Software Development AI agent skills

13,359 skills in the archive. Read a skill’s instructions or open its original repository.

• Quality Engineering Playwright Pom Generation

  by @HoangNguyen0403

  Generates Playwright page objects from an executable test plan, one class per screen with ladder-compliant locators and no assertions, wired into a shared fixture. Use when a web scenario needs a page object that does not exist…

• Common Decision Discipline

  by @HoangNguyen0403

  Right-size, ground, and gate SDLC decisions with SNC-sized depth, said-vs-assumed write-back, an evidence ledger, honest option cards, recorded approval, and self-review. Use when running brainstorm-feature, plan-feature,…

• Common Owasp

  by @HoangNguyen0403

  OWASP Top 10 audit checklists for Web Applications (2021), APIs (2023), and Mobile (2024). Use when performing any security review, PR review, or codebase audit touching web, mobile, or API code.

• Common Sdlc Metrics

  by @HoangNguyen0403

  Define the delivery metrics contract for agent-assisted SDLC — DORA four plus per-stage indicators derived from artifact and git history, and the control bands that turn metric drift into a routed intake. Use when reporting…

• Common Task Complexity Routing

  by @HoangNguyen0403

  Scores a coding task on Spread, Novelty, and Centrality (SNC 0-6) and maps the tier to autonomy, verification depth, review mode, reviewers, model tier. Use when sizing a fix or feature before planning, choosing fast vs deep…

• Quality Engineering Automation Health

  by @HoangNguyen0403

  Measures whether an automation suite builds release confidence via feedback-loop length, suite reliability, release cadence, and production escape rate, and emits a release_confidence verdict. Use when judging suite value, ROI,…

• Common Agent Guardrails

  by @HoangNguyen0403

  Define deterministic guardrails for agent tool calls — protected paths, test-file locks during bug fixes, post-edit formatters, production approval gates, secret deny rules. Use when writing or reviewing a hook policy, or moving…

• Typescript Language

  by @HoangNguyen0403

  Apply modern TypeScript standards for type safety and maintainability. Use when working with types, interfaces, generics, enums, unions, or tsconfig settings.

• Typescript Best Practices

  by @HoangNguyen0403

  Write idiomatic TypeScript patterns for clean, maintainable code. Use when writing or refactoring TypeScript classes, functions, modules, or async logic.

• System Design Integration Patterns

  by @HoangNguyen0403

  Choose distributed integration and evolution patterns by the constraint each removes: outbox, CQRS, event sourcing, saga orchestration or choreography, leader election, sidecar, anti-corruption layer, and strangler-fig…

• Common Store Changelog

  by @HoangNguyen0403

  Generate user-facing release notes for the App Store and Google Play from git history (App Store <=4000 chars, Google Play <=500). Use when generating release notes, app store changelog, play store release, or "what's new" text…

• Common Review Policy

  by @HoangNguyen0403

  Define a repository review policy fixing what each review pass checks, how severities rank, which paths are skipped, the nit cap, and who approves. Use when review findings feel inconsistent or noisy, or when tuning an automated…

• Typescript Security

  by @HoangNguyen0403

  Secure server-side TypeScript input, auth tokens, and injection boundaries. Use for API/request validation, sanitization, secrets, and sensitive configuration; defer client-only React form validation and generic linting.

• Typescript Tooling

  by @HoangNguyen0403

  Development tools, linting, and build config for TypeScript. Use when configuring ESLint, Prettier, Jest, Vitest, tsconfig, or any TS build tooling.

• JavaScript Best Practices

  by @HoangNguyen0403

  Idiomatic JavaScript patterns and conventions for maintainable code.

• JavaScript Language Patterns

  by @HoangNguyen0403

  Modern JavaScript (ES2022+) patterns for clean, maintainable code.

• JavaScript Tooling

  by @HoangNguyen0403

  Development tools, linting, and testing for JavaScript projects.

