Category

coding Agent Skills

54 open coding skills for AI agents. Each package is a portableSKILL.md folder with trigger guidance, instructions, and a benchmark suite — installable into Claude Code, Codex, Cursor, and OpenCode.

• code-reviewCore

  Review code changes for bugs, security issues, and maintainability with severity-tagged, actionable findings. Use whenever the user shares a diff, pull request, or code snippet and asks for review, feedback, "does this look right", "find issues", or "check my code" — even for small snippets or partial files.

  Category

  coding

  Context

  572

  Updated

  2026-07-11

• commit-messagesCore

  Write clear, conventional git commit messages from diffs or descriptions of changes. Use whenever the user asks for a commit message, is about to commit changes, mentions "git commit", shares a diff or staged changes that need summarizing, or finishes a coding task that will be committed — even if they don't ask about message formatting.

  Category

  coding

  Context

  496

  Updated

  2026-07-11

• debuggingVerified

  Diagnose bugs systematically instead of guessing — form hypotheses, isolate the fault, and verify the fix. Use whenever the user shares an error message, stack trace, unexpected behavior, failing test, or says things like "why doesn't this work", "it crashes", or "I'm stuck on this bug" — even if they only paste an error with no question.

  Category

  coding

  Context

  541

  Updated

  2026-07-11

• accessibility-implementationCommunity

  Implement accessible UI — semantic HTML, keyboard behavior, focus management, and names — rather than only auditing. Use whenever the user asks how to build an accessible modal, menu, form, table, or component, wants ARIA patterns to implement, or to fix a11y findings in code.

  Category

  coding

  Context

  551

  Updated

  2026-08-16

• accessibility-reviewCommunity

  Review UI and content for accessibility issues against WCAG-minded practices. Use whenever the user asks for an a11y review, accessibility audit, ARIA help, keyboard navigation, screen reader support, or whether a UI is accessible — even for small component snippets. To implement the keyboard/ARIA pattern, use accessibility-implementation.

  Category

  coding

  Context

  441

  Updated

  2026-08-16

• api-changelogCommunity

  Write consumer-facing API changelogs and migration notes for breaking and additive changes. Use whenever the user asks for an API changelog, OpenAPI migration notes, deprecation announcement, version diff summary, or how to communicate a breaking API change to clients.

  Category

  coding

  Context

  254

  Updated

  2026-07-26

• api-designCommunity

  Design and review HTTP, REST, GraphQL, and internal service APIs with clear contracts, errors, pagination, security, and evolution rules. Use whenever the user is planning endpoints, reviewing an API specification, naming resources, defining request or response shapes, or asking how services should communicate, even if they only share a rough route list.

  Category

  coding

  Context

  674

  Updated

  2026-07-11

• auth-designCommunity

  Design authentication and authorization — sessions, OAuth/OIDC, JWT, MFA, cookies, and object-level access. Use whenever the user asks how to add login, SSO, refresh tokens, RBAC/ABAC, API keys, session cookies, or whether to use JWT, or is designing signup/signin flows.

  Category

  coding

  Context

  650

  Updated

  2026-08-16

• caching-strategiesCommunity

  Design caching layers with correctness, TTLs, invalidation, and stampede control. Use whenever the user asks about Redis cache, CDN caching, HTTP cache headers, cache invalidation, thundering herd, or stale reads.

  Category

  coding

  Context

  286

  Updated

  2026-07-26

• chaos-experiment-designCommunity

  Plan chaos and resilience experiments safely with hypotheses, blast radius limits, and abort criteria. Use whenever the user asks for chaos engineering, fault injection, resilience experiments, or how to safely break things in staging or production. For facilitating a game day or on-call shadow, use game-day-facilitation.

  Category

  coding

  Context

  315

  Updated

  2026-07-26

• ci-cd-pipelinesCommunity

  Design and review CI/CD pipelines for speed, safety, and clear failure signals. Use whenever the user edits GitHub Actions, GitLab CI, Jenkinsfiles, or asks how to structure tests, builds, caches, deploy gates, and rollbacks in continuous integration.

  Category

  coding

  Context

  340

  Updated

  2026-07-26

• cli-designCommunity

  Design developer CLIs with clear UX, exit codes, flags, and help text. Use whenever the user builds a command-line tool, debates flags vs subcommands, stdout vs stderr, or asks how to structure a CLI for engineers.

  Category

  coding

  Context

  244

  Updated

  2026-07-26

• cloudformation-reviewCommunity

  Review AWS CloudFormation and SAM templates for deployment safety, IAM scope, replacement risk, dependencies, rollback behavior, and operability. Use whenever the user shares YAML or JSON templates, change sets, nested stacks, custom resources, or asks whether a CloudFormation deployment is safe.

