Skills
97,222 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Use this skill when the user asks to “test for insecure direct object references,” “find IDOR vulnerabilities,” “exploit broken access control,” “enumerate user IDs or object references,” or “bypass authorization to access other users’ data.” It provides comprehensive guidance for detecting, exploiting, and remediating IDOR vulnerabilities in web applications.
Use for search evaluation, a POC or bake-off, Parallel vs Exa/Tavily comparisons, SimpleQA/DeepSearchQA benchmarks, or diagnosing search evaluation results. For product selection use choose-your-parallel-api; for integration migration use migrate-to-parallel.
Find and explain current Proxyman debugging tools using official documentation, with GUI, MCP, and CLI workflows where supported. Use for Breakpoint, Map Local or Remote, Scripting, Compose, Repeat, Protobuf, TLS Key Logging, Reverse Proxy, Network Conditions, WebSocket, filters, exports, certificates, and other Proxyman feature guides.
Generates Serenity BDD tests in Java with Screenplay pattern, rich reporting, and Cucumber integration. Use when user mentions "Serenity", "Screenplay", "@Steps", "Serenity BDD". Triggers on: "Serenity BDD", "Screenplay pattern", "@Steps", "Serenity report".
Vitest testing framework for unit, component, and integration tests. Covers test structure (describe/it/test.each), assertions with expect, lifecycle hooks, mocking (vi.fn/vi.mock/vi.spyOn), React Testing Library patterns, hook testing with renderHook, user-event interactions, async utilities, configuration, workspace setup, coverage, and advanced patterns like in-source testing and concurrent execution. Also covers CLI commands, test filtering, tags, sharding, fixtures with test.extend, and fixture scoping. Use when writing unit tests, component tests, integration tests, or testing React hooks. Use for test configuration, mocking modules, testing async behavior, snapshot testing, or setting up test coverage.
Use when building features with TCA (The Composable Architecture), structuring reducers, managing state, handling effects, navigation, or testing TCA features. Covers @Reducer, Store, Effect, TestStore, reducer composition, and TCA patterns
Reviews DataHub connector implementations against 22 golden standards for compliance, code quality, silent failures, test coverage, type design, and merge readiness. Use when reviewing connector code, checking a PR, auditing a connector implementation, or verifying connector standards compliance.
Review failed Exarchos MCP tool calls from the current session, diagnose root causes, and categorize into code bug, documentation issue, or user error. Use when the user says 'dogfood', 'review failures', 'what went wrong', 'triage errors', or runs /dogfood. Scopes exclusively to Exarchos tools (exarchos_workflow, exarchos_event, exarchos_orchestrate, exarchos_view, exarchos_sync). Do NOT use for debugging application code or non-Exarchos tool failures.
First-class incident-handling workflow — for bugs, runtime errors, incorrect behavior, "stuck approval," regressions, and production incidents. Orchestrates triage → repro-first gate (do not fix until reproduced) → scope narrowing (code-graph/impact-check/bisect) → fix via safe-change with red-to-green evidence → dual distillation (incident wiki + failure-flywheel + problem-tree). Do NOT use for new features (use propose/orca-workflow).
Defines measurable performance budgets for bundle size, API latency, database queries, and render times. Provides enforcement strategies and monitoring plans. Use for “performance budgets,” “performance monitoring,” “web vitals,” or “optimization targets.”
Use when a Playwright end-to-end test has already run and failed and the user wants the root cause and a concrete fix. Trigger on a failing Playwright spec, TimeoutError, broken or ambiguous selector, post-deploy suite failure, retry-only flake, hydration or timing race, or a passes-locally-but-fails-in-CI split. Accept error messages, playwright-report/ or HTML reports, trace.zip, screenshots, and CI artifacts identified by a GitHub owner/repo slug plus run id. Distinguish product regressions from brittle tests. Do not use for writing new Playwright tests, speeding up or reviewing a passing suite, non-Playwright failures (Cypress, Jest, Vitest), or debugging an app/backend without a failing Playwright test.
Generates RSpec tests in Ruby with describe/context/it blocks, matchers, let/before hooks, and mocking. Use when user mentions "RSpec", "describe do", "expect().to", "Ruby test". Triggers on: "RSpec", "expect().to eq()", "describe do", "Ruby test", "spec file".
