Skills
97,222 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Use when measuring whether an agent works: eval suites, trajectory judging, traces as regression fixtures, a calibrated LLM judge, and release gates. Triggers: “agent eval” / “эвалы агента”, “LLM judge” / “LLM-судья”. Not for ordinary unit tests or model benchmarks; the loop is agent-orchestrator.
Two-pass audit and cleanup for a codebase that has started to congeal — spaghetti code, or "koshary code," where the layers have collapsed: business logic lives in the controller, the same validation sits in five files, and nobody wants to open the 800-line one. Pass 1 reports layer collapse, duplication that will drift, functions nobody reads, and dead code as a prioritized list and changes nothing; Pass 2 fixes in a safe order once the user approves. Security holes and vulnerable dependencies are covered too, as a later section rather than the headline. Use this whenever the user asks to audit, review, or clean up a codebase — and also when they say "this codebase is a mess," "spaghetti code," "technical debt," "this is unmaintainable," "duplicated logic," "dead code," "what's wrong with my code," or ask for a security review. Trigger it even when they never use the word "audit."
Learning designer quality check for Canvas LMS courses. Audits module structure, content completeness, publishing state, date consistency, and rubric coverage. Use when asked to "QC a course", "is this course ready", "pre-semester check", or "quality review".
Generates Capybara E2E tests in Ruby with RSpec integration. Acceptance testing DSL for web apps. Use when user mentions "Capybara", "visit", "fill_in", "click_button", "Ruby E2E". Triggers on: "Capybara", "Ruby acceptance test", "fill_in", "click_button", "have_content".
Run `@metaharness/darwin security bench` (upstream "Darwin Shield" / ADR-155)—evolve a champion security-detection harness against a 10-vuln / 9-decoy corpus and grade it on TPR/FPR/patch-pass/repro/unsafe against four baselines (B0 static, B1 LLM-single-pass, B2 fixed-agent, B3 Darwin-champion). Closest reference implementation for ruflo's own ADR-155 nightly self-learning security harness (PR #2417). Degrades gracefully when @metaharness/darwin is absent.
Practical offensive fuzzing methodology covering target identification, fuzzer selection (AFL++, libFuzzer, Honggfuzz, Boofuzz, syzkaller), harness writing, corpus curation, mutation strategies, coverage measurement, and crash triage. Use when setting up or running fuzz campaigns against any target: file parsers, network protocols, kernel drivers, EDR engines, embedded firmware, or language runtimes.
Use when writing or reviewing tests for DeepSeek Harness plugins, external DSH plugin packages, or package changes in the deepseek-harness repository. Select the minimum sufficient levels from unit tests, coverage, real-API end-to-end tests, snapshots, Web tests, real compositions, and built-artifact smoke tests. For Harness version migrations, use this Skill's built-in seven-touchpoint test workflow and validate the exact target-version runtime
Comprehensive AI-powered security scanning suite with 51 skills covering OWASP Top 10, 7 language-specific deep scanners (Go, TypeScript, Python, PHP, Rust, Java, C#), supply chain analysis, infrastructure-as-code scanning, and 3000+ checklist items. Use when you need to run a security audit, find vulnerabilities, scan a PR for security issues, or perform an authorized penetration test on a codebase. Full audits use evidence-led coverage tracking and independent candidate verification. In Claude Code, invoke it directly as /security-check to open the native audit setup menu.
Battle-tested testing best practices for AI coding assistants (40+ rules). Use when writing, reviewing, or generating tests. Covers test structure, data factories, assertions, mocking, DOM testing, and database testing. Works with Vitest, Jest, Playwright, Testing Library, Storybook, and more.
Emulated Vercel REST API for local development and testing. Use when the user needs to interact with Vercel API endpoints locally, test Vercel integrations, emulate projects/deployments/domains, set up Vercel OAuth flows, manage environment variables, create API keys, configure protection bypass, emulate Vercel Blob storage, or test without hitting the real Vercel API. Triggers include "Vercel API", "emulate Vercel", "mock Vercel", "test Vercel OAuth", "Vercel integration", "Vercel Blob", "local Vercel", or any task requiring a local Vercel API
Generate structured PR descriptions from diffs, add review checklists, risk assessments, and test coverage summaries. Use when the user says "write a PR description", "improve this PR", "summarize my changes", "PR review", "pull request", or asks to document a diff for reviewers.