  Category

  coding

  Context

  777

  Updated

  2026-08-16

• code-commentsCommunity

  Write and improve code comments and docstrings that explain why, not noise. Use whenever the user asks for better comments, docstrings, module headers, JSDoc/TSDoc, or documentation comments in source code.

  Category

  coding

  Context

  317

  Updated

  2026-07-26

• codebase-orientationCommunity

  Orient an engineer (or agent) in an unfamiliar codebase — map modules, entrypoints, how to run tests, and where to change a feature. Use whenever the user says "I'm new to this repo", asks where X is implemented, wants you to map this repo, asks how this project is structured, or an agent is exploring a repository — even if they only paste a directory listing. Distinct from onboarding-guides (HR/company onboarding) and debugging (a specific bug).

  Category

  coding

  Context

  731

  Updated

  2026-08-25

• container-reviewCommunity

  Review Dockerfiles and container configs for size, security, and operability. Use whenever the user shares a Dockerfile, compose file, Kubernetes image config, or asks how to harden, slim, or debug a container build.

  Category

  coding

  Context

  320

  Updated

  2026-07-26

• database-indexingCommunity

  Design and review database indexes and query plans — covering indexes, INCLUDE columns, partial/expression indexes, and EXPLAIN coaching beyond a single query rewrite. Use whenever the user asks what index to add, shares EXPLAIN ANALYZE, talks seq scans or index bloat, or wants a indexing plan for Postgres, MySQL, or SQL Server.

  Category

  coding

  Context

  582

  Updated

  2026-08-16

• database-migrationsCommunity

  Plan and review database schema migrations for safety and rollback. Use whenever the user writes migrations, alters tables, backfills data, adds indexes, or asks how to deploy schema changes without downtime or lock pain.

  Category

  coding

  Context

  377

  Updated

  2026-07-26

• dependency-upgradesCommunity

  Plan and execute dependency upgrades with risk assessment, changelog review, and verification. Use whenever the user wants to bump packages, resolve CVEs, upgrade a major version, interpret dependency conflicts, or update lockfiles safely.

  Category

  coding

  Context

  648

  Updated

  2026-07-26

• design-system-contributionCommunity

  Guide contributions to a design system — component API, accessibility, tokens, and docs. Use whenever the user adds a design-system component, variants, design tokens, Storybook docs, or asks how to version UI primitives safely.

  Category

  coding

  Context

  328

  Updated

  2026-07-26

• design-tokensCommunity

  Implement a token and theming system — color, type, space, dark mode, CSS variables, and Style Dictionary. Use whenever the user mentions design tokens, theme tokens, CSS variables, dark mode tokens, style-dictionary, semantic color, a spacing scale, or "tokenizing our theme", or wants to replace hex and magic numbers with a theme contract.

  Category

  coding

  Context

  899

  Updated

  2026-08-16

• desktop-releaseCommunity

  Plan and review desktop app releases — Electron, Tauri, and native installers, code signing, auto-update, and rollback. Use whenever the user asks about shipping a desktop build, Sparkle/Squirrel/electron- updater, notarization, MSI/DMG/AppImage, or a desktop release checklist.

  Category

  coding

  Context

  684

  Updated

  2026-08-16

• error-handlingCommunity

  Design robust error handling, retries, and failure modes for application code. Use whenever the user asks about exceptions, error types, retry policies, circuit breakers, timeouts, or how to handle failures in APIs, jobs, and distributed calls.

  Category

  coding

  Context

  365

  Updated

  2026-07-26

• feature-flagsCommunity

  Design feature flag rollout plans with targeting, kill switches, and cleanup. Use whenever the user asks about feature flags, gradual rollout, percentage deploys, experiments in production, flag lifecycle, or technical debt from stale flags.

  Category

  coding

  Context

  321

  Updated

  2026-07-26

• finops-reviewCommunity

  Review cloud spend and FinOps plans — idle resources, rightsizing, commitment discounts, and unit-cost metrics. Use whenever the user shares a bill, Cost Explorer export, asks why AWS/GCP/Azure is expensive, wants a savings plan, or reviews infra for cost before scaling.

  Category

  coding

  Context

  683

  Updated

  2026-08-16

• frontend-performanceCommunity

  Implement frontend performance — Core Web Vitals (LCP, INP, CLS), bundle size, code splitting, image optimization, hydration, and request waterfalls. Use whenever the user mentions Lighthouse, slow page load, LCP, INP, CLS, long tasks, TTFB for pages, or asks to shrink JS / split routes. For server, CPU, or DB profiling, use performance-review instead.

  Category

  coding

  Context

  871

  Updated

  2026-08-16

• git-conflict-resolutionCommunity

  Resolve git merge and rebase conflicts carefully while preserving intent. Use whenever the user has merge conflicts, rebase conflicts, or asks how to untangle conflicting branches, conflict markers, or conflicting file hunks.

