THE AI TOOLKIT / SKILLS
Skills.
Useful instructions.
Inspected in context.
Give your AI a repeatable way to work. Explore selected skills with original review notes, practical installation guidance and the source material behind each choice.
01 / START WITH THE JOB
What are you working on?
Explore a category, then refine your shortlist.
All categories are available in the filters.
BUILT BY UNDOMINATED
Evidence tools you can inspect.
Original source, MIT licence and complete downloads.
Each review names the checks performed and their limits.
- AI resource intake audit ↗
Review a skill, agent or MCP server for pinned source identity, licensing, requested permissions and observable verification before adding it to a trusted collection.
- Alias resolution ↗
Resolve an explicitly supplied alias to one distinct concrete target, refusing unresolved or conflicting candidate evidence. Use before treating a latest-style pointer as a concrete model ID.
- Benchmark cohort audit ↗
Audit a benchmark comparison for matched model identity, missing coverage, restricted populations and misleading confidence-interval interpretations.
- Context-tier ladder audit ↗
Check a past-this-length price multiple against every rung, so the dearest rung is not applied at the first boundary.
- Dominance wording audit ↗
Classify a two-model comparison before publishing it, so a tie or a dropped requirement is not called both better and cheaper.
- Evidence audit ↗
Audit a numeric claim against locally saved source evidence, including denominator and reproducible calculations, before citing or publishing it.
- Filter invariance ↗
Check that filtering preserves the relative order of retained IDs. Use for search or facet behavior that is intended to hide rows without re-sorting them.
- Final-host audit ↗
Refuse a vendor quote when the final host you recorded is not the host you requested. A redirect is not that vendor. www is not stripped, and this checker sends no request.
- Final-path audit ↗
Refuse a page claim when the final path you recorded is not the path you requested. A redirect to the homepage is not that page. The host is a different checker, and this one sends no request.
- Header-not-row audit ↗
Refuse a unit claim that borrows the table's display header when that row does not state its own unit. A per-million header is not every row's invoice unit. Amounts are not read.
- Indicative-rate audit ↗
Refuse a global-rate claim when the excerpt says the figure is indicative, varies by country, starts at a floor, or is a list price beside a credit. One sentence is not every region's rate.
- Licence-boundary audit ↗
Check a redistribution claim against the licence evidence you recorded. A public page is not a licence.
- Model migration preflight ↗
Check a proposed model replacement for required modalities, context, tool use, structured output and evaluation coverage before calling it a safe saving.
- Multiplier-aside audit ↗
Refuse a base-rate claim when the excerpt names a multiplier. Priority, fast, and scale factors are not the on-demand rate. The number in 2x is not read as a price.
- Payback basis ↗
Check switching-cost payback against savings per period using exact arithmetic. Use when a migration claims to pay back in a stated number of periods.
- Plan-quote hygiene ↗
Keep unverified subscription quotes out of a USD monthly ceiling. A source sentence is not a price.
- Provider quote comparison ↗
Compare like-for-like provider quotes with complete context tiers and distinct sellers; recompute workload cost without inventing cache or reasoning discounts.
- Resource release proof ↗
Verify local release artifacts and meaningful public-response receipts without confusing a build, HTTP 200 or registry metadata with a working installation.
- Schema-not-quote audit ↗
Refuse a model-rate claim when the excerpt describes a pricing field or a schema. "Values are in" a unit is a field description, not a model's rate. Amounts are not read.
- Seller-spread audit ↗
Check a price-spread multiple against distinct seller owners, so one vendor's own service tiers are not counted as competition.
- Serving-mode attribution ↗
Check that an explicit claimed score belongs to its named model or serving mode. Use when a model headline may have inherited a mode-specific score.
- Single-base audit ↗
Refuse a single-base price claim when the excerpt names both sides of a cache split or a peak split. Spelling USD per million does not make cache-hit and cache-miss one rate.
- Slug-is-not-body audit ↗
Refuse a currency or quantity claim whose words appear only in a URL, a slug, or a title. The excerpt is the body. A path named pricing-details-usd does not state USD.
- Source-pin audit ↗
Refuse a source identity that is only a branch, a tag, or a short SHA. A full 40-hex revision is the pin. The name v7 or main does not become that revision.
- Status-not-page audit ↗
Check a supplied status against a conservative integer-200-only gate and refuse every quote claim based on status alone. No status proves a body was received or read. This checker sends no request.
