.
A specialized skill for testing FluentValidation validators. Use when you need to create tests for Validator classes, verify business rules, or test error messages. Covers full use of FluentValidation.TestHelper, ShouldHaveValidationErrorFor, async validation, cross-field logic, and more. Make sure to use this skill whenever the user mentions FluentValidation testing, Validator testing, ShouldHaveValidationErrorFor, TestHelper, or testing business validation rules, even if they don't explicitly ask for validation testing guidance. Keywords: validator, 驗證器, fluentvalidation, validation testing, UserValidator, CreateOrderValidator, TestHelper, ShouldHaveValidationErrorFor, ShouldNotHaveValidationErrorFor, TestValidate, TestValidateAsync, 測試驗證器, 驗證業務規則
End-to-end frontend testing with Playwright. Page Object Model, selectors, fixtures, accessibility audits. Limited E2E coverage currently - area for improvement. Keywords: Playwright, E2E, Page Object Model, POM, data-testid, getByRole, getByLabel, getByText, fixtures, axe-playwright, frontend testing
Detects duplicate boilerplate, copy-paste tests, and structural maintainability issues across .NET test suites. Use when the user asks to reduce repetition, consolidate similar test methods, convert copy-paste tests to data-driven parameterized tests, suggest a better test structure, or identify refactoring opportunities. Identifies repeated construction, assertion patterns, copy-paste methods convertible to DataRow/Theory/TestCase, redundant setup/teardown, and shared infrastructure. Produces an analysis report with concrete before/after suggestions. Works with MSTest, xUnit, NUnit, and TUnit. DO NOT USE FOR: writing new tests (use writing-mstest-tests), reviewing test quality or anti-patterns (use test-anti-patterns), or deep mock auditing (use exp-mock-usage-analysis).
Find dead code using parallel subagent analysis and optional CLI tools, treating code only referenced from tests as dead. Use when the user asks to "find dead code", "find unused code", "find unused exports", "find unreferenced functions", "clean up dead code", or "what code is unused". Analysis-only — does not modify or delete code.
Polyglot, parse-only static analysis that pairs source files with referencing tests across Python, TypeScript/JavaScript, Go, Java, Rust, C#, and Ruby. JSON shape matches `find-untested-sources`. USE FOR: where to write tests next, find untested files, list sources without tests, polyglot test-pairing map. DO NOT USE FOR: coverage, CRAP risk. For .NET-only repos prefer `find-untested-sources`.
Comprehensive codebase review and parallel agent-based remediation skill. Use PROACTIVELY when agent needs to perform full codebase audit, generate master findings report with quantified metrics, and execute remediation using parallel goodvibes background agents (max 6 concurrent, one task per agent with fresh context). Triggers on: codebase review, code audit, full project analysis, quality assessment, technical debt analysis, parallel remediation, bulk fixes.
Use when managing Google Play developer account users, permissions, grants, or testers. Make sure to use this skill whenever the user mentions gpc users, gpc testers, gpc grants, developer account permissions, user roles, invite user, remove user, permission grants, per-app permissions, per-app grants, standalone grants, tester groups, beta testers, internal testers, alpha testers, Google Group testers, tester CSV import, team management, access control, user audit — even if they don't explicitly say 'user management.' Also trigger when someone wants to invite team members to their Play Console, update permissions for existing users, manage per-app grants independently from users, manage who can test their app, import testers from a CSV file, or audit who has access to their developer account. For authentication setup, see gpc-setup. For release track management, see gpc-release-flow.
Guides security assessment of embedded and cyber-physical systems on hardware-in-the-loop (HIL) test benches—bench setup, ECU/ECM or PLC targets, bus interfaces (CAN/CAN-FD, LIN, automotive Ethernet, Modbus at high level), fault injection and stimulus design, simulated plant/environment integration, attack-surface monitoring on real hardware, reproducible test cases, lab safety interlocks, and evidence capture for firmware and vehicle security teams. Use for HIL security testing, ECU security assessment, CAN bus security, PLC HIL test, fault injection lab, embedded hardware security—not web/API pentest (web-pentester), network-only pentest (network-pentester), malware/binary RE only (reverse-engineer), SOC operations (soc-analyst), AI red team (ai-redteam), classified ISSO paperwork (information-systems-security-officer-classified-specialist), or pure software CI without hardware (build-validator).
Plan and review localization changes across app, docs, and web surfaces. Use for string extraction, locale routing, plural/date/number formatting, RTL, pseudo-locale QA, message catalogs, and translation readiness. NOT for generic copy editing, frontend visual design, SEO, or JavaScript conventions.
This skill should be used when implementing features from Linear issues with full TDD workflow, automated planning, parallel code reviews (security and Rails best practices), systematic feedback implementation, and automated PR creation with Linear integration. Use when the user provides a Linear issue ID (e.g., "TRA-9", "DEV-123") and wants a complete implementation workflow from issue to PR.
Run parallel reviewer subagents across a target repo or diff to surface findings across correctness, security, maintainability, performance, tests, dead code, and dependency health, dedup them against a persistent ledger and Linear, then triage survivors into Linear tickets. Use when the user wants a code review, repo health audit, or to turn review findings into tickets.
