Skills
96,981 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Runs scoped browser probes for focus, hit targets, overflow, themes, request failures, and performance attribution, with evidence linked to UI rule IDs. Use when asked to "verify this in the browser", "reproduce this UI finding", "re-measure after the UI fix", or "review before and after screenshots"
Score work out of 10 against a clear rubric, then improve it round by round until every item reaches the target score the user named (for example, “get it to 8 out of 10” or “bring everything under 6 up to 6+”). Covers anchored rubrics, measurable criteria, independent or blind judging, before/after scorecards, and honest reporting of anything still short. Use whenever the user asks to score, rate, grade, or judge something out of 10, names a target score, or asks “what would make this a 9?”
OpenFGA authorization modeling best practices for defining types and relations, writing relationship tuples, deriving can_* permissions, applying type restrictions and usersets, and authoring .fga.yaml check/list_objects/list_users tests. Use when authoring, reviewing, or refactoring OpenFGA models, tuples, permissions, .fga files, .fga.yaml test files, or OpenFGA SDK integrations in JavaScript, TypeScript, Go, Python, Java, or .NET.
Read and dig into Scrawl screen captures, where someone recorded their screen while talking, clicking and drawing red marks on it. Use whenever a message contains a Scrawl capture (a line like `[scrawl 0:12 · App “Window” · /path/to/….scrawl]`, a `.scrawl` bundle path, or a contact-sheet.png from one), when the user says "look at my scrawl" or refers to something they just recorded or drew, or when you need the `scrawl` CLI to zoom into a moment, pull frames, send a capture to a session, or export one as video.
Guide for contributing to Nuxt UI. Provides component structure patterns, Tailwind Variants theming, Vitest testing conventions, and MDC documentation guidelines. Use when creating new components, reviewing component PRs, modifying existing components, writing tests, or creating documentation in this codebase.
Verifies that git commits address security audit findings without introducing bugs. This skill should be used when the user asks to "verify these commits fix the audit findings", "check if TOB-XXX was addressed", "review the fix branch", "validate remediation commits", "did these changes address the security report", "post-audit remediation review", "compare fix commits to audit report", or when reviewing commits against security audit reports.
Performs a white-box security review of Atlassian Forge apps using structured, Forge-specific security rules and evidence-driven reporting. Use for Forge security reviews, security audits, vulnerability assessments, pentest-style code reviews, authorization reviews, tenant isolation analysis, web trigger hardening, or static analysis of a Forge app.
Run measurement-led React and Next.js performance audits for waterfalls, bundle size, RSC/server-client boundaries, hydration mismatch, rerender churn, script cost, and slow page interactions. Use when the user needs help diagnosing or refactoring a slow React UI, App Router route, heavy client component, or Next.js page with excess JavaScript or weak client/server boundaries. Triggers on: React perf, Next.js perf, waterfall, bundle size, hydration, rerender, client component too heavy, slow route, React profiler, web vitals
Adopt repository-level harness engineering for coding agents. Use when a user wants to prevent repeated AI coding-agent mistakes by turning failures into durable instructions, drift checks, regression tests, failure memory, and adoption reports tailored to the target repository.
Audit a live page for accessibility issues and locate each violation precisely — pass a URL, a config target name (e.g. `accesslint:scan dev`), or nothing to use the default target from accesslint.config.json. Ensures a debuggable Chrome, runs the @accesslint/core engine via CDP, and returns a worklist of live-DOM WCAG violations grounded to each violation's DOM selector and source file:line. Locates; doesn't edit — output drives fixes by Claude. Use it for “is this page accessible,” or to verify a UI change. For diffing against uncommitted changes or a branch, use the `diff` skill.
Runs an evidence-based health audit of this skills marketplace repo—code safety, docs/SSOT, security/PII, PR/issue triage, and manifest integrity—via a parallel workflow, then verifies findings by priority. Use for 全面体检 / 检查仓库状态 / 审计一下仓库, a pre-release sweep, or “is this repo OK” even without saying “workflow.” Not for building marketplace.json (use marketplace-dev) or cache drift (use skill-governance)
Designs, implements, refactors, debugs, reviews, and verifies production-quality NestJS and TypeScript software. Use for NestJS feature development, bug fixes, APIs, libraries, testing, maintainability, developer experience, idiomatic syntax, or syntactic sugar. It inspects the current project and official version-appropriate documentation before selecting syntax, preserves public behavior, and tests the result. When other skills also apply, reconcile ownership before mutation.
Clean Code principles (DRY, KISS, YAGNI), naming, function design and readability. Use when code is hard to read, with long methods, unclear names, duplication or deep nesting. For how responsibilities are split across classes and which way dependencies point, use solid-principles instead
QA the omo Codex Light edition (lazycodex / packages/omo-codex) itself, in strict isolation so ONLY our plugin is exercised, never the user's real ~/.codex. The first-party method drives the real `codex app-server` against an isolated CODEX_HOME plus a LOCAL mock model (no real API call), and proves a plugin hook fired by asserting hook/started + hook/completed notifications. Also: isolated install verification, per-component hook probes, a tmux TUI smoke, and runtime log observation (RUST_LOG / logs SQLite / /debug-config). Ships tested helper scripts each with a --self-test. Use whenever someone changes anything under packages/omo-codex or wants to QA, smoke-test, verify, or debug the Codex plugin, its hooks/components, the installer/config.toml, the app-server flow, or the Codex TUI. Triggers: codex qa, qa codex, codex-qa, test codex plugin, verify codex hook, codex app-server, lazycodex qa, isolated CODEX_HOME, prove codex hook fired, codex tui test.
Optimize ToolUniverse skills for better report quality, evidence handling, and user experience. Apply patterns like tool verification, foundation data layers, disambiguation-first, evidence grading, quantified completeness, and report-only output. Use when reviewing skills, improving existing skills, or creating new ToolUniverse research skills.
