Skills
97,501 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Scans an iOS app project for App Store rejection risks. Reads source code directly — no back-and-forth. Auto-detects vibe coder vs developer and adapts language. Detects mid-build apps and asks before switching modes. Outputs a risk register, detailed findings with dynamic copy-paste fixes, reviewer experience checklist, draft App Store Connect reviewer notes, and a post-scan manual checklist. TRIGGER THIS SKILL for any of these — even if not explicitly asked: "audit my app" / "is my app ready" / "about to submit" / "submitting soon" / "about to launch" / "ready to ship" / "App Store review" / "keep getting rejected" / "got rejected" / "rejection" / "App Store Connect" / "TestFlight" / "submit for review" / "pre-submission" / "app review" / "first app" / "never submitted before" / "why did Apple reject" / "what do I need to fix" / "is this ready to launch". Also trigger proactively when working on an iOS app and the user seems close to shipping. Flutter/RN stack: load references/flutter-patterns.md. First-time submitter: load references/first-time-dev.md.
Turn a ticket, URL, or plain-language spec into an executed QA run and reusable regression flows—scenarios and evidence, not ad hoc clicking—by decomposing the request into happy-path, error, edge, and exploratory scenarios, driving each against the real target through the `browse` skill (web or iOS/Android/macOS), capturing pass/fail evidence, and recording cleanly scoped browse flows worth rerunning. Saves a flow only when it is well scoped and valuable, never noisy half-recordings. Use to QA a feature and leave behind rerunnable coverage.
Get an INDEPENDENT second-opinion review from a separate Claude agent in a read-only worktree — findings only, never edits to your working copy. Reads the real diff (branch, a commit, or uncommitted) to build a focused, risk-targeted brief, launches the reviewer under worktree isolation with report-only instructions, then summarizes findings by priority with `file:line`, carrying an exclusion list forward on later rounds. Treats returned findings as candidates to verify locally, not truth; states an explicit clean result rather than inventing issues; keeps secrets out of the prompt and never lets the reviewer mutate code. Use only when the user explicitly asks for a Claude review.
Validate code samples in Elastic documentation markdown files. Checks language identifiers, substitution attributes, callout usage, JSON validity, ES|QL syntax, and Painless scripts. Use when reviewing docs PRs, auditing content, or writing new examples.
Get an INDEPENDENT second opinion from the Kiro CLI run strictly READ-ONLY — a separate reviewer runtime over the real diff, with no write access to the repo. Reads the real diff (branch, a commit, or uncommitted) to build a focused prompt, optionally injects the stack's convention skills (`--skill`, since kiro can't load them itself), then launches kiro via the bundled helper with trust scoped to `fs_read,execute_bash` so it can grep/git to verify findings but never edit. Never uses `--trust-all-tools` (the auto-mode classifier dead-ends read-only tasks on it) or hand-rolls the prompt through the shell; keeps secrets out, treats findings as candidates to verify, and reports an explicit clean result. Use only on explicit user intent or when a user-invoked workflow composes it as the kiro reviewer.
Make the agent show evidence when handing work over instead of just saying “done”. Use in three cases: when an agent is about to hand off work; when the user corrects the agent a second time about the same thing (“wrong again”, “how many times have I said this”, “how do I stop it from doing this again”); or when writing tests or cleaning up useless tests. prove it, stop repeating this mistake, clean up useless tests.
Audits a Next.js (App Router, 14/15+) codebase for React Hook Form anti-patterns — watch() at form root, Controller inlined in parent, async submit without try/catch, missing setError on server failures, RHF in non-"use client" files, RHF mixed with useActionState, schemas defined inside components, useFieldArray without field.id keys, register({ disabled }) for visual disabling, useFieldArray({ disabled }) that silently no-ops mutations, useEffect+reset(data) instead of the values prop. Read-only; emits a markdown report with file:line citations linking back to the companion `react-hook-form` distillation skill. Trigger when the user asks to audit/review/lint RHF usage, find form anti-patterns, or run a quality check on forms — even if they don't say "react-hook-form" by name; if they mention auditing forms in a Next.js project, use this skill.
Analyze Cursor / Claude Code / Codex agent logs for Dosu MCP read_knowledge calls and create an HTML impact report. A highlight is when the returned information was relevant to the question and solution; citing it in code is not required. A failure is when the information was distracting or misleading. Use when the user asks how Dosu has helped, how the agent has used Dosu, how you’ve used Dosu, about read_knowledge impact or a knowledge MCP audit, wants a trajectory report of read_knowledge, or asks to run or rerun the read-knowledge-impact skill.
Rigorous adversarial review of AI-generated (or any) feature implementations and bug fixes. Challenges assumptions, hunts failure modes, and refuses rubber-stamp approval. Use whenever the user asks to review code, review a diff/PR/branch, review AI changes, do a skeptical/adversarial/strict review, verify a fix before merge, or wants you to find how the code can fail — even if they only say "review this" or "LGTM?" after an agent implementation. Prefer this over casual skim reviews when correctness matters.
