Skills
97,501 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Scans code for error handling and resilience issues — swallowed exceptions, missing try/catch on external calls, unhandled promise rejections, missing transactions, validation gaps, retry/timeout omissions, and logging blind spots. Generates severity-scored findings with copy-pasteable fix prompts. Trigger phrases: "error handling check", "exception audit", "resilience check", "try/catch review", "error handling audit".
Compare two folders function by function with jscpd --compare, in the same language or across languages, and explain the result. Use when asked how two codebases relate, which functions one implementation has and the other lacks, how far a port has come, whether the iOS and Android versions of an app match, or which function in one folder corresponds to a function in the other.
Agent simulation and GEO simulation prompt generation for AI visibility auditing. Use when the user wants to create simulation tasks via the TPC CLI, generate unbranded GEO prompts to test whether AI recommends a product, or run agent simulations.
Review native HarmonyOS ArkTS and ArkUI repositories for concrete, source-evidenced defects in correctness, security, lifecycle and resource ownership, state management, concurrency, persistence, permissions, compatibility, and performance. Use for code review, bug hunting, release readiness, migration audits, or review of a diff, PR, module, or whole project. Report only findings demonstrated by reachable code and project configuration, with precise file and line references; use current official Huawei documentation for version-sensitive claims.
Cross-LLM peer review of an implemented change (the diff) via `compozy exec`: an independent reviewer runtime pressure-tests the diff and writes one scoped Markdown findings artifact for user-directed remediation. Project-agnostic — any repo or language; auto-discovers project rule files and the verify command. Use after an implementation pass (feature, bug fix, refactor) when the user explicitly asks for an external review of the diff before commit or PR. Do not use for spec/TechSpec review — use spec-peer-review.
Use when writing, reviewing, executing, or updating manual test cases or a test plan; when asked 'how should I test this'; when restructuring an existing test suite or its layout; or after implementing a feature that changes system behavior — per CLAUDE.md, updating the manual test plan is mandatory. Covers API/backend, frontend, pipeline/workflow, AI/LLM, GUI, and infrastructure testing.
Closed-loop requirement change for existing features (gated seven steps). Hard trigger condition: the feature to change is already implemented and running. Use when the user says "change requirements", "requirement change", "adjust interaction", "change feature", "refactor flow", or when the change easily spreads across multiple files, touches auth/storage/config/permissions, or needs reliable verification + a rollback plan. Flow: lock scope and write a change brief → confirm current behavior from the code (not from memory or assumptions) → impact and risk assessment + rollback plan → propose a new design and wait for user approval (**never touch the code without approval**) → small, local diff → run the fixed regression checklist → update docs and the decision log. Outputs: change brief + code diff + regression record + decision log. Not applicable to: building an entirely new feature from scratch (go issue-pool → page-solution-design (when there is a UI) → backend-logic-design (when rules need discussion) → prd-test-writer), changing only visual styles without touching any logic (adjust directly on the existing UI), new ideas not yet decided (use issue-pool first to add to the pool), writing PRDs/test cases (use prd-test-writer), committing, pushing, and releasing (use git-push). Note: the seven-step flow of this skill applies to any project, but scripts/impact_scan.sh and references/chrome-extension-regression-example.md are Chrome extension examples; for general regression use references/regression-checklist.md and choose checks according to the actual project.
Read-only review of Plans, implementation, continuation rounds, or other scoped artifacts against intended behavior, docs, acceptance criteria, tests, and risk. Use for balanced, adversarial, multi-aspect, compliance, architecture, test, library, performance, or security review.
Benchmark any agent skill to measure whether it actually improves performance. Use when the user wants to evaluate, test, or compare a skill against baseline, or when they mention "benchmark", "eval", "skill performance", or "does this skill help". Runs isolated eval sessions with and without the skill, grades outputs via layered grading (deterministic checks + LLM-as-judge), analyzes behavioral signals, and generates a comparison report with a USE / DON'T USE verdict.
Multi-agent management workflow — task delegation, progress monitoring, quality verification with regression testing, feedback delivery, and cross-review orchestration. Use this skill when coordinating multiple agents on a shared task, monitoring delegated work, ensuring quality across agent outputs, or implementing a multi-phase plan (3+ phases or 10+ file changes).
Test environment provisioning, infrastructure as code for testing, Docker/Kubernetes for test environments, service virtualization, and cost optimization. Use when managing test infrastructure, ensuring environment parity, or optimizing testing costs.
