Skills
97,501 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Verify and transform Lean 4 proofs using the Axiom (Axle) API. Use when the user works with Lean 4 code, formal mathematics, Mathlib theorems, or mentions axiom, axle, lean verify, proof verification, formal proof, or theorem checking -- even if they don't explicitly say "axiom" but are clearly working with Lean proofs that need machine verification.
Use when reviewing Bagisto code changes or a pull request for correctness, convention compliance or quality, or when asked whether a change is ready to merge. Trigger phrases include "review", "code review", "PR review", "is this correct", "conventions", "violations", "code quality", "ready to merge".
Use when writing, changing or debugging a Bagisto end-to-end test — deciding what to cover, Playwright specs, page objects, locators, assertions, ACL role coverage, fixtures, test data, admin-versus-storefront coverage, a regression test, or a failing E2E run. Trigger phrases include "playwright", "e2e", "end to end", "spec.ts", "page object", "browser test", "add tests for", "flaky test", "regression test", "shard".
Whole-codebase code quality audit system with 9 specialized sub-skills covering security, SOLID principles, architecture, error handling, performance, test quality, code smells, design patterns, and framework best practices. Produces a scored health dashboard (0-100 per category), severity-rated findings (P0-P3) with severity rationales, and copy-pasteable fix prompts; also does PR-style diff review vs a base branch. Strictly read-only — never modifies user code. Use when the user says "codeprobe", "audit", "full code review", "code health", "check my code", "security scan", "code smells", "SOLID check", or asks how healthy, risky, or maintainable a codebase is. (For reviewing just the working diff, the built-in /code-review may be more appropriate unless the user asks for codeprobe.)
CodeRabbit CLI local code reviews and .coderabbit.yaml configuration. Run AI reviews on uncommitted/committed changes before pushing or opening a PR, parse --agent findings, iterate fix-and-verify loops within hourly rate limits, and tune repo config for low-noise high-signal reviews. Also drives cloud Coding Agent tasks from the CLI (coderabbit code). Use when reviewing local changes pre-push/pre-PR, installing or driving the coderabbit/cr CLI, starting or following a CodeRabbit cloud task, creating or tuning .coderabbit.yaml, or reducing CodeRabbit review noise. Not for PR-side review loops and thread handling (git-pr), commits (git-commit), or CI status (git-ci)
Use this skill when the user is invoking doca_flow_dpa_perf on DPA-capable hardware (ConnectX-7 minimum supported, ConnectX-8 recommended, or BlueField-3) to measure rule update / disable rates on the DPA-offloaded DOCA Flow path — picking the active / passive device split, choosing workload-shape axes (burst, queue, completion threshold, workers, hash pipe algo, PSL tables), or reading Kops/sec iteration stats and the optional self-test. Trigger even when the user does not explicitly mention "doca_flow_dpa_perf" or "DPA Provider" — typical implicit phrasings include "how fast can the DPA program path-selector entries", "baseline rule-update rate on ConnectX-8", "tool reports zero ops on my BlueField", "self-test sentinel never shows on tcpdump", or "is my BlueField-2 DPA-capable". Refuse and route elsewhere for the host / DPU-CPU Flow path (doca-flow-perf), Flow pipeline tuning (doca-flow-tune), writing doca-flow / doca-dpa applications, or DOCA install — those belong to other skills.
Use this skill to set up a CI gate that fails the build when Compose stability silently regresses, using the `skydoves/compose-stability-analyzer` Gradle plugin (primary) or the `j-roskopf/ComposeGuard` plugin (alternative for non-Android multiplatform). Covers applying `com.github.skydoves.compose.stability.analyzer`, configuring the `composeStabilityAnalyzer { stabilityValidation { ... } }` DSL, generating a `.stability` baseline with `:stabilityDump`, committing it to version control, and wiring `:stabilityCheck` into a GitHub Actions or other CI job. Use when the team wants a stability SLO, when an unstable parameter slipped into a shared data class and went unnoticed until jank was reported, when migrating a large app to strong skipping, or when the user mentions stabilityCheck, stabilityDump, baseline drift, ComposeGuard, or "fail the build on stability regression".
Comprehensive Flutter development patterns covering widgets, testing, performance, security, and animations. Use when you need quick reference for Flutter best practices, common UI patterns, performance optimization techniques, security guidelines, or animation implementations.
Reviews an ADK integration documentation page (a Markdown file under docs/integrations/) or an integration pull request for correctness, structure, style, working code, valid links, and catalog conventions. Produces a prioritized review report, a recommended decision (approve, request changes, or close PR), a top-level review response, and draft line-anchored comments; only fixes issues when explicitly asked. Triggers on "integration-review", "review integration page", "review integration PR", "review this integration", "check integration docs".