• Quality Engineering Jira Integration

  by @HoangNguyen0403

  Trigger only when the user explicitly requests live Jira or Zephyr retrieval, existing-link inspection, linking authored test cases, label updates, or stale-link audits. Do not trigger for analysis-only prompts such as 'Analyze…

• Cyber Incident Triage

  by @HoangNguyen0403

  NIST SP 800-61r3-aligned incident triage that preserves evidence, separates analysis from authorization, and records status. Use for incident intake, severity assessment, containment readiness, or evidence preservation; not…

• Information Architecture

  by @julianoczkowski

  Define the structural layer of a product or site before visual design begins. Covers navigation, content hierarchy, page structure, URL patterns, and user flows. Use when user wants to plan site structure, define navigation, map…

• Design Review

  by @julianoczkowski

  Run a structured design critique against the brief and codebase. Checks visual hierarchy, consistency, responsiveness, accessibility, and aesthetic fidelity. Use when user wants a design review, critique, QA pass, polish pass,…

• Adapter Review

  by @tommy0103

  Review a provider/agent adapter implementation or PR — transcript discovery, parsing, and indexing for agent hosts (Claude, Codex, Kimi, Pi, DeepSeek Harness, OMP, Copilot, etc.). Use when reviewing an adapter PR, adding a new…

• NULL ZONE FORUM

  by @yhy0

  零界AI社交网络比赛助手 - 自动化参赛框架。封装四大挑战（提示词注入、密钥交换、影响力竞争、信息搜集）的完整策略、博弈决策框架、cron定时任务编排、密钥管理和Flag自动提交。通过 Claude Code CLI + tmux 持久化运行。

• Null Zone Injection Cycle

  by @yhy0

  零界挑战一：提示词注入周期 — 每小时5次（cron:6,21,36,51,56），每次触发均可提交注入评论+检查私信回复。Bot 每小时:59 批量处理所有未处理评论。

• Null Zone Key Exchange Cycle

  by @yhy0

  零界挑战二：密钥交换周期 — 每5分钟执行，检查私信、处理密钥碎片、执行TFT决策、拼接提交flag。

• Anti Defensive Writing

  by @Boom5426

  Remove audit, defensive, self-critical, developer-facing and commitment writing from manuscripts, Supplementary Information, legends, table notes, data/code statements and figure content. Preserve numbers, definitions,…

• Common Architecture Audit

  by @HoangNguyen0403

  Audit structural debt, logic leakage, and monolithic components across Web, Mobile, and Backend codebases. Use when reviewing architecture, assessing tech debt, detecting logic in wrong layers, or identifying God classes.

• Common Best Practices

  by @HoangNguyen0403

  Enforce SOLID principles, guard-clause style, function size limits, and intention-revealing naming across all languages. Use when refactoring for readability, applying clean-code patterns, reviewing naming conventions, or…

• Common Git Collaboration

  by @HoangNguyen0403

  Enforce version control best practices for commits, branching, pull requests, and repository security. Use when writing commits, creating branches, merging, or opening pull requests.

• Android Agp Upgrade

  by @HoangNguyen0403

  Upgrade an Android project to Android Gradle Plugin (AGP) 9. Use when migrating to AGP 9, updating Gradle build files, migrating to built-in Kotlin, or adopting the new AGP DSL.

• Android Performance

  by @HoangNguyen0403

  Optimize Android app startup, UI rendering, frame stability, and benchmark performance with Baseline Profiles, Macrobenchmark, and lazy initialization. Use when reducing startup time, diagnosing jank, or measuring rendering;…

• Android Legacy Security

  by @HoangNguyen0403

  Harden Intent handling, WebView configuration, and FileProvider access in Android apps. Use when securing Intent extras, configuring WebViews, or exposing files via FileProvider; defer manifest export flags and generic Bundle…

• Android Legacy Navigation

  by @HoangNguyen0403

  Implement Jetpack Navigation Component with XML graphs and SafeArgs for type-safe fragment navigation. Use when working with XML-based navigation or SafeArgs in legacy Android projects; defer drawer and other UI-chrome work to…

• Android Networking

  by @HoangNguyen0403

  Integrate Retrofit, OkHttp, and Kotlinx Serialization for type-safe API communication in Android. Use when building API clients, adding interceptors, or configuring network security—not standalone MockWebServer or API-test setup.

• Android Tooling

  by @HoangNguyen0403

  Configure Android static analysis with Detekt, Ktlint, and Android Lint for CI/CD quality gates. Use for Android-specific lint and quality tooling; defer generic Java Checkstyle, SonarQube, and standalone CI configuration.

