Skills
97,222 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Closeout pass on a finished substantive change — sequence refactor-clean (shape), code-review (diff), and write-docs (docs) so all three run, in the order where each feeds the next. Use after implementing a slice or feature and before calling it done or committing; when the user asks for a final review, a cleanup-and-document pass, or to "review everything." For a diff-only audit, reach code-review directly
This skill should be used when the user asks to “pentest WordPress sites”, “scan WordPress for vulnerabilities”, “enumerate WordPress users, themes, or plugins”, “exploit WordPress vulnerabilities”, or “use WPScan”. It provides comprehensive WordPress security assessment methodologies.
Acton CLI workflow for TON smart contract development in Tolk: install/update, project bootstrap, Acton.toml configuration, build/compile/wrapper generation, tests with coverage/gas/fuzz/mutation/UI, scripts and deployment, wallets, verification, RPC inspection, libraries, lint/format/hooks, LSP/completions, and troubleshooting.
Enforce output quality, evidence verification, and quality gates across security audits. Use this skill when performing SAST, SCA, threat modeling, or security code reviews. Verify code locations and taint traces for all findings. Prevent valid security findings from being suppressed. Evaluate reports against quality thresholds (score ≥ 8/10) before delivery
Diagnose React runtime performance with React Doctor traces, live render outlines, Long Animation Frames, interaction timing, and component render evidence. Use when invoked as `/performance` for a slow interaction, unexpected re-renders, or a measured before-and-after comparison.
Testing strategies, patterns, and tools for robotics software. Use this skill when writing unit tests, integration tests, simulation tests, or hardware-in-the-loop tests for robot systems. Trigger whenever the user mentions testing ROS nodes, pytest with ROS, launch_testing, simulation testing, CI/CD for robotics, test fixtures for sensors, mock hardware, deterministic replay, regression testing for robot behaviors, or validating perception/planning/control pipelines. Also covers property-based testing for kinematics, fuzz testing for message handlers, and golden-file testing for trajectories.
Generates Test::Unit tests in Ruby. Classic xUnit-style testing with assert methods and test case classes. Use when user mentions "Test::Unit", "assert_equal Ruby", "Ruby test-unit". Triggers on: "Test::Unit", "Ruby test-unit", "assert_equal Ruby" (not RSpec).
Address review and issue comments on the open GitHub PR for the current branch using gh CLI. Use when user says "address PR comments", "fix review feedback", "respond to PR review", or "handle PR comments". Verifies gh auth first and prompts to authenticate if not logged in. Do NOT use for creating PRs, CI debugging (use gh-fix-ci), or general Git operations
Use when a user asks to debug or fix failing GitHub PR checks that run in GitHub Actions. Uses `gh` to inspect checks and logs, summarize failure context, draft a fix plan, and implement only after explicit approval. Treats external providers (for example Buildkite) as out of scope and reports only the details URL. Do NOT use for addressing PR review comments (use gh-address-comments) or general CI outside GitHub Actions
Configure and troubleshoot Proxyman HTTPS capture across desktop systems, Apple and Android devices or simulators, browsers, runtimes, containers, frameworks, and HTTP clients, including Atlantis instrumentation for controlled apps.
Comprehensive Python development skill covering coding standards, CLI development, linting, testing, debugging, refactoring, code review, auditing, documentation, project planning, and bulk operations. Use when writing, reviewing, refactoring, debugging, or documenting Python code; configuring linters; setting up CLI tools; planning features; performing code audits; checking Python antipatterns, forbidden methods, or bad style; or handling bulk operations (10+ files) that benefit from batch workflows instead of per-file iteration
Runs real-user QA, manual test plans, UX bug hunts, build sign-off, bug filing, and bug triage for web or iOS/iPadOS apps. Use when asked "QA this", "is this ready to ship?", or similar. Produces P0/P1/P2 bug reports, YES/NO phase sign-off, tracker sync guidance, and an HTML QA dashboard; keeps Interactive BRB triage in a separate session
Use when an Unreal Engine 5.8 project misses its frame rate or stutters: "optimize to 60 fps", "we run at 38 fps", CPU or GPU bound, game or render thread too long, hitches, traversal or shader stutter (PSO), GC spikes, camera-cut spikes, Lumen, Nanite, VSM, ray tracing, foliage, crowds or Niagara too expensive, async compute, stat unit, ProfileGPU, Unreal Insights, TraceQuery, snapshothitches, scalability and device profiles, dynamic resolution and TSR, streaming budgets, or proving a fix with before and after captures.
