THE AI TOOLKIT / SKILLS

Skills.
Useful instructions. Inspected in context.

Give your AI a repeatable way to work. Explore selected skills with original review notes, practical installation guidance and the source material behind each choice.

Selected for a reason. Reviewed within a stated scope. Every entry includes our own findings and limitations. Source review is not a runtime test, a security certificate or proof of a universal “best.”

01 / START WITH THE JOB

What are you working on?

Explore a category, then refine your shortlist.
All categories are available in the filters.

PLAN THE HANDOFF

Put the resources to work.

Explore 24 workflows

Task briefs, working sheets and acceptance checks. Suggested plans; each resource needs its own setup.

BUILT BY UNDOMINATED

Evidence tools you can inspect.

Original source, MIT licence and complete downloads.
Each review names the checks performed and their limits.

  • AI resource intake audit ↗

    Review a skill, agent or MCP server for pinned source identity, licensing, requested permissions and observable verification before adding it to a trusted collection.

  • Alias resolution ↗

    Resolve an explicitly supplied alias to one distinct concrete target, refusing unresolved or conflicting candidate evidence. Use before treating a latest-style pointer as a concrete model ID.

  • Benchmark cohort audit ↗

    Audit a benchmark comparison for matched model identity, missing coverage, restricted populations and misleading confidence-interval interpretations.

  • Context-tier ladder audit ↗

    Check a past-this-length price multiple against every rung, so the dearest rung is not applied at the first boundary.

  • Dominance wording audit ↗

    Classify a two-model comparison before publishing it, so a tie or a dropped requirement is not called both better and cheaper.

  • Evidence audit ↗

    Audit a numeric claim against locally saved source evidence, including denominator and reproducible calculations, before citing or publishing it.

  • Filter invariance ↗

    Check that filtering preserves the relative order of retained IDs. Use for search or facet behavior that is intended to hide rows without re-sorting them.

  • Final-host audit ↗

    Refuse a vendor quote when the final host you recorded is not the host you requested. A redirect is not that vendor. www is not stripped, and this checker sends no request.

  • Final-path audit ↗

    Refuse a page claim when the final path you recorded is not the path you requested. A redirect to the homepage is not that page. The host is a different checker, and this one sends no request.

  • Header-not-row audit ↗

    Refuse a unit claim that borrows the table's display header when that row does not state its own unit. A per-million header is not every row's invoice unit. Amounts are not read.

  • Indicative-rate audit ↗

    Refuse a global-rate claim when the excerpt says the figure is indicative, varies by country, starts at a floor, or is a list price beside a credit. One sentence is not every region's rate.

  • Licence-boundary audit ↗

    Check a redistribution claim against the licence evidence you recorded. A public page is not a licence.

  • Model migration preflight ↗

    Check a proposed model replacement for required modalities, context, tool use, structured output and evaluation coverage before calling it a safe saving.

  • Multiplier-aside audit ↗

    Refuse a base-rate claim when the excerpt names a multiplier. Priority, fast, and scale factors are not the on-demand rate. The number in 2x is not read as a price.

  • Payback basis ↗

    Check switching-cost payback against savings per period using exact arithmetic. Use when a migration claims to pay back in a stated number of periods.

  • Plan-quote hygiene ↗

    Keep unverified subscription quotes out of a USD monthly ceiling. A source sentence is not a price.

  • Provider quote comparison ↗

    Compare like-for-like provider quotes with complete context tiers and distinct sellers; recompute workload cost without inventing cache or reasoning discounts.

  • Resource release proof ↗

    Verify local release artifacts and meaningful public-response receipts without confusing a build, HTTP 200 or registry metadata with a working installation.

  • Schema-not-quote audit ↗

    Refuse a model-rate claim when the excerpt describes a pricing field or a schema. "Values are in" a unit is a field description, not a model's rate. Amounts are not read.

  • Seller-spread audit ↗

    Check a price-spread multiple against distinct seller owners, so one vendor's own service tiers are not counted as competition.

  • Serving-mode attribution ↗

    Check that an explicit claimed score belongs to its named model or serving mode. Use when a model headline may have inherited a mode-specific score.

  • Single-base audit ↗

    Refuse a single-base price claim when the excerpt names both sides of a cache split or a peak split. Spelling USD per million does not make cache-hit and cache-miss one rate.

  • Slug-is-not-body audit ↗

    Refuse a currency or quantity claim whose words appear only in a URL, a slug, or a title. The excerpt is the body. A path named pricing-details-usd does not state USD.

  • Source-pin audit ↗

    Refuse a source identity that is only a branch, a tag, or a short SHA. A full 40-hex revision is the pin. The name v7 or main does not become that revision.

  • Status-not-page audit ↗

    Check a supplied status against a conservative integer-200-only gate and refuse every quote claim based on status alone. No status proves a body was received or read. This checker sends no request.

  • Withdrawal residue ↗

    Check an explicitly observed withdrawn numeric field and its named dependents for leftover values. Use after a source value has been removed from a snapshot.

02 / THE SELECTION

Find a fit. Read the reasoning.

Alphabetical by default. Every match is shown.
Compare up to three before opening a full review.

Runtime, access and execution

Labels summarise reviewed source wording. A local process can still send data to external services. Read each review's prerequisites and permissions; these filters do not certify compatibility or enforce access.

131 of 131 selected skills

Data and analytics · dbt Labs

Adding a dbt unit test

Builds dbt SQL-model unit tests from explicit input fixtures and expected output rows.

dbttestingwarehouses

Why we selected itDocuments dict/CSV/SQL fixture tradeoffs and the special SQL-fixture requirement for ephemeral dependencies.

Weigh upMocked inputs do not make dbt tests offline. SQL models only; not a validator of production data, Python models or final incremental-table state. Never run --empty against data that must be retained.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewApache-2.0

AI application development · Anthropic

Anthropic Claude API

Routes Claude API work to language-specific SDK guidance and distinguishes self-hosted tool loops from managed agent execution.

anthropicclaudeapi

Why we selected itExplains the operational differences among a plain API call, a tool runner, managed agents and the separate Agent SDK.

Weigh upThis is Anthropic-specific and its instructions can strongly influence model, SDK and architecture choices.

Source reviewed

7 sources · 2026-09-21

Read the full review Install command in reviewApache-2.0

Research and documentation · Anthropic

Anthropic Documentation Coauthoring

Guides a human and agent through audience discovery, section-by-section drafting and a separate-reader review of a substantial document.

documentationrfcspecifications

Why we selected itStarts with the audience, intended impact and missing context, then lets the author curate ideas before the agent drafts each section.

Weigh upReader-model agreement is a spot check, not factual verification or a human usability study; the author still needs to verify facts and links.

Source reviewed

2 sources · 2026-09-21

Read the full review Upstream setup linkedNot established

Design and interfaces · Anthropic

Anthropic Frontend Design

Builds a visual direction from the product’s audience and subject, then reviews typography, layout and interface copy against that brief.

designtypographyfrontend

Why we selected itRequires a compact design plan and a critique of generic choices before implementation.

Weigh upThis is an opinionated design process, not a component library, usability study or automated accessibility audit.

Source reviewed

5 sources · 2026-09-21

Read the full review Install command in reviewApache-2.0

Documents · Anthropic

Anthropic PDF Processing

Covers PDF extraction, transformation and form filling, with separate workflows for actual form fields and image-based overlays.

pdfformsocr

Why we selected itForm instructions require field discovery before filling, which avoids treating every PDF as the same format.

Weigh upThe bounding-box helper prints failures without setting a failing exit code; callers must inspect its messages.

Source reviewed

6 sources · 2026-09-21

Read the full review Install command in reviewAnthropic custom terms

Guides new-slide generation and template editing with OOXML validation and rendered thumbnail checks.

powerpointpptxslides

Why we selected itExplains presentation-specific failure modes in chart axes, colors and shared slide assets.

Weigh upLibreOffice previews can differ from PowerPoint font rendering; the source calls for visual review.

Source reviewed

6 sources · 2026-09-21

Read the full review Install command in reviewAnthropic custom terms

Agent development · Anthropic

Anthropic Skill Creator

Develops skills through example tasks, baseline comparisons, human review and separate trigger-description evaluation.

skillsevaluationtriggering

Why we selected itSeparates whether a skill activates from whether its instructions improve the resulting work.

Weigh upFull baseline and comparison workflows depend on subagents and Claude CLI; reduced Claude.ai paths omit those evaluations.

Source reviewed

7 sources · 2026-09-21

Read the full review Install command in reviewApache-2.0

Documents · Anthropic

Anthropic Spreadsheets

Keeps spreadsheet formulas editable and requires recalculation plus explicit inspection of formula-error results.

excelxlsxformulas

Why we selected itDistinguishes formula expressions from cached calculated values, a common source of misleading workbook output.

Weigh upRecalculation uses LibreOffice and the guide excludes several newer Excel functions that this environment cannot evaluate.

Source reviewed

5 sources · 2026-09-21

Read the full review Install command in reviewAnthropic custom terms

Browser testing · Anthropic

Anthropic Webapp Testing

Guides local browser checks with Playwright and includes a wrapper that starts development servers around an automation command.

playwrightbrowserlocal-development

Why we selected itUses rendered-page reconnaissance before choosing selectors for dynamic applications.

Weigh upThe server helper checks only whether a TCP port accepts a connection, not whether the expected application is healthy.

Source reviewed

7 sources · 2026-09-21

Read the full review Install command in reviewApache-2.0

Documents · Anthropic

Anthropic Word Documents

Separates new Word-document generation from editing existing OOXML, with explicit checks for tables, comments and tracked changes.

worddocxtracked-changes

Why we selected itDocuments the different create, edit and read paths instead of treating Word files as plain text.

