Skills
97,501 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Use when reviewing or judging a finished PRD (product requirements document) to decide whether the downstream build can be planned from it — an acceptance gate, not authoring. Judges the PRD against a 12-condition plannability bar: the problem is evidenced (not asserted), users are concrete, success metrics are measurable (with guardrails where gameable), the MVP boundary is defensible, features + acceptance criteria are concrete, non-functional requirements carry numeric targets, the problem→goal→metric→feature→AC chain is traceable (no orphans), dependencies are named, no evidence is fabricated, and open questions are surfaced. Also reviews an AMEND as a delta-scoped review. Emits exactly `VERDICT: approve|revise` plus actionable findings. Approves a PRD that meets the bar (no false-revise on a thin one) and revises only on a real, named gap. Not for authoring or fixing a PRD, not for engineering design docs (specs, ADRs, RFCs), and not for other document types.
Validates locally (`robomotion validate`) then executes a Robomotion flow on a robot (`robomotion run <flow-dir>`), tailing the agent-mode JSONL session log to drive a validate → run → observe → fix loop with bounded retries. Use when the user says "run the flow", "start on robot X", "trigger this on the robot", "test on a robot", or "deploy and run".
Audit requirement quality across spec.md, plan.md, and tasks.md for a chosen domain (UX, API, security, performance…). Writes reviewer-owned checklists that test whether requirements are complete, clear, measurable, and consistent—unit tests for the requirements, not for the code
Drive the managed Strix platform headlessly through the app.strix.ai REST API — create an API token, register domain/repository assets, launch and poll pentest scans, list and triage vulnerabilities, export SARIF, download PDF/DOCX reports (Enterprise plan), start PR reviews, and set up schedules and webhooks. Use when the user wants Strix without local Docker/LLM infra, or wants scans tracked in a team dashboard, on a schedule, or in CI via API.
Expert technical advisor with deep reasoning for architecture decisions, code analysis, and engineering guidance. Masters complex tradeoffs, system design, security architecture, performance optimization, and engineering best practices. Use when making critical architecture decisions, after implementing significant work, when debugging complex issues, encountering unfamiliar patterns, facing security/performance concerns, or evaluating multi-system tradeoffs. Provides comprehensive analysis with clear recommendations and rationale.
Runs and authors behavioral tests for Robomotion flows using @robomotion/sdk/testing. Use when the user says "test the flow", "write tests for main.ts", "mock this service", "check branch coverage", or when a flow needs regression tests before a change. For pspec schema validation, use validating-flow instead.
LLM and AI testing patterns — mock responses, evaluation with DeepEval/RAGAS, structured output validation, and agentic test patterns (generator, healer, planner). Use when testing AI features, validating LLM outputs, or building evaluation pipelines.
Validates a compiled Robomotion flow against pspec schemas via `robomotion validate <flow-dir>`. Exits 0 on clean, 1 on error with node-by-node report on stderr; no stdout output (composes in shell pipelines). Use when the user says "validate this flow", "check the flow", "is this correct", or before running. Does NOT run the flow — for behavioral tests use testing-flow.
Alibaba Java Development Manual (Huangshan Edition): overview and routing entry point. Covers seven areas: programming conventions, exceptions and logs, unit testing, security conventions, MySQL databases, project structure, and design conventions. Use when writing, reviewing, or designing Java code; handling exceptions/logging; writing SQL or designing tables; writing unit tests; designing project architecture; or whenever Alibaba Java standards apply. Before writing or modifying Java or SQL code, first read “Specification Enforcement Strategy” in SKILL.md. P0 red lines (new code and modified existing code must comply; silently retaining a red-line violation is noncompliant): do not use factory methods such as Executors.newFixedThreadPool/newCachedThreadPool (use new ThreadPoolExecutor with explicit parameters); no bare new Thread; do not use SimpleDateFormat or java.util.Date for dates (always use java.time + DateTimeFormatter); do not concatenate SQL with ${}; update/delete must include where; resources must use try-with-resources; do not swallow exceptions with empty catch blocks; collections must not return null; always call remove() after using ThreadLocal. When modifying existing code, “leave everything else unchanged” does not apply to red lines: complete the original request first, then explicitly identify red-line issues in the output (citing the rule number) and include fix code — showing a red-line violation without mentioning it means the task fails. Naming and other style rules are mandatory only for newly written code; do not rename existing code or flood the output. Consult the relevant chapter in data/ as needed.
