Skills
96,981 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Perform dynamic application security testing with OWASP ZAP, Burp Suite, and Nikto. Test running applications for security vulnerabilities through automated and manual testing. Use when testing web applications, APIs, or performing penetration testing
Records visual proof while testing UI behavior—the agent tests the app hands-on via computer use while a screen recording with structured test/assertion annotations captures the session—then posts the video and a results summary to the requested destination. Use when changed runtime behavior needs observable verification, including headless environments (scripted screenshots and probes) and non-UI changes (measured numbers, output pairs).
Enforces Behavior Driven Development. Use when: implementing new features, making significant code changes, adding functionality, refactoring behavior. Requires writing a Gherkin feature file first, getting user approval, then implementing.
Production-grade Rust implementation and acceptance baseline for PMA-managed Rust services and CLIs. Use with /pma when creating, upgrading, or validating acceptance of Rust workspaces, Axum/Tokio services, CLI binaries, CI pipelines, release packaging, lint policy, dependencies, testing, observability, security, or supply-chain controls. Use pma-cr for code-review workflow
Review Next.js security audit patterns for App Router and Server Actions. Use for auditing NEXT_PUBLIC_* exposure, Server Action auth, and middleware matchers. Use proactively when reviewing Next.js apps. Examples: - user: "Scan Next.js env vars" → find leaked secrets with NEXT_PUBLIC_ prefix - user: "Audit Server Actions" → check for missing auth and input validation - user: "Review Next.js middleware" → verify matcher coverage for protected routes - user: "Check Next.js API routes" → verify auth in app/api and pages/api - user: "Secure Next.js headers" → audit next.config.js for security headers
This skill should be used when the user asks to "verify code", "run verification", "check quality", "validate changes", or before creating a PR. Provides comprehensive verification including build, type check, lint, tests, security scan, and diff review.
Analyzes code diffs and files to identify bugs, security vulnerabilities (SQL injection, XSS, insecure deserialization), code smells, N+1 queries, naming issues, and architectural concerns, then produces a structured review report with prioritized, actionable feedback. Use when reviewing pull requests, conducting code quality audits, identifying refactoring opportunities, or checking for security issues. Invoke for PR reviews, code quality checks, refactoring suggestions, review code, code quality. Complements specialized skills (security-reviewer, test-master) by providing broad-scope review across correctness, performance, maintainability, and test coverage in a single pass.
Use this skill automatically when you feel your code is ready for human review, and whenever writing or reviewing code comments. Ready means the code works and achieves a stated goal, verified by your own tests and/or, if you deem it necessary, human testing.
Scan an AEM Edge Delivery Services page for WCAG 2.1 AA accessibility violations and generate specific fixes. Identifies missing alt text, heading hierarchy issues, link text problems, color contrast concerns, and EDS-specific accessibility patterns. Use when fixing accessibility issues, preparing for compliance audits, or remediating WCAG violations.
Compare two versions of an AEM Edge Delivery Services page to identify what changed. Fetches preview vs live, or two different URLs, and produces a detailed content diff showing added, removed, and modified content, metadata, and blocks. Use when reviewing changes before publishing, auditing content modifications, or tracking content evolution.
Specializes in analyzing Lynx trace data to diagnose performance issues and provide actionable optimization strategies. Key Scenarios: - Loading Performance: Diagnosing slow startup metrics (FCP, FMP, TTI) and white screen issues. - Smoothness Analysis: Investigating root causes for scroll jank, frame drops, and interaction lag. - Regression Detection: Comparing traces to identify performance degradation or verify optimization gains between versions. - Pipeline Deep Dive: Pinpointing bottlenecks in specific rendering stages like Layout, Paint, JS execution, and background threads. - Native Module Analysis: Investigating performance issues related to native module calls. - Memory Analysis: Diagnosing high PSS, page lifecycle leaks, shared BTS context growth, VM pool waste, and JS heap snapshots.
