Claude Skills
The open format is called Agent Skills and works in Claude Code, Codex, Cursor and other agents — most people know it as Claude Skills.
Every Agent Skill we could find on GitHub, deduplicated by content. 86 696 files from 2 113 authors, of which 68 413 are unique — the rest is the same skill repackaged into someone else's repository. For each one: what it weighs in tokens, whether it ships runnable scripts, and which MCP servers it needs.
NestJS backend build agent for REST/GraphQL APIs, microservices, and enterprise backends. Extends build-agent with NestJS architectural patterns, dependency injection, testing strategies, and security best practices. Use when building NestJS applications.
Python build agent for scripts, backends, data pipelines, and ML projects. Extends build-agent with Python conventions. Use when building Python applications, APIs, data processing, or automation.
Validates requirements for ambiguity and physical hardware constraints. Use this after requirements are generated but before code/hardware synthesis begins.
Defines metrics, events, dashboards, alerts, and SLOs to monitor production systems. Use after Gate 2 or with release-manager to ensure production observability.
Manages R&D pipeline, technology scouting, prototyping, and IP tracking with traceable innovation-to-product handoff. Use when evaluating technologies, managing prototypes, or transferring validated innovations to the engineering pipeline.
Manages post-Gate-2 release activities with Agile V rigor. Rollout plans, rollback procedures, sign-off checklists. Use after Human Gate 2 for production deployment.
The Verification Agent — challenges Build Agent artifacts via independent verification. Executes tests against artifacts. Use to audit code, schematics, or firmware against requirements.
Establishes a tailored safety lifecycle from hazards through operational feedback and assurance evidence. Use when a system can create unacceptable harm.
Converts high-level product intent into traceable PRDs and User Stories. Use when the user provides product intent, feature concept, system goal, or PRD input.
Generates schematics, netlists, or HDL from approved, baselined requirements for hardware/PCB projects. Validates physical constraints. Use when building PCB, HDL, or hardware designs after Gate 1 approval and baseline capture.
Create traceability from Agile V requirements to Understand Anything graph nodes, changed files, and tests, ensuring full evidence chain coverage.
Create evidence explaining the actual implementation diff and its relationship to the predicted impact, closing the loop between pre-change prediction and post-change reality.
Identify the likely impact of a proposed change before implementation by mapping it to graph nodes, affected files, functions, APIs, and tests.
Select and prioritize regression tests based on the impact map and graph dependency relationships, flagging coverage gaps before the Red Team step.
Consume Understand Anything outputs and create a concise, reviewable system overview that gives agents sufficient context before modifying code (Gate 0).
STRIDE threat modeling and privacy impact assessment to generate security/privacy requirements. Use before requirement-architect to shift security left.
Designs the verification suite from approved, baselined requirements only — never from code. Prevents success bias. Use when building test cases in parallel with the Build Agent after Gate 1 approval and baseline capture.
Converts UX/design intent into testable design specifications that feed requirements. Use when defining user flows, accessibility, or design constraints.
Plans and assesses intended-use validation with representative users and operational environments. Use after verification to decide whether the right system was built for its defined intended use.
Converts vision and market opportunity into traceable business models, product portfolios, and strategic plans. Use when defining business strategy, product direction, competitive positioning, or fundraising materials.
Author and optionally direct-launch one durable loop-graph run for long-horizon agent work. Use when the user invokes /octopus, asks to design or start a multi-round run, needs durable state, gated milestones, owner decision boundaries, cross-host continuity, or independent audit. Detect Codex or Claude Code from context instead of asking. For a self-contained task, recommend the host's ordinary task or goal directly. Do not execute or resume existing runtime node files from this authoring skill.
Author and optionally direct-launch one durable loop-graph run as executor, ledger, directives, and supervisor artifacts under a dated `.longgraph` directory, then present copy-ready host prompts. Use for multi-round work with gated milestones, independent audit, cross-host execution, or durable state. Detect Codex or Claude Code from context and create both same-host runtime nodes when the owner chooses direct launch. Existing runtime nodes are self-contained.
