Skills
97,501 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Perform dynamic security testing against running web applications and APIs to discover vulnerabilities through active probing and fuzzing. Use when the user requests dynamic application security testing or provides relevant inputs for this workflow.
Code-vs-artifacts review for OpenSpec's tempa-spec schema — checks implemented code against specs/**/*.md, design.md, and tasks.md once every task is complete. A loop of up to 3 passes, each run in a fresh subagent session with no memory of the implementer, HIGH/MEDIUM/LOW severity with MECHANICAL/DECISION resolution tagging, hard-gated on passing tests and lints, with a bundled diff floor guard that flags suppressions, skips, deleted tests, dropped assertions, and stubs. Use during the tempa-spec schema's `apply` Phase 2 review.
Use this skill when asked to perform any of the following actions in a Java project: - To add jspecify support - To prevent NullPointerExceptions - To better handle Nullability This skill will add jspecify dependency, configure Maven or Gradle build to automatically use jspecify for checking Nullability issues.
Execute a comprehensive NestJS Project Health Audit. Analyzes tech stack, architecture, API design, data layer, testing, code quality, CI/CD, and documentation. Produces a shareable Markdown report with section scores and weighted overall score. Use when the user asks to audit a NestJS project, run a health check, evaluate backend quality, or assess technical debt. Triggers on: 'nestjs audit', 'health audit', 'backend audit', 'nestjs health', 'node audit', 'api audit', 'project quality check'.
Catch the deterministic CI failures reachable from your diff before pushing, with `hogli ci:preflight`. Use when the pre-push hook blocks a push, before reporting a task done, or after editing Python, serializers, migrations, workflows, or dependency manifests — to avoid burning a CI matrix on a failure you could catch locally (formatting, lint, broken lockfiles, OpenAPI drift, migration conflict, stale branch). Trigger terms: ci:preflight, preflight, pre-push checks, pre-push hook failed, "will this break CI".
Analyze source code for security vulnerabilities using static analysis tools, custom rules, and CI-integrated scanning pipelines. Use when the user requests static application security testing or provides relevant inputs for this workflow.
Yaklang toolchain and plugin verification guide. Explains how to run scripts with the yaklang source engine (go run common/yak/cmd/yak.go), and how the four hot patch/codec verification commands (yak hotpatch-mitm / hotpatch-global / hotpatch-webfuzzer / codec-plugin) verify your MITM / global / Web Fuzzer hot patches and right-click codec plugins using the same execution path as real gRPC; it also explains how to locate and debug MITM issues with the yaklang repository source code. Use when the user asks "how do I verify the plugin I wrote / how do I debug incorrect MITM behavior".
Diagnose Comet Hook, installation, routing, platform, generated Runtime, or lifecycle behavior by distinguishing stale configuration from source defects and executing real packaged Runtime paths. Use when Hook or installation reports may involve configuration, generated asset drift, unsupported platforms, or cross-project ownership issues.
Creates a Page Object Model (POM) class for a specified page in a Playwright E2E test suite. Generates the POM file with proper structure, comment banners, JSDoc, setUp/tearDown lifecycle methods, and locators. Use when asked to create a POM, page object, or page model.
DDD architecture evaluation and evolution — DDD maturity 5-level model (AdHoc/Aware/Applied/Scaled/Optimized), architecture fitness assessment (business alignment/team fit/tech fit/evolution capability), technical debt quantification with scoring, architecture evolution roadmap (4 phases), and migration risk assessment. Use when user asks about architecture evaluation, 架构评估, DDD maturity, 技术债务, architecture evolution, 架构演进, or needs to assess DDD implementation health.
DDD testing strategy — domain model unit testing, aggregate root testing, repository testing with mocks, application service integration testing, adapter E2E testing, test pyramid for DDD layered/hexagonal/clean architectures, and Test-Driven Domain Design (TDDD). Use when user asks about testing strategy, 测试策略, DDD testing, aggregate test, repository test, test-driven domain design, or needs to test DDD applications.
Use this skill when the user is building or interpreting the doca/tools/gpunetio_ib_write_bw tool pair—a CUDA kernel posts RDMA WRITE work requests through the doca-gpunetio device-side surface to measure sustained GPU-driven WRITE BW on a GPU+IB-device pair. Trigger even without the tool name—typical phrasings: "measure WRITE BW when the GPU posts the WRs", "BW swings run to run on the same flags", "is the NIC saturated or am I bound on the CUDA kernel", "meson compile fails for the GPUNetIO bw tool", "nvidia_peermem isn't picking up my GPU buffer", or "GPU-posted WRITE BW vs the CPU path". Refuse and route elsewhere for general doca-gpunetio library work, DOCA setup, the GPU-posted WRITE latency analog, CPU-posted RDMA benchmarking (doca-perftest), and app-level end-to-end rates.
Use this skill when the user characterizes RDMA WRITE round-trip time posted from a CUDA kernel via GPUNetIO—compiling `gpunetio_ib_write_lat` under `doca/tools/`, verifying GPU–NIC affinity, and interpreting the half-iteration / full-iteration / nanosecond columns for median / p99 / tail-jitter analysis of a real-time control loop. Also load it for implied asks like "p99 WRITE time on H100 + ConnectX", "tail delay versus batching", or "device-originated versus upstream ib_write_lat". Refuse and route to the proper owner for throughput runs (doca-gpunetio-ib-write-bw), the GPI channel API (doca-gpi), GPUNetIO API work (doca-gpunetio), or SDK setup.
Use when developing Go applications, implementing job schedulers or cron (netresearch/go-cron, ofelia), Docker API integrations, LDAP/AD clients, building resilient services with retry logic, setting up Go test suites (unit/integration/fuzz/mutation), or running golangci-lint.