Creates GitHub pull requests with pre-flight validation, conventional title formatting, and structured summary generation. Runs parallel checks (tests, lint, type-check, security) before opening. Supports feature, bugfix, refactor, and hotfix PR types with milestone assignment via gh CLI. Invoke only if the operator named it; an everyday `gh pr create` stays plain tooling. Use when opening PRs or submitting code for review.
Use when the user wants to create, generate, or set up a GitHub Actions workflow. Handles CI/CD pipelines, testing, deployment, linting, security scanning, release automation, Docker builds, scheduled tasks, and custom workflows for any language or framework.
SUPERSEDED by /claudex-loop (formerly /crucible; its docs-aware mode covers this variant) — prefer that skill unless you explicitly want this one. Two-act plan hardening with living documentation. ACT 1 (you ↔ Claude) — Claude interviews you relentlessly about a plan, one question at a time, challenging it against your project's existing domain model and glossary (CONTEXT.md), sharpening fuzzy terms, stress-testing with concrete scenarios, cross-referencing code, and updating CONTEXT.md + ADRs inline as decisions crystallise. ACT 2 (Claude ↔ Codex) — Claude writes the locked plan to PLAN.md and OpenAI Codex adversarially reviews it in a read-only sandbox (VERDICT:APPROVED/REVISE), Claude revises and re-submits to the SAME Codex session until APPROVED or a MAX_ROUNDS cap, then you sign off before any code. Use when the user says "/grill-with-docs-codex", "grill me against the docs then have codex review", "stress-test this against our domain model then get a second model on it", or is about to build something high-stakes in a project with established terminology/ADRs and wants alignment, documentation, AND a cross-model sanity check. Builds on Matt Pocock's grill-with-docs (MIT). NOT for reviewing already-written code (use /codex:review) and NOT for trivial changes
Manage `@metaharness/darwin` bench suites — `bench create <repo>` scaffolds a JSON suite from a repo's test corpus; `bench verify <suite.json>` checks suite well-formedness. Bench suites are the fixed evaluation corpora that `harness-evolve --bench <suite.json>` scores variants against, decoupling evolution from the repo's natural tests. Degrades gracefully when @metaharness/darwin is absent.
Generates NUnit 3 tests in C#. Covers Assert.That constraint model, parameterized tests, setup/teardown, and Moq mocking. Use when user mentions "NUnit", "[TestFixture]", "[Test]", "Assert.That", "C# unit test". Triggers on: "NUnit", "[Test]", "Assert.That", "C# test", "NUnit3".
Expert-level software testing with unit tests, integration tests, E2E tests, TDD/BDD, and testing best practices. Use when the user mentions TDD, BDD, unit tests, integration tests, or end-to-end tests, or when the task involves Testing Fundamentals, Unit Testing, Integration Testing, or End-to-End Testing.
Test React components with Testing Library patterns. Covers queries (getBy/findBy/queryBy), user-event interactions, async testing (findBy vs waitFor), accessibility testing, and MSW integration for API mocking. Use when: testing React components, simulating user interactions, testing forms, mocking API calls with MSW, or writing accessible tests. Keywords: testing-library, react testing library, getByRole, user-event, waitFor, MSW, screen.
Retrofit an automated test suite onto a working codebase that has none: rank the untested surface, crown a slice, stand up a runner, and write tests that were each watched to fail before they were kept. Use when the user says "this project has no tests", "add test coverage" to code that already runs, or "what should I test first". Tests for code still being built belong to implementkit.
Use when you need to set up Gatling performance testing for a Java Maven project—including adding Gatling dependencies and the Gatling Maven plugin, creating Java simulations, running gatling:test, configuring a simulation class, and reviewing generated reports. Trigger for requests such as adding or applying Gatling performance testing, creating a Gatling simulation, adding Gatling support, or reviewing Gatling performance test assertions and feeders. Part of Plinth Toolkit
Comprehensive TypeScript file audit system. Command-only skill (no natural triggers). Accepts file or directory path to systematically audit through accelint-ts-testing, accelint-ts-best-practices, accelint-ts-performance, and accelint-ts-documentation skills. Maintains progress tracking across sessions with interactive change approval. Uses isolated git worktrees to enable parallel audits without conflicts.