Weigh upRestricted Anthropic terms apply; this is a source-available reference, not an open-source document package.

Source reviewed

6 sources · 2026-09-21

Read the full review Install command in reviewAnthropic custom terms

Development workflow · Addy Osmani

API and Interface Design

Designs stable API contracts, consistent errors and retry-safe idempotency behavior.

apicontractsdesign

Why we selected itExplains atomic idempotency claims, payload-hash checks and explicit handling of an unknown downstream outcome.

Weigh upExamples need project-specific transactions, authentication and failure recovery. Trusted internal types do not make stored user-controlled data intrinsically trustworthy.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMIT

Testing and reliability · GitHub community

Bug Receipt

Creates an evidence-bearing defect or incident handoff that distinguishes verified, partial and blocked outcomes.

debuggingverificationincident-handoff

Why we selected itRequires the observed baseline, root-cause evidence, changed artifacts and relevant checks to accompany a completion status.

Weigh upThe validator checks supplied fields and status consistency; it cannot prove that a command actually ran or that a claimed observation is correct.

Source reviewed

10 sources · 2026-09-22

Read the full review Install command in reviewMIT

Research and evidence · GitHub community

Build Evidence Map

Builds a structured map of claims, evidence and unresolved gaps, with a local validator for the map’s structure.

evidenceresearchdecision-records

Why we selected itPreserves supporting, contradicting, qualifying and missing evidence as separate relationships instead of flattening a contested choice into confident prose.

Weigh upThe bundled validator checks structure and declared excerpts; it does not establish that a source is true or that the excerpt supports the claim.

Source reviewed

10 sources · 2026-09-22

Read the full review Install command in reviewMIT

Agent development · Cloudflare

Cloudflare Agents SDK

Guides stateful Cloudflare agent applications through current SDK documentation, persistence, scheduling and approval-aware tool flows.

cloudflareagentsdurable-state

Why we selected itTreats installed SDK versions and current docs as the basis for implementation.

Weigh upThis is specific to Cloudflare’s Agents SDK and runtime, not a general multi-provider agent framework.

Source reviewed

7 sources · 2026-09-21

Read the full review Install command in reviewApache-2.0

Cloud development · Cloudflare

Cloudflare Durable Objects

Designs per-entity state and coordination with explicit persistence, concurrency and runtime-test guidance.

cloudflaredurable-objectssqlite

Why we selected itDefines where Durable Objects fit and where stateless Workers or independent requests fit better.

Weigh upA single coordination object can become a bottleneck; object boundaries must fit the workload.

Source reviewed

7 sources · 2026-09-21

Read the full review Install command in reviewApache-2.0

Security · Cloudflare

Cloudflare Turnstile Spin

Sets up, repairs, or migrates Turnstile bot verification with per-framework wiring, secret-safe validation scripts, and explicit scope boundaries.

turnstilebot-managementcaptcha-migration

Why we selected itShips six framework references including SvelteKit plus scripts for validation, widget creation, auth probing, and persistence, with a tests/validation.md checklist.

Weigh upNeeds a Cloudflare account with a Turnstile widget secret; validation runs against live configuration.

Source reviewed

7 sources · 2026-10-07

Read the full review Install command in reviewApache-2.0

Web performance · Cloudflare

Cloudflare Web Performance Audit

Builds a performance review from browser traces, request details and relevant source instead of generic optimization advice.

core-web-vitalsdevtoolslighthouse

Why we selected itStarts by discovering available measurement tools and records measurements it could not collect.

Weigh upA lab trace does not establish real-user Core Web Vitals or prove a resource is unused in every interaction.

Source reviewed

5 sources · 2026-09-21

Read the full review Install command in reviewApache-2.0

Cloud development · Cloudflare

Cloudflare Workers Best Practices

Reviews Workers code against its configured runtime, focusing on request lifetime, state isolation, streaming and binding contracts.

workerscloudflarestreaming

Why we selected itUses installed types and compatibility settings instead of assuming the newest package defines the current runtime.

Weigh upWorkers-specific guidance is not interchangeable with a Node server checklist.

Source reviewed

6 sources · 2026-09-21

Read the full review Install command in reviewApache-2.0

Cloud operations · Cloudflare

Cloudflare Wrangler Workflow

Runs Workers configuration and deployment work against the project’s installed Wrangler version and an explicitly identified target.

wranglercloudflaredeployment

Why we selected itDistinguishes local simulation from remote bindings so development commands are not assumed to be harmless.

Weigh upThe skill authorizes no cloud action by itself; commands can deploy or mutate real resources.

Source reviewed

5 sources · 2026-09-21

Read the full review Install command in reviewApache-2.0

Security review · Trail of Bits

CodeQL

Builds and checks CodeQL extraction, explicit query suites and project-specific data-flow models.

codeqlstatic-analysissecurity

Why we selected itTreats an empty or poorly extracted database as missing evidence rather than a clean security result.

Weigh upThe skill licence does not grant CodeQL product rights. Public repositories are eligible under CodeQL terms; private use may require GitHub Code Security. Exit 137 alone does not establish an Apple Silicon mismatch.

Source reviewed

4 sources · 2026-10-07

Read the full review Install command in reviewCC-BY-SA-4.0

Development workflow · Addy Osmani

Constraint-driven development

Records project quality constraints with measured baselines, enforcement commands and reviewable exceptions.

qualityconstraintsratchet

Why we selected itPairs each threshold with a concrete check and separates written policy from scripted enforcement.

Weigh upSuggested coverage/performance values are defaults, not measured guarantees. Example scanner commands need exit-code/severity wiring; a green invocation alone is not necessarily a blocking security gate.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMIT

Planning and delivery · Matt Pocock

Conversation to Specification

Turns an already-discussed change into a repository-aware specification for the configured issue tracker.

specificationplanninggithub

Why we selected itUses existing project context, glossary and architecture decisions before synthesizing requirements.

Weigh upThis is synthesis after discussion, not a discovery interview or a check that every stakeholder requirement is present.

Source reviewed

14 sources · 2026-09-22

Read the full review Install command in reviewMIT

AI application development · Datadog Labs

Datadog LLM Observability Instrumentation

Instruments a Python or Node.js/Next.js backend with Datadog LLM Observability, auditing session-ID plumbing and persisting the dependency before reporting.

llm-observabilityinstrumentationddtrace

Why we selected itRuns detection before editing: runtime, LLM framework, app framework, existing instrumentation, and the manifest to persist into are all identified in Phase 1.

Weigh upEdits source and dependency manifests, so every change needs review and a test run before it ships.

Source reviewed

7 sources · 2026-10-07

Read the full review Install command in reviewMIT

Model evaluation · Datadog Labs

Datadog Trace RCA

Root-causes production AI failures from LLM traces through phased span analysis, then converts the failure taxonomy into evaluator code.

evalroot-cause-analysisllm-traces

Why we selected itStructures the analysis as explicit phases from input resolution through open and axial coding to recommendations, instead of offering generic debugging advice.

Weigh upRequires the Datadog LLMO MCP toolset with API credentials and existing LLM Observability data; without traces there is nothing to analyze.

Source reviewed

6 sources · 2026-10-07

Read the full review Install command in reviewMIT

Databases · dbt Labs

dbt Documentation Maintenance

Audits descriptions in a dbt manifest and drafts missing model or column documentation in the project’s existing style.

dbtdocumentationsql

Why we selected itUses dbt’s resolved manifest rather than guessing YAML layout, and clearly limits column coverage to columns declared in that manifest.

Weigh upThe audit measures nonempty descriptions, not their correctness or every physical warehouse column; imported model nodes can also appear in a manifest.

Source reviewed

8 sources · 2026-09-21

Read the full review Install command in reviewApache-2.0

Testing and reliability · Matt Pocock

Diagnosing Bugs

A debugging procedure that establishes a reproducible symptom, tests competing explanations and preserves a regression check.

debuggingreproductionregression-tests

Why we selected itRequires a red-capable reproduction before edits, so an apparent improvement has a concrete behavior to compare against.

Weigh upThe included human-in-the-loop shell script is an editable single-line-input template, not a ready-made test runner or secret-redaction tool.

Source reviewed

8 sources · 2026-09-22

Read the full review Install command in reviewMIT

Research and documentation · GitHub community

Diataxis Documentation Writer

Writes docs under Diataxis discipline: clarify the quadrant, audience, goal and scope first, approve an outline, then draft tutorials, how-tos, reference or explanation in project tone.

documentationdiataxistechnical-writing

Why we selected itThe quadrant gate (tutorial, how-to, reference, explanation) plus a mandatory outline-approval step stops documentation from being written before its purpose and scope are agreed.

Weigh upFramework-first and deliberately procedural; overkill for one-paragraph answers and small edits.

Source reviewed

5 sources · 2026-10-07

Read the full review Install command in reviewMIT

Development workflow · Superpowers

Dispatching Parallel Agents

Splits independent investigations into bounded agent assignments and checks their integration afterward.

subagentsparallel-workcoordination

Why we selected itRequires independence and explicit file or subsystem scope before work is parallelized.

Weigh upShared mutable state, sequential dependencies and overlapping file edits defeat the independence assumption.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMIT

Security review · Sentry

Django access review

Traces Django and DRF ownership, query scoping and tenant boundaries to investigate authorization gaps.

djangoauthorizationidor

Why we selected itSeparates authentication from object ownership and follows inherited classes, middleware and managers before reporting.

