Skills
96,981 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Reviews, writes, and fixes focus management code for all Apple platforms (tvOS, iOS/iPadOS, watchOS, visionOS, macOS), covering SwiftUI, UIKit, AppKit, and RealityKit. Use when reading, writing, or reviewing apps that handle focus, hover, key view loops, or Digital Crown navigation.
Luban — a Skill workshop. Refine a usable Skill into a public asset that can be understood, installed, shared, validated, and continuously improved. Its craft-based method has five steps: inspect the material (challenge the Skill’s premise first and say plainly when it is not worth refining), survey the field (search online for similar Skills and understand its place in the ecosystem), measure it (assess structure, real-world tests, and live runs together—the latter means checking actual outputs, since green CI can lie), plane slowly (freeze the original as a baseline; keep changes only if they pass validation, otherwise revert; wherever possible, preserve validation methods as repository tools and conventions), and rework (publication is not the finish line; keep a comparison watchlist and use real feedback in the next round). Use when users want to upgrade, optimize, refine, productize, or publish a Skill they developed. The final deliverables are a structured “Skill Refinement Report,” rewrite snippets ready to replace the originals, and a shareable “certificate of mastery” result card. Triggers include, but are not limited to: “let Luban review this skill,” “refine my skill,” “upgrade my skill,” “optimize this skill,” “skill checkup,” “skill audit,” “productize my skill,” “how do I publish this skill,” “compare it with similar skills,” “why is nobody installing my skill,” “help me publish my skill to GitHub/ClawHub,” and “improve SKILL.md.” Even if the user only shares a Skill directory, GitHub repository link, or SKILL.md and asks “how should I change this?”, trigger it whenever the context is to make the Skill more useful and shareable. Do not use it to create a new Skill from scratch (use skill-creator), for ordinary code review (use code-review), or to rewrite a general prompt unrelated to Skill assets.
Perform static application security testing with tools like Semgrep, CodeQL, and SonarQube. Identify security vulnerabilities in source code before deployment. Use when implementing secure SDLC, code review automation, or security gates in CI/CD pipelines.
Fix or change an AI agent's behavior using MLflow traces and regression tests. Use for wrong or incomplete answers, hallucinations, missing tool calls, new business rules, trace-driven debugging, or context and token-cost optimization. Diagnose the actual failure, plan a test, implement the smallest fix, and verify the new behavior without breaking existing cases.
React and Next.js performance optimization guidelines from Vercel Engineering. This skill should be used when writing, reviewing, or refactoring React/Next.js code to ensure optimal performance patterns. Triggers on tasks involving React components, Next.js pages, data fetching, bundle optimization, or performance improvements.
Add-on to patrol-write-test for Patrol test suites built on LeanCode's recommended architecture—Modules, System, and ApiClients—with per-feature keys.dart files. Use together with patrol-write-test when the project's Patrol tests already follow this architecture (e.g., a `patrol_test/modules/` directory and a `testApp` wrapper), or when the user asks to introduce it or organize test code into modules
/c-level-agents:caio-review [plan] — Eval-demanding Chief AI Officer interrogation of any plan that involves AI: model selection, risk classification, cost economics, or AI hiring. Use when shipping an AI feature without an eval set, choosing between API, fine-tune, and self-hosted, or classifying a use case under the EU AI Act.
Adversarial review (对抗 review) of a finished deliverable — a change ready for a PR, an investigation report, a recommendation, a batch of record edits — before it is reported to the user. Spawns fresh reviewer subagents briefed to disprove it from three directions (open, over-engineering, residue), verifies and fixes what holds, then reports. Run once per deliverable when it is considered done, and on request at level strong (强力) or max (极致). Not for answers to questions, lookups, or steps inside a task.
Analyze KuiklyUI Compose DSL recomposition performance issues from Recomposition Profiler output. Use when the user mentions 重组分析、重组优化、卡顿分析、recomp 报告、recomposition analysis, or asks to analyze profiler_report.json / profiler_frames.jsonl log files generated by KuiklyUI Recomposition Profiler.
Use when asked to review, critique, audit, or improve an existing user interface — "review this UI", "why does this look generic", "make this more polished", "design feedback", "does this look AI-generated", "audit this page". Also use as the final gate before shipping any frontend work, and when a UI renders correctly but feels unfinished, cheap, or inconsistent without an obvious cause.
This skill enables visual inspection of websites running locally or remotely to identify and fix design issues. Triggers on requests like “review website design,” “check the UI,” “fix the layout,” or “find design problems.” Detects issues with responsive design, accessibility, visual consistency, and layout breakage, then fixes them in the source code
Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking screenshots, extracting data, testing web apps, or automating any browser task. Triggers include requests to “open a website”, “fill out a form”, “click a button”, “take a screenshot”, “scrape data from a page”, “test this web app”, “login to a site”, “automate browser actions”, or any task requiring programmatic web interaction.
Audit an AEM Edge Delivery Services page for content quality, SEO, accessibility, performance, and EDS best practices. Produces a prioritized fix list with specific remediation steps. Use when reviewing page quality, preparing for launch, or optimizing existing content.
Identifies and exploits Insecure Direct Object Reference (IDOR) vulnerabilities by manipulating object identifiers (numeric IDs, UUIDs, slugs) in API requests and URLs, using Burp Suite proxy history, Intruder, and the Authorize extension to test object-level authorization across sessions. Use during authorized penetration tests or bug bounty work to validate that CRUD endpoints and multi-tenant applications enforce per-object access control.
Best-practice authoring guidance AND a read-only policy gate for AWS Terraform generated by a migration skill. Load during any phase that writes a terraform/ directory — first as the "what to emit" posture rules + security-baseline spec, then after writing as the deterministic policy verdict. Read-only: it reports whether the generated Terraform passes; it never edits .tf files, never touches .phase-status.json, and never decides phase completion. Complements (does not replace) terraform fmt/init/validate
Automate GitHub workflows with AI assistance. Includes PR reviews, issue triage, CI/CD integration, and Git operations. Use when automating GitHub workflows, setting up PR review automation, creating GitHub Actions, or triaging issues.
Inspects PostHog Visual Review (VR) runs that gate PR merges with screenshot regression checks. Use when the user mentions "visual review", "VR", "snapshot diff", "screenshot test", "storybook regression", "playwright snapshot", "quarantine", asks why a PR is blocked or what changed visually, wants to triage the VR backlog, decide whether a snapshot diff is real vs flaky, quarantine or lift a flaky story, or check whether a story has been changing across runs. Also invoke when a PR has a failing `visual-review` status check, when a PR comment mentions "Visual review", when a PR from a fork fails `Visual regression tests pass`, or when the user is on a branch with an open VR run.
Plan, conduct, and analyze UX research using proven methodologies. Use when planning user research, writing interview scripts, creating test plans, recruiting participants, analyzing qualitative data, or synthesizing findings into actionable insights. Covers generative, evaluative, and continuous discovery research with specific frameworks, scoring rubrics, and templates
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.