Run mobile automation, app testing, and interact with iOS and Android devices, simulators, emulators, and apps using the mobilecli CLI tool or JSON-RPC API. Trigger this skill whenever the user wants to list connected devices, boot or shut down simulators/emulators, take mobile screenshots, start screen recordings, send key/touch inputs (tap, text, swipe, pinch, hardware buttons), manage apps (install, uninstall, launch, terminate, get foreground app), inspect webviews (query DOM, evaluate JS, navigate), download/upload files on-device, get crash reports, install mobilecli, or allocate and release remote real devices on Mobile Next cloud, even if they don't explicitly name "mobilecli". Requires the mobilecli npm package; the skill installs it if missing.
Apply Edward de Bono's Six Thinking Hats methodology to software testing for comprehensive quality analysis. Use when designing test strategies, conducting test retrospectives, analyzing test failures, evaluating testing approaches, or facilitating testing discussions. Each hat provides a distinct testing perspective: facts (White), risks (Black), benefits (Yellow), creativity (Green), emotions (Red), and process (Blue).
Use this skill to install and operate the `skydoves/compose-stability-analyzer` IntelliJ / Android Studio plugin so the developer sees Compose stability feedback live in the editor instead of waiting for a Gradle build. Covers installing the plugin from disk, configuring the `Settings → Tools → Compose Stability Analyzer` panel, reading the four gutter colors (green stable, red unstable, yellow runtime, gray no-params), the per-parameter hover documentation, the inline parameter hint badges, and the `UnstableComposable` weak-warning inspection with its `@Suppress("NonSkippableComposable")` and `@Suppress("ParamsComparedByRef")` quick fixes. Use when the user mentions gutter icons, inline hints, the stability inspection, the IDEA plugin, real-time stability feedback while editing, or asks why a composable is flagged as non-skippable in the editor.
Use this skill to drive the active investigation features of the `skydoves/compose-stability-analyzer` IntelliJ / Android Studio plugin: the static Recomposition Cascade visualizer that walks the call graph from a root `@Composable`, and the live Recomposition Heatmap that streams `D/Recomposition` events from a connected device's logcat into block inlays above each instrumented composable. Covers the `Compose Stability Analyzer` tool window's three tabs (Explorer, Cascade, Heatmap), the cascade analyzer's static PSI walk with depth cap and cycle detection, the ADB logcat command the heatmap consumes, and the toggle/clear actions. Use when the user asks "what gets dragged in if I change this composable", "how many times did this recompose during that scroll", "what is the blast radius of this state change", or mentions the cascade tab, the heatmap tab, the recomposition inlays, or `Toggle Recomposition Heatmap`.
Use when testing whether users can access data or actions they shouldn't — IDOR/BOLA, horizontal and vertical privilege escalation, multi-tenant isolation, forced browsing, function-level authorization (BFLA), and mass assignment. The #1 cause of real-world breaches.
Whole-codebase code quality audit system with 9 specialized sub-skills covering security, SOLID principles, architecture, error handling, performance, test quality, code smells, design patterns, and framework best practices. Produces a scored health dashboard (0-100 per category), severity-rated findings (P0-P3) with severity rationales, and copy-pasteable fix prompts; also does PR-style diff review vs a base branch. Strictly read-only — never modifies user code. Use when the user says "codeprobe", "audit", "full code review", "code health", "check my code", "security scan", "code smells", "SOLID check", or asks how healthy, risky, or maintainable a codebase is. (For reviewing just the working diff, the built-in /code-review may be more appropriate unless the user asks for codeprobe.)
Analyze repositories to reveal unseen patterns, strategic drift, and organizational health. Use when assessing repository coherence, diagnosing project issues, identifying documentation inflation, or understanding why a codebase feels misaligned with its stated goals.
Scaffolds a complete Playwright E2E test suite from scratch. Creates the e2e/ directory with configuration files, folder structure, base page class, custom fixtures, auth setup, and environment config. Use when: setting up E2E tests for a new project, initialising a Playwright test suite, or bootstrapping the e2e directory.
Author-then-adversarial-review authoring pass for a single OpenSpec artifact — a subagent drafts it, `hrt-artifact-lint` clears the deterministic structure checks, then two subagents review it concurrently in fresh isolated contexts (a Destructive Critic for content/logic, a Structural Auditor for the structural judgement calls a linter cannot make), findings resolved before finalizing. Parameterized by artifact (specs or design). Use during the tempa-spec schema's `specs` and `design` phases.
Cross-artifact consistency review for OpenSpec's tempa-spec schema — checks proposal.md, specs/**/*.md, design.md, and tasks.md are mutually consistent and faithful to the requirements, BEFORE any code is written. One cycle is an ALIGN pass (deterministic structure and coverage via `hrt-artifact-lint`, then five judgement dimensions, a consequence gate, then HIGH/MEDIUM/LOW × MECHANICAL/DECISION — HIGH DECISION findings shown together and answered one by one, the rest in one digest), a fresh-context VERIFY pass (only when ALIGN raised a HIGH), then a human WALKTHROUGH led by specs and design; walkthrough feedback re-enters ALIGN. Exits on a clean walkthrough round or user sign-off; after 3 cycles it asks whether to keep going. Use during the tempa-spec schema's `align` phase.