  Category

  coding

  Context

  374

  Updated

  2026-07-26

• graphql-schema-designCommunity

  Design and review GraphQL schemas for authz, pagination, N+1 risk, nullability, and evolution. Use whenever the user works on GraphQL types, resolvers, connections, deprecations, query cost, or schema reviews — even when they only paste an SDL snippet.

  Category

  coding

  Context

  354

  Updated

  2026-07-26

• helm-chart-scaffoldingCommunity

  Scaffold and review Helm charts with safe defaults for values, templates, and hooks. Use whenever the user asks for a Helm chart, Chart.yaml, values.yaml production review, Helm upgrade hooks, or packaging a service for Helm install/upgrade.

  Category

  coding

  Context

  332

  Updated

  2026-07-26

• i18n-reviewCommunity

  Review product UI and copy for internationalization readiness — concatenation, pluralization, locale formats, RTL, and string extraction. Use whenever the user asks about i18n, l10n, localization readiness, translation safety, or whether strings are ready for other locales.

  Category

  coding

  Context

  434

  Updated

  2026-07-26

• kubernetes-reviewCommunity

  Review Kubernetes manifests and Helm values for security, reliability, and operability. Use whenever the user shares Deployment, Service, Ingress, StatefulSet, Helm charts, or asks about probes, RBAC, resource limits, network policies, or production-ready k8s YAML.

  Category

  coding

  Context

  380

  Updated

  2026-07-26

• load-test-planningCommunity

  Plan and interpret load tests with clear goals, scenarios, and pass/fail criteria. Use whenever the user asks for k6, Locust, JMeter, Gatling, soak tests, stress tests, capacity tests, or how to read p95 latency and error rates under load.

  Category

  coding

  Context

  355

  Updated

  2026-07-26

• logging-observabilityCommunity

  Design logging, metrics, and tracing that operators can use under pressure. Use whenever the user asks about structured logs, metrics, OpenTelemetry, dashboards, SLIs/SLOs, alerting, or how to instrument a service for production debugging.

  Category

  coding

  Context

  382

  Updated

  2026-07-26

• message-queue-designCommunity

  Design queue and pub/sub systems — Kafka, SQS, Rabbit, NATS — with poison messages, retries, ordering, and exactly-once caveats. Use whenever the user designs consumers, dead-letter queues, outbox, Kafka partitions, SQS visibility, or asks if delivery is at-least-once.

  Category

  coding

  Context

  523

  Updated

  2026-08-16

• migration-playbooksCommunity

  Plan large technical migrations with strangler patterns, dual-run, and rollback. Use whenever the user migrates frameworks, databases, clouds, monorepo boundaries, or large platform changes at scale.

  Category

  coding

  Context

  258

  Updated

  2026-07-26

• mobile-releaseCommunity

  Plan and review iOS and Android store releases — versioning, signing, store listings, staged rollout, and rollback. Use whenever the user asks about TestFlight, Play Console tracks, App Store submit, build numbers, signing, privacy nutrition labels, or a mobile release checklist.

  Category

  coding

  Context

  667

  Updated

  2026-08-16

• multi-region-active-activeCommunity

  Design multi-region and active-active systems — data-plane topology, consistency, conflict policy, traffic steering, and failover — and refuse invented RPO, vendor replication flags, or magic DNS. Use whenever the user asks for active-active, multi-region, multi-primary, dual-region writes, global database, cross-region failover architecture, "serve writes from two regions", or "users in EU and US write locally" — not a backup restore drill, live incident command, or Kubernetes manifest review.

  Category

  coding

  Context

  1265

  Updated

  2026-08-16

• observability-alertsCommunity

  Design actionable alerts that page humans only for real pain. Use whenever the user writes alert rules, fixes alert fatigue, designs on-call notifications, escalations, or SLO burn alerts.

  Category

  coding

  Context

  259

  Updated

  2026-07-26

• openapi-spec-designCommunity

  Design and review OpenAPI specifications for clarity, consistency, and evolution. Use whenever the user writes OpenAPI or Swagger YAML/JSON, reviews API specs, or asks how to document REST endpoints for code generation and client SDKs.

  Category

  coding

  Context

  275

  Updated

  2026-07-26

• partner-api-integrationCommunity

  Plan integrating a third-party or partner HTTP API: auth, retries, idempotency keys, sandbox vs prod keys, versioning, pagination, and field mapping. Use whenever the user wants to integrate Stripe, Twilio, or a partner API, build a third-party API client, compare sandbox vs prod keys, handle partner pagination, or asks "how do we wrap this vendor API" — even if they only share a vendor doc snippet and do not name this skill.