Test Android apps on a rooted device. Decompile APKs, intercept traffic, parse UI, test for IDORs, bypass SSL pinning, hook methods with Frida, inspect exported components, read local storage, and find sensitive data. Use when asked to "test this app", "find bugs", "pentest", "reverse engineer", "decompile", "intercept requests", "check for IDORs", "bypass cert pinning", "hook this method", or "check deeplinks".
Generates a rich, visual HTML one-pager that lets a busy reviewer understand a body of changes and either approve a proposed PR stack or merge a finished one — without reading the diff themselves. Auto-detects whether the run is DRAFT (working-tree changes plus a proposed stack, pre-approval) or FINAL (a real PR stack with review complete, pre-merge). Leads with a TL;DR, surfaces the PR stack near the top, flags high-stakes changes (endpoints, auth, schema), then walks the reviewer through the important code as a numbered Code Tour with inline diff snippets. Use whenever someone wants to eyeball a change before approving or merging — "review the changes", "show me what changed", "summarize the diff / the branch / the stack", "what am I about to approve", "walk me through what shipped", "explain the final code", or any shipping-workflow approval/merge gate — even if they don't say the words "brief" or "HTML".
Go concurrency programming expert, based on the book "Go Concurrency in Practice". Analyzes concurrency performance, detects synchronization bugs, optimizes lock strategies, and provides concurrency design advice. Covers all sync primitives such as Mutex, RWMutex, WaitGroup, Cond, Once, Pool, sync.Map, atomic, channel, context, and synctest; official extension libraries such as semaphores, SingleFlight, ErrGroup, and rate limiting; third-party libraries such as CyclicBarrier, circuit breakers, and WorkerPool; distributed synchronization primitives (etcd); and 13+ concurrency patterns including half-async/half-sync and Reactor. Trigger words: Go concurrency, sync, Mutex, WaitGroup, Cond, Once, Pool, RWMutex, channel, goroutine, deadlock, data race, atomic operations, sync.Map, concurrency optimization, lock optimization, Go concurrency, data race, deadlock, concurrency patterns, concurrency design, semaphore, SingleFlight, ErrGroup, rate limiting, token bucket, leaky bucket, circuit breaker, etcd distributed lock, distributed queue, leader election, STM.
Session experience becomes something fixable — the agent's word about the skills and tools it worked with. Fires on its own for non-trivial experience: a rule missed a case, a description lied about the surface, a fix worked for the wrong reason, a step had no marker. Triggers: "фидбэк", "дай обратную связь", feedback, "запиши, что не сработало", "скилл подвёл". Places the case in the work graph on the tool node, addressed to its steward, after checking whether the same thing has already been said. Composes writing. Requires iskron_* tools.
Control native macOS apps that have no API and leave reproducible evidence: capture a specific window (even when occluded in the background), click and type, probe whether an app can be automated, control Chromium-embedded apps via CDP with zero focus, run product testing and multi-model batch runs. For browser work use huashu-chrome; for browsing old screenshots use disk-keeper.
Helps users report issues with GTM skills — incorrect advice, broken activation, missing context, or unexpected behavior. Guides through gathering the right details (skill name, prompt used, actual vs expected output, context files present) and generates a properly formatted GitHub issue. Use when users say: 'this skill gave wrong advice', 'report a bug', 'file an issue', 'skill isn't working', 'wrong output', 'skill didn't activate', 'bad recommendation', 'incorrect behavior', or 'something is broken'.
Computational provenance audit verifying every number, table, and figure in a manuscript derives from code, not manual entry. Triggers on: "check provenance", "verify reproducibility", "audit my pipeline", "are my numbers from code", "provenance audit". Companion to manuscript-review (prose audit).
Turn on Partial Prefetching in a Next.js app and work through the insights it surfaces. Use when the user wants to enable or adopt Partial Prefetching, flip the `partialPrefetching` flag, opt routes in with `export const prefetch = 'partial'`, audit `Link prefetch={true}` behavior, preserve existing prefetched UI with `instant()` tests, or resolve the instant-link-prefetch-partial and instant-shell-url-data insights.