Weigh upThis is source reasoning, not a executed multi-user access test or security certificate. Upstream notes OWASP-derived reference material under CC BY-SA; retain those notices.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewApache-2.0

Mobile development · Expo

Expo Design System

Builds a token theme (color, spacing, typography, radius, shadow, motion) plus variant/size/state component conventions inside an Expo app, with grep-based drift audits and a named gallery of AI-generated-looking anti-patterns.

design-systemdesign-tokensreact-native

Why we selected itAdopt-before-you-build rule: extend an existing styling library in its own idiom and never introduce a second token system beside it, so adoption cannot become drift.

Weigh upWhat looks native (palettes, HIG rules, controls) is delegated to the sibling expo-native-ui skill; this skill governs where values live, not which values to pick.

Source reviewed

6 sources · 2026-10-07

Read the full review Install command in reviewMIT

Mobile development · Expo

Expo Router Navigation

File-based routing for Expo Router apps: route groups, NativeTabs, native stacks, headers and search bars, modals and form sheets, with SDK-version-aware option names.

expo-routernavigationnative-tabs

Why we selected itVersion-aware guidance throughout: headerLargeTitleEnabled for SDK 56+ versus the deprecated headerLargeTitle, and expo-router/react-navigation instead of direct react-navigation imports.

Weigh upSeveral flagship patterns are iOS-gated (header search bar iOS only, Apple Zoom iOS 18+, liquid-glass sheet styling iOS 26+); Android equivalents need separate verification.

Source reviewed

6 sources · 2026-10-07

Read the full review Install command in reviewMIT

Mobile development · Expo

Expo Web to Native Migration

Migrates a web React codebase to a native Expo app screen by screen: native shell first, whole web UI shippable in DOM components on day one, then strangler-order nativization with device verification.

expomigrationreact-native

Why we selected itThe migration spine keeps the app shippable at every step: assess into a durable worklist, scaffold, DOM-component shell as the day-one milestone, then one nativized screen per pass in value order.

Weigh upThe verification recipe is opinionated about tooling: it asks the user to install agent-browser and argent simulators rather than falling back to manual screenshots.

Source reviewed

6 sources · 2026-10-07

Read the full review Install command in reviewMIT

Security review · Trail of Bits

False Positive Check

Investigates a specific suspected security bug through reachability, attacker control and counter-evidence.

securitytriageverification

Why we selected itRestates the exact root-cause claim before selecting standard or deeper verification.

Weigh upThis is finding verification, not discovery or security certification. Preserve an inconclusive outcome when evidence is missing rather than forcing a confident binary verdict.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewCC-BY-SA-4.0

Planning and delivery · GitHub community

GitHub Release Workflow

Cuts a library release end to end: tag-derived versioning, code-diff-first SemVer analysis against commit intent, Keep a Changelog authoring, and a gated release-branch plus PR handoff.

releasessemverchangelog

Why we selected itVersion analysis prefers the code diff as primary signal with commit messages secondary, and states the reconciliation rule outright: on conflict the diff wins, with worked examples.

Weigh upSingle-package GitHub repositories are assumed; monorepos and non-SemVer tag schemes fall outside the versioning logic.

Source reviewed

6 sources · 2026-10-07

Read the full review Install command in reviewMIT

Design and interfaces · Google Labs / Stitch

Google Stitch Design-System Extraction

Reads frontend source and theme files to draft a structured DESIGN.md for design-system documentation or later Stitch use.

design-systemsdesign-tokenscss

Why we selected itStarts with tokens and theme definitions, then inspects representative components to separate intended conventions from scattered overrides.

Weigh upSource extraction does not verify rendered appearance, accessibility or the effects of runtime themes. Descriptions of intent remain interpretation.

Source reviewed

9 sources · 2026-09-21

Read the full review Upstream setup linkedApache-2.0

Development workflow · Hugging Face

Gradio App Builder

A Gradio reference and example collection for building Python interfaces, event-driven layouts and chat demos.

gradiopythondemos

Why we selected itConnects component signatures and event listeners to complete examples covering forms, streaming and chat interfaces.

Weigh upThe static signatures are a source snapshot, not a version compatibility guarantee; check current Gradio documentation and your installed package.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewApache-2.0

Data and research · Hugging Face

Hugging Face Dataset Workflows

Explores Hub dataset splits and rows through the Dataset Viewer API and documents separate dataset-upload workflows.

datasetshugging-faceparquet

Why we selected itStarts with subset/split discovery before pagination, search or filtering.

Weigh upAlthough the opening describes read-only exploration, later sections create repositories and upload files or raw agent traces.

Source reviewed

5 sources · 2026-09-21

Read the full review Install command in reviewApache-2.0

Model development · Hugging Face

Hugging Face LLM Trainer

Prepares and submits managed training jobs with dataset checks, monitoring and explicit persistence of trained artifacts.

fine-tuningtrlhugging-face

Why we selected itTreats dataset shape, credentials and model persistence as prerequisites rather than leaving them until a job fails.

Weigh upThe skill directs immediate job submission for training requests; make the target, hardware and spending scope explicit before invocation.

Source reviewed

8 sources · 2026-09-21

Read the full review Install command in reviewApache-2.0

Model evaluation · Hugging Face

Hugging Face Local Model Evaluations

Chooses a local evaluation framework and inference backend, starting with a small smoke run before scaling evaluation work.

evaluationsinspect-ailighteval

Why we selected itSeparates local GPU inference from a locally launched client that calls remote Inference Providers.

Weigh upThe provider-backed helper still sends inference requests over the network; local script execution does not mean local inference.

Source reviewed

7 sources · 2026-09-21

Read the full review Install command in reviewApache-2.0

Data and research · Hugging Face

Hugging Face Paper Reading

Retrieves AI research-paper text and structured metadata, with fallbacks to the original arXiv page or PDF when Hub text is incomplete.

papersarxivliterature-research

Why we selected itSeparates paper text from metadata such as authors and linked code, models and datasets, helping a research task collect the right evidence.

Weigh upHub indexing and HTML availability vary; confirm that the fetched text is the actual paper before summarizing methods or results.

Source reviewed

6 sources · 2026-09-21

Read the full review Install command in reviewApache-2.0

Model development · Hugging Face

Hugging Face Trackio

Adds training metrics and diagnostic alerts, then retrieves run data through Trackio’s CLI or a local or hosted dashboard.

experimentstraining-metricsalerts

Why we selected itSeparates logging, alerting and retrieval into focused references, including a route from an alert to metrics around the relevant training step.

Weigh upThe private flag only affects newly created Spaces; inspect an existing Space’s visibility before uploading metrics. Webhooks and remote synchronization send data outside the machine.

Source reviewed

9 sources · 2026-09-21

Read the full review Install command in reviewApache-2.0

Documentation and knowledge · Anthropic

Internal Communications

Formats source-backed team updates, internal newsletters and employee FAQs for a defined audience.

communicationsstatus-updatesfaq

Why we selected itRoutes the request to separate Progress/Plans/Problems, newsletter, FAQ and general-communication guides.

Weigh upTemplates reflect one organization’s style; adapt audience, length and date range to your team.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewApache-2.0

Testing and reliability · Grafana Labs

k6

Authors k6 protocol and browser test scripts from task-specific examples with an explicit validation step.

k6load-testingperformance

Why we selected itDistinguishes inspection of arrival-rate load scenarios from a small local execution and checks functional assertions as well as exit status.

Weigh upA threshold breach accepted during script validation is not an SLO pass. Recheck version-specific APIs and VU-state behavior against current k6 docs; generated scripts have not been executed in this review.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewApache-2.0

Testing and reliability · Grafana Labs

k6 test maintenance

Maintains k6 scripts with behavior-change classification, validation and cloud-script hash checks.

k6load-testingmaintenance

Why we selected itSeparates syntax-only edits from changes to thresholds, targets, assertions and load shape that need an explicit review.

Weigh upA parse check cannot establish SLO or target correctness. Even short smoke requests require authorized targets; companion cloud workflows and service operations were not exercised.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewApache-2.0

Documentation and knowledge · Sentry

Maintaining AGENTS.md

Creates concise repository instructions from actual commands, conventions and existing policy files.

agents-mdinstructionsrepositories

Why we selected itInspects manifests, CI and established documentation before drafting instructions.

Weigh upIts preferred line limit and closest-file simplification are editorial conventions, not permission to discard governing policy or override higher-priority instructions.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewApache-2.0

Web development · Matt Pocock

Matt Pocock Codebase Design

Evaluates module boundaries through caller complexity, dependency seams and alternative interface designs.

architectureinterfacesrefactoring

Why we selected itDefines a deep module by what callers can accomplish through a small interface, rather than by its line count.

Weigh upThe adapter and interface rules are design heuristics, not universal requirements; local substitutes do not prove production integration behavior.

Source reviewed

14 sources · 2026-09-21

Read the full review Install command in reviewMIT

Research and documentation · Matt Pocock

Matt Pocock Domain Modeling

Builds a project glossary and short architecture decision records while testing domain terms against code and concrete edge cases.

domain-modelingglossaryarchitecture-decisions

Why we selected itDistinguishes canonical domain terms from implementation notes and uses conflicting examples to expose overloaded language.

Weigh upThe root and bounded-context instructions do not fully agree on glossary and ADR placement; agree the target paths and numbering convention first.

Source reviewed

14 sources · 2026-09-21

Read the full review Install command in reviewMIT

Research and documentation · Matt Pocock

Matt Pocock Grilling

Interviews the user through dependency-ordered decisions before the agent acts on a plan or idea.

planningrequirementsdecision-making

Why we selected itOnly asks decisions whose prerequisites are settled, so answers do not depend on unanswered questions from the same round.

