Skills
97,501 packaged capabilities and playbooks for agents. Install any of them with one command.
Testing & quality
Address all valid review comments on a PR for the current branch in the streamlit/streamlit repo. Covers both inline review comments and general PR (issue) comments. Use when a PR has reviewer feedback to address, including code changes, style fixes, and documentation updates.
Assess whether structured data, query results, dashboards, or analytical evidence are trustworthy enough to use. Use when the task is to check data quality, reconcile conflicting sources or metric definitions, or decide whether evidence is safe to cite.
Use when authoring or amending a test plan / QA verification plan — what to test, at what level, to what done-criteria, and the cases to run. Guides the METHOD, not the outline: deriving every case from a feature-spec behavior/AC or api-spec operation/error (never inventing one); the functional levels the project warrants; RISK-WEIGHTED catalog sizing (BVA/equivalence/decision-table/state-transition/pairwise, not the cross-product); a non-functional taxonomy (perf/security/accessibility WCAG 2.2 AA/compat/i18n) each with a numeric target where warranted; metric-threshold-on-a-named-dataset cases for ML/probabilistic behavior; and amending as a versioned delta with impact+risk regression selection — to a bar where a tester executes it with no questions, every behavior traced. Composes with a template tool + deep-research; consumes handed-in upstreams (feature-spec/api-spec/PRD/NFRs), never a blank page. Specs the cases, not the scripts; not the runbook, not the behavior contract, not reviewing one.
Provides agent-ready AXe CLI usage guidance for iOS Simulator automation. Use when asked to "use AXe", "automate a simulator", "tap/swipe/type on simulator", "set a slider", "describe UI", "take a screenshot", "record video", "batch steps", or "interact with an iOS app". Covers all commands including touch, gestures, sliders, text input, keyboard, buttons, accessibility, screenshots, video, and batch workflows.
Drive a real browser through a UI flow, or run API and endpoint QA and report structured test results. Use when the user names a flow or an endpoint to test against a URL, when verifying filters, pagination, error handling, auth or counts on an API, or after a UI or backend change lands and needs verifying in the browser.
Trace bugs and manual fixes back to kits and prompts; fix at the source so the iteration loop can reproduce the fix autonomously. Six-step revision process plus the single-failure backpropagation protocol. Use when a manual hot-fix has been applied, when convergence stalls, or when the same class of bug keeps reappearing.
Creates comprehensive GitHub pull requests with automated quality validation and security scanning, then hands off to /github:review-pr for CI monitoring and reviewer-comment triage. This skill should be used when the user asks to "create a PR", "submit a pull request", or needs to merge completed work with full compliance checks.
Guidance for Testcontainers — running Docker containers in automated integration tests. Covers Java (@Testcontainers, @Container, PostgreSQL/Redis/Kafka/Elasticsearch), Python (testcontainers-python with pytest), container lifecycle management (singleton, reuse), CI/CD integration (Docker-in-Docker, Ryuk), Testcontainer best practices, and database migration testing. Use when the user asks about testcontainers, integration testing with Docker, database testing, Java testcontainers, Python testcontainers, or needs to test with real Docker services. 使用场景:testcontainers、集成测试、docker 测试、数据库测试、Java Testcontainers、Python Testcontainers。
Use when users need to diagnose I2C bring-up failures on Arduino or ESP32-class boards, including no devices found, wrong readings, address conflicts, scanner-detects-but-library-fails cases, pull-up problems, or board-family-specific bus quirks.
调试与验收 MaaFramework(MaaFW)应用(开发态、设备在线):节点识别失败、点击不落点(识别成功 ≠ 点击生效)、ROI 校准与调参、单节点验证、流程卡死、controller 连接、pipeline_override 生效验证、端到端验收(含 pipeline / custom / interface 改完、声明完成 / 交付 / 开 PR 前的真机跑通)。按配置 / 识别 / 动作 / 流程 / 验收五层分诊,产出定位结论与证据,修复交接 maafw-pipeline / maafw-interface / maafw-custom。Use when debugging or acceptance-testing a MaaFW app with a device attached — recognition failures, clicks that miss, ROI tuning, stuck flows, controller faults, pipeline_override checks, pre-delivery acceptance.
