Skills
97,725 packaged capabilities and playbooks for agents. Install any of them with one command.
All
Maintain the .qa/ knowledge base of cross-session QA knowledge (quirks, flaky verdicts, defect patterns, contract changes); read before test tasks. Not for: pipeline state, case files (test-case-writing). 维护被测项目 .qa/ 跨会话知识库（环境怪癖、flaky、缺陷模式、契约变更）读写治理；任务前先读取。不用于：流水线状态、用例文件读写（test-case-writing）。
QA web testing skill using PinchTab browser automation for visual regression testing, responsive breakpoint validation, and CSS layout debugging. Use this skill whenever the user asks to "test a page", "check breakpoints", "verify responsive layout", "QA this page", "test CSS at different viewports", "check for layout bugs", "verify the fix", or wants to visually inspect a web page at specific viewport widths. Also triggers when the user provides a URL and asks to take screenshots, compare layouts, or inspect element dimensions. Works with any PinchTab-connected browser session on localhost or staging environments.
Define a RACI matrix for a cross-functional project or process. Use when asked to build a RACI, create a responsibility matrix, clarify ownership across teams, or document decision rights. Produces a complete RACI matrix with role definitions, decision mapping, and a process for resolving conflicts.
Migrate shadcn components and custom Radix UI primitives to Base UI with a manual, low-risk workflow. Use when users ask to move from Radix UI to Base UI, replace asChild patterns, fix migration TypeScript errors, update renamed props/types, or adapt dropdown/popover/dialog positioning to Base UI positioner patterns.
Guides use of RDKit (Python) for reading and writing SMILES, MOL/SDF, and InChI, computing descriptors (MW, LogP, TPSA), generating Morgan/MACCS/atom-pair fingerprints, running SMARTS substructure searches, applying reaction SMARTS, and building 2D/3D coordinates with ETKDG. Use when parsing or sanitizing molecules that fail default sanitization, calculating Tanimoto similarity or clustering compounds, filtering libraries by substructure, embedding and optimizing conformers, or computing Murcko scaffolds and molecule hashes. Use when fine-grained control over sanitization or algorithms is needed. For simpler standard workflows, use datamol instead, which wraps RDKit.
React 18+ library for building user interfaces. Covers components, hooks, state management, and rendering patterns. USE WHEN: user mentions "React component", "useState", "useEffect", "hooks", asks about "building UI", "component lifecycle", "React rendering", "JSX" DO NOT USE FOR: React 19 features - use `react-19` instead, React Router - use `react-router` instead, performance optimization - use `react-performance` instead
React performance optimization techniques and best practices. Covers memoization, virtualization, code splitting, profiling, React DevTools, bundle optimization, and avoiding common performance pitfalls. USE WHEN: user mentions "React performance", "slow React app", "memoization", "virtualization", "code splitting", "lazy loading", "bundle size", asks about "optimizing React", "React DevTools Profiler", "preventing re-renders" DO NOT USE FOR: React 19 Compiler - use `react-19` skill instead, basic React concepts - use `react` skill instead, testing performance - use `react-testing` skill instead
Query the production Supabase Postgres read-only via psql using the SELECT-only agents_readonly role. Use when debugging prod issues, investigating a user report, checking real usage/billing/retention numbers, or verifying data actually landed in prod. Usage/PMF numbers default to customer-only scope (David & team excluded, ADR 0175) and every answer must state which scope it used. Differentiator: this is LIVE prod data, read-only; for tests use the local Docker harness (npm run test:db) instead.
Remote-control Rebelle (Escape Motions' natural-media painting app) and Rebelle Motion IO with JSON events: paint real watercolour, oil, ink and pencil strokes programmatically, drive a live Rebelle Pro session over its WebSocket server, or batch-render painted animation frames and turn them into video. Use whenever the user wants to paint, sketch or generate artwork in Rebelle, script or automate Rebelle, produce a watercolour/ink/oil rendering of something, animate a painting frame by frame, render a .reb artwork, or says "Rebelle", "Motion IO", "paint this in watercolour", "make a painted animation" — even if they don't mention scripting. Also covers Hungarian phrasings like "fesd meg Rebelle-ben", "akvarell kép", "festett animáció", "vezéreld a Rebelle-t". Not for photo editing or vector work (use Affinity) or for keyframed motion graphics (use Cavalry).
Use when receiving code review feedback, before implementing suggestions, especially if feedback seems unclear or technically questionable - requires technical rigor and verification, not performative agreement or blind implementation
Use when properties need synchronized configuration. Use when adding new properties requires updates elsewhere. Use when implementing optimization checks. Use when building property validators. Use when maintaining parallel data structures.
This skill MUST be used to scan any contract, terms, or legal document for clauses unfavorable to the user, translating each trap into plain language. Applies to all kinds of contract review scenarios: general commercial contracts, apartment leases, gym/tutoring/subscription membership contracts, job offers/employment contracts, app or website terms of service (ToS), privacy policies, insurance contracts, loan contracts, warranty terms, and more. Trigger keywords: look over my contract, review a contract, contract red flags, red-flag clauses, check a contract, lease, membership contract, cancellation terms, employment contract, non-compete clause, terms of service, ToS, privacy policy, auto-renewal, hidden fees, penalty, liability waiver, unfair terms, contract traps, loan contract, insurance contract. It MUST also trigger proactively when: the user uploads or pastes text that looks like a contract or terms and asks "is there anything wrong with this", "should I sign it", "what should I watch out for", "did the other side sneak anything in", or wants to know whether a clause is "normal". Default output is Traditional Chinese; English contracts can also be read and analyzed directly.