• Android Deployment

  by @HoangNguyen0403

  Configure release signing, R8 obfuscation, and App Bundle publishing for Android. Use when setting up signing configs, enabling minification, adding ProGuard keep rules, or preparing for Play Store submission.

• Android Edge To Edge

  by @HoangNguyen0403

  Migrate a Jetpack Compose app to edge-to-edge display and fix system bar inset issues. Use when UI components are obscured by navigation/status bars, fixing IME insets, or enabling edge-to-edge for SDK 35+.

• Common Documentation

  by @HoangNguyen0403

  Write effective code comments, READMEs, and technical documentation following intent-first principles. Use when adding comments, writing docstrings, creating READMEs, or updating any documentation.

• Angular Style Guide

  by @HoangNguyen0403

  Naming conventions, file structure, and coding standards for Angular projects. Use for Angular-specific naming and organization; defer language-only TypeScript naming questions.

• Common Debugging

  by @HoangNguyen0403

  Troubleshoot systematically using the Scientific Method. Use when debugging crashes, tracing errors, diagnosing unexpected behavior, or investigating exceptions.

• Angular Http Client

  by @HoangNguyen0403

  Integrate HttpClient, Interceptors, and API interactions in Angular. Use when integrating HttpClient, writing interceptors, or handling API calls in Angular.

• Angular Dependency Injection

  by @HoangNguyen0403

  Configure DI, inject() usage, and providers in Angular. Use when configuring Angular dependency injection, using inject(), or defining providers.

• Enferno Dev

  by @level09

  Development skill for the Enferno Flask framework. Use when implementing features, fixing bugs, or writing code in Enferno-based applications: blueprints, SQLAlchemy models and migrations, admin JSON APIs, Vue 3 + Vuetify pages…

• User Interviews

  by @emotixco

  Write a 25-minute customer discovery interview script that follows The Mom Test, with screening criteria, exact wording, red flags, and a framework for analyzing 5-8 interviews. Use when a founder wants to talk to potential…

• Persona Gen

  by @emotixco

  Create 3 distinct user personas with a day in the life, quotable pain points, current workarounds, buying behavior, and a priority matrix showing who to build for first. Use when a founder needs to decide or describe who their…

• Web App Logic

  by @transilienceai

  Web application logic testing - business logic flaws, race conditions, access control, cache poisoning/deception, and information disclosure.

• Server Side

  by @transilienceai

  Server-side vulnerability testing - SSRF, HTTP Request Smuggling, Path Traversal, File Upload, Insecure Deserialization, and Host Header injection.

• Injection

  by @transilienceai

  Injection vulnerability testing - SQL, NoSQL, OS Command, SSTI, XXE, and LDAP/XPath injection techniques.

• Client Side

  by @transilienceai

  Client-side vulnerability testing - XSS (reflected/stored/DOM), CSRF, CORS misconfiguration, Clickjacking, DOM-based attacks, and Prototype Pollution.

• Dfir

  by @transilienceai

  Digital forensics and incident response - Windows event log analysis, PCAP forensics, filesystem artifact analysis, AD attack detection, and timeline correlation. Use when investigating security incidents, analyzing Sherlocks,…

• Phx Deps Audit

  by @oliver-kriska

  Audit Hex deps for supply-chain security risk — bidi chars, compile-time exec, maintainer changes, typosquats, CVEs. Use after mix deps.update, when checking if a package upgrade is safe, or reviewing mix.lock PR diffs.

• Reverse Engineering

  by @transilienceai

  Static and dynamic reverse engineering — ELF/PE analysis, custom-VM bytecode, packed binaries, anti-debug bypass, Frida hooking.

• Cryptography

  by @transilienceai

  Cryptanalysis techniques — lattice attacks, padding oracles, weak-RNG exploitation, signature forgery, secret-sharing recovery.

• Mobile Security

  by @transilienceai

  Mobile application security testing (Android + iOS) mapped to OWASP MASVS/MASTG — static reversing (Flutter AOT, Unity IL2CPP, React Native/Hermes, native ARM64, Mach-O/Swift), SAST (manifest/IPC, storage, crypto, signing),…

• Reconnaissance

  by @transilienceai

  Domain assessment and web application mapping - subdomain discovery, port scanning, endpoint enumeration, API discovery, and attack surface analysis.

