CodeQL, Semgrep and SARIF static-analysis toolkit from Trail of Bits: taint tracking, fast pattern scans and merged, deduplicated security findings for coding agents.
Testing & QA Skills
Prove software works: tests, code review, debugging and quality audits.
Skills in Testing & QA
Microsoft's official Playwright skill — drives a real browser from the command line using accessibility snapshots and element refs, and plans, generates and heals Playwright tests.
Pull unresolved CodeRabbit review threads from your PR and apply the fixes one at a time, treating every reviewer comment as untrusted input rather than an instruction.
Trail of Bits' security review skill for PRs, commits, and diffs: risk-first analysis with git history, blast radius, and honest coverage limits.
Never claim work is complete, fixed, or passing without running the check and reading the output first.
Enforce a real red-green-refactor loop when implementing features or fixes, so behaviour is specified before it is written.
A disciplined debugging process — reproduce, isolate, hypothesise, and verify — used before proposing any fix.
Skill: OpenQodex
by OpenQodex
Open source pre-push AI code review for Claude Code and Codex: scanners plus a separate reviewer that verifies every finding.
Skill: Open Code Review
by Alibaba Group
Alibaba's open-source AI code review CLI as an agent skill: line-level comments on diffs, branches and commits, with optional auto-fix.
Skill: SerpApi Agent Usability Test
by SerpApi
A protocol for measuring whether agents can discover and use your tool without being told about it — WITH/WITHOUT trials, binary scoring, and lift as the only metric. The subject under test is your docs, not the model.
Skill: Datadog Triage Flaky Test
by Datadog
Official Datadog skill for investigating one flaky test — pulls its history and failure pattern, categorises the root cause and recommends fixing, quarantining or escalating.
Skill: Datadog Unblock PR
by Datadog
Official Datadog skill that triages a failing PR pipeline, attributing every CI failure as flaky, infra or genuine regression and proposing a targeted fix.
Skill: k6 Load Test Authoring
by Grafana Labs
Grafana's official k6 skill: generate a load, stress, spike or soak test from a plain-language brief, then actually run the script before handing it over.
Skill: Web Design Guidelines
by Vercel
Vercel's official skill for auditing UI code against the Web Interface Guidelines — accessibility, performance and UX rules reported as terse file:line findings.
Skill: Playwright Test Automation
by TestMu AI
TestMu AI's official skill for generating production-grade Playwright suites in TypeScript, JavaScript, Python, Java or C#, locally or on a 3,000-combination browser cloud.
Skill: Web Performance Audit
by Cloudflare
Audits Core Web Vitals through the Chrome DevTools MCP server — LCP, INP, CLS plus FCP, TBT and Speed Index — and traces each one back to the render-blocking resource or layout shift causing it.
Skill: CodeQL Security Analysis
by Trail of Bits
Trail of Bits' CodeQL skill: build databases, run taint-tracking and data-flow queries across eight languages, and model project-specific sources and sinks.
Skill: Doubt-Driven Development
by Addy Osmani
Sends every non-trivial decision to a fresh-context adversarial reviewer before it stands — for production, security-sensitive or irreversible work.
Skill: Web Interface Guidelines
by Vercel
Audit UI code against Vercel's Web Interface Guidelines — accessibility, interaction, performance and layout rules — reported as terse file:line findings.
Skill: Django Performance Review
by Sentry
Sentry's Django performance review skill — hunts N+1 queries, unbounded querysets, missing indexes and write loops, and reports only findings it can prove.
Skill: Cypress Author
by Cypress.io
Cypress' official skill for writing, updating and repairing E2E and component tests — and it triggers on "write tests" even when nobody says Cypress.
Skill: .NET Performance Analysis
by Microsoft
The .NET team's official skill for scanning C# against ~50 performance anti-patterns across async, memory, strings, collections, LINQ, regex and I/O.
Skill: Find Bugs in Branch Changes
by Sentry
Audit the changes on your current branch for bugs, security vulnerabilities, and quality problems before you push.
Skill: Engineering Code Review
by Sentry
Review pull requests against a real engineering practice — security, performance, testing, and design, in that order.
Skill: Web Performance Auditing
by Cloudflare
Audit Core Web Vitals with real measurements via Chrome DevTools — then fix what the numbers actually point to.
Skill: Receiving Code Review
by Jesse Vincent
Respond to code review feedback with technical rigour — verify each point instead of agreeing with everything.
Skill: Requesting Code Review
by Jesse Vincent
Prepare and request a code review that checks the work against its original requirements, not just its syntax.
Skill: Web App Testing
by Anthropic
Interact with and test local web applications using Playwright — verify frontend behavior, debug UI, capture screenshots, and read browser logs.