Skills
97,222 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Use for DSH plugin compatibility, migration, upgrade, regression, or post-upgrade diagnosis, including read-only review of already-migrated plugin source and version-boundary, API, dependency, activation, or runtime compatibility problems. Inspection and diagnosis stay read-only; show a plan and obtain confirmation before any configuration, dependency, or source write.
Replicate and validate a GitHub issue by spinning up Archon, analyzing the issue, and systematically testing all described symptoms using browser automation. Use when: User wants to reproduce a bug, validate a GitHub issue, confirm a reported problem, or investigate whether an issue is real before working on a fix. Triggers: "replicate issue", "reproduce issue", "validate issue", "confirm bug", "test issue", "can you reproduce", "try to replicate", "verify the bug". Capability: Checks out main, pulls latest, starts Archon, reads the GitHub issue, then uses agent-browser to systematically test every symptom and produce a findings report. NOT for: Fixing issues (use /archon or /exp-piv-loop:fix-issue), general UI testing (use /validate-ui).
Review a diff, PR, branch, or path against the Sliced Bread architecture rules: dependency direction, crust integrity, model purity, growth justification, and event usage. Use when the user asks for an architecture review, says "check this against sliced bread", "review the slice boundaries", "is this import allowed", or before merging changes that add directories, abstractions, or cross-slice imports. Do NOT use for general bug-hunting or a full repo audit — this reviews a bounded change set.
Use this skill when the user asks to "intercept HTTP traffic", "modify web requests", "use Burp Suite for testing", "perform web vulnerability scanning", "test with Burp Repeater", "analyze HTTP history", or "configure proxy for web testing". It provides comprehensive guidance for using Burp Suite's core features for web application security testing.
Analyze, recreate, align, and verify reference-video motion. Use when the user asks to recreate, copy, match, align, pixel-align, or compare a video; when a HyperFrames or Remotion remake is judged not aligned; when fixed reference playback and reusable motion components must be separated; or when delivery needs full-frame runtime, render, decode, boundary, timing, and archive evidence instead of sampled screenshots alone.
Check whether your rules file (CLAUDE.md or AGENTS.md) still matches the codebase after recent changes — run before a merge, or fold into your code-review pass. Reports stale/now-false rules, drifted architecture-map entries, and any new invariant worth adding, each with the minimal edit. Advisory and anti-bloat: it keeps the rules file true, never longer than it needs to be.
Run a human-in-the-loop whole-repo coherence review of a Sliced Bread codebase: inventory slices, the spine, and seams; fan out subagents to digest every file with its tests; walk seams in ranked order with the human issuing a disposition per stop; review the spine for orchestration drift. Use when the user says "review the seams", "slice and spine review", "whole-repo coherence review", "walk the seams", or asks whether slices still hang together after individual changes passed review. Do NOT use for rule-compliance checking on a bounded change set (sliced-bread-review), autonomous audit and issue filing (sliced-bread-audit), or depth/crust-shape scoring (sliced-bread-depth) — this skill is a guided session over the whole repo, not an automated check.
Score each slice of a Sliced Bread codebase as a deep module: classify its crust shape, measure where implementation mass sits relative to the crust, and recommend which crusts to break down. Use when the user asks "are our slices deep", "review the crusts", "which modules should we break down", "is this facade too fat", or after a compliance review passes but a slice still feels monolithic. Do NOT use for boundary compliance on a change set (sliced-bread-review) or a rule-violation sweep (sliced-bread-audit) — this skill measures depth, not compliance.
Use when the user is writing or running automated tests for a Spree 6 app or extension — model specs, workflow/hook specs, subscriber specs, API v3 controller/request specs, factories, and dashboard (Vitest/Playwright) tests. Covers RSpec + Factory Bot (not Minitest/fixtures), spree_dev_tools, Spree's factories (:cart, :cart_ready_to_complete, :completed_order_with_totals …), the 'API v3 Store' / 'API v3 Admin' shared contexts, Spree::Current.store in tests, `spree rspec`, and common failures. Common phrasings include "test my Spree model", "Spree spec", "Spree factories", "spree_dev_tools", "include_context API v3", "test a workflow hook", "test a subscriber", "OrderWalkthrough", "Store must exist", "spree rspec", "dashboard tests".