Alibaba Java Development Manual (Alibaba coding guidelines), used for code standard checks and guiding development. Invoke this skill when the user needs to check whether Java code complies with the Alibaba development guidelines.
Reviews Spec Kit code changes for consistency with applicable design documents, positive and negative test coverage, regression evidence for bug fixes, and consistent repository terminology. Use when reviewing a diff or pull request. Do not use for implementing changes or posting GitHub review actions.
Diagnose GitHub Actions and coverage checks for Comet PRs using the PR's current accurate head, failing job logs, local reproduction boundaries, and mergeability state. Use when a PR shows CI errors, Codecov issues, stale checks, or unexplained red jobs.
Use when something is too slow, uses too much memory or CPU, degrades under load, or times out — and before making any change intended to speed something up. Triggers include "this is slow", "optimize this", "high latency", "p99", "memory leak", "it's fine locally but not in production", "the query takes forever", "reduce bundle size", and any request to make code faster.
Publish the nurb model leaderboard from merged benchmark submissions. Sanity-checks every run landed since the last regeneration, writes or refreshes the editorial verdicts, regenerates the benchmarks repo's REPORT.md and this repo's site/benchmarks.html, and opens the publish PRs. Use when the user says "update the leaderboard", "publish the benchmarks", "regenerate the benchmark page", or after merging submission PRs.
Empirically validates a software metric before trusting or optimizing it — point it at any candidate metric (a command that takes a path and prints one number) plus a corpus, and it runs experiments that try to falsify each property a good metric must have. Checks determinism (same input, same number across runs and hash seeds), invariance to cosmetic edits (also an anti-gaming probe), monotonicity under construct-increasing edits, discrimination, robustness on edge inputs, near-linear tractability, and construct validity (convergent, discriminant vs LOC, predictive AUC, lift over a baseline). Trigger whenever someone proposes, reviews, tunes, or ships a metric, score, or index, asks "is this metric any good", suspects a score tracks LOC or jumps between runs, or builds a deterministic optimization target. It is the empirical companion to the deterministic-metric-design skill and is read-only.
This skill should be used when the user asks to "validate plugin structure", "review manifest files", "check frontmatter compliance", "verify tool invocation patterns", "explain plugin component types", or needs Claude Code plugin architectural guidance.
Analyze, recreate, align, and verify reference-video motion. Use when the user asks to recreate, copy, match, align, pixel-align, or compare a video; when a HyperFrames or Remotion remake is judged not aligned; when fixed reference playback and reusable motion components must be separated; or when delivery needs full-frame runtime, render, decode, boundary, timing, and archive evidence instead of sampled screenshots alone.
Audit interface copy — labels, buttons, errors, empty states, tooltips, notifications, form hints — against UX-writing standards. Produces a severity-rated issue list with concrete rewrites. Use when reviewing UI copy for clarity, tone, and consistency, or as a validation step on any generated screen.
Validates hook, skill, and agent counts are consistent across CLAUDE.md, hooks.json, manifests, and source directories. Use when counts may be stale after adding or removing components, before releases, or when CLAUDE.md Project Overview looks wrong.
Use when debugging or repairing existing features from rough agent-assisted coding reports, regressions, failed prior fixes, repeated "still broken" feedback, source-only debugging stalls, unobserved runtime state, tool or automation failures, environment-specific failures, runtime artifact mismatches, security boundary surprises, or fixes that feel wrong.