Shepherd PRs through CI and reviews to merge readiness. Operates as an iteration loop within the synthesize phase (not a separate HSM phase). Uses assess_stack to check PR health, fix failures, and request approval. Triggers: 'shepherd', 'tend PRs', 'check CI', or /shepherd.
Workflow for finalizing PUSH/RELEASE/PR/MR — invoke when the user mentions 'release'/'push'/'ship'/'lên release'/'mở PR'/'tạo MR'. Run a pre-push checklist: (1) medic --ci (health gate: rule violations/drift/docs/code/eval), (2) UAT /fdk-uat via a real remote if the diff adds new capabilities (release/pr/mr only; medic --ci cannot prove the curl path), (3) clean git state (scratchpad/ephemeral untracked), (4) selftest, (5) version x.x.x+1 from the latest tag (release level only), (6) honest patch note/PR body (Added/Fixed/Removed/Known-limitations, no exaggeration). Supports 5 levels: 'ship push' = push only, no tag; 'ship release' = push + tag vX.Y.Z + release notes; 'ship pr' = push branch + gh pr create (GitHub); 'ship mr' = push branch + glab mr create (GitLab); 'ship merge' = list incoming repo PRs/MRs by remote, fetch branches, run gates and tests, merge only if GREEN. STOP for approval before side-effect steps. Triggers: /ship, 'release', 'push', 'ship', 'mở PR', 'tạo MR', 'ship pr', 'ship mr', 'ship merge', 'gom PR về merge', 'merge PR nếu test xanh', 'chuẩn bị push', 'lên release', 'checklist trước push', 'đủ điều kiện push chưa'.
Generates SpecFlow BDD tests for C#/.NET with Gherkin feature files and step bindings. Use when the user mentions “SpecFlow,” “C# BDD,” “.NET Gherkin,” “[Binding],” or “[Given]/[When]/[Then]. Triggers on: “SpecFlow,” “C# BDD,” “.NET BDD,” “step bindings,” “[Binding].”
Prevent Terraform/OpenTofu hallucinations by diagnosing and fixing failure modes: identity churn, secret exposure, blast-radius mistakes, CI drift, and compliance gate gaps. Use when generating, reviewing, refactoring, or migrating IaC and when building delivery/testing pipelines.
Benchmark vLLM or OpenAI-compatible serving endpoints using vllm bench serve. Supports multiple datasets (random, sharegpt, sonnet, HF), backends (openai, openai-chat, vllm-pooling, embeddings), throughput/latency testing with request-rate control, and result saving. Use when benchmarking LLM serving performance, measuring TTFT/TPOT, or load testing inference APIs
Structured code reviews with severity-ranked findings and deep multi-agent mode. Use when performing a code review, auditing code quality, or critiquing PRs, MRs, or diffs, including a diff or patch pasted inline. For the full multi-agent workflow, use the ia-review command (/ia-review in Claude Code).
Playwright v1.64 (E2E / component testing framework) reference. test, expect, page, locator, getByRole / getByText / getByLabel / getByTestId / getByRef, toBeVisible, click, fill, route, mock, fixtures, playwright.config.ts, auth persistence, Credentials (passkeys / WebAuthn), WebStorage, WebMCP, Playwright MCP / playwright-cli, trace viewer, screencast, test locks, codegen, UI mode
For frontend engineers authoring UI — how to make components reliably locatable by tests and AI agents. Covers the official Playwright locator priority, semantic/accessible markup first, and how to add valid, unique, stable `data-testid` attributes (naming convention, uniqueness in lists, stability rules) for React, Vue, Angular, and Svelte. Use when writing or reviewing components, or when an agent needs durable locators.
Refactors brittle snapshot tests into resilient, focused assertions. Provides strategies for reducing snapshot size, extracting meaningful assertions, and maintaining snapshots. Use for "snapshot testing", "snapshot refactoring", "brittle tests", or "assertion improvement"
DEPRECATED — prefer the official zentao-cli (https://github.com/easysoft/zentao-cli) and its skills (https://github.com/easysoft/zentao-skills) for new setups. This skill still works for existing @leeguoo/zentao-mcp users and remains useful for its bug resolution stats command. Use the zentao CLI to query and operate ZenTao bugs, tasks, stories, todos, products, programs, projects, executions, plans, releases, test cases, test tasks, test suites, docs, users, departments, issues, and risks. Use when the user mentions 禅道 or ZenTao, wants bug/task/story/todo/project/test/doc lookups or updates, wants bug resolution rate stats or reports (bug 解决率统计/解决数量统计/bug statistics/bug report) by product or person, or needs login / whoami / self-test for a 禅道 instance. ZENTAO_URL usually includes /zentao
Take a GitHub issue, an open PR, or a plan file from plans/ and drive it to a merge-ready PR — reproduce with a failing test first, implement the fix (bugs) or feature (plans), verify against the repo's gates, and open or update the PR. Use when asked to fix an issue, implement or execute a plan, finish or land an open PR, or work through plans/issues/.