Security-focused source code review and SAST. Scans for vulnerabilities (OWASP Top 10, CWE Top 25), CVEs in third-party dependencies/packages, hardcoded secrets, malicious code, and insecure patterns. Use when given source code, a repo path, or asked to "audit", "scan", "review" code security, or "check dependencies for CVEs".
Turns WCAG 2.2 into practical guidance for web design, frontend implementation, content review, accessibility QA, remediation planning, and conformance documentation. Unlike wcag-audit-patterns, it covers the full WCAG guidance workflow from design through documentation.
Run health self-checks on Wuji devices with wuji doctor: EMF disconnect detection (pinpoints the affected finger and tells RX faults from TX faults) and tactile sensor dead pixel / bad row / bad column detection, plus active diagnostic items like the Wuji Hand 2 thumb-opposition check. Use when the user reports a glove not working, abnormal sensor data, needs to verify thumb-to-finger motion, or asks for troubleshooting or a device checkup.
Emulated Sign in with Apple / Apple OIDC for local development and testing. Use when the user needs to test Apple sign-in locally, emulate Apple OIDC discovery, handle Apple token exchange, configure Apple OAuth clients, or work with Apple userinfo without hitting real Apple APIs. Triggers include "Apple OAuth", "emulate Apple", "mock Apple login", "test Apple sign-in", "Sign in with Apple", "Apple OIDC", "local Apple auth", or any task requiring a local Apple OAuth/OIDC provider.
Assesses and rates quality 0-10 across multiple dimensions (correctness, maintainability, security, performance, testability, simplicity) with pros/cons analysis. Compares against project conventions and prior decisions from memory. Produces structured evaluation reports with actionable improvement suggestions. Use when evaluating code, designs, architectures, or comparing alternative approaches
Generates Geb browser automation tests in Groovy with Spock integration. jQuery-like content DSL and page object pattern. Use when user mentions "Geb", "Groovy test", "GebSpec", "Browser.drive". Triggers on: "Geb", "GebSpec", "Groovy browser test", "Browser.drive".
Review and implement safe concurrency patterns in Go: goroutines, channels, sync primitives, context propagation, and goroutine lifecycle management. Use when writing concurrent code, reviewing async patterns, checking thread safety, debugging race conditions, or designing producer/consumer pipelines. Trigger examples: "check thread safety", "review goroutines", "race condition", "channel patterns", "sync.Mutex", "context cancellation", "goroutine leak". Not for: general style (go-coding-standards), HTTP handler patterns (go-api-design).
Go testing patterns for production-grade code: subtests, test helpers, fixtures, golden files, httptest, testcontainers, fuzz testing, and testing/synctest. Covers mocking strategies, test isolation, coverage analysis, and test design philosophy. Use when writing tests, improving coverage, reviewing test quality, setting up test infrastructure, or choosing a testing approach. Trigger examples: “add tests,” “improve coverage,” “write tests for this,” “test helpers,” “mock this dependency,” “integration test,” “fuzz test,” “flaky test,” “synctest,” “goroutine leak in tests.” Not for: benchmarking methodology (go-performance-review), security testing (go-security-audit), or table-driven patterns (go-test-table-driven)
Run `@metaharness/darwin evolve <repo>` to mutate a harness's seven policy surfaces (planner/contextBuilder/reviewer/retryPolicy/toolPolicy/memoryPolicy/scorePolicy), sandbox-score each variant, and promote only measured wins. The model is frozen; the harness evolves. Closes the loop ADR-150 opens (score+genome describe; evolve changes). Degrades gracefully when @metaharness/darwin is absent (ADR-150 + ADR-153 architectural constraints).
Grade work that already exists and decide whether it can merge. Runs the project's current unit, integration, and E2E suites plus security scanning and type checking, scores every dimension 0-10, and returns a merge verdict with a VERIFIED-vs-CLAIMED evidence manifest. Writes no test files and edits no source. Use when verifying changes are ready to merge. Use /ork:cover instead when the tests still have to be written.
Vitest testing framework patterns for test setup, async testing, mocking with vi.*, snapshots, and test performance (formerly test-vitest). This skill should be used when writing or debugging Vitest tests. This skill does NOT cover TDD methodology (use test-tdd skill), API mocking with MSW (use test-msw skill), or Jest-specific APIs.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.