Weigh upThe interview has no built-in round cap and can be too demanding for a small task; choose its scope deliberately.

Source reviewed

12 sources · 2026-09-21

Read the full review Install command in reviewMIT

Cloud operations · Microsoft

Microsoft Azure Cost Management

Connects Azure cost reports to actual billing queries, utilization evidence and separately identified savings estimates.

azurecost-managementfinops

Why we selected itRequires the total bill and service breakdown alongside optimization suggestions.

Weigh upRequires Azure billing/monitoring permissions and supporting CLI or MCP tools.

Source reviewed

8 sources · 2026-09-21

Read the full review Install command in reviewMIT

Cloud operations · Microsoft

Microsoft Azure Diagnostics

Routes Azure incidents through resource health, recent changes, logs and service-specific troubleshooting guides.

azureakslogs

Why we selected itSeparates App Service, Functions, AKS, compute and messaging investigations.

Weigh upThe AKS helper selects Azure resources by arguments but uses the existing kubectl context; confirm both point to the same cluster.

Source reviewed

7 sources · 2026-09-21

Read the full review Install command in reviewMIT

Research and documentation · Microsoft

Microsoft Docs Research

Finds current Microsoft documentation with task-specific queries and retrieves full pages when excerpts are insufficient.

microsoftazuredotnet

Why we selected itAsks for version, platform and task context in documentation searches.

Weigh upThis is a retrieval workflow, not an implementation validator; official documentation still needs to match the installed version and target environment.

Source reviewed

5 sources · 2026-09-21

Read the full review Install command in reviewMIT

Research and documentation · Microsoft

Microsoft Wiki Researcher

Traces architecture and data flow through source code to produce an explanation with file references, diagrams and stated uncertainties.

codebase-researcharchitecturedocumentation

Why we selected itRequires code-reading before architectural claims and traces actual calls and data flow rather than trusting directory names.

Weigh upIts git command identifies the current branch, although the prose calls it the default branch; choose the actual revision and host-specific link format yourself.

Source reviewed

6 sources · 2026-09-21

Read the full review Install command in reviewMIT

Development workflow · Trail of Bits

Modern Python

Sets up or modernizes Python projects with uv, Ruff, pytest and explicit migration checks.

pythonuvruff

Why we selected itSeparates new-project setup from requested migration and documents when legacy Python requirements are outside its preferred path.

Weigh upTool substitutions and coverage thresholds are recommendations, not equivalence proofs. Preserve old lockfiles and environments until the actual project passes its checks.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewCC-BY-SA-4.0

AI application development · Neon

Neon AI Gateway

Adds multi-provider LLM calling through Neon's branch-scoped gateway with one credential, resolving model IDs against the live catalog instead of hardcoded lists.

llm-gatewaymodel-routingopenai-compatible

Why we selected itIntegrates with OpenAI, Anthropic, google-genai, Vercel AI SDK, and Mastra by changing only the base URL, with separate recommended and lower-level paths.

Weigh upGateway availability and the served catalog are plan-gated; the skill's own Availability section says to check gating first.

Source reviewed

5 sources · 2026-10-07

Read the full review Install command in reviewApache-2.0

Observability · Addy Osmani

Observability and instrumentation

Plans feature telemetry around operational questions and verifies logs, metrics, traces and alerts in staging.

loggingmetricstracing

Why we selected itKeeps request correlation separate from the entry point that actually initiated a shared job.

Weigh upSample thresholds and the prescribed alerting policy are starting points, not universal SLOs. Validate untrusted request IDs and measure overhead, sampling and privacy in the real system.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMIT

AI application development · OpenAI

OpenAI Agents SDK Workflow

Builds a small Agents SDK application around an explicit workflow contract, then checks the real agent path and optional local deployment.

openaiagents-sdktools

Why we selected itStarts with a single agent and adds tools, delegation or sandboxing only when the application needs them.

Weigh upA companion credential gate can pause work before implementation even when a key already exists.

Source reviewed

6 sources · 2026-09-21

Read the full review Upstream setup linkedProprietary (declared in plugin manifest)

AI application development · OpenAI

OpenAI API Troubleshooting

Classifies a failed OpenAI request using its actual transport or API error and routes credentials, billing, throttling and access issues separately.

openaiapierrors

Why we selected itDistinguishes exhausted quota from ordinary rate limiting even when the HTTP status is the same.

Weigh upIt relies on companion documentation and credential skills; it does not provision or rotate keys itself.

Source reviewed

6 sources · 2026-09-21

Read the full review Upstream setup linkedProprietary (declared in plugin manifest)

Creates or reuses a repository threat model bound to the actual target and revision, preserving supplied context and explicit review gaps.

threat-modelingcodex-securitytrust-boundaries

Why we selected itBinds reusable models to repository/version identity and avoids mixing scan-specific context into a shared cache.

Weigh upThis is one phase in the Codex Security plugin, not a standalone full security scan.

Source reviewed

7 sources · 2026-09-21

Read the full review Upstream setup linkedProprietary (declared in plugin manifest)

Data and research · OpenAI

OpenAI Data Analytics Notebooks

Turns SQL or Python analysis into a traceable notebook whose conclusions are tied to executed outputs and stated assumptions.

jupytersqlpython

Why we selected itRecords query links, input versions, filters and cohort definitions next to the analysis.

Weigh upWarehouse and operational-log placeholders depend on the host’s configured connectors; exports or supplied data are fallback paths.

Source reviewed

5 sources · 2026-09-21

Read the full review Upstream setup linkedProprietary (declared in plugin manifest)

Agent development · OpenAI

OpenAI Evaluate Skill

Connects a local skill review to structural checks, budget explanations and an explicitly separate live benchmark workflow.

skillsevaluationtoken-usage

Why we selected itDistinguishes static instruction-size estimates from observed usage collected by real agent runs.

Weigh upStatic scores and budget bands are tool heuristics, not proof of task quality or safety.

Source reviewed

8 sources · 2026-09-21

Read the full review Upstream setup linkedMIT (declared in plugin manifest)

Security review · Trail of Bits

Post-patch validation

Compares a pinned vulnerable revision and security patch with controls, variants and explicit validation gaps.

patchesverificationsecurity

Why we selected itRequires exploit reachability markers and benign controls so an import failure cannot masquerade as reproduction.

Weigh upThe runner’s worktree/environment isolation is not an OS sandbox. This review did not audit or execute every helper, and passing supplied checks still requires coverage review.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewCC-BY-SA-4.0

API design · GitHub community

Protobuf gRPC API Review

Reviews .proto and gRPC changes as long-lived contracts across binary wire, JSON and text formats, generated APIs and runtime behavior, with mixed-version rollout tracing and a four-rung verdict.

protobufgrpcapi-compatibility

Why we selected itCompatibility is evaluated on four independent dimensions (binary wire, named formats, generated source API, behavior and operations) instead of a single wire-compatibility verdict.

Weigh upVerdicts are only as good as the declared compatibility envelope; the skill itself requires lowering confidence when encodings, consumers or deployment order are unknown.

Source reviewed

6 sources · 2026-10-07

Read the full review Install command in reviewMIT

Infrastructure development · HashiCorp

Provider configuration

Designs Terraform provider credential resolution, unknown-value guards and redacted diagnostics.

terraformauthenticationprovider

Why we selected itResolves credentials as complete sets and distinguishes absent credentials from a misconfigured source.

Weigh upThe examplecloud code is illustrative. Credential and endpoint precedence must match the real provider; do not treat endpoint or insecure-setting mismatches as automatically harmless.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMPL-2.0

Infrastructure development · HashiCorp

Provider framework migration

Migrates individual Terraform provider resources from SDKv2 to the Plugin Framework while checking state compatibility.

terraformmigrationprovider

Why we selected itUses muxing to avoid a whole-provider rewrite and treats existing schema and block syntax as compatibility contracts.

Weigh upSimple schemas still need measured compatibility. The included server example must be adapted to the real provider; no state migration or acceptance tests ran here.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMPL-2.0

Creative production · Remotion

Remotion Video Workflows

Routes video work to focused Remotion guides for creation, preview, rendering, media and reusable video applications.

videoremotionreact

Why we selected itKeeps new-project scaffolding separate from adding a composition to an existing project.

Weigh upThis is a router into a larger reference package, so copying the definition alone loses the working guidance.

Source reviewed

6 sources · 2026-09-21

Read the full review Install command in reviewNo redistribution license found

Development workflow · Superpowers

Requesting Code Review

Prepares a requirements-aware review brief around an explicit base and head revision.

code-reviewrequirementssubagents

Why we selected itGives the reviewer concrete requirements, implementation context and a bounded Git comparison.

Weigh upA base-to-head comparison excludes uncommitted changes; include those separately when they are in scope.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMIT

Languages and tooling · GitHub community

Ruff Recursive Fix

Enforces Python code quality with scoped Ruff runs: safe fixes first, unsafe fixes second with diff review each pass, then targeted manual remediation under explicit stop criteria.

pythonrufflinting

Why we selected itFix passes are ordered by blast radius: safe autofixes with diff review and formatting first, unsafe fixes only if findings remain, then minimal manual edits.

Weigh upUnsafe autofixes can change behavior; the workflow's value depends on actually performing its mandated diff reviews rather than waving them through.

Source reviewed

5 sources · 2026-10-07

Read the full review Install command in reviewMIT

Security review · Trail of Bits

Rust review

Orchestrates a scoped Rust security review with worker coverage records, duplicate review and explicit incomplete results.

rustunsafesecurity

Why we selected itSeparates finding scope from broader read-only context and validates worker artifacts before accepting completion.