Review and create distinctive, production-grade frontend interfaces with high design quality and design system compliance. Evaluates using three pillars: frictionless insight-to-action, quality craft, and trustworthy building. Use for: PR reviews, design reviews, accessibility audits, design system compliance checks, creative frontend design, UI code review, component reviews, responsive design checks, theme testing, and creating memorable UI. Do not use for: backend API reviews, database schema reviews, infrastructure or DevOps work, pure business logic without UI, or non-frontend code
React component testing patterns including components, hooks, context, and forms. Covers Vitest Browser Mode with vitest-browser-react and @testing-library/react. Use when testing React applications. For general UI testing patterns, see the front-end-testing skill.
Elite Application Security engineer specializing in secure SDLC, OWASP Top 10 2025, SAST/DAST/SCA integration, threat modeling (STRIDE), and vulnerability remediation. Expert in security testing, cryptography, authentication patterns, and DevSecOps automation. Use when securing applications, implementing security controls, or conducting security assessments.
Use when writing or reviewing anything read as true: a decision record, ADR, README, acceptance report, runbook, changelog, audit finding, or claim of verification. Applies the ten canons of evidence-backed docs. Not for drafts, chat answers, or commit messages; 'без доков' opts out.
Validate and auto-repair YAML frontmatter on brain pages. Catch malformed pages before they enter the brain (missing closing ---, nested quotes, slug mismatches, null bytes, empty frontmatter, YAML parse failures), explain files sync holds instead of importing, and drive the previewed `gbrain repair frontmatter` fix. Wraps the `gbrain frontmatter` CLI for agent-driven workflows.
QA engineering workflows on top of Playwright. Use when a QA engineer asks to design test cases from a ticket, PRD or acceptance criteria, decide what to automate, write a bug report from a failing test or trace, convert manual test cases (TestRail, Xray, CSV) into Playwright specs with case-ID traceability, or review Playwright test code and pull requests.
Build throwaway code that answers a question, whether an interactive state model you can drive, a script that measures one thing, or competing live UI variants to switch between in the app, then fold the answer into the decision and delete the code. Use when the user says "prototype this", "spike this", "does this state model hold up", "is this library fast enough", or "try three live versions in the app". Not a demo generator and never production code.
Expert Section 508 compliance advisor for US federal ICT accessibility. Use this skill whenever a user asks about Section 508, WCAG 2.0/2.1 AA for federal systems, VPAT or Accessibility Conformance Reports (ACR), accessibility audits, remediation planning, PDF accessibility, web or software accessibility, mobile accessibility, federal procurement accessibility requirements, contractor obligations, undue burden exceptions, assistive technology compatibility, or Section 508 testing. Covers the Revised Section 508 Standards (2018), all WCAG 2.0 Level AA success criteria, the four POUR principles, testing methodologies, and agency compliance workflows. Trigger even if the user doesn't say "skill" — any Section 508 or ICT accessibility question for federal systems should use this skill.
Test-driven development workflow for Noodle. Use when testing changes, writing tests, fixing bugs, creating fixtures, or running the test suite. Triggers: “test”, “write a test”, “fix this bug”, “add a fixture”, “run tests”, “TDD”, or any task involving verification of code changes
Generates XCUITest UI tests for iOS/iPadOS apps in Swift. Apple's native testing framework for reliable, fast UI automation. Supports local simulators and TestMu AI cloud real devices. Use when the user mentions "XCUITest", "XCTest", "iOS UI test", "Swift test", or "XCUIApplication". Triggers on: "XCUITest", "XCTest UI", "iOS UI test", "Swift UI test", "XCUIApplication", "TestMu".
Operates HyperExecute end to end for TestMu AI/LambdaTest cloud test execution: analyzes projects, creates YAML, validates locally, runs CLI jobs, debugs failures, and wires CI. Use when the user mentions HyperExecute, hyperexecute.yaml, HyperExecute CLI, autosplit, matrix execution, LambdaTest grid, cloud test runs, CI test orchestration, or migrating Playwright/Cypress/Selenium/Pytest/WebdriverIO tests to HyperExecute
Provides the complete metavr (Meta VR CLI) reference for Meta VR and Horizon OS development — installation, device setup, command discovery, MCP server mode, documentation search, app deployment, device testing setup, audio control, screenshots, and performance analysis. Use when the user needs to install metavr, asks what commands are available, needs CLI syntax help, or wants to know what metavr can do. Build paths: all Meta VR app stacks; use hz-quest-verify-first if the build path is unclear.
Run `gbrain skillpack-check` to produce an agent-readable JSON health report for the gbrain install. Wraps `gbrain doctor` + `gbrain apply-migrations --list` so a host agent (your OpenClaw's morning-briefing, any OpenClaw cron) can see at a glance whether the skillpack needs attention. Use when the user asks "is gbrain healthy?", when a cron fires a morning check, or proactively when something seems off (jobs not running, brain not updating, autopilot silent).