>- Test AI/LLM features that ship in your product. Covers prompt regression testing, response quality evaluation, tool-call validation, hallucination and RAG grounding checks, nondeterministic-output strategies, red-team/safety scans, eval frameworks, and agent-as-target injection (indirect injection via tool output / RAG / scan reports, self-propagating payloads, data exfiltration via an feature," "prompt regression test," "eval framework," "hallucination test," "RAG grounding," "nondeterministic output," "AI feature testing," "red-team our chatbot," "indirect prompt injection," "agent reading untrusted tool output," "production AI quality." rollout of an AI feature — use testing-in-production. security-testing, risk-based-testing, test-data-management.
>- Test REST and GraphQL APIs with Playwright APIRequestContext, Supertest, or standalone HTTP clients. Covers schema validation with Zod 4/AJV, auth flow testing, CRUD lifecycle "API test," "endpoint test," "REST test," "GraphQL test," "schema validation," "Postman replacement."
>- Test for WCAG 2.2 AA compliance with axe-core + Playwright, keyboard navigation audits, screen reader testing, ARIA pattern validation, and legal compliance mapping (ADA, EAA, Section 508). Automated tools catch 30-40% of issues — this skill covers automated and "keyboard navigation," "ARIA," "ADA compliance." regression — use visual-testing.
>- Goal-driven E2E testing where a browser agent (Playwright MCP / computer-use) reads a natural-language goal and explores the app via the accessibility tree to assert outcomes — no pre-written script. Covers when intent-driven beats scripted, making agent runs deterministic (pinned model, temperature 0, seeded data, bounded steps, explicit success assertion, snapshot-not-pixel), cost/latency control, the accessibility-tree-first interaction model, CI gating, and graduating a stable run into a scripted Playwright test. "natural-language E2E," "browser agent smoke test," "Playwright MCP test." playwright-automation. Testing your product's OWN LLM features — that is ai-system-testing.
>- Review EXISTING test code for quality, smells, and testability issues. Detects test smells across six dimensions — readability, reliability, diagnostic value, design, AI-generated, and coverage — analyzes testability of application code, and backs the qualitative smells with mutation testing. `ai-system-testing`.
>- Use AI to write NEW test code from specs, PRDs, user stories, code diffs, bug analysis → coverage matrix → scenario generation → oracle design → test code → human review, with guardrails against hallucinated APIs and weak assertions. "auto-generate test cases," "AI write tests for me." ai-qa-review (Step 7 here only reviews tests THIS pipeline produced).
>- Meta/TikTok/LinkedIn pixels, and ad-tech tags. Covers building a tracking plan as the contract, intercepting collect-endpoint beacons and dataLayer.push in Playwright, asserting event name + params + values + timing + de-duplication, Consent Mode v2 gating, CI regression tracking," "GA4 event test," "verify the pixel fires," "dataLayer test," "tracking plan," "Meta Pixel dedup," "scroll-depth tracking test," "gate tracking in CI." compliance-testing; this skill checks the data is CORRECT. SEO meta tags / structured data — out of scope.
>- Hybrid fingerprint + LLM pipeline for bug classification, deduplication, and ticket generation. Normalizes CI logs, creates stable fingerprints, clusters near-duplicates, then uses LLM for severity classification and ticket writing. Includes bug reporting "failure analysis," "auto-classify," "CI failures," "bug report," "defect template." designing new tests from production telemetry — use observability-driven-testing.
>- Validate system resilience through controlled fault injection. Covers hypothesis-driven chaos experiments, failure injection types (network, service, infrastructure, dependency), LitmusChaos/Chaos Mesh/AWS FIS/Gremlin/toxiproxy tooling, automated abort gating, game day "resilience test," "game day," "failure recovery," "system reliability," "blast radius." designing new tests from production telemetry — use observability-driven-testing.