Weigh upInstalling only this SKILL.md directory does not install the parent plugin scripts, prompts and named agents. Host-specific tool/cache assumptions and security findings need independent verification.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewCC-BY-SA-4.0

Testing and reliability · Trail of Bits

SARIF Parsing

Extracts and summarizes SARIF findings with reusable jq examples and a Python helper.

sarifstatic-analysisci

Why we selected itExplains run structure and severity inheritance instead of treating every absent result.level as the same severity.

Weigh upThe helper is not a complete SARIF validator: invocation-level ruleConfigurationOverrides and extension rule components are not resolved.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewCC-BY-SA-4.0

Security and privacy · Trail of Bits

Semgrep Rule Creator

Turns a concrete bug pattern into a Semgrep rule with positive and negative test cases.

semgrepstatic-analysisregression-tests

Why we selected itRequires vulnerable and safe examples before rule implementation, then runs Semgrep validation and rule tests.

Weigh upA passing fixture suite establishes behavior on those examples; it does not prove complete detection or an acceptable false-positive rate on other repositories.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewCC-BY-SA-4.0

Research and documentation · Sentry

Sentry API Endpoint Documentation

Aligns a Sentry API endpoint’s runtime response, TypedDict definitions and drf-spectacular OpenAPI schema.

openapidjango-rest-frameworksentry

Why we selected itChecks runtime serialization against types and schema, including the difference between an absent field and a nullable one.

Weigh upThe file paths, ownership checks and validation commands are specific to Sentry; this is not a drop-in guide for every Django API.

Source reviewed

7 sources · 2026-09-21

Read the full review Install command in reviewApache-2.0

Git commits · Functional Software, Inc. dba Sentry

Sentry commit message

Guides Sentry-style conventional commit messages, branch checks and one coherent local commit at a time.

gitcommitsentry

Why we selected itRequires a branch check before committing and a feature branch by default, making the target of a local commit explicit.

Weigh upThe skill can create a feature branch and a git commit; it is not a read-only message formatter. It does not instruct a push.

Source reviewed

5 sources · 2026-10-07

Read the full review Install command in reviewApache-2.0

Testing and reliability · Sentry

Sentry Django Performance Review

Reviews Django code for proven performance issues only, with ordered rules for N+1 queries, serializers, model properties, and unbounded querysets.

djangoormn-plus-one

Why we selected itStates its evidence rule up front and repeats it as a validation checklist: research the codebase to confirm each issue and report only what can be proven.

Weigh upDjango-only; its ORM rules do not transfer to other frameworks or raw SQL tuning.

Source reviewed

4 sources · 2026-10-07

Read the full review Install command in reviewApache-2.0

Testing and reliability · Sentry

Sentry Find Bugs

Reviews a branch diff against surrounding code and existing tests, reporting only substantiated issues and explicit coverage limits.

code-reviewgit-diffsecurity-review

Why we selected itRequires the complete diff to be read before findings and follows changed behavior into surrounding implementations and tests.

Weigh upThe initial command compares committed branch history and omits uncommitted edits; inspect those separately if they are in scope.

Source reviewed

6 sources · 2026-09-21

Read the full review Install command in reviewApache-2.0

AI application development · Sentry

Sentry Prompt Optimizer

Optimizes agent and system prompts through contracts, context inventory, and evals, including porting prompts between model families.

promptsprompt-evalstoken-cost

Why we selected itRequires a captured contract and external-context inventory before wording changes, which keeps optimization causal instead of stylistic.

Weigh upPorted prompts still need verification on the target model; family notes are guidance, not equivalence proofs.

Source reviewed

6 sources · 2026-10-07

Read the full review Install command in reviewApache-2.0

Security review · Sentry

Skill scanner

Reviews an agent skill’s instructions, scripts and requested permissions for adoption risks.

skillssupply-chainreview

Why we selected itDistinguishes malicious instructions from security examples discussing the same syntax.

Weigh upA clean pattern scan cannot certify a skill safe, and repository hosting on GitHub or PyPI does not establish trust. Scanner scripts and detection effectiveness were not runtime-tested here.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewApache-2.0

Planning and delivery · Matt Pocock

Specification to Dependency-Aware Tickets

Splits an agreed plan into small vertical slices, with explicit blocking relationships and a review before publication.

ticketsdependenciesplanning

Why we selected itAsks for user agreement on the proposed breakdown before creating the tickets.

Weigh upTicket publication is not transactional: partial failures or repeated runs can leave duplicates and incomplete dependency links.

Source reviewed

14 sources · 2026-09-22

Read the full review Install command in reviewMIT

Databases · Supabase

Supabase Development

Covers the full Supabase surface beyond Postgres tuning: Auth flows, client and SSR integration, CLI and MCP use, declarative or imperative schema changes, and structured debugging.

supabaseauthmigrations

Why we selected itSeparates declarative schemas from imperative migrations and pairs each path with committing guidance instead of treating all schema edits alike.

Weigh upTriggers on any Supabase task, so it can load for work the narrower Postgres skill would handle better; pick the skill per task.

Source reviewed

6 sources · 2026-10-07

Read the full review Install command in reviewMIT

Connects Postgres schema and query decisions to worked SQL examples, connection guidance and row-level security checks.

postgresqlsqlindexes

Why we selected itPairs incorrect and corrected SQL with query-plan examples instead of offering only generic database advice.

Weigh upIllustrative speedups and blanket indexing rules are not measurements of your workload; inspect actual plans and write costs.

Source reviewed

7 sources · 2026-09-21

Read the full review Install command in reviewMIT

Testing and reliability · Jesse Vincent / Superpowers

Superpowers Receiving Code Review

Checks review feedback against the code and project constraints before making and testing each requested change.

review-feedbackregressionsverification

Why we selected itTreats reviewer suggestions as hypotheses to verify, with explicit checks for existing behavior, platform constraints and unused functionality.

Weigh upIts conversational tone rules are a style preference, and its pause-on-ambiguity rule may be too restrictive for independent review items.

Source reviewed

6 sources · 2026-09-21

Read the full review Install command in reviewMIT

Testing and reliability · Jesse Vincent / Superpowers

Superpowers Systematic Debugging

Moves debugging from reproducible evidence through a single hypothesis to a verified fix, with a stop point for repeated failed attempts.

debuggingroot-causereproduction

Why we selected itAsks for evidence at component boundaries and backward tracing of bad values before proposing a patch.

Weigh upThe bundled polluter helper assumes npm tests, hides their output and swallows their failing exit statuses.

Source reviewed

7 sources · 2026-09-21

Read the full review Install command in reviewMIT

Testing and reliability · Jesse Vincent / Superpowers

Superpowers Test-Driven Development

Makes an observed failing behavior test the entry point for implementation and checks that assertions can detect real production mistakes.

tddregression-teststest-design

Why we selected itRequires verifying why a test fails before changing implementation, then running the project suite after the fix.

Weigh upThe workflow is deliberately prescriptive: it tells an agent to discard implementation written before tests and seek permission for exceptions.

Source reviewed

6 sources · 2026-09-21

Read the full review Install command in reviewMIT

Testing and reliability · Jesse Vincent / Superpowers

Superpowers Verification Before Completion

Requires a fresh command result or direct check for each completion claim and distinguishes passing tests from fulfilling requirements.

verificationevidencebuilds

Why we selected itMaps common claims to appropriate evidence, including compiler/build status, original bug reproduction and requirements checks.

Weigh upThis is a behavioral checklist, not an automatic enforcement mechanism or runtime test harness.

Source reviewed

5 sources · 2026-09-21

Read the full review Install command in reviewMIT

Research and documentation · Jesse Vincent / Superpowers

Superpowers Writing Plans

Turns an agreed specification into file-specific implementation tasks with verification steps and a structured plan review.

implementation-planningspecificationstests

Why we selected itMakes each task name concrete files, expected behavior and meaningful failing/passing checks rather than leaving implementation placeholders.

Weigh upDetailed code in a plan can become stale as the repository changes; planned checks are not evidence that tests have run.

Source reviewed

7 sources · 2026-09-21

Read the full review Install command in reviewMIT

Security and privacy · Trail of Bits

Supply Chain Risk Auditor

Collects dependency identity, advisory and repository-maintenance evidence while retaining unassessable cases.

dependenciessupply-chainprovenance

Why we selected itKeeps ecosystem and resolved package versions attached to evidence and distinguishes unknown results from clean checks.

Weigh upDocumented project inputs include npm package-lock/shrinkwrap, Python uv.lock and supported Go module files; other lock formats need a separate extraction step.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewCC-BY-SA-4.0

Framework development · Svelte

Svelte Core Best Practices

Svelte-maintained guidance for reactivity, component composition and integration with browser APIs.

sveltereactivitycomponents

Why we selected itExplains when to derive state instead of synchronizing it with effects, and when reactive wrappers or subscriptions are needed.

Weigh upThe references span several Svelte releases and include experimental async behavior. Check the installed compiler version and required flags before applying an example.

Source reviewed

16 sources · 2026-09-22

Read the full review Install command in reviewMIT

Infrastructure development · HashiCorp

Terraform Provider Resources

Guides Terraform Plugin Framework CRUD, import, waiters and state-preserving provider changes.

terraformprovidergo

Why we selected itSeparates read-time not-found removal from deletion, and compares planned attributes with state before update calls.