Turn test-policy ambiguity into one packet-first validation brief. Use when the main job is deciding which gate is actually being shaped (merge, release, or scheduled), what evidence a change needs, how flaky or expensive suites should be handled, and whether the next owner is `backend-testing`, `debugging`, `code-review`, `deployment-automation`, `steam-store-launch-ops`, `game-ci-cd-pipeline`, `web-accessibility`, or `performance-optimization` instead of absorbing all test work here. Triggers on: test strategy, merge gate, required status checks, release gate, flaky-suite policy, regression policy, validation brief, release confidence, and what should we test.
Use when the user asks to “test the triage skill,” “run triage tests,” “validate antithesis triage,” “test:triage,” or “smoke test triage.” Orchestrates end-to-end testing of the antithesis-triage skill by running real triage operations via subagents and reviewing results for bugs, skill compliance issues, and papercuts.
Use when comparing physical Android benchmark configurations, investigating inconsistent rankings, or selecting an Android default from measured results. Do not use for code-level Compose performance diagnosis without a configuration comparison
Guide for simplifying and refining code after coding sessions. Use when cleaning up complex code, reviewing PRs for readability, or applying consistent refactoring patterns. Triggers on simplify code, refactor, clean up, code review, コード整理, リファクタ, 複雑さ削減, コードレビュー
Scan package dependencies for known vulnerabilities using Snyk, Dependabot, and OWASP Dependency-Check. Identify and remediate vulnerable libraries in your software supply chain. Use when managing third-party dependencies or implementing software composition analysis.
Route performance work from the artifact people already have into one measurement-led tuning brief. Use when the main job is locating the tightest latency, throughput, memory, bundle-size, or frame-budget bottleneck; choosing the right trace, query plan, load-test result, profiler capture, or CWV report; naming one bottleneck; and recommending one or two bounded optimizations with before/after verification. Route telemetry rollout to monitoring-observability, correctness diagnosis to debugging, structural cleanup to code-refactoring, validation-policy design to testing-strategies, and engine-specific capture interpretation to game-performance-profiler.
Evidence-based code review for local diffs, pull requests, and repository audits. Checks design, correctness, tests, compatibility, and operations using a shared engineering baseline plus TypeScript frontend/backend, Go, Rust, and Python packs. Use after implementation, before merging, or when auditing an existing codebase.
Use when you need to write or improve integration tests — including Testcontainers with @ServiceConnection, @DataJdbcTest persistence slices, TestRestTemplate or MockMvcTester for HTTP, data isolation, and container lifecycle management for Spring Boot 4.0.x. This should trigger for requests such as Review Java code for Spring Boot integration tests; Apply best practices for Spring Boot integration tests in Java code; Write @SpringBootTest integration tests with Testcontainers; Configure dynamic properties for Spring integration tests; Review Spring Boot integration test profiles. Part of Plinth Toolkit
Emulated Google OAuth 2.0, OpenID Connect, Gmail, Calendar, and Drive for local development and testing. Use when the user needs to test Google sign-in locally, emulate OIDC discovery, handle Google token exchange, configure Google OAuth clients, work with Gmail messages/drafts/threads/labels, manage Calendar events, upload or list Drive files, or work with Google userinfo without hitting real Google APIs. Triggers include "Google OAuth", "emulate Google", "mock Google login", "test Google sign-in", "OIDC emulator", "Google OIDC", "Gmail API", "Google Calendar", "Google Drive", "local Google auth", or any task requiring a local Google API.
Generates comprehensive unit tests with AAA pattern (Arrange-Act-Assert), edge cases, error scenarios, and coverage analysis. Creates test files matching source structure with complete test suites. Use for "unit testing", "test generation", "Jest tests", or "test coverage".
Apidog import/export and quality gates: import OpenAPI, Postman, Swagger, and Apidog native formats; export OpenAPI, HTML, Markdown, Postman, and Apidog native formats; validate spec completeness, tag grouping, schema/body coverage, counts, modules, and resource visibility.