Thorough, user-invoked tech debt and architecture audit of the current codebase. Produces TECH_DEBT_AUDIT.md with file-cited findings, severity, effort estimates, and a required “looks bad but is actually fine” section. Use when the user asks for a debt audit, codebase health check, architecture review, or code quality assessment of an entire repo. Does not auto-invoke.
Comprehensive quality verification: spec compliance, linting, type-checking, tests, cross-layer data flow, code reuse, and consistency checks. Use after code is written and needs quality verification, before committing changes, or to catch context drift during long sessions.
Test REST and GraphQL API endpoints with structured assertions and reporting. Use when a user asks to test an API, hit an endpoint, check if an API works, validate a response, debug an API call, test authentication flows, or verify API contracts. Supports GET, POST, PUT, PATCH, DELETE with headers, body, auth, and response validation.
Maintenance orchestrator for the brooks-lint plugin itself. Runs a sequential subagent pipeline—author → eval → QA → trigger-audit → release—to add or edit a skill, refresh the eval suite, keep the four manifests + all README translations + CHANGELOG + AGENTS/GEMINI in sync, audit trigger boundaries, and cut releases. Drives the five agents in .codex/agents/ (skill-author, eval-curator, consistency-qa, trigger-boundary-auditor, release-manager). Triggers when the maintainer asks to work ON brooks-lint itself: "add a new skill", "edit the brooks-debt guide", "update the eval suite", "fix the trigger descriptions", "make this change and validate it", "release brooks-lint", "bump and publish", and follow-ups: "re-run", "re-validate", "update that skill", "redo the audit", "redo the X part again". Do NOT trigger for: USING the brooks-lint analysis skills on some target codebase (that's brooks-review / brooks-audit / brooks-debt / brooks-test / brooks-health / brooks-sweep); generic questions about brooks-lint that don't ask to change it; or maintenance of a different plugin
Check documentation impact before completing a change or declaring it ready to ship. Use when a change may affect user, operator, or developer instructions, when asked whether docs need updates, or for a documentation pass. Supports author and read-only review modes without requiring a PR or spec.
Find the bugs your tests miss. Define what your Solana program must guarantee in a .qedspec; QEDGen validates it, generates tests and proofs, and scaffolds agent-fill Rust code. Trigger when the user asks for “qedgen”, “qedspec”, “verify my code”, “prove correctness”, formal verification, property testing, generated Kani/proptest/Lean artifacts, or Solana program correctness.
Iterate on RAG systems with structured evals instead of eyeballing. Use this skill when the user is tuning a RAG pipeline — changing retrieval prompts, swapping models, adjusting chunking, or debugging poor answers — and wants a cheap, ranked set of experiments with cost tracking and structured feedback on the stack. Also use when the user asks "how do I know if my RAG is working?", "this RAG eval is burning money", or "what should I try next on retrieval?".
Reviews one GitHub pull request and prepares a verified local review or posts its exact approved contents. Use when the user asks to review a PR, audit a pull request, draft review comments or request-changes feedback, write a PR review file, or optionally post approved review comments. Handles exactly one PR
Complete Java Spring Boot skill set for building enterprise applications. Includes modular architecture with optional components: PostgreSQL database with JPA/Hibernate + Flyway migration; Redis caching (optional); Kafka/RabbitMQ messaging (optional, choose one); JWT + OAuth2 authentication (OAuth2 optional); RBAC authorization (optional); TDD with Mockito; Spec-First Development with OpenSpec.
Statically inspects Triton operator code quality on the Host and Device sides for Ascend NPU. Identifies potential bugs, API misuse, and performance risks. Focuses exclusively on static code analysis. Keywords: code review, code inspection, static analysis.
Review and understand freshly AI-generated code. Scans the current repo's uncommitted/branch changes and builds a Claude-style light-themed two-column webpage — left is the project folder tree of changed files, right is the selected file's syntax-highlighted diff (additions/deletions clearly distinguished from unchanged code) with a side rail showing, per code segment, the related unit requirement (相关单位需求) and a plain-language code explanation (代码解释). Invoke for "/understand", "code review 这次改动", "解释一下新生成的代码", "看看这次变更".
Use this skill when the user wants to investigate a bug, defect, incident, or quality issue and find its root cause — including requests to run a "5 whys" analysis, write a postmortem, do a root-cause analysis (RCA), figure out why a bug reached production or slipped past code review/QA, set up a recurring defect-analysis routine, or run a daily/weekly quality-improvement (Kaizen) triage. Also known as the Dantotsu method (Sadao Nomura's Toyota-derived defect-analysis approach, adapted for software). Trigger even if the user doesn't name the method explicitly — e.g. "why did this bug get through code review", "a client reported a bug, help me analyze it", "I want to understand why this keeps happening", "write up a root cause report for this defect", or "help me prioritize which fixes to actually ship this week".
