Skills
97,222 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Run a structured 5-pass finishing audit on any website before launch, scoring visual polish, technical foundation, UX completeness, content quality, and cross-device readiness out of 100. Use for: pre-launch final validation; post-redesign checks; client handoff proof of readiness; quarterly reviews to catch accumulated debt; or a single-pass focus, such as running only Pass 2 after a performance sprint
Automated vulnerability scanner for agent platforms. Performs dependency scanning (npm audit, pip-audit), multi-database CVE lookup (OSV, NVD, GitHub Advisory), SAST analysis (Semgrep, Bandit), and agent-specific static hook inspection for OpenClaw hooks.
Reviewer role. Opens rendered HTML, inspects every slide visually, fixes problems in custom.css or slides.html and rebuilds through build-html.sh. Use whenever the user says "review", "QA", "check slides", "inspect", "audit", "proofread", or wants feedback on a rendered deck.
Provider-independent quality assurance for AI-generated and AI-assisted media. Use when reviewing, accepting, revising, or reporting on images, video, audio, avatars, ads, product content, social clips, explainers, localization, mixed-source edits, captions, accessibility, provenance, model metadata, safety/policy, and delivery readiness.
Perform a structured maintainer-style PR review for the mariadb-operator repository. Gathers PR context, triages the change, and evaluates correctness, safety, pitfalls, backwards compatibility and code quality against the project conventions documented in AGENTS.md. Use whenever the user mentions a mariadb-operator PR number or URL and wants any kind of judgment on it — "review this PR", "what do you think of #1234", "is this safe to merge", "assess this diff", "take a look at this change" — even if they don't literally say "review".
Full code review for Keboola Python components — covers both code quality (architecture, config/client patterns, typing, Pythonic best practices) and backward compatibility (configSchema changes, sync actions, output tables, state files, telemetry impact). Use for PRs, pre-merge checks, and component audits. Invoke whenever someone asks to review code, check a PR, audit before release, or verify that changes are safe for existing users.
Map a codebase into a structured vocabulary — surfaces, features, entities, flows, compartments, invariants, tech stack — plus code-health metrics. Produces a JSON map and an interactive local UI. Use whenever the user wants to understand or audit a codebase
Adversarially review an existing written artifact — stories, plans, acceptance criteria, specs, or design mocks — to surface missing states, unhandled edge cases, unstated assumptions, unverifiable criteria, and slices still too broad or horizontal. Works interactively, one question at a time, writing each answer back into the artifact as a new acceptance criterion, plan update, or mock-state spec. Use when an artifact needs tightening before planning or coding ("what's missing?", "poke holes in this", "tighten this up"). Requires an artifact to inspect — for a fuzzy decision tree with no artifact yet, use specification or an installed grill-me skill; for splitting oversized work, see story-splitting.
Execute build, test, lint, serve, and other tasks in an Nx workspace using single runs, run-many, and affected commands. Use when user says "run tests", "build my app", "lint affected", "serve the project", "run all tasks", or "nx affected". Do NOT use for code generation (use nx-generate) or workspace configuration (use nx-workspace).
Use this skill when the user asks to consult Codex/GPT for planning or code review, or wants a second opinion on code. Trigger phrases include "ask Codex", "consult Codex", "second opinion on code", "consult the oracle". Not for implementation tasks.
This skill should be used when the user asks to "analyze my game", "review my Phaser project", "audit project health", "find bottlenecks", "refactor my game", "improve my code", "optimize my project", "what's wrong with my game", "code review Phaser", or "assess architecture".
Single adversarial review pass over the integrated branch diff — spec-compliance, code quality, and test adequacy judged together by one fresh-context reviewer. Triggers: /review, 'review the changes', or after delegation completes. Emits one verdict (reviews.review.status). Do NOT use for plan-review (that is its own dispatched gate) or for debugging.
Write, refactor, and review Rails code using layered architecture principles from “Layered Design for Ruby on Rails Applications”. Use when writing or refactoring Rails code—models, controllers, services, jobs, mailers, policies, forms, query objects, presenters, view components, state machines, serializers, or AI/LLM features—to apply correct patterns and avoid layer violations; and when reviewing Rails code, PRs, or diffs for layer violations, fat controllers/models, anemic models, callback misuse, god objects, or specification-test failures. Triggers on “layered design”, “architecture layers”, “abstraction layer”, “specification test”, “layer violation”, “fat controller/model”, “god object”, “anemic model”, “extract service/callback/policy/concern”, “service object”, “form/policy/query/value object”, “presenter”, “view component”, “state machine”, “Active Delivery”, “callback scoring”, “Rails refactor/review”, “Rails patterns/best practices”, “archspec”, or “architecture linter/enforcement”.
Verification-ladder R5 review dimension: the mutation-adequacy adequacy backstop. Runs the diff-scoped mutation gate, reads the carrier, and turns surviving / NoCoverage mutants into concrete 'write a test that kills <file>:<line>' follow-ups. Triggers: 'mutation adequacy', 'check mutation score', or /review on a HIGH-tier feature. The mutation SCORE is advisory by default (a config override is needed to block on it). The NoCoverage axis has its own real, functioning block-mode enforcement path under review.mutationEnforcement: block (default budget: 0 uncovered changed lines) — opt-in, same as the score's severity. The diff-scoped CI wiring runs in observe mode unconditionally pending a clean runner verdict; it is not yet a blocking CI backstop. Do NOT run full-tree mutation here (scope:'full' is deferred to R10/v2.12).
Transform outside-of-diff review files into properly formatted issue files for a given PR. Use when converting review files from ai-docs/reviews-pr-<PR>/outside/ into issue format in ai-docs/reviews-pr-<PR>/issues/. Automatically determines starting issue number and preserves all metadata (file path, date, status) from original review files. Don't use for inline-diff review files, non-PR review artifacts, or creating GitHub issues directly.