Diff a live page's accessibility violations against a baseline — by default compares uncommitted changes (stash-based), or pass --branch [<name>] to diff against a branch. Reports only new violations introduced, violations fixed, and pre-existing count. Use `scan` for a full audit with no diffing
Debug and visualization helpers in three.js Core Helpers (AxesHelper, GridHelper, CameraHelper, light helpers, SkeletonHelper, bounding box helpers, PlaneHelper, PolarGridHelper, ArrowHelper) and Addons Helpers (VertexNormalsHelper, VertexTangentsHelper, RectAreaLightHelper, LightProbeHelper, ViewHelper, OctreeHelper, TextureHelper, PositionalAudioHelper, AnimationPathHelper, RapierHelper). Use only for development and editor overlays—not for shipping art; for gizmo-style manipulation use threejs-controls
CI/CD pipeline design, optimization, DevSecOps security scanning, and troubleshooting. Use this skill whenever the user mentions CI/CD, GitHub Actions, GitLab CI, pipelines, workflows, builds, or DevSecOps. Triggers include creating new CI/CD workflows, debugging pipeline failures or flaky tests, implementing SAST/DAST/SCA security scanning, optimizing slow builds with caching or parallelization, setting up deployment workflows, securing pipelines with OIDC or secrets management, implementing matrix builds or test sharding, and troubleshooting Docker, permissions, or timeout issues.
Review Java concurrency code for thread safety, race conditions, deadlocks, and modern patterns (Virtual Threads, CompletableFuture, @Async). Use when user asks “check thread safety”, “concurrency review”, “async code review”, or when reviewing multi-threaded code.
Use for HarmonyOS NEXT development help and local DevEco automation. Covers ArkTS/ArkUI/NDK API lookup, offline guide navigation, DevEco Studio and HarmonyOS Emulator tasks, hdc/uitest/aa/bm/hilog/hidumper diagnostics, ArkWeb/WebView DevTools and CDP evidence, and private DevEco interfaces such as CodeGenie, MCP, LanceDB, devecostudio://, ArkUI Inspector, Previewer, Profiler, Doctor, and UxTestService offline UI/UX audits.
Use when working with WeChat mini-program automation (小程序自动化、自动化测试、E2E) via miniprogram-automator, especially for standalone Node scripts or Jest tests involving DevTools launch/connect, page navigation, waitFor, custom-component selectors, wx method mocking, console or exception listeners, screenshots, regression checks, or troubleshooting launch failures, connection timeouts, and element-not-found issues.
Audits an existing NestJS repository with bundled semantic guidance and optional specialist skills, then returns one prioritized, evidence-backed code-quality report. Use when asked to check a whole NestJS codebase or a scoped folder for syntax, TypeScript, lint, module-boundary, dependency, design-smell, security, testing, performance, reliability, or production-readiness problems. This is a read-only review workflow: it does not fix code, install dependencies, run migrations, or deploy. When other skills also apply, reconcile ownership before mutation.
Keep a CometChat integration accessible — the UI Kit is designed targeting WCAG 2.1 AA with keyboard navigation (verify per component in its docs; full conformance still needs manual testing), and this skill makes sure the HOST app doesn't break that, covering contrast, focus, screen-reader context, reduced motion, RTL, and calls accessibility. Cross-family. Triggers: 'is cometchat accessible', 'WCAG / 508 / ADA compliance', 'screen reader support', 'keyboard navigation', 'a11y audit', 'accessible chat', 'contrast/focus issues in chat'.
Write, refine, run, and QA promptfoo evaluation suites: promptfooconfig.yaml, prompts, providers, vars, tests, assertions, model-graded rubrics, transforms, datasets, exports, and CI gates. Use for non-redteam eval coverage, regression tests, or new eval matrices. Do not use for adversarial redteam plugin or strategy setup.
Test case generator - Generates high-quality test cases in batches by test point (POINT), based on equivalence partitioning and boundary value analysis, and outputs them in Markdown format. Use when the user runs the /testcase-gen command or needs to generate test cases.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.