Vitest testing framework patterns for test setup, async testing, mocking with vi.*, snapshots, and test performance (formerly test-vitest). This skill should be used when writing or debugging Vitest tests. This skill does NOT cover TDD methodology (use test-tdd skill), API mocking with MSW (use test-msw skill), or Jest-specific APIs.
WordPress security code review and vulnerability detection. Use when reviewing WordPress PHP code for security issues, auditing themes/plugins for vulnerabilities, checking code before launch, analyzing AJAX/REST handlers for exploits, detecting XSS, SQL injection, CSRF, or authorization bypass, or when user mentions "security review", "vulnerability", "XSS", "SQL injection", "CSRF", "nonce", "sanitization", "escaping", "capability check", "privilege escalation", "file upload security", "insecure code", "auth bypass", or "security audit". Detects vulnerabilities in input handling, output escaping, authorization, nonces, database queries, file uploads, and dangerous functions.
Apply XP practices including pair programming, ensemble programming, continuous integration, and sustainable pace. Use when implementing agile development practices, improving team collaboration, or adopting technical excellence practices.
Use when a Java change needs independent Behavior-Driven Development guidance from trusted behavior facts through concrete examples and observable scenarios, with focused clarification when behavior is pending or ambiguous. This should trigger for requests such as Apply BDD; Facilitate behavior examples; Discover scenarios with Given When Then; Review these examples for shared domain language; Complete BDD discovery as a self-contained interaction. Part of Plinth Toolkit
Use when reviewing whether an OpenSpec change's execution goal, acceptance criteria, and implementation or verification tasks are aligned. This should trigger for requests such as Review this OpenSpec change with ATDD; Check acceptance criteria against tasks; Find acceptance criteria without task coverage; Detect tasks that diverge from the execution goal; Explain what is missing, vague, ambiguous, partial, absent, or divergent in this OpenSpec change. Part of Plinth Toolkit
Stress-test a code change for concrete correctness defects, unsafe assumptions, and failure modes. Use when the user explicitly asks for an adversarial review, a deep bug hunt, or to tear a change apart, or to check your own change before submitting it. Do not use for ordinary review, style feedback, or general improvement suggestions
Ascend C operator mssanitizer memory detection and analysis skill. Used to detect and analyze operator memory issues: illegal memory access, illegal free, memory leaks, UB address out-of-bounds, and to generate problem reports. Automatically identifies the operator project type (ops operator repositories use GE IR mode, custom operators use Python mode). Trigger keywords: mssanitizer, memory detection, memory leak, illegal access, illegal free, memory error.
Verify and classify Comet GitHub issues against the current repository contracts, source, Runtime, tests, and install behavior. Use when the user asks whether an issue is real, reproducible, a duplicate, already implemented, a configuration problem, or suitable for follow-up.
Review Comet community PRs read-only and evidence-first, including the latest diff, linked issues, review thread status, mergeability, and CI. Use when the user asks to review a PR, judge whether comments are still valid, or prepare concise merge-blocking comments.
Creates a ticket-driven handover test for a Playwright E2E test suite. Names the test with the ticket prefix, places it in the handover test directory, and follows the promotion lifecycle. Use when asked to write a handover test, ticket test, functional test, or test for a specific ticket number.
Creates a regression or smoke test spec file for a Playwright E2E test suite. Generates the spec file, test data JSON, and fixture updates. Handles complete test scaffolding including beforeAll cleanup, POM usage, and parallel-safe data. Use when asked to write a regression test, smoke test, or E2E test for a feature.
DDD DevOps integration — CI/CD pipeline with ArchUnit automated architecture validation, multi-module build optimization for DDD projects, containerized deployment with Docker/K8s for layered/hexagonal/clean architectures, database migration strategies for domain events, and monitoring domain health. Use when user asks about DevOps, CI/CD, DDD deployment, ArchUnit CI, or needs to automate DDD project builds.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.