Skills
97,222 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Write and review React code as if the React Compiler is enabled. Skip manual useMemo, useCallback, and React.memo by default, and audit existing code for stale manual memoization. Use when writing or refactoring any React component in a React 19+ codebase, reviewing a React PR, setting up the eslint-plugin-react-hooks configuration, or seeing memoization patterns in code an LLM produced. Counterweight to pre-compiler React in LLM training corpora, which biases default output toward manual memoization unless prompted otherwise.
Signals scout for Core Web Vitals (`$web_vitals`). Watches each page's p75 LCP / INP / CLS / FCP against Google's thresholds and its own history — poor-band pages, band crossings, sharp regressions — and dates each regression against deploys and flag rollouts.
Use when testing local web applications using Playwright. Triggers include requests to verify frontend functionality, debug UI behavior, capture browser screenshots, view browser logs, or test any web application interactively. Write native Python Playwright scripts for all web application testing tasks.
Use when about to claim work is complete, fixed, or passing, before committing or creating PRs - requires running verification commands and confirming output before making any success claims; evidence before assertions always
Windows and Git Bash testing compatibility for Vitest, Playwright, and MSW. PROACTIVELY activate for: (1) Vitest tests failing on Windows but passing on Linux, (2) Playwright on Windows with Git Bash quirks, (3) MSW intercept issues across shells, (4) path normalization in test fixtures, (5) browser binaries on Windows (Playwright install), (6) line-ending issues in test snapshots (CRLF vs LF), (7) cross-platform test scripts in package.json, (8) shell detection in pretest/posttest hooks, (9) CI-on-Windows debugging. Provides: cross-platform package.json scripts, snapshot normalization, Playwright Windows install, MSW shell-aware setup, and CI Windows debugging recipes.
Cross-vendor adversarial code review of the current branch. Two different model families (Claude + Codex/GPT) review the diff independently, then try to refute each other's findings; survivors are reported by confidence. Runs from either Claude Code or Codex. Use when the user asks for an adversarial review, a cross-model / second-opinion review, or wants high-confidence findings before merging. Report-only — never auto-applies fixes.
Audit React Doctor against ReactBench or similar diagnostic benchmark corpora for confirmed false positives, false negatives, taxonomy gaps, and verifier artifacts. Use when analyzing rd.log, rd-before.json, rd-after.json, model.patch, result.json, reward/test logs, rule distributions, or when asked to perform a second adversarial pass over React Doctor benchmark findings.
Execute comprehensive web application security testing using Burp Suite's integrated toolset, including HTTP traffic interception and modification, request analysis and replay, automated vulnerability scanning, and manual testing workflows.
Use when auditing or recalibrating game balance: build a source-driven Monte Carlo balance lab (Rust + rayon) that extracts live game data, simulates human playstyles (AFK→pro), emits win-rate/economy verdicts with confidence intervals, and bruteforce-tunes parameters. Trigger on unfair levels, unreachable shops, farm exploits, interest-curve cliffs, post-content recalibration, or CI balance JSON diffs. Keywords: balance lab, Monte Carlo, win rate, difficulty curve, economy career, playstyle simulation, Resource extraction, GDScript parser, bruteforce tuning.
UX/UI audit skills, each a structured methodology: ux-audit-rethink (IxDF UX factors), nielsen-heuristics-audit, wcag-accessibility-audit (POUR framework), don-norman-principles-audit, cognitive-walkthrough, ui-design-review, and information-architecture-audit. The package also holds AI-governance and security-audit skills that this catalogue does not install.
Scans code for security vulnerabilities, including injection attacks, authentication flaws, exposed secrets, insecure dependencies, and data exposure. Use when the user says "security review", "is this secure?", "check for vulnerabilities", "audit this", or before deploying to production.
ShellCheck validation as a non-negotiable 2025 workflow practice. PROACTIVELY activate for: (1) running ShellCheck on bash scripts, (2) interpreting and fixing ShellCheck warnings (SC2086, SC2068, SC2155, SC2295, SC2327, SC2328, SC2294), (3) integrating ShellCheck into CI (GitHub Actions, Azure DevOps, pre-commit), (4) per-line and per-file disable directives (when justified), (5) shellcheck-rc and project configuration, (6) ShellCheck v0.11.0 new checks, (7) suppressing false positives correctly. Provides: ShellCheck install/CI setup, common warning catalog with fixes, CI workflow templates, and a quality gate pattern that fails builds on regressions.
Signals scout for PostHog MCP tool calls. Watches `$mcp_tool_call` telemetry for tools that need improvement — broad-reach failure rates, retry hammering, slow or context-bloating responses — grouped by owning product category, each with a fix suggestion.
Architecture reviews across 7 dimensions (structural, scalability, enterprise readiness, performance, security, ops, data) with scored reports. Triggers on: "review architecture", "critique design", "audit system", "assess scalability", "enterprise readiness", "technical due diligence". NOT for diagrams, use architecture-diagram.