Weigh upThe fictional examplecloud snippets are patterns, not a standalone compiled provider. Install the accompanying references and companion test guidance; no cloud CRUD was exercised.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMPL-2.0

Infrastructure development · HashiCorp

Terraform Stacks

Guides Terraform Stacks components, deployments, workload identity and deployment monitoring.

terraformstackshcl

Why we selected itKeeps component and deployment languages separate and documents ephemeral credentials and provider bindings.

Weigh upExamples are not tested deployments. A rule forbidding deletions alone does not make every remaining update safe; review resource changes, billing and approval policy.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMPL-2.0

Development workflow · HashiCorp

Terraform style guide

Applies Terraform HCL organization, naming, variable documentation and formatting conventions.

terraformstylehcl

Why we selected itShows separation of providers, variables, resources and outputs, with sensitivity and version-control guidance.

Weigh upThe resource snippets omit project-specific required values and are not deployment-ready. Suggested versions and latest-provider guidance do not authorize an upgrade.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMPL-2.0

Security · Trail of Bits

Trail of Bits Audit Context Building

Builds a cited dossier of function invariants, assumptions and dependencies before a separate vulnerability-hunting pass.

auditcode-understandinginvariants

Why we selected itFollows callees and unsuccessful paths instead of trusting names such as validate or authorize.

Weigh upThe skill is a router into a plugin workflow and named function analyzer; a copied standalone SKILL.md is insufficient.

Source reviewed

8 sources · 2026-09-21

Read the full review Upstream setup linkedCC-BY-SA-4.0

Reviews security-relevant changes against their baseline, removed protections, callers and concrete attacker scenarios.

diff-reviewgit-historysecurity

Why we selected itUses git history to ask why a removed check existed and whether a previous fix is being undone.

Weigh upThe methodology includes checking out the baseline and head; use a suitable worktree so the review does not disrupt uncommitted work.

Source reviewed

7 sources · 2026-09-21

Read the full review Upstream setup linkedCC-BY-SA-4.0

Languages and tooling · Trail of Bits

Trail of Bits Modern C++

Moves C++ toward C++20/23/26 idioms with a 30-pattern migration table, usability-tiered feature guidance, and compiler-hardening and sanitizer minimums for security-critical code.

cppmodern-cppmemory-safety

Why we selected itFeature tiers rank by practical usability today (use now, deploy without a standard bump, plan for, watch) instead of reciting the standard in version order.

Weigh upC++26 positions (reflection availability, contracts caution, execution immaturity) are roadmap judgments; verify against the installed toolchain before restructuring around them.

Source reviewed

6 sources · 2026-10-07

Read the full review Install command in reviewCC-BY-SA-4.0

Testing and reliability · Trail of Bits

Trail of Bits Mutation Analysis

Interprets mutation campaign results and turns survivors into qualified test-gap reports or separately reproduced bug findings.

mutation-testingtest-gapsmewt

Why we selected itSeparates test-gap analysis from bug hunting, so an uncaught mutation is not automatically presented as a vulnerability.

Weigh upThis selection focuses on existing-report analysis. Setup and optimization need separate review: examples hardcode src/, retain a pre-optimization acceptance check and mix counting formats. Do not copy their campaign estimates or purge steps unchanged.

Source reviewed

15 sources · 2026-09-21

Read the full review Install command in reviewCC-BY-SA-4.0

Testing and reliability · Trail of Bits

Trail of Bits Property-Based Testing

Chooses meaningful invariants and generators for tests that explore an input domain, while rejecting tautological or vacuous assertions.

property-testinghypothesisinvariants

Why we selected itExplains how tests can pass while restating implementation or filtering away nearly every input.

Weigh upProperty selection still needs a valid specification; an incorrect invariant can generate misleading failures.

Source reviewed

6 sources · 2026-09-21

Read the full review Upstream setup linkedCC-BY-SA-4.0

Security · Trail of Bits

Trail of Bits Sharp Edges

Examines APIs and configuration for cases where ordinary developer mistakes can disable a security boundary.

api-designsecure-defaultsconfiguration

Why we selected itLooks at zero, empty, negative and mixed-up values rather than only intended happy-path usage.

Weigh upThis is a design-review method, not a general implementation bug scanner.

Source reviewed

6 sources · 2026-09-21

Read the full review Upstream setup linkedCC-BY-SA-4.0

Evidence and evaluation · Undominated.ai

Undominated · AI resource intake audit

Review a skill, agent or MCP server for pinned source identity, licensing, requested permissions and observable verification before adding it to a trusted collection.

skillsagentsmcp

Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.

Weigh upDeterministic local checks over supplied evidence; not a guarantee of source truth or production suitability.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMIT

Evidence and evaluation · Undominated.ai

Undominated · Alias resolution

Resolve an explicitly supplied alias to one distinct concrete target, refusing unresolved or conflicting candidate evidence. Use before treating a latest-style pointer as a concrete model ID.

identityaliascatalogue

Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.

Weigh upChecks one caller-supplied candidate set, refusing unresolved, conflicting and self-targets. It does not verify target existence, candidate completeness, recency or recursively resolve aliases.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMIT

Evidence and evaluation · Undominated.ai

Undominated · Benchmark cohort audit

Audit a benchmark comparison for matched model identity, missing coverage, restricted populations and misleading confidence-interval interpretations.

benchmarksstatisticscoverage

Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.

Weigh upDeterministic local checks over supplied evidence; not a guarantee of source truth or production suitability.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMIT

Evidence and evaluation · Undominated.ai

Undominated · Context-tier ladder audit

Check a past-this-length price multiple against every rung, so the dearest rung is not applied at the first boundary.

pricingcontexttiers

Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.

Weigh upDeterministic local check of a supplied ladder; it does not fetch vendor prices or model marginal block billing.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMIT

Evidence and evaluation · Undominated.ai

Undominated · Dominance wording audit

Classify a two-model comparison before publishing it, so a tie or a dropped requirement is not called both better and cheaper.

dominancewordingcapabilities

Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.

Weigh upDeterministic local checks over one supplied pair and the listed requirements; not a guarantee of source truth.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMIT

Evidence and evaluation · Undominated.ai

Undominated · Evidence audit

Audit a numeric claim against locally saved source evidence, including denominator and reproducible calculations, before citing or publishing it.

evidenceprovenanceclaims

Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.

Weigh upDeterministic local checks over supplied evidence; not a guarantee of source truth or production suitability.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMIT

Evidence and evaluation · Undominated.ai

Undominated · Filter invariance

Check that filtering preserves the relative order of retained IDs. Use for search or facet behavior that is intended to hide rows without re-sorting them.

rankingfilterspopulation

Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.

Weigh upChecks one supplied ordered population and subsequence, including empty arrays. It does not check scores, numeric ranks, frontier membership or dominance labels.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMIT

Evidence and evaluation · Undominated.ai

Undominated · Final-host audit

Refuse a vendor quote when the final host you recorded is not the host you requested. A redirect is not that vendor. www is not stripped, and this checker sends no request.

provenancepricingaudit

Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.

Weigh upCompares the two host strings you supply. It does not send a request, read a body, or strip www. A pass is not a rate card.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMIT

Evidence and evaluation · Undominated.ai

Undominated · Final-path audit

Refuse a page claim when the final path you recorded is not the path you requested. A redirect to the homepage is not that page. The host is a different checker, and this one sends no request.

provenancepricingaudit

Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.

Weigh upChecks recorded path strings in a narrow ASCII subset. It rejects whitespace, doubled leading slashes, URLs, queries, fragments and dot segments; it does not fetch, compare hosts, decode percent escapes, or verify page content.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMIT

Evidence and evaluation · Undominated.ai

Undominated · Header-not-row audit

Refuse a unit claim that borrows the table's display header when that row does not state its own unit. A per-million header is not every row's invoice unit. Amounts are not read.

pricingmeteraudit

Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.

Weigh upThe header is ignored. rowUnit has to come from that row's own sentence, or be null. It does not read amounts or convert units. A pass is not a vendor quote.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMIT

Evidence and evaluation · Undominated.ai

Undominated · Indicative-rate audit

Refuse a global-rate claim when the excerpt says the figure is indicative, varies by country, starts at a floor, or is a list price beside a credit. One sentence is not every region's rate.

pricingregionaudit

Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.

Weigh upLooks for qualifying wording in the excerpt you supply. Negation is not parsed. It does not read amounts or pick a country. A pass is not a vendor quote.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMIT

Evidence and evaluation · Undominated.ai

Undominated · Licence-boundary audit

Check a redistribution claim against the licence evidence you recorded. A public page is not a licence.

licensingredistributionattribution

Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.

Weigh upDeterministic consistency check of a filled licence note; it does not interpret licence text or fetch the licence.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMIT

Evidence and evaluation · Undominated.ai

Undominated · Model migration preflight

Check a proposed model replacement for required modalities, context, tool use, structured output and evaluation coverage before calling it a safe saving.

modelsmigrationcompatibility

Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.

Weigh upDeterministic local checks over supplied evidence; not a guarantee of source truth or production suitability.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMIT

Evidence and evaluation · Undominated.ai

Undominated · Multiplier-aside audit

Refuse a base-rate claim when the excerpt names a multiplier. Priority, fast, and scale factors are not the on-demand rate. The number in 2x is not read as a price.

pricingmultiplieraudit

Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.

Weigh upLooks for multiplier wording in the excerpt you supply. Negation is not parsed. It does not read amounts or apply a factor. A pass is not a vendor quote.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMIT

Evidence and evaluation · Undominated.ai

Undominated · Payback basis

Check switching-cost payback against savings per period using exact arithmetic. Use when a migration claims to pay back in a stated number of periods.

costmigrationarithmetic

Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.