>- Implement consumer-driven contract testing with Pact-JS (v16). Covers consumer test writing, broker-driven provider verification, Pact Broker setup, can-i-deploy as a deployment gate, webhook-triggered verification, pending pacts, and schema-first vs consumer-first approaches (OpenAPI/Ajv, Schemathesis). verification," "can-i-deploy." general REST/GraphQL endpoint assertions against your own API — use api-testing.
>- Mode v2, Global Privacy Control (GPC), CCPA/US state opt-out, EU AI Act Article 50 transparency, Better Ads Standards, and cookie-inventory auditing. Covers automated consent-flow testing, third-party script blocking before consent, and cookie drift detection. "CCPA," "GPC," "AI Act," "Better Ads," "privacy banner." safety — use ai-system-testing.
>- Design CI/CD pipelines that run test suites. Covers GitHub Actions and GitLab CI templates, parallelism and sharding, artifact management, flaky-test quarantine, test-result publishing, coverage quality gates, OIDC keyless deploy, and copy-paste workflows for Playwright, Jest, and multi-stage pipelines. "continuous integration," "test automation pipeline," "shard tests in CI." decisions and smoke-test checklists — use release-readiness; test-result dashboards and trend reporting — use qa-metrics.
>- Turn a vague bug report into a VERIFIED minimal reproduction and then a failing regression test, agent-driven end to end. Covers extracting the implicit repro from a thin report (env, build, steps, data), the reproduce-minimize-isolate-capture loop, git bisect to find the introducing commit, building a deterministic minimal repro (fixed seeds, frozen time, stubbed network), writing the failing regression test BEFORE the fix (red) and confirming the fix flips it green, and writing repro evidence back into the ticket. Distinguishes flaky-not-reproducible from environment-specific. that broke it," "git bisect," "make the repro deterministic," "write a failing test for this bug," "regression test for a defect," "can't reproduce this bug." reproducing them — that is ai-bug-triage. Generating tests from specs rather than from a defect — that is ai-test-generation.
>- Measure and improve test coverage meaningfully. Covers Istanbul/V8/coverage.py configuration, coverage gap analysis by risk, coverage-as-ratchet in CI (never let it decrease), PR coverage diff checks, mutation testing for assertion quality, and gap," "Istanbul," "coverage threshold," "coverage report," "branch coverage." tracked KPI trend over time — use qa-metrics.
>- cy.intercept network control, cy.session login, Cypress Cloud, and CI integration. Covers retry-ability, the command queue, cross-origin flows with cy.origin, and data-driven testing with fixtures. "cy.intercept," "Cypress component test," "Cypress Cloud," "cypress.config.ts." use test-reliability; bulk selector regeneration after a UI refactor — use selector-drift-recovery; Selenium-to-Cypress conversion — use test-migration.
>- Design analytics-driven browser test matrices and execute cross-browser tests. Covers BrowserStack/Sauce Labs configuration, Playwright browser channels, common cross-browser CSS/JS divergences, a known-issues documentation log, and progressive enhancement validation. "browser compatibility," "Edge," "works in Chrome but not Safari." device-farm testing of native/hybrid apps — use mobile-testing.
>- Design and execute structured exploratory testing sessions. Covers Session-Based Test Management (SBTM), charter writing, heuristic-based exploration (HICCUPS, FEW HICCUPS), bug discovery patterns, note-taking templates, and conversion of "bug hunting," "test charter," "heuristic testing." features — use ai-system-testing.
>- Validate database integrity, test migrations forward and backward, verify schema constraints, manage seed data, detect migration drift, and identify query performance issues. Covers PostgreSQL, MySQL, MongoDB with Prisma, TypeORM, Drizzle, and SQLAlchemy, plus Testcontainers test databases. "data integrity," "SQL test," "schema validation," "seed data," "query performance," "Testcontainers." Docker/IaC test-environment provisioning — use test-environments; SQL injection — use security-testing.