Debug and find the root cause of AscendC operator precision issues. Use when an operator fails precision tests (allclose fails, results are off, output is all zeros/NaN, etc.). Workflow: analyze error distribution → review error-prone code → isolate experiments → instrument with printf/DumpTensor → verify the fix. Keywords: precision debugging, precision issues, inconsistent results, error localization, allclose failure, output deviation, NaN, all zeros, precision debug.
Create basic Transformers model adapters for msModelSlim. Implements required interfaces and completes a four-step verification workflow: generate test model -> full fallback quantization -> weight verification -> quantization description validation. Use this skill when the user wants to: (1) create msModelSlim adapters for decoder-only LLMs, (2) adapt understanding VLM text backbones for quantization, or (3) implement a W8A8/W4A16 quantization workflow for new models. Trigger: user mentions “msModelSlim”, “adapter”, “model adapter”, “quantization”, “W8A8”, “W4A16”, “transformers”, “LLM”, “VLM”, “adapter creation”, “适配器”, “模型适配”, “量化”, “模型适配器”, or “LLM量化”.
Creates, modifies and debugs Infrahub check definitions — Python validation logic, GraphQL queries, and YAML-driven tests for proposed change pipelines. TRIGGER when: writing validation checks, creating Python checks, building data quality guards for proposed changes, writing or running tests for a check, modifying or extending an existing check, debugging why a check fails, passes when it should not, or flags the wrong nodes. DO NOT TRIGGER when: designing schemas, querying live data, building transforms or generators
Provider-independent media quality control and delivery direction for generated images, video, audio, ads, product content, social clips, broadcast and streaming assets, localization packages, and mixed-source edits. Use when an agent must define final export specs, inspect technical and perceptual quality, check captions/audio/color/accessibility/provenance/rights, create delivery sheets, version filenames, checksums, manifests, package deliverables, set acceptance or rejection criteria, and perform final delivery QA before handoff to a platform, broadcaster, streamer, client, or ad trafficker.
Runs a guided, end-to-end security review of a Power Pages site and consolidates every finding into one HTML report covering source code and dependencies, the live site, browser headers, firewall, authentication, and role-based permissions. Use when the user wants a full security review, a release-readiness check before publishing, a code-and-config check during development, live site monitoring, or asks open-ended questions like "review my site security", "is my site safe to ship", "do a security check", "monitor my site" — even if they do not name the individual checks.
Acts as a Senior Staff Engineer to enforce high-quality software development standards. Use this skill when the user asks for code implementation, architectural review, debugging, or technical design. It ensures all code is production-ready, typed, and architecturally sound.
Reference for the Storybook MCP server itself (@storybook/addon-mcp): 6 tools across 3 toolsets (dev, docs, testing), availability detection, and per-agent toolset filtering. Use when setting up the server or calling these tools directly against components that already exist. For the end-to-end pipeline that turns a mockup into a new component and consumes these tools as one stage, use design-to-code.
Detects anemic domain models, validates and refactors them into rich domain models, and enforces tactical DDD patterns (Entities, Value Objects, Aggregates, Domain Services, Domain Events). Use when the user asks to validate, review, or check domain models or DDD code; detect anemia; refactor domain objects; improve encapsulation; or mentions terms like "anemic model", "rich domain", "aggregate", "value object", "domain event", "ubiquitous language", "is this good DDD", "does this follow DDD", or "check my domain". Do NOT use for module or service boundary design, architectural decomposition, strategic DDD context mapping, or code outside the domain layer (DTOs, controllers, infrastructure adapters).
Run the AgentRC readiness assessment on the current repository and produce a static HTML dashboard at reports/index.html. Wraps `npx github:microsoft/agentrc readiness` and hands off rendering to the @ai-readiness-reporter custom agent. Supports policies (--policy) for org-specific scoring. Use when asked to assess, audit, or score the AI readiness of a repo.
Audit AI-powered interfaces against the uxuiprinciples Part V taxonomy—44 principles covering transparency, trust calibration, human override, consent, agentic workflows, and conversational design. Returns structured findings with severity and remediation. API key is optional; enriched output requires uxuiprinciples.com API Access.
Algorithmic complexity (Big-O) review — finding nested loops, N+1 queries, exponential recursion, quadratic string builds, and other accidental complexity blowups. Covers Python, JavaScript/TypeScript, Java, Go, and similar languages. Use whenever writing, reviewing, or refactoring code where Big-O matters. Trigger even when the user doesn't mention "Big-O" explicitly — if they're reviewing code for performance, refactoring a hot path, asking "why is this slow," or working with data that scales (loops, recursions, collections, ORM access), apply this skill to classify the time/space complexity and suggest the fix. Especially trigger on tasks like "review for performance," "find slow code," "make this faster," "this code is O(n²)," or when reading code that processes collections.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.