Weigh upExact savings-based arithmetic only; repeating results remain rational pairs. Currency and period alignment, taxes, timing, discounting and source truth are not verified.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMIT

Evidence and evaluation · Undominated.ai

Undominated · Plan-quote hygiene

Keep unverified subscription quotes out of a USD monthly ceiling. A source sentence is not a price.

plansquotescurrency

Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.

Weigh upDeterministic local checks over a supplied plan table; not a guarantee that a vendor page still matches.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMIT

Evidence and evaluation · Undominated.ai

Undominated · Provider quote comparison

Compare like-for-like provider quotes with complete context tiers and distinct sellers; recompute workload cost without inventing cache or reasoning discounts.

pricingproviderstier-ladders

Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.

Weigh upDeterministic local checks over supplied evidence; not a guarantee of source truth or production suitability.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMIT

Evidence and evaluation · Undominated.ai

Undominated · Resource release proof

Verify local release artifacts and meaningful public-response receipts without confusing a build, HTTP 200 or registry metadata with a working installation.

releasesverificationdistribution

Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.

Weigh upDeterministic local checks over supplied evidence; not a guarantee of source truth or production suitability.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMIT

Evidence and evaluation · Undominated.ai

Undominated · Schema-not-quote audit

Refuse a model-rate claim when the excerpt describes a pricing field or a schema. "Values are in" a unit is a field description, not a model's rate. Amounts are not read.

pricingprovenanceaudit

Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.

Weigh upLooks for schema phrases in the excerpt you supply. Negation is not parsed. It does not read amounts. A plain pass is not a vendor quote.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMIT

Evidence and evaluation · Undominated.ai

Undominated · Seller-spread audit

Check a price-spread multiple against distinct seller owners, so one vendor's own service tiers are not counted as competition.

pricingsellersspread

Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.

Weigh upDeterministic local checks over supplied rows and caller-assigned seller owners; not a guarantee of source truth or market coverage.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMIT

Evidence and evaluation · Undominated.ai

Undominated · Serving-mode attribution

Check that an explicit claimed score belongs to its named model or serving mode. Use when a model headline may have inherited a mode-specific score.

benchmarkidentityattribution

Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.

Weigh upChecks explicit claimedScore and named-subject equality only. It does not verify benchmark provenance, source truth or shared measurement conditions.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMIT

Evidence and evaluation · Undominated.ai

Undominated · Single-base audit

Refuse a single-base price claim when the excerpt names both sides of a cache split or a peak split. Spelling USD per million does not make cache-hit and cache-miss one rate.

pricingcacheschedule

Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.

Weigh upChecks two splits in the excerpt you supply. It does not fetch a page, read amounts, or decide which sentence is the invoice. Batch, region, and input-versus-output are outside this check. A pass is not a vendor quote.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMIT

Evidence and evaluation · Undominated.ai

Undominated · Slug-is-not-body audit

Refuse a currency or quantity claim whose words appear only in a URL, a slug, or a title. The excerpt is the body. A path named pricing-details-usd does not state USD.

pricingprovenancecurrency

Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.

Weigh upReads the excerpt only. A locator is ignored. It does not fetch a page or read amounts. A pass is not a vendor quote.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMIT

Evidence and evaluation · Undominated.ai

Undominated · Source-pin audit

Refuse a source identity that is only a branch, a tag, or a short SHA. A full 40-hex revision is the pin. The name v7 or main does not become that revision.

provenancerevisionaudit

Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.

Weigh upChecks the revision string you supply. It does not fetch a repository, resolve a tag, or prove the tree was read. A pass is not a source review.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMIT

Evidence and evaluation · Undominated.ai

Undominated · Status-not-page audit

Check a supplied status against a conservative integer-200-only gate and refuse every quote claim based on status alone. No status proves a body was received or read. This checker sends no request.

provenancepricingaudit

Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.

Weigh upChecks a conservative status policy only. A 200 result is status-eligible; every other valid status needs review and every quote claim is refused. No status establishes that a response body was received or read; bodyVerified is always false.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMIT

Evidence and evaluation · Undominated.ai

Undominated · Withdrawal residue

Check an explicitly observed withdrawn numeric field and its named dependents for leftover values. Use after a source value has been removed from a snapshot.

withdrawalevidenceconsistency

Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.

Weigh upRequires the explicit observed withdrawnValue and named numeric dependents. It cannot verify withdrawal or discover omitted dependencies; zero remains residue and empty coverage requires review.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewMIT

Data and analytics · dbt Labs

Upgrading dbt

Plans a dbt v1 migration to 1.12 using adapter-specific issue bundles and a recorded verification gate.

dbtmigrationwarehouses

Why we selected itSeparates sequential pre-1.8 changes from detected behavior flags and preserves unresolved outside-repository job changes.

Weigh upIts stated target is 1.12, not a promise to reach whichever release is newest. Starting versions 1.3–1.7 have bundles; later versions have narrower flag handling. Parsing alone does not prove migration correctness.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewApache-2.0

Security and privacy · Trail of Bits

Variant Analysis

Expands a confirmed vulnerability into related-code searches while preserving root-cause evidence and triage decisions.

variant-analysiscodeqlsemgrep

Why we selected itStarts from a verified instance and broadens one abstraction at a time, with explicit false-positive review.

Weigh upPattern matches are candidates, not confirmed vulnerabilities; reachability, sanitization and impact still need review.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewCC-BY-SA-4.0

Cloud operations · Vercel

Vercel Optimize

Runs a metrics-first Vercel audit: collects usage signals before reading source, gates candidates deterministically, then produces ranked cost and performance recommendations.

vercelcost-optimizationperformance

Why we selected itEnforces an observability-first pipeline: no source file is inspected until signals.json exists and a deterministic gate names a route, file, or setting, which blocks speculative rewrites.

Weigh upNeeds Vercel project access and usage metrics; without signals the workflow stops by design and produces nothing.

Source reviewed

6 sources · 2026-10-07

Read the full review Install command in reviewMIT (declared in upstream README)

Web development · Vercel

Vercel React Best Practices

Organizes React and Next.js performance reviews around request waterfalls, bundles, server work and rendering costs.

reactnextjsperformance

Why we selected itPairs rules with incorrect and corrected code, making recommendations easier to inspect.

Weigh upPublished impact labels and example speedups are not measurements of your application.

Source reviewed

7 sources · 2026-09-21

Read the full review Install command in reviewMIT (declared in upstream README)

Web development · Vercel

Vercel React Composition Patterns

Replaces growing boolean-mode APIs with explicit component composition and provider-owned state contracts.

reactcomponent-designcontext

Why we selected itShows complete before-and-after component variants rather than only naming the compound-component pattern.

Weigh upContext and compound components can add indirection to a simple component; apply the pattern where variation warrants it.

Source reviewed

7 sources · 2026-09-21

Read the full review Install command in reviewMIT (declared in upstream README)

Mobile development · Vercel

Vercel React Native Skills

Provides React Native and Expo patterns for scrolling, animations, native navigation and dependency layout.

react-nativeexpomobile

Why we selected itIncludes worked mobile-specific examples rather than reusing browser performance guidance.

Weigh upThe list rule recommends virtualization even for short lists; that is a prescriptive default, not a measured requirement for every screen.

Source reviewed

7 sources · 2026-09-21

Read the full review Install command in reviewMIT (declared in upstream README)

Design and interfaces · Vercel

Vercel Web Interface Guidelines

Reviews interface code against a freshly fetched guideline set and returns file-specific findings.

accessibilityformsui-review

Why we selected itCovers concrete interaction details such as focus visibility, form labeling, asynchronous announcements and URL state.

Weigh upThe skill fetches a mutable external rules file at runtime; pinning the skill alone does not freeze the guidance.

Source reviewed

6 sources · 2026-09-21

Read the full review Install command in reviewMIT (declared in upstream README)

Localization · GitHub community

VS Code Extension Localization

Localizes VS Code extensions by routing each string to its correct target: package manifest files, walkthrough markdown, or code l10n bundles.

localizationvscode-extensionsi18n

Why we selected itThree localization approaches keyed to resource type (manifest, walkthrough, code strings) instead of one blanket rule applied to all strings.

Weigh upVS Code extensions only; not a general i18n-framework guide and silent on pluralization, ICU formats and RTL layout.

Source reviewed

5 sources · 2026-10-07

Read the full review Install command in reviewMIT

Web development · Addy Osmani

Web Quality Audit

Runs an evidence-led site audit across performance, accessibility, SEO, best practices and agentic browsing, routing each check to live traces first with CLI fallbacks, and closes with re-run verification.

web-qualitylighthouseaccessibility

Why we selected itMeasured findings and code-only hypotheses are kept in separate columns, and the Performance section tracks the Lighthouse move to shared Performance Insights instead of requiring retired audit IDs.

Weigh upIts own reference list points at the sibling accessibility skill withheld in wave 1 over a px-versus-pt contrast-table error; follow this audit's ratio-only checks and current WCAG text instead of that table.

Source reviewed

6 sources · 2026-10-07

Read the full review Install command in reviewMIT

Security review · Trail of Bits

Zeroize audit

Investigates C, C++ and Rust secret-memory cleanup with source, compiler and optional runtime evidence.

cryptographyzeroizecompilers

Why we selected itRequires build context and compiler output before attributing a missing wipe to optimization.

Weigh upRead-only target intent does not sandbox compilers or generated checks. Evidence labels and example reports are not independently verified zeroization proofs; AArch64 and unsupported Rust categories require manual review.

Source reviewed

3 sources · 2026-10-07

Read the full review Install command in reviewCC-BY-SA-4.0

03 / BEHIND THE SELECTION

The review is part of the product.

A useful recommendation tells you why it fits—and what still needs checking.