• Source Code Scanning

  by @transilienceai

  Security-focused source code review and SAST. Scans for vulnerabilities (OWASP Top 10, CWE Top 25), CVEs in third-party dependencies/packages, hardcoded secrets, malicious code, and insecure patterns. Use when given source code,…

• Phx Deps Update

  by @oliver-kriska

  Bump outdated Hex deps — inventory, snapshot changelogs, update, fix breaks, split reviewable PRs (patches bundled, majors solo). Use to upgrade/bump Elixir dependencies or when versions fall behind. NOT for deps.get failures…

• Phx Document

  by @oliver-kriska

  Use when asked to document Elixir code: add or fill in @moduledoc and @doc for modules and functions. Documents tested code only; may add a README section or ADR. Not for docs lookup or audits.

• Skill Update

  by @transilienceai

  Skill creation, update and management — generates skill directory structure, validates against best practices, enforces line count limits. Use when creating, updating, or improving skills.

• Github Workflow

  by @transilienceai

  GitHub workflow automation — branching, committing, pushing, pull requests, issues, and code review. Use when asked to commit, push, create PRs/branches/issues, or manage git workflow.

• Codex Ab

  by @oliver-kriska

  Run an A/B codex review experiment — holistic codex review vs 3 focused dimension passes (security, ecto, liveview) on the branch diff, classify findings, report a panel-value verdict. Use when the branch is fresh, before any…

• Phx Boundaries

  by @oliver-kriska

  Analyze Phoenix context boundaries and module coupling via mix xref. Use when checking cross-context calls, validating dependencies, before splitting modules, or reviewing architecture.

• Phx Audit

  by @oliver-kriska

  Project health audit and health check — architecture, performance, tests, dependencies, code quality. Use when assessing overall project health, before releases, or after refactors.

• Session Scan

  by @oliver-kriska

  Compute metrics for Claude Code sessions. Discovers via ccrider, filters trivial, computes friction/opportunity/fingerprint scores. Use for broad session triage.

• Phx Brief

  by @oliver-kriska

  Interactive briefing of a plan file — explains reasoning, schema decisions, component choices. Use when developers need to understand a plan before approving.

• Phx Help

  by @oliver-kriska

  Use when the user asks which phx-* command fits a task (review, plan, debug, test) or how two commands differ. Checks plans and git state, then recommends from the routing table. Not for bare /help, a tour, or ambiguous requests…

• Release

  by @oliver-kriska

  CONTRIBUTOR TOOL - Cut a plugin release: bump plugin.json version, finalize CHANGELOG, update README if needed, gate on make ci, commit, tag vX.Y.Z, and create the GitHub release. Use when shipping a new plugin version. NOT…

• Phx Codex Loop

  by @oliver-kriska

  Fix Elixir/Phoenix code until Codex CLI review comes back clean — bounded review, fix, verify loop before opening a PR. Use when codex is installed and you want an external cross-model critic on your changes before pushing.

• Promote

  by @oliver-kriska

  Generate X/Twitter release promotion posts with ASCII tables and CodeSnap rendering. Use when writing release posts, promotion tweets, plugin announcements, or preparing social media content for new versions.

• Attack Path Stitcher

  by @transilienceai

  Stitches confirmed single-asset findings into multi-hop attack paths across the organization. Builds a graph where nodes are assets and edges are confirmed exploit hops citing the findings that enable them.

• Regression Sweep

  by @transilienceai

  Re-validates every previously-confirmed finding against its current target — detects drift (patched, mitigated, re-introduced). Cron-driven weekly sweep across the org's validated finding tree.

• Techstack Frontend

  by @transilienceai

  Frontend tech-stack identification — JavaScript frameworks, meta-frameworks, CSS frameworks, UI libraries, build tools, and CMS via DOM, JS globals, HTML, and bundle patterns.

• Techstack Backend

  by @transilienceai

  Backend tech-stack identification — web servers, runtimes, languages, frameworks, databases, APIs, and CMS via HTTP headers, cookies, error pages, and API discovery.

• Techstack Correlation

  by @transilienceai

  Correlation, confidence scoring, and conflict resolution across all tech-stack signals. Cross-validates and assigns High/Medium/Low confidence per technology.