Use when the user wants to operate or validate web pages with the locally logged-in Chrome (including testing their own site, E2E, screenshots), read logged-in admin backends, scrape data that has no API, fill out forms, or troubleshoot OpenCLI doctor, session, or adapter failures, or explicitly mentions opencli, browser automation, or tab stealing. For public text, use HTTP first; route topic research to agent-reach; route SEO and keyword decisions to rankup; route backlink selection, submission, and Semrush/Similarweb report interpretation to backlink; this Skill only handles browser driving, sessions, and data retrieval mechanisms.
Promotes a handover test to the regression or smoke test suite. Renames the file to remove the ticket prefix, moves it to the target directory, and updates the test.describe block. Use when asked to promote, graduate, or move a handover test to regression or smoke.
Execute a comprehensive React project health audit. Analyzes the tech stack, architecture, state management, testing, code quality, performance, CI/CD, and documentation. Produces a shareable Markdown report with section scores and a weighted overall score. Use when the user asks to audit a React project, run a health check, evaluate frontend quality, or assess technical debt. Triggers on: 'react audit', 'health audit', 'react health', 'frontend audit', 'next.js audit', 'vite audit', 'project quality check'.
Resolves GitHub issues using isolated worktrees and test-driven development, then delegates PR creation to /github:create-pr so the quality gate and the /github:review-pr loop always run. This skill should be used when the user asks to "resolve an issue", "fix issue #123", or needs to implement a solution for a specific GitHub ticket using a structured workflow.
Android-specific code review checklist and MVVM/Compose pattern validation for Bitwarden Android — use this for any review task, even if the user doesn't explicitly ask for a "checklist". Detects change type automatically and loads the right review strategy (feature additions, bug fixes, UI refinements, refactoring, dependency updates, infrastructure). Triggered by "review PR", "review changes", "review this code", "check this code", "Android review", code review requests on Kotlin/ViewModel/Composable/Repository/Gradle files, or any time someone asks to look at a diff, PR, or code changes in bitwarden/android.
Scans a Power Pages site project for security issues in source code and dependencies. Runs static analysis and dependency scanning, then surfaces findings by category (code patterns, vulnerable packages, secrets, license issues). Use when the user wants to review code for security problems, check for vulnerable packages, find hard-coded secrets, run a code scan, or asks "is my code safe?", "check my dependencies", "find security issues in my source" — even if they say "audit my code" without mentioning specific tools.
Security-first visual testing combining URL validation, PII detection, and visual regression with parallel viewport support. Use when testing web applications that handle sensitive data, need visual regression coverage, or require WCAG accessibility compliance.
Audit where one fact lives in many places and report the canonical source of truth plus a consolidation plan — read-only. Use when the same fact, spec, decision, config, status, or definition appears in multiple artifacts or platforms and may have drifted; when refactoring a legacy codebase, building or grading the severity of a knowledge base, or scaffolding a new project; before trusting a value stated in more than one place; or when asked to find duplication, check consistency, or locate the source of truth. Never modifies anything.
Test-driven development with a red-green-refactor loop. Use when the user wants to build features or fix bugs with TDD, mentions "red-green-refactor", wants integration tests, or asks for test-first development. For general testing patterns (coverage, mocking, organization) without a test-first approach, use testing-patterns instead.
Comprehensive testing patterns and strategies for JavaScript/TypeScript projects. Covers unit, integration, and E2E testing, mocking strategies, test organization, and common anti-patterns. Use when the user wants to write tests, improve test coverage, establish a testing strategy, or fix flaky tests. For the strict test-first red-green-refactor approach, use tdd instead.
Reviews URLSession networking code for iOS/macOS. Covers async/await patterns, request building, error handling, caching, and background sessions. Use when reviewing code that uses URLSession, URLRequest, URLCache, or URLError, or any iOS networking path.
Evaluate every dependency a branch pulls in — client or server, any language — against the WARM check (Worth it, Alive, Right-sized, Maintained securely). Diffs the branch against a base, finds newly added or upgraded direct dependencies across all manifests, and scores each one. Use when the user asks to "WARM check" a branch, vet new dependencies, or review what a PR adds to the dependency tree.
Testing workflow skill for finding high-value test candidates, writing focused tests, generating realistic workloads, reviewing test value, and diagnosing test-suite health. Use for prompts about what to test next, adding or improving tests, reviewing whether a test is worth keeping, low-signal or flaky tests, workload scenarios, or test-suite trust. Do not use for general QA discussion unless the user wants a concrete testing workflow or artifact.
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.