SonarCloud deep dive via its REST API: pull open issues (bugs, vulnerabilities, code smells), coverage/duplication metrics, quality-gate pass/fail with failed thresholds, security hotspots, and measure/analysis history for a whole project, branch, or PR, then return a ranked summary. Use whenever the user names SonarCloud or asks about code-quality metrics, technical debt, a red/failing quality gate, or static-analysis vulnerabilities/hotspots — e.g. 'why is the SonarCloud gate failing on this PR' or 'pull every BLOCKER vulnerability with file and line'. NOT for: the thin `/sonarcloud <query> <project>` slash command for a quick lookup (sibling 'sonarcloud'); replying to/resolving PR review threads across Greptile, CodeRabbit, or GitHub Actions ('review'); running local lint/type-check/test/security scans pre-ship ('validate'); implementing or patching a flagged issue ('dev'); or an external market/competitor report on SonarSource or DevSecOps vendors ('parallel-deep-research').
Apply shared coding standards when writing, reviewing, or refactoring TypeScript in apps, services, workers, and shared packages. Use before editing TypeScript functions, types, exports, error handling, documentation, package dependencies, or React components and hooks. Includes conditional React and Next.js rules; backend repositories do not require either framework.
Comprehensive Java development best practices covering SOLID principles, DRY, Clean Code, Java-specific patterns (Optional, immutability, streams, lambdas), exception handling, collections, concurrency, testing with JUnit 5 and Mockito, code organization, performance optimization, and common anti-patterns. Essential reference for uncle-duke-java agent during code reviews and architecture guidance.
Use when working with @faasjs/pg or PostgreSQL in FaasJS: Tables declaration merging, QueryBuilder, select aliases, parameterized sql expressions, raw SQL, numeric/decimal/bigint boundaries, transaction isolation and read-only modes, row locks, concurrency, migrations, SchemaBuilder, TableBuilder, faasjs-pg CLI, PgVitestPlugin, shared migration snapshots, per-file test database isolation, and database type tests.
Use when implementing, reviewing, or verifying normative FaasJS runtime behavior and compatibility for faas.yaml, staged config discovery and merge order, zero-mapping route resolution, HTTP request/response protocol envelopes, status behavior, plugin identity, concurrent mount and failed-mount retry behavior, lifecycle execution, config layering, and config-driven plugin loading.
Adversarial code review of server-side TypeScript for adherence to the kamae principles (discriminated unions, branded types, Result error handling, boundary validation, PII protection). TRIGGER when: reviewing a pull request, audit, or quality check of TypeScript server-side code involving domain models, repositories, use cases, business logic, or boundary code. SKIP: frontend code review, infrastructure-as-code review, test-only review, code review unrelated to domain logic.
Next.js adapter for embedding emulators directly in a Next.js app via @emulators/adapter-next. Use when the user needs to embed emulators in Next.js, set up same-origin OAuth for Vercel preview deployments, create an emulate catch-all route handler, configure Auth.js/NextAuth with embedded emulators, add persistence to embedded emulators, or wrap next.config with withEmulate. Triggers include "Next.js emulator", "adapter-next", "embedded emulator", "same-origin OAuth", "Vercel preview", "createEmulateHandler", "withEmulate", or any task requiring emulators inside a Next.js app.
Monitor Nx Cloud CI pipeline status and handle self-healing fixes automatically. Use when user says "watch CI", "monitor pipeline", "check CI status", "fix CI failures", or "self-heal CI". Requires Nx Cloud connection. Do NOT use for local task execution (use nx-run-tasks) or general CI debugging outside Nx Cloud.
Score any AI model on the DeepSWE coding-agent benchmark via the OpenRouter API. Use when the user wants an independent, reproducible coding-agent eval — "run DeepSWE", "benchmark this model on DeepSWE", "score model X on the coding benchmark", "test a model via OpenRouter on DeepSWE", or to verify vendor-reported coding scores. Covers setup, the OpenRouter wiring for mini-swe-agent, single-task / subset / full 113-task runs, and leaderboard submission.
WordPress performance code review and optimization analysis. Use when reviewing WordPress PHP code for performance issues, auditing themes/plugins for scalability, optimizing WP_Query, analyzing caching strategies, checking code before launch, detecting anti-patterns, or when the user mentions "performance review", "optimization audit", "slow WordPress", "slow queries", "high-traffic", "scale WordPress", "code review", "timeout", "500 error", "out of memory", or "site won't load". Detects anti-patterns in database queries, hooks, object caching, AJAX, and template loading.
Expert-level security auditing, compliance, code review, and vulnerability assessment. Use when the user mentions compliance, security review, code review, vulnerability assessment, SOC 2, or GDPR, or when the task involves Audit Types, Audit Frameworks, Audit Process, or Authentication Review.
Use when AI-written code needs structural cleanup or when implementing a change under a guard against AI coding slop — duplicated reimplementations of existing helpers, try-import fallbacks, broad exception swallowing, speculative abstraction layers, _v2 copies, dead "for future use" code, narrating comments — including requests to "deslop", "remove AI slop", "humanize code", review an AI-generated PR beyond tests passing, or prevent these patterns in the current change.
Review the changes since a fixed point (commit, branch, tag, or merge-base) along two axes: Standards (does the code follow this repo's documented coding standards?) and Spec (does the code match what the originating issue/spec asked for?). Runs both reviews in parallel sub-agents and reports them side by side. Use when the user wants to review a branch, a PR, work-in-progress changes, or asks to "review since X".
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.