• Session Trends

  by @oliver-kriska

  Analyze trends across session metrics. Computes windowed aggregates, deltas, and compares against MEMORY.md findings. Use periodically for progress tracking.

• Osint

  by @transilienceai

  Open-source intelligence gathering - company repository enumeration, secret scanning, git history analysis, employee footprint, and code exposure discovery.

• Phx Compound

  by @oliver-kriska

  Capture solved problems as searchable solution docs. Use after fixing bugs, when "that worked", or after successful phx-review or phx-investigate.

• Ln 52 Delivery Reviewer

  by @levnikolaevich

  Reviews a completed change for acceptance, regressions and release risk; read-only, not a whole-codebase audit.

• Plugin Dev Workflow

  by @oliver-kriska

  Guide plugin development workflow — editing skills, agents, hooks, or eval framework in this repo. Use when modifying files in plugins/elixir-phoenix/, lab/eval/, or lab/autoresearch/. Ensures changes pass eval, lint, and tests…

• Skill Prune

  by @transilienceai

  Identify and remove negative-ROI skill content — orphan files, never-read entries, duplicates, content reintroducing challenge-specific lore. Inverse of /skill-update. Use during quarterly maintenance or after the linter flags…

• Ln 12 Product Requirements Builder

  by @levnikolaevich

  Defines product requirements, business rules and acceptance criteria for a committed intent; edits product docs only.

• Ln 43 Code Modernizer

  by @levnikolaevich

  Modernizes a bounded capability to reduce demonstrated maintenance cost; not routine upgrades or performance tuning.

• Ln 54 Codebase Auditor

  by @levnikolaevich

  Audits cross-cutting codebase health, security and maintainability; not a single-change review or specialist audit.

• Script Generator

  by @transilienceai

  Generates optimized, syntax-validated scripts on demand. Never executes — only generates, optimizes, and validates.

• Ln 41 Surgical Change Implementer

  by @levnikolaevich

  Implements one scoped feature or fix through the smallest complete solution; not upgrades or performance tuning.

• Ln 33 Plan Reviewer

  by @levnikolaevich

  Reviews a concrete implementation plan for missing decisions, feasibility and risk before execution; read-only.

• Ln 23 System Design Proposal Builder

  by @levnikolaevich

  Designs target system boundaries, contracts and tradeoffs from requirements; does not plan tasks or implement.

• Ln 56 Architecture Auditor

  by @levnikolaevich

  Audits implemented architecture boundaries, dependencies and ownership; not target design or plan review.

• Ln 22 Current Architecture Documenter

  by @levnikolaevich

  Documents current architecture from implementation evidence; does not propose a target or audit fitness.

• Ln 51 Acceptance Test Builder

  by @levnikolaevich

  Builds, updates or retires scoped acceptance tests and verifies execution; does not repair product code.

• Ln 64 Community Announcer

  by @levnikolaevich

  Drafts or publishes authorized, fact-checked GitHub Discussions announcements; does not create releases.

• Ln 42 Dependency Upgrader

  by @levnikolaevich

  Upgrades dependencies in reversible batches with version-specific compatibility and regression checks.

• Ln 55 Test Suite Auditor

  by @levnikolaevich

  Audits existing tests for risk coverage, reliable oracles and maintenance value; does not edit tests.

• Ln 45 Benchmark Comparator

  by @levnikolaevich

  Compares tools or implementations through controlled benchmarks and independent correctness checks.

• Ln 62 Release Publisher

  by @levnikolaevich

  Prepares and publishes an explicitly requested tagged GitHub release; does not deploy applications.

• Ln 61 Repository Publisher

  by @levnikolaevich

  Commits, pushes and remotely verifies authorized repository changes; does not create releases.

• Ln 53 Documentation Auditor

  by @levnikolaevich

  Audits documentation and comments for trust, coverage, consistency and freshness; read-only.

• Ln 81 Skill Reviewer

  by @levnikolaevich

  Reviews skill instructions, trigger boundaries and distribution contracts; not product code.

• Ln 32 Test Strategy Planner

  by @levnikolaevich

  Plans risk-based test portfolios and acceptance evidence; does not write or execute tests.

• Specify Factory

  by @rsmdt

  Decompose a multi-feature or multi-component specification into factory-consumable artifacts. Use this for high-complexity work — multiple features, three or more components, or parallel-eligible workstreams.