>- End-to-end testing of email-dependent flows — signup confirmation, password reset, magic-link login, OTP/MFA codes, and notification emails. Covers the capture-inbox decision tree (Mailpit, Mailosaur, MailSlurp, Ethereal), Playwright polling without fixed sleeps, regex extraction of links/OTPs from the email body, deterministic per-test addresses (plus-addressing, per-inbox), subject/from/header/link assertions, and SPF/DKIM/DMARC deliverability checks as a separate suite. "magic-link login test," "capture OTP from email," "Mailpit," "Mailosaur," "MailSlurp," "email arrives flaky in CI," "assert email subject/from/links." an email provider — those are api-testing / app concerns. Email HTML rendering across clients (Outlook/Gmail dark mode) is out of scope (note it as a gap; use visual-testing or Litmus).
>- Use production telemetry as INPUT to design new tests. Covers OpenTelemetry integration with tests, trace-based assertions, log-informed test creation, production-error analysis for coverage gaps, and telemetry-driven test "OpenTelemetry assertions," "production errors point to test gaps," ai-bug-triage.
>- Test payment and checkout flows end to end against PSP sandboxes — Stripe first, with the general pattern for Adyen/Braintree/PayPal. Covers Stripe test-mode card numbers and their decline codes, the 3DS/SCA challenge flow and its nested-iframe handling in Playwright, test clocks for subscription/billing-cycle simulation, webhook testing (stripe listen/trigger, signature verification, idempotency), failed/retried payments and "3DS test," "test webhook signature," "test subscription renewal," "test clock," "refund test," "decline card test," "checkout E2E." compliance audit — compliance-testing.
>- Test application performance with k6 load/stress/soak/spike scripts and k6 scenarios, Lighthouse CI for Web Vitals, and performance budgets as CI gates. Covers load profiles, custom metrics, bottleneck identification, and Core Web Vitals (LCP, INP, CLS). "k6," "k6 scenarios," "Lighthouse," "Web Vitals," "Core Web Vitals," "performance budget." use visual-testing; designing tests from prod telemetry — use observability-driven-testing.
>- Test native, React Native, hybrid, and Flutter mobile apps with Appium 3.x, Detox, Maestro, and Patrol. Covers device farm setup (BrowserStack, Sauce Labs), gesture simulation, deep link and cold-start testing, push notifications, biometric (Face ID) auth, offline/poor-network simulation, and iOS/Android permission dialog handling. "iOS test," "Android test," "device farm," "deep link," "biometric," "Face ID," "permission dialog," "React Native test." app startup/memory/battery profiling depth — use performance-testing; mobile screenshot diffing — use visual-testing.
>- fixtures, auto-waiting, user-facing locators, parallel execution, CI integration, sharding, and 2025-2026 feature awareness. Includes an explicit "do not" list for AI agents. "Playwright config." audits — use accessibility-testing.
>- Build and visualize QA dashboards and reports with Allure Report, Grafana, and ReportPortal. Covers test execution visualization, stakeholder-facing quality reports, trend/flakiness panels, release-readiness gates, alerting, and CI integration for automated report generation. "Grafana," "ReportPortal," "test results visualization." (this skill builds the panels; qa-metrics decides what they should show).
>- escape rate, MTTR, test execution time trends, automation ROI, quality gates, and SLAs for test suites. Includes metric formulas, realistic targets by company stage, and the action to take when each metric goes red. "defect escape rate." gaps and mutation score — use coverage-analysis.
>- Routing skill of last resort. Takes a plain-language QA situation and names the right 1-2 skills to use and in what order. Use ONLY when the request does not "where do I start," "I'm not sure what to test," "/qa-do," or any vague QA use qa-project-context. If the request clearly matches another skill, invoke that skill directly instead of routing through here.