Researches public Reddit posts, comments, communities, user history, and trends through the Crawlora API. It also supports explicitly requested buying-intent lead discovery that scores public posts. Use for community research, sentiment, trends, or a clearly requested lead search; do not infer sensitive traits or target people on that basis.
Refactor PHP/Laravel code to improve maintainability, readability, and adherence to best practices. This skill transforms code using modern PHP 8.3+/8.4+ features like property hooks and typed constants, Laravel 11+ patterns including Actions and simplified structure, and SOLID principles. It addresses fat controllers, code duplication, N+1 queries, and missing type declarations. Apply when you notice business logic in controllers or legacy PHP patterns.
Validate systems and processes against GDPR/CCPA privacy regulations, privacy-by-design principles, ADA/WCAG accessibility standards, data processing agreements (DPAs), and provide compliance checklists with regulatory change monitoring guidance.
Test an oh-my-opencode-slim release candidate or bugfix before publishing. Use when validating a packed plugin artifact, release branch, crash fix, OpenCode runtime compatibility, or model-specific smoke test such as OpenCode 1.17.11 message transform regressions.
Coordinate local, Git remote, and SSH/HPC/RunAI research projects. Use for server state, sync safety, job submission, interactive sessions, logs, artifact lookup, context recovery, raw SSH commands, remote shell one-liners, SSH quoting issues, remote-cmd, remote-bash, or avoiding local shell expansion of remote variables.
Use Responder for LLMNR/NBT-NS/MDNS poisoning and NTLMv2 hash capture. Use in a Windows domain network when passive credential capture or a man-in-the-middle attack is needed. Responder listens for name-resolution broadcasts (LLMNR/NBT-NS/MDNS) on the network and forges responses to induce targets to send NTLMv2 authentication hashes. Captured hashes can be cracked offline with hashcat or relayed to other services with ntlmrelayx. Use this skill for LLMNR poisoning, NBT-NS poisoning, WPAD proxying, NTLMv2 capture, or man-in-the-middle attacks.
Derive, review, and debug responsive web layout math for fluid widths, media query ranges, viewport units, percentages, and CSS clamp() formulas. Use when building responsive layouts, converting fixed designs to fluid CSS, calculating breakpoints, choosing vw/svw/lvw/dvw units, or deciding whether CSS math or JavaScript measurement should own a layout behavior.
Use when diagnosing why a published video underperformed — reading a YouTube retention graph, comparing a weak video against a winner, or mapping audience drop-off points to script beats. For writing the next script, use storytelling-hooks or long-form-youtube.
Multi-agent code review without any edits or commits — requested rounds of parallel reviewers, synthesis, default-on reproduction of uncertain material findings, and a final report. Use when the user wants a code review of a diff, branch, path, or PR but does NOT want any fixes applied automatically (no edits, no commits, no staging). Activates the `review-anvil` engine in read-only mode.
Review the changes since a fixed point (commit, branch, tag, or merge-base) along two axes — Standards (does the code follow this repo's documented coding standards?) and Spec (does the code match what the originating issue/PRD asked for?). Runs both reviews in parallel sub-agents and reports them side by side. Use when the user wants to review a branch, a PR, work-in-progress changes, or asks to "review since X".
Review diffs, pull requests, commits, patches, or source files for correctness, baseline security, performance, maintainability, tests, and integration risk. Use for ordinary read-only review, edge-case audits, PR preflight, and reviewer simulation; use auditing-code-security when security is the primary objective, and hardening-code-paths to fix confirmed failure modes.
Use when judging a finished market and competitive prior-art artifact before it is accepted — a market vocabulary map, a per-angle search output, an extract record, or the competitor register and report. An acceptance gate, not authoring. Judges a single-sourced bar: a recorded zero is distinguishable from an unreachable source and from one excluded on its terms; queries are reproducible as run; ratings carry their denominators; vendor claims are attributed rather than asserted; a tier is argued from capability overlap rather than fame; point-in-time facts are dated; a dead product is recorded as dead with its date; a register row says what its record says; white space is phrased as a search result. Approves a thin-but-honest result for a thin market and revises only on a named, unrecorded gap. Emits exactly VERDICT: approve|revise plus actionable findings. Keywords: competitive analysis review, market research review, competitor set critique.
Hardening a skill so it resists rationalization under pressure: run combined-pressure scenarios on a subagent without the skill (RED), capture excuses verbatim, write/edit the skill (GREEN), then plug loopholes (REFACTOR) until compliance holds. Use when deploying or editing a discipline-enforcing skill that an agent could rationalize away. Skip for pure reference skills with no rules to violate.
Use when building, fixing, testing, or reviewing any Roblox game or Roblox Studio work - Roblox, Roblox Studio, Luau, obby, tycoon, simulator, Roblox UI, Roblox combat, DataStore, RemoteEvent, Roblox multiplayer, Studio MCP. Router skill; load the matching reference for the task.
Use for Roblox OAuth 2.0 work: registering an OAuth app, choosing confidential versus public client flows, implementing authorization code flow with PKCE, safely handling authorization callbacks and token refresh, selecting minimal scopes for Open Cloud access, and troubleshooting OAuth-specific auth failures
New to MCP?
From what the protocol is to installing your first server, these answers cover most first questions.
An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.