What we inspect

We inspect the skill instructions and relevant supporting material, look for a concrete workflow and useful checks, and record dependencies, permissions and limitations. Each review names the files actually examined. Directory popularity is a discovery signal, not a quality verdict.

What a selection means

Each resource has a concrete use case, original selection reasons, named limitations and a dated review record. We favour specific instructions, useful scope and inspectable setup. The list is curated; it is not a census of everything available or an independently benchmarked league table.

Before using it

Read the complete review, check the upstream revision and match the resource to your own host and permissions. Review notes apply to the material named at the recorded date. Installation commands may retrieve a newer upstream version.

Where we looked

Download this index as JSON ↗
Selections we withheld (33)

These are documented decisions from this review, not a blacklist of the wider ecosystem.

  • playwright: The publisher explicitly deprecated this repository and directs current skill/plugin users to openai/plugins. Its source was inspected but it is not selected as a current recommendation.Source ↗
  • security-best-practices: The publisher explicitly deprecated this repository and directs current skill/plugin users to openai/plugins. Its source was inspected but it is not selected as a current recommendation.Source ↗
  • security-threat-model: The publisher explicitly deprecated this repository and directs current skill/plugin users to openai/plugins. Its source was inspected but it is not selected as a current recommendation.Source ↗
  • gh-fix-ci: The publisher explicitly deprecated this repository and directs current skill/plugin users to openai/plugins. Its source was inspected but it is not selected as a current recommendation.Source ↗
  • jupyter-notebook: The publisher explicitly deprecated this repository and directs current skill/plugin users to openai/plugins. Its source was inspected but it is not selected as a current recommendation.Source ↗
  • speech: The publisher explicitly deprecated this repository and directs current skill/plugin users to openai/plugins. Its source was inspected but it is not selected as a current recommendation.Source ↗
  • transcribe: The publisher explicitly deprecated this repository and directs current skill/plugin users to openai/plugins. Its source was inspected but it is not selected as a current recommendation.Source ↗
  • figma-implement-design: The publisher explicitly deprecated this repository and directs current skill/plugin users to openai/plugins. Its source was inspected but it is not selected as a current recommendation.Source ↗
  • Expo EAS Workflows: Withheld pending clearer setup and trigger guidance. The helper depends on import.meta.main but declares no Node.js version requirement. The embedded key list describes a trigger as required, while the current service schema requires only jobs and official documentation allows manual runs without on. Resolve these differences before relying on the installed instructions.Source ↗
  • Neon Postgres Branching: Withheld at the inspected revision: its lifecycle policy returns no changes for every existing branch, while the subsequent guidance says to apply that policy to an existing branch. The branching and reset material remains useful background, but this reconciliation path needs correction before recommending the installable workflow.Source ↗
  • Sentry Skill Inspection: Withheld at the inspected revision: the helper copies a matching source line into its secret-detection evidence without redacting the matched value, despite a masking comment. It also reads files before reporting symlinks. Resolve these output and input-handling concerns before running it on sensitive or untrusted material.Source ↗
  • Neon Postgres Egress Review: Withheld pending clearer operational examples. The bundled compute policy returns no changes for every existing branch while the next command is described as applying it to the current branch. Its query rankings use row and call counts rather than network bytes, and resetting statistics discards the existing measurement window. These need reconciliation before a guided cost-reduction recommendation.Source ↗
  • Sentry Django Access Review: Withheld pending clarification of the examples and reference loading. The DRF reference places an unscoped return before the scoped return in the same function, making the latter unreachable if copied. The main definition also does not link its four useful references. The investigation method has value, but the installable material needs more precise guidance before selection.Source ↗
  • Expo SDK Upgrade: Withheld after inspecting the complete references: the main workflow says to migrate uses before removing expo-av, while the video reference tells readers to uninstall it before installing expo-video. Reconcile this migration order against the target app and current Expo documentation before adoption.Source ↗
  • Stripe Best Practices: Withheld at the inspected revision: required payment and security reference links point to documentation URLs that returned HTTP 404 during this review. Related files exist in the repository, but the installed workflow needs its reference routing checked before recommendation.Source ↗
  • Stripe Upgrade Workflow: Withheld pending reconciliation: the useful live-version and no-downgrade guidance is paired with legacy global/module-level SDK examples, while the companion current best-practices skill explicitly rejects those patterns. Follow current SDK documentation instead of copying the bundled examples unchanged.Source ↗
  • Microsoft Playwright CLI Skill: Withheld at the inspected revision: its test-generation guide requires scenario files inside tests/<group>/ but imports ./fixtures even though the shown fixture lives at tests/fixtures.ts. The same guide gives conflicting sequential/parallel instructions. Correct those examples before relying on its generation workflow.Source ↗
  • Addy Osmani Accessibility: Withheld at the inspected revision: its contrast table uses CSS pixels where WCAG’s large-text exception uses points. Applying that lower size threshold could accept insufficient contrast; verify the current W3C criterion rather than copying the table.Source ↗
  • Microsoft Azure Monitor OpenTelemetry for Python: Withheld pending correction: the main definition presents instrumentations as an allow-list, while its own reference and Microsoft’s current API documentation use instrumentation_options with enable/disable entries. The configuration and default behavior need reconciliation before recommendation.Source ↗
  • Superpowers Git Worktree Setup: Withheld at the inspected revision: the ignore check succeeds when either .worktrees or worktrees is ignored, rather than checking the directory actually selected. This can let an unignored local worktree path pass the stated safety check.Source ↗
  • GitHub Implementation Plan: Withheld pending reconciliation: the required GOAL example is not a declaration under the skill’s own rules, and its separate regex checks miss cross-form duplicates. The advertised template-validation contract therefore does not match the checks provided.Source ↗
  • Datadog Monitor Management: Withheld at the inspected revision: the noisy-monitor audit sorts state-change timestamps rather than alert counts, and its ownership test looks for a literal team: tag rather than a team-prefixed tag. Those examples can misclassify the monitors they claim to audit.Source ↗
  • Datadog Flaky-Test Triage: Withheld pending reconciliation: one step sends an unknown cause to quarantine while a later decision table sends a low-rate unknown cause to escalation. The same inputs can produce different actions, including a shared test-management state change.Source ↗
  • Trail of Bits Modern Python: Withheld at the inspected revision: the requirements migration loop continues after an individual dependency import fails, then instructs removal of the old requirements files and environment. Confirm a complete dependency migration before following that destructive cleanup.Source ↗
  • Hugging Face AWS Context Discovery: Withheld at this revision: the identity branch treats an IAM Identity Center/SSO ARN as evidence that IAM roles cannot be created. Effective permissions depend on the assigned permission set and policies, so the identity alone cannot settle the preflight.Source ↗
  • Hugging Face SageMaker IAM Preflight: Withheld at this revision: the workflow inherits the assumption that an SSO principal cannot create a role and tells the user to stop on that basis. Check actual assigned IAM permissions instead of deriving this restriction from the sign-in type.Source ↗
  • Hugging Face Local Models: Withheld at this revision: the llama.cpp setup still instructs users to run make, while the current upstream Makefile explicitly rejects that removed build path and directs users to CMake.Source ↗
  • Matt Pocock Resolving Merge Conflicts: Withheld for broad use: the compact workflow directs the agent to always resolve, never abort, and stage everything before committing. It does not bound those writes to the requested conflict or protect unrelated work in a shared checkout.Source ↗
  • Svelte Code Writer: Withheld at this revision: the Bash documentation example expands rune names inside double quotes, while the inline-code example preserves an unwanted backslash inside single quotes. Both examples need corrected shell quoting before they are reliable installation/use guidance.Source ↗
  • Terraform Test: The pinned main guide documents terraform test -no-cleanup and a positional test-file invocation, and treats -filter as a run-block name. The current official Terraform test command contract documents option-only invocation and -filter=testfile. Correct upstream commands before recommending this execution guide.Source ↗
  • Security Code Review: The pinned Do Not Flag list excludes code paths that require prior authentication. That blanket exclusion can hide authenticated authorization and privilege-escalation vulnerabilities, contradicting the stated broad security-review scope. The separate Django access review explicitly handles these cases.Source ↗
  • libFuzzer: The recommended byte-to-uint32 harness uses potentially unaligned pointer casts, so a harness can generate its own undefined behavior. The troubleshooting guidance also conflates ASan virtual address reservation with RSS and recommends disabling the RSS guard for out-of-memory. Require corrected harness and resource-limit guidance.Source ↗
  • Prometheus cardinality troubleshooter: Its series-per-instance example uses sum of sample values rather than count of series, and it asserts a fixed 14x benefit per removed label plus conclusive causation from temporal correlation. Those statements can misdirect operational diagnosis; cardinality depends on distinct label combinations.Source ↗

04 / PRACTICAL ANSWERS

Before you add it.

What is an AI skill?

A skill packages instructions for a repeatable task. It may also include scripts, reference documents or other files. The host decides when and how to use it; a skill does not replace the underlying model or guarantee its output.

What does “source reviewed” mean here?

We examined the material named in the review record and wrote our own reasons, findings and limitations. This is not an installation test, a security certification or a measured improvement in model performance. Untested aspects are listed on each detail page.

How do I install a listed skill?

Open its review and use the documented command or upstream setup guide. Skills installed through the Skills CLI can include supporting files, so copying only SKILL.md may be incomplete. Choose the intended host and project scope, and inspect the permissions before running the skill.

Are the skills ranked by downloads?

No. The default order is alphabetical. These are editorial selections with named reasons and trade-offs, drawn from multiple publishers and sources. Installation counts and star counts do not establish that a skill is right for your task.

Evidence & Ask