Accessibility audit and remediation for Canvas LMS courses. Scans content for WCAG-oriented issues, generates prioritized reports, guides fixes, and verifies remediation. Use when asked to "audit accessibility", "check WCAG", "fix accessibility issues", or "run accessibility review".
Generates Lettuce BDD tests for Python with feature files and step definitions. Note: Lettuce is legacy/unmaintained; consider Behave for new projects. Use when user specifically mentions "Lettuce". Triggers on: "Lettuce", "lettuce test", "lettuce BDD".
Classify whether user intent was satisfied in a Datadog LLM Obs trace or session. Three modes: (1) session_id — classify a single CMD+I assistant session with RUM; (2) trace_id — classify a single LLM Obs trace without RUM; (3) ml_app — sample and classify multiple sessions or traces from a given LLM app. Output is compact by default (verdict + one-sentence reason). Use when evaluating satisfaction, classifying sessions/traces, labeling data, or generating signal for llm-obs-eval-pipeline or llm-obs-trace-rca.
Use when running a scheduled mechanical maintenance pass over a repo — dead code removal, useless-test pruning, layering-violation fixes, duplicate unification, logic bugfixing, logic simplification, or excess-abstraction flattening. Invoked as `/cadence:maintenance-routine <archetype>`, typically from a scheduler (cron, a CI schedule, or an agent workbench's time trigger). One archetype per invocation; opens PRs and never merges. NOT for reviewing a PR (use pr-review), NOT for ad-hoc refactoring the user asked for directly.
Generates MSTest tests in C#. Microsoft's built-in testing framework for .NET. Use when user mentions "MSTest", "[TestMethod]", "[TestClass]", "Assert.AreEqual". Triggers on: "MSTest", "[TestMethod]", "[TestClass]", "Microsoft test framework".
Generates NightwatchJS E2E tests in JavaScript. Integrated test runner with Selenium WebDriver, built-in assertions, and page objects. Use when user mentions "Nightwatch", "NightwatchJS", "nightwatch.conf.js". Triggers on: "Nightwatch", "NightwatchJS", "nightwatch test".
Discover and safely use the installed proxyman-cli for proxy control, MCP state, licenses, configuration, logs, certificates, rules, and debugging-tool automation. Use for Proxyman shell commands, scripts, CLI help, or operations that MCP does not execute
This skill should be used in any OPA5 task - creating, modifying, extending, debugging, fixing or reviewing an integration test. Use when the user asks to "write an OPA5 test", "add an OPA5 journey", "fix the OPA5 test failure" or mentions OPA5 or its components - opaTest, page object, journey, waitFor.
End-to-end, phase-gated SDLC for AI coding agents: relentless design interview → reviewed spec → dependency-graphed task board → safe-wave TDD execution → verification → converge. Handles features, bugs, refactors, greenfield projects, planning breakdowns, and migrations. Triggers on “absolute work”, “build this end-to-end”, “plan and build”, “break this into tasks”, “grill me on this plan”, “pick up this ticket”, “run this migration”.
Multi-agent workflow orchestrator for software projects. Invoke when the user says "Hey Buddy", asks to work on a task, wants to check Linear tasks, start continuous monitoring for new issues, or needs a full develop-test-review cycle on any software change. Orchestrates specialized agent roles in a loop until the task is complete.
Reviews Go code for idiomatic patterns, error handling, concurrency safety, and common mistakes. Use when reviewing .go files, checking error handling, goroutine usage, or interface design. Covers generics (Go 1.18+), errors.Join and slog (Go 1.21+), and Go 1.22 loop variable semantics
Use when editing, reviewing, or auditing DRF viewsets and serializers in PostHog. Triggers on files in posthog/api/, products/*/backend/api/, products/*/backend/presentation/, or any file importing rest_framework. Covers field typing, schema annotations, enum collision fixes, and OpenAPI spec quality — everything that flows downstream into generated TypeScript types and MCP tools.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.