Use when running Playwright via terminal CLI — `npx playwright test` (test runner), `codegen` (interactive recording), `screenshot` / `pdf` (one-off captures), and CI sharding. NOT for agent-driven real-time browser control (use `claude-in-chrome` MCP tools for that).
Used to review an existing development plan, technical approach or readiness to start; not for writing a plan from scratch, implementing features, or reviewing only a code diff. Multiple agents verify facts, approach, requirement mapping, dependencies and delivery readiness, and by default write a report to disk.
Comprehensively reviews Python libraries for quality across project structure, packaging, code quality, testing, security, documentation, API design, and CI/CD. Provides actionable feedback and improvement recommendations. Use when evaluating library health, preparing for major releases, or auditing dependencies.
Rewrite existing Python, TypeScript/JavaScript, or Go code for strict static typing, boundary validation, and maintainable idioms while preserving behavior. Use when the user asks to harden code, remove unsafe escape hatches, add validation, or align with mypy, Pyright, tsc, go vet, or Staticcheck. Coordinates baseline mapping, strategy, approved implementation, and review through co-located subagents and just-in-time language references.
Audit Apex code for CRUD/FLS violations, sharing rule compliance, SOQL injection risks, and PII exposure. Scans entire codebases for security issues that cause AppExchange review failures. Use when asked about security review, AppExchange review readiness, CRUD/FLS audit, vulnerability scanning, or code security. Activate on mentions of "security audit", "AppExchange", "CRUD/FLS", "stripInaccessible", "with sharing", or "security review".
Enforces Built for Shopify (BFS) quality standards during Shopify app development. Use when building, reviewing, or auditing Shopify apps for BFS compliance, or when the user mentions Built for Shopify, BFS, app quality, or app store requirements.
Testing expert with comprehensive knowledge of test structure, mocking strategies, async testing, coverage analysis, and cross-framework debugging. Use PROACTIVELY for test reliability, flaky test debugging, framework migration, and testing architecture decisions. Covers Jest, Vitest, Playwright, and Testing Library.
Use whenever writing, editing, refactoring, or reviewing TypeScript or TSX code. This skill defines how TypeScript should be modeled, how boundaries and shared helpers should be handled, how intent should be expressed without code comments, and how to keep code clear, DRY, and free of defensive AI slop. For review workflows, read references/review-and-fix-changes.md.
Visual inspection and code review for compliance with the Web Interface Guidelines. Triggers on "review my UI", "check accessibility", "audit design", "review UX", "fix the layout", "find design problems". Supports static code analysis and visual inspection in the browser with automatic fixes.
Patterns and techniques for evaluating and improving AI agent outputs. Use this skill when implementing self-critique and reflection loops; building evaluator-optimizer pipelines for quality-critical generation; creating test-driven code refinement workflows; designing rubric-based or LLM-as-judge evaluation systems; adding iterative improvement to agent outputs (code, reports, analysis); or measuring and improving agent response quality.
Autonomously optimize any Claude Code skill by running it repeatedly, scoring outputs against binary evals, mutating the prompt, and keeping improvements. Based on Karpathy's autoresearch methodology. Use when: optimize this skill, improve this skill, run autoresearch on, make this skill better, self-improve skill, benchmark skill, eval my skill, run evals on. Outputs: an improved SKILL.md, a results log, and a changelog of every mutation tried.
Use this skill to validate findings during a code review. For each finding, run the rejection criteria and verification checks. If a finding fails any check, drop it. In PR mode it also holds the once-per-review stacked-PR gate that decides whether completeness findings apply to the pull request at all.