Use BEFORE any rename, removal, required-field change, or other contract-breaking edit to a config on a Datex Studio branch. Runs reverse-trace to find all callers, categorizes them (including write-side vs read-side for storage-shape changes), and presents a safety gate. Generic — works for any config type (functions, datasources, flows, storages, type definitions, reports, etc.). Also invoke when a calling skill asks you to "audit all callers" or "verify a contract change is safe" before proceeding.
Validate markdown files against formatting standards. Auto-detects and installs markdownlint-cli if missing. Checks project config or falls back to sensible defaults. Supports auto-fix mode. Use when creating or modifying markdown files, validating documentation, or enforcing markdown conventions.
React useEffect anti-pattern detection and correction guide. Use this skill whenever writing, reviewing, or modifying any React component that contains useEffect, or when about to add a useEffect hook. Also trigger when you see patterns like "setState inside useEffect", "effect chains", "derived state in effect", or "notify parent in effect". Covers 12 specific scenarios where Effects are unnecessary or misused, with correct alternatives. Even if the useEffect looks reasonable at first glance, consult this skill to verify it's truly needed.
Python type checking expertise using ty - the extremely fast type checker by Astral. Use when: (1) Adding type annotations to Python code, (2) Fixing type errors reported by ty, (3) Migrating from mypy/pyright to ty, (4) Configuring ty for projects, (5) Understanding advanced type patterns (generics, protocols, intersection types), (6) Setting up ty in editors (VS Code, Cursor, Neovim, PyCharm).
Run a structured mobile-responsiveness audit on a design, screen, or component — viewport adaptation and reflow, orientation, touch-target size and spacing, thumb reachability, mobile input ergonomics, gesture safety, and mobile readability/content priority. Produces a severity-rated issue list with concrete fixes. Use when reviewing whether a UI works on phones/tablets, or as a validation step after generating mobile or responsive UI.
Query and summarize CawPlan QA Insights A3 TestRail execution progress for a Version or Run: execution rate, pass quality, deduplicated failure/blocker queue, and per-Ticket progress tables. Use when: A3 execution progress, test execution summary, TestRail run progress, execution summary, failure list, pass rate, untested count, status counts, custom status, 查询A3执行进度、查询Version测试进度、查询TestRail Run进度、执行摘要、失败列表、通过率、未执行统计、全status统计。 NOT for: importing test cases, creating TestRail Plans/Runs, filing defects (use `cawplan-defect-ticket`), or release risk assessment.
Comprehensive guidance for COLA v5 Architecture (菱形架构) — Alibaba's COLA framework with adapter/application/domain/infrastructure layers. Covers full project scaffolding, architecture validation (cola-creator + cola-validator combined), dependency rule checking with ArchUnit, CQRS integration, and multi-module Maven/Gradle project generation. Use when user asks about COLA architecture, 菱形架构, cola-creator, cola-validator, 创建 COLA 项目, or needs Alibaba DDD framework.
Systematic evidence-based debugging using runtime logs. Generates hypotheses, instruments code with NDJSON logs, guides reproduction, analyzes log evidence, and iterates until root cause is proven with cited log lines. Use when the user reports a bug, unexpected behavior, or asks to debug an issue.
Use when reviewing code, pull requests, patches, CLs, diffs, or proposed implementations for engineering quality, code health, design, functionality, tests, maintainability, specialist risk, or approval risk. TRIGGER on "review this PR", "code review", "LGTM?", "approve?", "is this code/diff/change safe to merge/deploy?", and local diff reviews. DO NOT TRIGGER for PR descriptions, PR splitting, author review-feedback responses, or non-code safety questions unless code review is requested.
Local E2E debug and test framework for clawd-feishu plugin development. Use when debugging message flow, testing bot responses, verifying Feishu web UI interactions, or performing end-to-end validation of the OpenClaw-Feishu integration during development.
Use when working with Hardhat 3 projects — writing or modifying Solidity tests, TypeScript tests, or any code touching hardhat.config.ts, the `hardhat` import, or `network.create()`. Covers test-layer choice, forge-std cheatcodes, the network connection API, `networkHelpers`, the compile-then-typecheck workflow, and speeding up slow builds (especially via-IR) with the slang-solx compiler. For toolbox-specific guidance (clients, contract calls, assertions), also load the matching `hardhat-toolbox-*` skill.
Use this skill when diagnosing iOS app launch performance, startup regressions, first-frame readiness, or early responsiveness. Covers pre-main/dyld work, AppDelegate/SceneDelegate, SwiftUI App startup, launch orchestration, SDK initialization, and launch measurement. Do not use for general performance unless the code runs on the launch path.
Juniors-focused React and TypeScript best practices. Use this skill when writing or reviewing code to enforce clear, consistent, and maintainable patterns across common scopes like React, TypeScript, styling, devtools, assets, and Git.
Interpret and use `mcpjam` probe, doctor, OAuth, XAA (Cross-App Access / ID-JAG), apps conformance, tools, resources, and prompts output conservatively against MCP 2025-11-25. Use when interacting with MCP servers, executing tools, triaging findings, performing security reviews, debugging enterprise-managed authorization, deciding whether a CLI finding is real or overstated, or turning inspection output into an engineer-facing report with severity and confidence.
Optimize the meaningful UI available immediately from a Next.js route on an initial load (hard navigation) or named client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route and entry point at a time; the shipped test then guards against regression. Use when asked to grow a static shell, fix a slow first paint or non-instant navigation, diagnose which Suspense boundary blocks useful UI, or add instant() regression coverage. Requires Next.js 16.3+ with Cache Components already adopted.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.