>- Onboard a new QA engineer to an existing codebase, or audit an existing test walkthrough, test architecture audit, mentorship pairing, and first-test QA on a brand-new project from scratch — use `qa-start`.
>- Create and fill .agents/qa-project-context.md with the project's tech stack, test frameworks, CI/CD pipeline, environments, quality goals, risk areas, team structure, and conventions. This is the one file every other QA skill reads first, so they skip redundant discovery and give context-aware advice.
>- Remove AI-generated patterns from QA reports, bug reports, test summaries, status updates, and quality communications. Detects and rewrites robotic test-result language, template-sounding status updates, inflated severity descriptions, and generic stakeholder reports — without inventing facts. Makes QA writing sound like a real engineer wrote it. "make this sound human," "clean up status update."
>- Analyze escaped defects and test suite health through blameless postmortems. Covers bug pattern analysis, test suite health reviews, 5 Whys root cause analysis, process improvement cycles, and postmortem/retro meeting templates with action item tracking. "improvement cycle." dashboards — use qa-metrics. Not for reviewing existing test code quality — use ai-qa-review.
>- Sequenced launcher that bootstraps QA on a project with no QA in place. Chains qa-project-context → test-strategy → test-planning in one guided run, then points clear match — use qa-do.
>- Validate release readiness with evidence-based go/no-go decisions. Covers go/no-go checklists, smoke test suite design, staged rollout validation, rollback criteria and procedures, and post-deployment verification. Ensures release confidence comes "release checklist," "rollback plan," "staged rollout," "canary deploy." rollout itself — use testing-in-production; scheduled probes that run continuously after release — use synthetic-monitoring; designing new tests from prod telemetry — use observability-driven-testing.
>- Produce a risk matrix or heatmap that quantifies what could break by business impact × probability, runs failure mode analysis on the top items, and maps test coverage to risk zones. Includes stakeholder interview frameworks and continuous assessment," "risk matrix," "risk heatmap," "what could break," "critical paths," "failure modes," "where to focus testing." bug hunting — use exploratory-testing.
>- (DAST), dependency/supply-chain scanning (OSV-Scanner, SBOM, provenance), Semgrep SAST, auth/session tests (JWT, OAuth, RBAC), and XSS/CSRF/SQLi/SSRF Playwright patterns. "auth testing," "OWASP LLM Top 10." Scope is automated scanning + negative-path security tests in CI, not manual penetration testing. pipeline stage wiring and deploy gating mechanics — use ci-cd-integration; purely functional API auth/input tests with no attacker model — see api-testing; testing your product's own LLM features or defending the agent itself (prompt-injection detector, indirect injection, jailbreak red-teaming) — use ai-system-testing.
>- Move quality earlier in the development lifecycle. Covers dev/QA pairing patterns, Three Amigos sessions, TDD facilitation (Red-Green-Refactor), PR review checklists for testability, and Definition of Done with quality gates. Includes shift-left "definition of done," "testability," "quality culture," "QA in sprint planning." test-quality review at scale — use ai-qa-review; multi-quarter QA direction or roadmap — use test-strategy.
>- Bulk-regenerate broken test selectors after a UI refactor or redesign. Detects drift between old and new DOM with an aria-snapshot diff, maps old locators to new equivalents using role-first + region scoping, validates against the new build, and produces a single PR with grouped per-file selector updates and per-change evidence. Assumes Playwright >= 1.50 (trace viewer DOM-snapshot "redesign broke tests," "bulk update selectors," "regenerate selectors after after a framework switch (Selenium to Playwright) — use test-migration.
>- in-process mocks, HTTP stubs (MSW, WireMock), record-replay, fault injection (Toxiproxy), or ephemeral real services (Testcontainers), and how to enforce that no real calls escape in CI. "test isolation," "dependency management," "stub an external API in CI." up a full Docker Compose env or seed data — use test-environments; broad resilience/game-day fault campaigns — use chaos-engineering.
Claude Skills — questions
Answers built from the skills we actually parsed.