Grade whether a change's complexity and blast radius are actually worth the benefit it delivers, using an itemized ROI receipt and rankings among solutions already raised. Use on an existing PR, a local diff, or an idea still being discussed before any code exists. Trigger on "is this worth it", "ROI on this fix", "are we overengineering this bugfix", "worth the blast radius", or when a small fix seems to be touching shared systems, adding state, or expanding scope out of proportion to what it fixes.
Guide for migrating MSBuild tasks to multithreaded mode support, including compatibility red-team review. Use this when converting tasks to thread-safe versions, implementing IMultiThreadableTask, adding TaskEnvironment support, or auditing migrations for behavioral compatibility.
A comprehensive suite of protocols, meta-prompts, and orchestration tools designed to streamline software development workflows, project management, and team collaboration. Includes the VibeCode Protocol Suite with web interface, user manuals, and reusable templates for efficient development processes
(NS) Create or improve project-local agent skills in a NextStage harness project — draft SKILL.md under .agents/skills/, run evals, then harness sync. Use whenever the user asks to create a skill, add a custom skill to this project, author SKILL.md, iterate on skill evals/benchmarks, or optimize skill descriptions — even if they say "make a skill for our repo" or "skill-creator". Do NOT use for contributing to the nextstage-brasil/skills catalog (that repo has its own maintainer workflow in AGENTS.md).
Run a local multi-model code review through the user's OpenCode setup BEFORE a pull request is opened. Use this right after finishing an implementation or bug fix in Claude Code, while the changes are still local — uncommitted, or committed on a branch but not yet turned into a PR — and the user wants an independent review pass before pushing. Trigger whenever the user says things like "review my changes", "review before I open the PR", "run the opencode review", "multi-model review", "review this diff", "second opinion on this", or asks for a pre-PR review of work that was just completed, even if they don't name OpenCode explicitly. Returns a consolidated review report on stdout for Claude Code to act on. Do NOT use this for reviewing an already-open GitHub PR — that path is handled interactively in the OpenCode TUI and uses gh.
Complete browser automation with Playwright. Auto-detects dev servers, writes clean test scripts to /tmp. Test pages, fill forms, take screenshots, check responsive design, validate UX, test login flows, check links, automate any browser task. Use when user wants to test websites, automate browser interactions, validate web functionality, or perform any browser-based testing.
Design and audit product analytics instrumentation for events, properties, identity, sessions, funnels, cohorts, experiments, attribution, billing/support joins, privacy, consent, data quality, mobile/web/server tracking, dashboards, QA, release gates, and metric ownership. Use when teams need trustworthy behavior data before product decisions or launches.
Validates apps-in-toss project configuration and structure for both web and React Native apps. Use when checking if granite.config.ts is properly configured, verifying required files exist, validating package.json has framework dependencies, ensuring project structure follows apps-in-toss conventions, or debugging project setup issues.
Executes a four-phase feature addition workflow (Discovery, Planning, TDD Implementation, Verification) for Python projects. Use when adding a new feature end-to-end — discovering project structure and integration points, drafting a feature spec with MoSCoW-prioritized requirements and BDD acceptance criteria, implementing via test-first TDD cycles, then verifying with ruff lint, ty type checks, and behavior-focused regression and contract coverage.
Design probes and diagnostics to inspect what a model representation has learned. Use for embeddings, intermediate features, collapse checks, retrieval behavior, clustering structure, mechanistic interpretation-lite, or when aggregate accuracy does not explain internal behavior.
A command guide for operating the ROCK platform with rockcli (rc): manage sandboxes, run and view agent evaluations, manage experiments, dump images, manage datasets, and more. Use when the user wants to look up rc command usage or use rockcli to start or stop sandboxes, run commands in sandboxes, transfer files, run agent evaluations, manage experiments, move images, or manage datasets.
Use RocketSim to inspect visible UI and interact with iOS Simulator apps. Detects the installed RocketSim version, loads the matching bundled RocketSim CLI guidance, and helps agents read visible accessibility elements, navigate screens, tap, long-press, swipe, type text, press simulator hardware buttons, and automate simulator flows reliably. Use when: (1) the user mentions RocketSim, the rocketsim command, or RocketSim CLI, (2) interacting with an app in the iOS Simulator, (3) navigating or testing a simulator app with AI, (4) reading visible UI state or accessibility elements, (5) tapping, long-pressing, swiping, typing, or pressing simulator buttons, (6) using RocketSim instead of ad-hoc simulator automation.
Technical SEO auditor and fixer. Use when the user wants to: - Run a Lighthouse/PageSpeed audit on a website or local dev server - Analyze SEO, performance, accessibility, or best practices scores - Fix technical SEO issues in their codebase - Optimize meta tags, structured data, Core Web Vitals - Improve page speed, accessibility, or PWA compliance Triggers: "audit my site", "check SEO", "fix SEO", "lighthouse", "pagespeed", "improve performance", "meta tags", "structured data", "core web vitals"
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.