5-dimension harness readiness scorecard from `metaharness score <path>`. Returns harnessFit / compileConfidence / taskCoverage / toolSafety / memoryUsefulness + estCostPerRunUsd + scaffoldReady. Read-only; invokes a subprocess; degrades gracefully when MetaHarness is absent (ADR-150 architectural constraint).
Create new ESLint rules for the @n8n/eslint-plugin-community-nodes package. Use when adding a lint rule, creating a community node lint, or working on eslint-plugin-community-nodes. Guides rule implementation, tests, docs, and plugin registration.
Feature-level UX audit for React/Next.js code. Catches what Lighthouse, axe, ESLint, and Storybook miss — state coverage gaps (missing loading/empty/error), form data loss on validation, broken focus management, optimistic UI without rollback, skeleton-induced layout shift, vague microcopy, and 25+ other modern frontend UX bugs. Diff-aware (audits changed files only) and produces a 3-tier ship-readiness verdict (release-blocker / fix-this-sprint / backlog) grouped by surface, with concrete fixes using modern React 19 APIs (useActionState, useFormStatus, useOptimistic, useTransition, Suspense). Use before merging a frontend PR, before shipping a feature, or when asked "is this checkout/onboarding/dashboard ready?", "review this PR for UX bugs", "audit this component", "what would break in production?", "is this ready to ship?"
Audits existing table permissions on a Power Pages site by analyzing them against site code and Dataverse metadata, then GRADES the configuration with deterministic 1–5 scores across 3 security/usability/correctness categories (9 dimensions). Detection is anchored by a recurring-issue catalog so findings and severities stay consistent run-to-run. Generates an HTML report with an at-a-glance verdict and per-category scores in the Overview plus a single list of major/minor issues (each major issue labelled permissions-only or upstream-caused with a short justification), and suggested fixes. Use when the user wants to review, verify, check, score, or grade table permissions for security issues. Supports SPA and PAC-downloaded non-SPA sites
Browser debugging, performance profiling, and automation via Chrome DevTools MCP. Use when user says "debug this page", "take a screenshot", "check network requests", "profile performance", "inspect console errors", or "analyze page load". Do NOT use for full E2E test suites (use playwright-skill) or non-browser debugging.
Creates GitHub Pull Requests with automated validation and task tracking. Use when the user wants to create a PR, open a pull request, submit for review, or check if it's ready for a PR. Analyzes commits, validates task completion, generates a Conventional Commits title and description, and suggests labels. NOTE: For merging existing PRs, use github-pr-merge instead.
Validates all pre-generation gates before sending tracks to Suno. Checks sources verified, lyrics reviewed, pronunciation resolved, explicit flag set, style prompt complete, and artist names cleared. Use before generating tracks on Suno or when the user says "pre-gen check" or "ready to generate".
Plan and run pre-release OpenClaw plugin validation across bundled plugins, package artifacts, lifecycle commands, doctor/fix, config round-trip, gateway startup, SDK compatibility, Docker E2E, Package Acceptance, and Testbox proof.
Structured review process for Remotion video implementations. Analyzes spec compliance, detects common timing/easing issues, validates asset quality, and provides prioritized revision lists. Use when reviewing Remotion code against design specs or performing quality assurance on video compositions. Trigger phrases "review video code", "check spec compliance", "audit Remotion implementation".
MUST be used whenever fixing test coverage for a Dune app to meet the 80% line coverage hard gate. This skill finds AND fixes coverage gaps — it configures tooling, writes missing tests, covers untested paths, and refactors code for testability. It does not just report. Triggers: test coverage, fix tests, write tests, add tests, coverage fix, 80% coverage, coverage gate, missing tests, testability, vitest coverage, jest coverage.
Read and analyze Arduino or embedded serial output for structured runtime debugging across Arduino IDE, Arduino CLI, PlatformIO, and vendor-specific monitor tools. Use when boot output, sensor data, resets, communication failures, timing symptoms, or field behavior need evidence rather than compile-only reasoning.
One-command drift detection. Composes audit-list + oia-audit + audit-trend into a single primitive — finds the most recent audit in `metaharness-audit` namespace, runs a fresh audit against the current repo, diffs them via ADR-152 §3.1 similarity, and alerts when structural distance crosses `--threshold`. Iter 53 of ADR-150 deep integration.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.