Monitors awesome-copilot releases for drift against the amplihack integration. Checks latest commits on github/awesome-copilot via the GitHub API and reports whether the local integration is current or has drifted behind upstream changes. Use when auditing integration freshness or before updating awesome-copilot features.
Validation-first design for Cavekit — every kit requirement must be automatically verifiable. Six-gate validation pipeline, phase gates, merge protocol, completion signals, acceptance criteria patterns. Use when designing acceptance criteria, wiring CI gates, or debugging why an agent is producing output that nobody can verify.
Detects framework-specific anti-patterns, convention violations, and idiom misuse across PHP/Laravel, React/Next.js, and Python/Django/FastAPI codebases. Loads framework-specific reference guides and checks against framework conventions. Generates severity-scored findings with copy-pasteable fix prompts. Trigger phrases: "framework review", "framework check", "laravel best practices", "react best practices", "framework audit", "framework-specific review".
Audits code for SOLID principle violations — Single Responsibility, Open/Closed, Liskov Substitution, Interface Segregation, and Dependency Inversion. Identifies classes and methods that violate these principles and generates fix prompts. Trigger phrases: "SOLID check", "solid review", "SRP violation", "dependency inversion".
A collection of Java development manual conventions, based on the Alibaba Java Development Manual (Songshan edition). Covers 7 dimensions: programming conventions, exception logging, unit testing, security conventions, MySQL databases, engineering structure, and design conventions. Use this skill when users need to: (1) write or review Java code (2) check naming/code conventions (3) handle exceptions and logging (4) write unit tests (5) do secure coding (6) design databases (7) design engineering architecture. Trigger words: Java conventions, Alibaba conventions, code conventions, development manual, programming conventions, exception handling, unit testing, security, MySQL, engineering structure, design patterns.
Двусторонняя сверка кода и графа — уборочный такт: всюду ли код соответствует графу, а граф — коду; конец каждой сущностной задачи. Триггеры: reconcile, «сверь код с графом», «приведи граф в порядок», «протки свою область», «отдай долги графа», does the graph match the code, tidy the graph. Также: задача, записанная крией; феномен-ярлык состояния; комментарий-портянка, пересказывающая граф. Distinct from weaving (ремонт графа изнутри), integrity (claim-аудит), reality-audit (поведенческие заявки). Композирует entry, writing, weaving. Нужны тулы iskron_*.
Adversarial verification of AI-generated legal content with systematic fact-checking, source validation, and quality control. Use when a user asks to verify, fact-check, red-team, validate sources, or quality-control a legal document, briefing, compliance summary, or regulatory analysis before it is distributed to clients, stakeholders, or published. Trigger phrases include "verify", "fact-check", "red team", "red-flag", "check accuracy", "validate sources", "quality control", "is this correct", and "review for errors". Produces a structured verification report with severity-categorized errors, verified sources, unsupported claim list, missing disclaimers, and an explicit distribution-readiness assessment.
Reviews Claude configuration files for security, structure, and prompt engineering quality. Use when reviewing changes to CLAUDE.md, agents, prompts, commands, hooks, or settings. Routes each file type to a targeted review skill and returns classified findings. Flags settings.local.json appearing in a changeset, hardcoded secrets, malformed YAML, insecure agent tool access, and unsafe hook commands. Does not review SKILL.md files — plugin-dev:skill-reviewer owns those.
Use when you have a security finding (from code audit or pentest) and need to fix it correctly with secure-coding patterns, then verify the fix actually closes it. Covers fixes for injection, access control, XSS, auth, secrets, and config across the stack.
Generate and review Apex code for Salesforce with governor limit awareness, bulkification patterns, and CRUD/FLS compliance. Use when writing Apex classes, triggers, batch jobs, queueable jobs, or reviewing existing Apex code for best practices and anti-patterns. Activate on .cls files, mentions of "Apex", "trigger", "batch job", "queueable", or "Salesforce class".
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.