Review and improve tldraw SDK documentation against the voice and docs guides, scoring each article and iterating until it passes. Use when asked to review docs, audit an article in apps/docs/content, check whether documentation follows the style guide, or improve existing documentation.
Use when you need to add or evaluate Maven dependencies that improve code quality or domain modeling — including nullness annotations (JSpecify), static analysis (Error Prone + NullAway), functional programming (VAVR), architecture testing (ArchUnit), or money and currency support (JavaMoney) — and want a consultative, question-driven approach that adds only what you actually need. This should trigger for requests such as Add Maven dependencies; Add JSpecify nullness dependencies; Add Error Prone NullAway dependencies; Add VAVR functional dependencies; Add ArchUnit architecture testing dependencies; Add JavaMoney dependencies. Part of Plinth Toolkit
Use when you need to write unit tests for Spring Boot applications — including pure unit tests with @ExtendWith(MockitoExtension.class) for @Service/@Component, slice tests with @WebMvcTest and @MockitoBean for controllers, @JsonTest for JSON serialization, parameterized tests with @CsvSource/@MethodSource, test profiles, and @TestConfiguration. For framework-agnostic Java use @131-java-testing-unit-testing. For integration tests use @322-frameworks-spring-boot-testing-integration-tests. This should trigger for requests such as Review Java code for Spring Boot unit tests; Apply best practices for Spring Boot unit tests in Java code; Write Mockito-first unit tests for Spring Boot services; Avoid unnecessary @SpringBootTest in Spring unit tests; Review Spring Boot slice-free unit test design. Part of Plinth Toolkit
Run a broad web UI review for pages, flows, or component surfaces using audit categories such as layout hierarchy, content clarity, CTA emphasis, visual consistency, interaction states, responsiveness basics, performance signals, and accessibility basics. Use when the user asks to review a UI, audit a page, critique UX polish, check interface quality before launch, or turn vague design-feedback requests into a structured audit packet. Not for accessibility- only remediation, reusable component API design, system-level token governance, or React/runtime performance debugging. Triggers on: UI audit, design review, UX review, interface critique, polish review, landing-page review, dashboard review, usability review, visual consistency, CTA clarity.
A WeChat Pay delegated recurring payment integration solution covering the full lifecycle for recurring deductions and buy-now-pay-later scenarios: contract-only signing, signing during payment, deduction requests, pre-deduction notifications, contract termination, queries, refunds, and reconciliation. Provides five capabilities: solution selection, sample code, business quick reference, quality assessment, and troubleshooting. Use when the user mentions "委托代扣", "周期扣款", "周期扣费", "自动续费", "先享后付", "免密支付", "纯签约", "支付中签约", "预扣费通知", or "申请扣款", or asks to "接入委托代扣", "要委托代扣接口示例代码", or "排查委托代扣问题".
Improve the quality and type safety of TypeScript/JavaScript being written or refactored—parse, don’t validate; make illegal states unrepresentable; use exhaustive matching; separate pure functions from IO; and maintain public API hygiene. Use when asked to refactor, clean up, improve, harden, or review the design or quality of code or an API. Not for hunting bugs (use /code-review) or for vigiles’s own spec/lint rules.
Creates and maintains the scenarios run by LiveKit agent simulations and wires the agent to consume them. Use when the user asks “what should I test,” “generate simulation scenarios,” “write scenarios for my agent,” “add a scenario for X,” “organize my scenario files,” “my simulations are flaky,” “the scenario hits my real database,” “seed state per scenario,” “it passed but booked the wrong thing,” “grade the final state,” or wants to stress-test a flow before shipping. Covers generating a baseline with the LiveKit scenario generator and refining it, writing cases generation misses, phrasing simulated-user instructions for reliable steering, splitting scenarios into sets across files, and agent-side code that seeds deterministic state from a scenario and fails a run if its final state is wrong. To run scenarios, use running-livekit-simulations.
Browser automation with two integrations - Chrome DevTools MCP (always available, performance tracing) and Claude-in-Chrome extension (authenticated sessions, GIF recording). Use DevTools for testing/debugging, Claude-in-Chrome for authenticated workflows.
Runs LiveKit agent simulations and acts on the results. Use when the user says “run my simulations,” “regression test my agent before deploying,” “run the scenarios,” “use lk agent simulate,” “did my agent pass,” “why did this scenario fail,” “run simulations in CI,” “test the audio pipeline,” “check turn-taking and interruptions,” or wants to check whole-conversation behavior before shipping. Covers text and audio modes and what each catches, running against a local or deployed agent, degraded-audio flags, automating a pre-release run, and triaging failures with list, view, and export. To write scenarios, use writing-livekit-scenarios. Not the default for a bare “test my agent,” which goes to debugging-livekit-agents. Use this skill when the user names simulations, scenarios, a run, CI, or shipping.
Use when comparing Scenario models on the same brief through MCP: a bake-off with shared prompts and inputs, cost, generation time and quality measured side by side, choosing a default model, testing a new release against the incumbent, or finding which model handles a style, edit, or reference image best. Keywords: model comparison, benchmark, bake-off, A/B test, contact sheet, cost per asset, latency.
Take the current branch from done-coding to merge-ready in one pass — review the diff against AGENTS.md, deslop, commit and push, open a PR using rule-validate's PR copy, then babysit until mergeable. Use when the user types `/ship` or asks to ship, finalize, or land the current branch
CI-only Simplify & Harden workflow for pull requests using gh-aw (GitHub Agentic Workflows). Runs headless scan-and-report checks for simplify/harden/document, posts structured findings, and can block merges on critical or advisory classes. Use when: you want automated quality/security review in CI without interactive approvals.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.