Skills
96,981 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Create and run E2E tests. Use agent-browser primarily, falling back to Playwright only for interactions it cannot handle. Covers when to write or skip tests, prohibits timing dependencies caused by sleep, and specifies explicit wait conditions. Use when adding major user-facing flows, making significant UI changes, or changing success criteria for existing flows.
Run a thorough audit of an iOS / macOS Swift codebase—bugs, dead code, duplication, Swift concurrency issues, deprecated APIs, security, performance, and SwiftUI quality—and produce a single navigable CODE_AUDIT.md report with file:line-cited findings. Use when the user asks for a “code audit,” “comprehensive review,” “find tech debt,” “what should I clean up,” or a similar broad-scope assessment of a Swift project
Use when a Scenario user wants to report a bug or request a change, on the public tracker at github.com/scenario-labs/skills or by email to [email protected]: turning a failed generation, MCP tool error, or unclear skill into a reproducible report, collecting trace ids with diagnostics_run, stripping keys, signed asset URLs, and personal data, asking before sharing a team or project id, or building a prefilled issue URL. Keywords: file an issue, feature request, feedback.
Use when the user requests TDD, BDD, tests derived from the specification's reference Gherkin, traceability between `spec.md` and tests, or a RED-GREEN-REFACTOR cycle. Also use when an automatic transition requests materialization, RED, or test verification. Use to edit sections 11–13 and run tests; `specsfy-07-implement` remains responsible for production tasks in section 14 of the same file.
Use quando o usuário pede para validar, revisar, auditar ou checar se `specs/{id}-{slug}/spec.md` segue o formato rígido Specsfy/2.0 e está pronto para planejar. Use também quando uma transição automática pedir prova do Definition Gate ou nova validação após correção. Use antes do Ato II. Registre gates na seção 13 do mesmo arquivo; não crie checklist, relatório, plan.md ou outro artefato.
After navigating and interacting in Cursor's built-in browser, use browser_network_requests to audit every fetch/XHR for failures, slowness, duplicate calls, and suspicious payloads. Use for API-heavy pages and after backend or client networking changes.
MUST be used right after changing any CLI color config (delta/bat/themes/lazygit pager) — renders the terminal's colored output to a PNG so Claude can actually SEE contrast, alignment, and highlighting instead of raw ANSI codes. Use for delta git diff colors, bat syntax highlighting, starship prompt, eza/ls colors, or ripgrep matches. Trigger phrases: 看终端效果, 终端截图, 验证配色, terminal screenshot.
Comprehensive debugging methodology for finding and fixing bugs (formerly debugging). This skill should be used when debugging code, investigating errors, troubleshooting issues, performing root cause analysis, or responding to incidents. Covers systematic reproduction, hypothesis-driven investigation, and root cause analysis techniques. Use when encountering exceptions, stack traces, crashes, segfaults, undefined behavior, or when bug reports need investigation.
Validate test effectiveness with mutation testing using Stryker (TypeScript/JavaScript with Vitest or bun test via @hughescr/stryker-bun-runner) and mutmut (Python). Find weak tests that pass despite code mutations. Use to improve test quality.
Use when modernizing PHP code: PHP 8.1-8.5 features, PSR/PHP-FIG/PER-CS compliance, PHPStan/Rector/PHP-CS-Fixer/PHPat tooling, DTOs/enums/readonly/property hooks, type safety. Triggers: PHP modernization, type safety, PHPStan, Rector, PHP-CS-Fixer, enum, DTO, readonly, strict_types, property hooks, PHP 8.4, PHP 8.5.
Web accessibility specialist for WCAG compliance, ARIA implementation, and inclusive design. Use when auditing websites for accessibility issues, implementing WCAG 2.1 AA/AAA standards, testing with screen readers, or ensuring ADA compliance. Expert in semantic HTML, keyboard navigation, and assistive technology compatibility.
Runtime iOS app security testing with Objection (Frida): inspect Keychain and filesystem data, explore app internals at runtime, and validate or bypass client-side protections during authorized mobile assessments.