Find the root cause of a bug before fixing it. Read this skill before fixing any bug, even when the fix seems obvious. Use it when the user says "fix", "broken", "not working", "error", "failing", or "bug". Also use it when a test fails unexpectedly during other work
Use this skill to diagnose Jetpack Compose stability problems by enabling and reading the Compose Compiler Reports (classes.txt, composables.txt, composables.csv, module.json). Covers the Gradle DSL, the release-only build requirement, and how to interpret per-class and per-composable stability annotations including stable, unstable, runtime, restartable, skippable, readonly, @static, and @dynamic markers. Use when the developer asks "why does this recompose", reports jank, dropped frames, slow scroll, high recomposition count, suspects an unstable parameter, mentions Compose Compiler Reports, classes.txt, composables.txt, module.json, or wants to know which composables are non-skippable. The fix lives in a sibling skill — this one only diagnoses.
An in-depth web-based fact checker for verifying external claims in technical documents or verifiable factual claims in spoken scripts. Use when the user says “deep review,” “Lao Han review,” “web review,” “technical document review,” or “verify spoken-script facts,” or asks to verify factual claims in technical plans, deployment scripts, configuration files, or spoken scripts. By default, review only; modify files only when the user explicitly requests fixes or the workflow contract authorizes them. Does not perform style-only reviews.
Set up and run mutation testing with PIT (pitest) on a Gradle project, and read the mutation score. Use this skill whenever the user wants mutation testing added to a build, configured, run or re-run, wants a mutation score or a mutation report interpreted, asks why a particular mutant survived, or asks what should be excluded from mutation analysis, or wants something added to those exclusions — in any language, and whether or not the tool is named. Also use it when the task calls for it: checking test quality rather than coverage — a high JaCoCo number can hide tests that assert nothing.
Detect React and TypeScript maintainability smells across the whole component, hook, and module, explain the cost of each, and propose a fix with a source link. Covers prop and API design (naming, booleans, callbacks, variants, controlled state, generics, refs, styling, JSDoc), state and data flow (redundant state, stale closures, context and ref misuse), effects and lifecycle, component structure and hooks, rendering correctness (keys, mutation, impure renders, hydration, the leaked 0 from &&), accessibility and focus management, async handlers, error boundaries, unsafe HTML, TypeScript discipline (any, casts, untyped catch, exhaustiveness), and a cross-file duplication pass. Defers memoization and re-render performance to react-compiler and color literals to theme-colors. Use when reviewing or writing React components or hooks, auditing for maintainability, or asked to sniff, smell-check, lint, or clean up a codebase, folder, file, or pasted snippet. Respects native HTML attributes and library conventions.
Use when cleaning up existing CodeceptJS 4 tests — deduplication, extracting page objects, taming long locators, moving raw JS into custom helpers. Targeted (one file) or global (whole tests directory); always proposes before applying. Trigger on "refactor my tests", "clean up", "extract page object", "this test is too long", "deduplicate", or when reviewing test files for quality
Score a codebase, file, or merge request against the FIASSE v1.0.4 SSEM model — 0-10 per attribute, equal-weighted pillars, evidence-backed strengths and weaknesses, prioritized recommendations, 50-item checklist appendix. Trigger on "review/score/audit securability", "SSEM scorecard", "FIASSE/SSEM compliance", "where would I start hardening this?", "is this audit-ready?", "security posture baseline" — including phrasings that don't say SSEM explicitly. For requirements use prd-securability-enhancement; for new code use securability-engineering.
Scans for security vulnerabilities including XSS, SQL injection, CSRF, and auth flaws using OWASP Top 10 methodology. Use when conducting SAST/DAST scans, auditing authentication flows, testing authorization rules, or implementing security test automation
Apply when writing or reviewing a spec, requirements, acceptance criteria, user stories, or tickets, before any code exists. Two passes: an edge probe over a closed taxonomy of data-shape boundaries, and a prohibition probe for what the feature must never silently become. Every raised item is resolved, dismissed with a reason, or carried as an explicit gap.
Use when writing, fixing, or refactoring Android/KMP code in Kotlin — a test-first (RED-GREEN-REFACTOR) foundation plus the Android/KMP test traps: Compose-test dispatching (StandardTestDispatcher default, the two-schedulers trap), semantics-first selectors, choosing the smallest test shape, test-clock vs wall-clock, animation/screenshot determinism, and a `commonTest` name that fails the iOS compile while `jvmTest` stays green.
Periodic architecture survey — walks the module graph and reports ranked deepening candidates (shallow modules, hypothetical seams, logic behind the wrong seam). Survey, not rescue: it finds candidates and hands them to the captain; it never refactors on its own.
Ban `as` type assertions in a package via the `@typescript-eslint/consistent-type-assertions` lint rule, replacing them with compiler-verified type-safe alternatives. Use when enabling the assertion ban in a new package or fixing violations in an existing one.
Multi-perspective code review that synthesizes findings from multiple reviewers into a unified report. Use when the user asks to review code changes, audit a diff, check code quality, review a PR, review commits, or review uncommitted changes. Also covers 'code review', 'review my changes', 'check this before I merge', or wanting multiple perspectives on code. Do not use for documentation/markdown review or trivial single-line changes.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.