Execute a micro-level NestJS code quality audit. Validates code against live GitHub standards for testing, architecture, DTO validation, error handling, and code implementation. Produces a detailed violations report with prioritized action plan. Use when the user asks to check NestJS code quality, validate best practices, or review backend code standards. Triggers on: 'nestjs best practices', 'backend code quality', 'code review', 'nestjs standards', 'dto validation', 'error handling review'.
Design and apply QA methodology for software teams: test strategy, regression testing, CI failure triage, test automation, quality gates and metrics, risk-based testing, exploratory testing, test design techniques, AI code quality gates (independent verification, artifact provenance, spec-first oracles, AI-review-comment triage, acceptance-criteria testability for Spec-Driven Development), mutation-guided test hardening and review evidence (surviving mutants, weak assertions, diff-aware mutation testing), agentic eval design (dataset test design, judge-as-system-under-test, flaky-eval discipline), QA career levels (Senior/Staff/Principal), and SDET engineering (test infrastructure, gTAA, CI/CD integration). Do not use for root-cause debugging of production incidents, security implementation or threat modeling, or evaluation framework governance and statistical analysis — route those to systematic-debugging, secure-software-engineering, and agent-evals-and-observability respectively.
Tracks quality metrics including defect density, test effectiveness ratio, DORA metrics, and mean time to detection. Use when establishing quality dashboards, defining KPIs, evaluating test suite effectiveness, or reporting quality trends to stakeholders.
Execute a micro-level React code quality audit. Validates code against live GitHub standards for testing, component architecture, hooks patterns, state management, performance, and TypeScript. Produces a detailed violations report with prioritized action plan. Use when the user asks to check React code quality, validate best practices, or review frontend code standards. Triggers on: 'react best practices', 'react code quality', 'component review', 'hooks review', 'react standards', 'frontend code quality'.
Verify whether an incoming security advisory is a real, disclosable vulnerability in a target repository checkout, and assign an honest severity. Use when triaging an advisory, GHSA, scanner finding, or draft report from the researcher/reporter side to decide if it is worth disclosing. Optimizes against false confirmations and inflated severity.
Use when checking your own manuscript before submission from a reviewer's perspective. Returns anticipated Major/Minor comments with fixes, including numerical, citation and leakage checks, with an optional multi-reviewer panel. Someone else's paper is /peer-review.
Use this skill whenever writing new code, proposing a bugfix, reviewing a PR/diff, or discussing whether to add an abstraction, config layer, plugin system, or generic mechanism. Also trigger for architecture/design discussions, "is this too complex" questions, or any point where Claude is about to suggest introducing a new abstraction layer. The core stance — code is written for humans to read, not as an artwork to admire — optimize for affordance (like a road sign, instantly readable) rather than elegance or cleverness. Trigger even if the user doesn't name "simplicity" explicitly — e.g. "should I make this configurable", "quick fix for this bug", "review this PR", "should I abstract this into a helper", "this codebase feels messy". DO NOT USE for one-shot factual questions, pure formatting/typo edits, or when the user explicitly asks for a generic/configurable design.
Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy
Drive comprehensive test creation for a feature, spec, module, or PR. Decide what must be tested, pick the testing strategy at the lowest sufficient cost, drive the test producers to author the tests, run them, and record the session — what was tested, by what test type, and what passed — in specs/<feature>/test-spec.md and test-report.md. Drives the producers create-yaml-tests and create-agent-tests.
Integration and contract testing patterns — API endpoint tests, component integration, database testing, Pact contract verification, property-based testing, and Zod schema validation. Use when testing API boundaries, verifying contracts, or validating cross-service integration.
Autonomous PR monitor — polls every 2 minutes for merge conflicts, CI/CD failures across GitHub Actions, Buildkite, Vercel, and Fly.io, review comments, and merge readiness. Auto-detects PR from current branch, fixes what it can, notifies on state changes. No setup questions. Use when asked to babysit a PR, watch a PR, monitor CI, keep a PR green, handle merge conflicts, or poll PR status
Use this skill when a process needs automated tests before go-live or after a change—every path, error, and timeout, with full coverage—even if Camunda Process Test isn't mentioned. Plans, writes, and runs CPT suites (.test.json scenarios or Java) with Maven. Not for end-to-end, UI, or Tasklist click-through tests, unit tests of classes, authoring models, or deploying.
Use when investigating non-obvious bugs, intermittent failures, regressions requiring bisection, or whether a regression test reaches the real shared failure boundary. Not for abstract trade-offs, feature design, or an error whose message already supplies the fix.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.