Security-focused code review checklist and automated scanning patterns. Use when reviewing pull requests for security issues, auditing authentication/authorization code, checking for OWASP Top 10 vulnerabilities, or validating input sanitization. Covers SQL injection prevention, XSS protection, CSRF tokens, authentication flow review, secrets detection, dependency vulnerability scanning, and secure coding patterns for Python (FastAPI) and React. Does NOT cover deployment security (use docker-best-practices) or incident handling (use incident-response).
Full API lifecycle management through Postman. Sync OpenAPI specs to collections, generate typed client code, run API tests, create mock servers, publish documentation, audit security against OWASP Top 10, and discover APIs across workspaces. Requires the Postman MCP Server. Use this skill when the user mentions Postman, API collections, syncing specs, generating SDKs, running API tests, creating mocks, API documentation, or API security audits. Triggers on tasks involving API development workflows, collection management, or any Postman-related operations.
Web UI testing and browser automation. Use Vercel agent-browser for general apps, or the repo-pinned Playwright wrapper inside Eve Horizon. Use when tasks require opening pages, interacting with forms, validating UI flows, taking screenshots, extracting page data, or running repeatable browser-based checks locally or in CI.
Runs the Metabase semantic checker against a tree of Representation Format YAML files to verify that all references resolve — cross-entity references (collection_id, dashboard_id, parent_id, parameter source cards, snippet references, transform tags, etc.) and references to columns inside MBQL and native queries. Slow (≥1 min per run). Only use when the user explicitly asks to verify entity references or column references in MBQL/SQL queries; in most cases this runs as a CI step, not locally. Requires database metadata on disk (by default `.metadata/table_metadata.json`)
Audit PostHog experiments and feature flags for configuration issues, staleness, and best-practice violations. Read when the user asks to audit, health-check, or review experiments or feature flags, check flag hygiene, or verify experiment setup.
Safety rules, workflows, and tool reference for debugging applications via the IntelliJ debugger: breakpoints, debug sessions, stepping, evaluating expressions, and inspecting runtime state. Trigger when the user wants to debug, investigate a bug, set breakpoints, inspect runtime behavior, step through code, or understand why code behaves unexpectedly at runtime. Trigger phrases (EN): “debug”, “breakpoint”, “step through”, “step into”, “step over”, “why does this crash”, “why is this null”, “launch in debug mode”, “trace execution”, “run with debugger”, “evaluate expression”. Trigger phrases (RU): “отладить”, “дебаг”, “брейкпоинт”, “почему падает”, “пошагово пройти”, “зайти в метод”, “посмотреть значение переменной”, “запустить в режиме отладки”, “почему null”, “стектрейс”. Also trigger when the user wants to understand runtime behavior or investigate incorrect behavior.
Install, configure, and operate Strix for AI-driven application security testing. Use it to run authorized vulnerability scans against local codebases, GitHub repositories, staging URLs, domains, or CI pipelines; configure Docker and LLM providers; choose quick, standard, or deep scan depth; or pass authenticated testing instructions to Strix. Triggers on: strix, ai pentest, vulnerability scan cli, appsec scan, bug bounty automation, strix ci, strix docker, strix scan mode, strix instruction file, headless security scan
Use when doing dev-stage self-review on the current branch before pushing or opening a PR — runs an auto-loop of codex review (cross-model, OpenAI) + per-finding fix + re-review until findings converge or stop conditions fire. Codex follows pr-review's multi-role methodology (security / staff-engineer / sdet / spec-auditor). Triggers — 'self review', 'self-review', '自己 review', '自我 review', 'cross-model review', 'pre-push review', 'review and fix my branch'. NOT for live PR review with sticky/inline comments (use pr-review), NOT for managed PR babysitting (use pr-babysit), NOT for first-time review without intent to fix (use mode=review-only opt-in).
Audit frontend codebases for security vulnerabilities and bad practices. Use for security reviews, auditing code for XSS/CSRF/DOM vulnerabilities, checking Content Security Policy configurations, validating input handling, reviewing file upload security, or examining Node.js/NPM dependencies. Target frameworks include web platform (vanilla HTML/CSS/JS), React, Astro, Twig templates, Node.js, and Bun. Based on OWASP security guidelines
Use when reviewing a PR/MR diff for security, logic, performance, cross-file impact, test coverage, or spec compliance findings. NOT for writing PR descriptions, design reviews requiring business judgment, implementation work, release notes, or deep CVE/supply-chain audits.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.