  Category

  coding

  Context

  922

  Updated

  2026-08-16

• performance-reviewCommunity

  Diagnose application performance bottlenecks and propose measured fixes. Use whenever the user mentions slow endpoints, high latency, CPU or memory spikes, N+1 queries, profiling results, p95/p99, or asks how to make code or systems faster — even without formal profiler output.

  Category

  coding

  Context

  641

  Updated

  2026-07-26

• pr-descriptionsCommunity

  Write pull request titles and descriptions that reviewers can act on fast. Use whenever the user asks for a PR description, opens or prepares a pull/merge request, shares commits or a branch diff to summarize, or says "write up this PR" — even if they only paste a diff.

  Category

  coding

  Context

  914

  Updated

  2026-07-26

• prompt-injection-hardeningCommunity

  Threat-model AI features against prompt injection, tool abuse, and data exfiltration, then propose mitigations and eval cases. Use whenever the user builds agents, RAG chatbots, tool-calling systems, or asks about prompt injection, jailbreaks, indirect injection, or agent security.

  Category

  coding

  Context

  559

  Updated

  2026-07-26

• pulumi-reviewCommunity

  Review Pulumi programs and previews for safe infrastructure changes across TypeScript, Python, Go, C#, Java, and YAML. Use whenever the user shares Pulumi code or preview output, designs component resources, handles secrets or state, or asks whether pulumi up is safe.

  Category

  coding

  Context

  770

  Updated

  2026-08-16

• rate-limitingCommunity

  Design rate limiting and throttling for APIs and gateways with fair use and abuse resistance. Use whenever the user asks about rate limits, quotas, 429 responses, token buckets, leaky buckets, or protecting endpoints from overload and abuse.

  Category

  coding

  Context

  277

  Updated

  2026-07-26

• refactor-planningCommunity

  Plan safe refactors that preserve behavior — seams, steps, tests, and rollback. Use whenever the user asks how to refactor, untangle a module, reduce complexity, extract a service, or restructure code without changing product behavior — even for "clean this up" requests with a large file.

  Category

  coding

  Context

  630

  Updated

  2026-07-26

• secrets-managementCommunity

  Handle secrets safely in apps and infrastructure without committing credentials. Use whenever the user asks about API keys, secret managers, .env handling, rotation, CI secrets, or how to inject credentials at runtime.

  Category

  coding

  Context

  347

  Updated

  2026-07-26

• security-reviewCommunity

  Review code and designs for security vulnerabilities — injection, authn/authz, secrets, crypto, SSRF, and data exposure. Use whenever the user asks for a security review, OWASP check, or whether something is safe to ship, shares auth/payment/upload code, or mentions vulnerability, exploit, hardcoding secrets, or "is this secure". For a STRIDE-style system threat model, use threat-modeling.

  Category

  coding

  Context

  1104

  Updated

  2026-08-16

• sql-query-reviewCommunity

  Review and improve SQL queries for correctness, performance, safety, and maintainability. Use whenever the user shares a SQL query, asks to optimize a query, prevent SQL injection, rewrite a join, or debug wrong database results — even for ORM-generated SQL or "why is this query slow". For a dedicated index / EXPLAIN indexing plan, use database-indexing.

  Category

  coding

  Context

  948

  Updated

  2026-08-16

• terraform-reviewCommunity

  Review Terraform and OpenTofu configuration and plans for blast radius, state risk, IAM overreach, and safer apply order. Use whenever the user shares .tf files, a terraform plan, asks if apply is safe, or reviews infrastructure-as-code modules and state backends.

  Category

  coding

  Context

  440

  Updated

  2026-07-26

• test-generationCommunity

  Design and write focused automated tests for new code, bug fixes, and risky behavior. Use whenever the user asks for tests, shares untested code, fixes a defect that needs regression coverage, mentions coverage gaps, or wants help deciding what to test, even if they do not name a testing framework.

  Category

  coding

  Context

  616

  Updated

  2026-07-11

• threat-modelingCommunity

  Build a structured threat model — assets, actors, trust boundaries, STRIDE, and mitigations — before or beside a code review. Use whenever the user asks for a threat model, attack tree, STRIDE analysis, abuse cases, trust boundaries, or "who can attack this system" rather than a line-by-line security review.

  Category

  coding

  Context

  625

  Updated

  2026-08-16

• webhook-designCommunity

  Design outbound and inbound webhooks with signatures, retries, idempotency, and replay defense. Use whenever the user builds Stripe-like webhooks, Slack events, GitHub hooks, partner callbacks, or asks how to sign, verify, retry, or version webhook payloads.

  Category

  coding

  Context

  610

  Updated

  2026-08-16

• websocket-designCommunity

  Design WebSocket and realtime channels with auth, backpressure, and reconnect semantics. Use whenever the user builds realtime features, sockets, presence, live updates, or streaming over persistent connections.

  Category

  coding

  Context

  286

  Updated

  2026-07-26