Reference for using Plannotator (its `plannotator` tool when available, otherwise the CLI): plan review, code review, annotating files, URLs, folders, and running local apps, annotating the last assistant message, browsing archived plan decisions, exporting or sharing Guided Reviews, and the Plannotator Inbox (messages and questions the person answers later, without blocking you). Invoke when asked to use Plannotator for anything not covered by a more specific plannotator-* skill, and before leaving the person a decision, question, or finished work while they are away from the chat (if another agent started you, report to it instead)
Writes, refactors, and evaluates prompts for LLMs — generating optimized prompt templates, structured output schemas, evaluation rubrics, and test suites. Use when designing prompts for new LLM applications, refactoring existing prompts for better accuracy or token efficiency, implementing chain-of-thought or few-shot learning, creating system prompts with personas and guardrails, building JSON/function-calling schemas, or developing prompt evaluation frameworks to measure and improve model performance.
Code review and PR review skill for Python PySide6/Qt 6.8+ applications. Focuses on modern best practices, performance, thread safety, signal/slot patterns, Model/View architecture, QML integration, and async patterns. Use when reviewing Python Qt code, PySide6 PRs, GUI application code, or when asked to review code that uses QtWidgets, QtQuick, QtCore, QtGui, or any Qt module. Catches common anti-patterns, memory issues, thread violations, and suggests modern Qt 6.8+ idioms.
Senior Python developer expertise for writing clean, efficient, and well-documented code. Use when: writing Python code, optimizing Python scripts, reviewing Python code for best practices, debugging Python issues, implementing type hints, or when user mentions Python, PEP 8, or needs help with Python data structures and algorithms.
Inspects PostHog Visual Review (VR) runs that gate PR merges with screenshot regression checks. Use when the user mentions "visual review", "VR", "snapshot diff", "screenshot test", "storybook regression", "playwright snapshot", "quarantine", asks why a PR is blocked or what changed visually, wants to triage the VR backlog, decide whether a snapshot diff is real vs flaky, quarantine or lift a flaky story, or check whether a story has been changing across runs. Also invoke when a PR has a failing `visual-review` status check, when a PR comment mentions "Visual review", when a PR from a fork fails `Visual regression tests pass`, or when the user is on a branch with an open VR run.
Generates xUnit.net tests in C#. Covers Fact/Theory, constructor injection, IClassFixture, and FluentAssertions. Use when user mentions "xUnit", "[Fact]", "[Theory]", "Assert.Equal", "C# xUnit". Triggers on: "xUnit", "[Fact]", "[Theory]", "Assert.Equal C#", "xUnit.net".
Use when auditing an agent codebase against the 12-Factor Agents methodology, reviewing LLM-powered system architecture, or assessing agentic app compliance. Triggers on "analyze agent architecture", "12-factor audit", "how compliant is this agent", or "evaluate this LLM app". Also applies when comparing frameworks or planning agent improvements. Not for quick checklists — this performs deep per-factor codebase analysis with file-level evidence.
This skill should be used when the user asks to "test for broken authentication vulnerabilities", "assess session management security", "perform credential stuffing tests", "evaluate password policies", "test for session fixation", or "identify authentication bypass flaws". It provides comprehensive techniques for identifying authentication and session management weaknesses in web applications.
Chase a symptom to its true cause: reproduce it, shrink it, write falsifiable hypotheses, and prove the cause by toggling the symptom on and off, then hand over a failing reproduction instead of a fix. Use when the user says "debug this", "why is this failing", "find the root cause", "what's causing this bug", "this test is flaky", "it broke after the upgrade", "it worked yesterday", "this got slower", or "/debugkit".
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.