- Withdrawal residue ↗
Check an explicitly observed withdrawn numeric field and its named dependents for leftover values. Use after a source value has been removed from a snapshot.
02 / THE SELECTION
Find a fit. Read the reasoning.
Alphabetical by default. Every match is shown.
Compare up to three before opening a full review.
Runtime, access and execution
Labels summarise reviewed source wording. A local process can still send data to external services. Read each review's prerequisites and permissions; these filters do not certify compatibility or enforce access.
131 of 131 selected skills
Data and analytics · dbt Labs
Adding a dbt unit test
Builds dbt SQL-model unit tests from explicit input fixtures and expected output rows.
Why we selected itDocuments dict/CSV/SQL fixture tradeoffs and the special SQL-fixture requirement for ephemeral dependencies.
Weigh upMocked inputs do not make dbt tests offline. SQL models only; not a validator of production data, Python models or final incremental-table state. Never run --empty against data that must be retained.
AI application development · Anthropic
Anthropic Claude API
Routes Claude API work to language-specific SDK guidance and distinguishes self-hosted tool loops from managed agent execution.
Why we selected itExplains the operational differences among a plain API call, a tool runner, managed agents and the separate Agent SDK.
Weigh upThis is Anthropic-specific and its instructions can strongly influence model, SDK and architecture choices.
Research and documentation · Anthropic
Anthropic Documentation Coauthoring
Guides a human and agent through audience discovery, section-by-section drafting and a separate-reader review of a substantial document.
Why we selected itStarts with the audience, intended impact and missing context, then lets the author curate ideas before the agent drafts each section.
Weigh upReader-model agreement is a spot check, not factual verification or a human usability study; the author still needs to verify facts and links.
Design and interfaces · Anthropic
Anthropic Frontend Design
Builds a visual direction from the product’s audience and subject, then reviews typography, layout and interface copy against that brief.
Why we selected itRequires a compact design plan and a critique of generic choices before implementation.
Weigh upThis is an opinionated design process, not a component library, usability study or automated accessibility audit.
Documents · Anthropic
Anthropic PDF Processing
Covers PDF extraction, transformation and form filling, with separate workflows for actual form fields and image-based overlays.
Why we selected itForm instructions require field discovery before filling, which avoids treating every PDF as the same format.
Weigh upThe bounding-box helper prints failures without setting a failing exit code; callers must inspect its messages.
6 sources · 2026-09-21
Read the full review Install command in reviewAnthropic custom termsDocuments · Anthropic
Anthropic PowerPoint Presentations
Guides new-slide generation and template editing with OOXML validation and rendered thumbnail checks.
Why we selected itExplains presentation-specific failure modes in chart axes, colors and shared slide assets.
Weigh upLibreOffice previews can differ from PowerPoint font rendering; the source calls for visual review.
6 sources · 2026-09-21
Read the full review Install command in reviewAnthropic custom termsAgent development · Anthropic
Anthropic Skill Creator
Develops skills through example tasks, baseline comparisons, human review and separate trigger-description evaluation.
Why we selected itSeparates whether a skill activates from whether its instructions improve the resulting work.
Weigh upFull baseline and comparison workflows depend on subagents and Claude CLI; reduced Claude.ai paths omit those evaluations.
Documents · Anthropic
Anthropic Spreadsheets
Keeps spreadsheet formulas editable and requires recalculation plus explicit inspection of formula-error results.
Why we selected itDistinguishes formula expressions from cached calculated values, a common source of misleading workbook output.
Weigh upRecalculation uses LibreOffice and the guide excludes several newer Excel functions that this environment cannot evaluate.
5 sources · 2026-09-21
Read the full review Install command in reviewAnthropic custom termsBrowser testing · Anthropic
Anthropic Webapp Testing
Guides local browser checks with Playwright and includes a wrapper that starts development servers around an automation command.
Why we selected itUses rendered-page reconnaissance before choosing selectors for dynamic applications.
Weigh upThe server helper checks only whether a TCP port accepts a connection, not whether the expected application is healthy.
Documents · Anthropic
Anthropic Word Documents
Separates new Word-document generation from editing existing OOXML, with explicit checks for tables, comments and tracked changes.
Why we selected itDocuments the different create, edit and read paths instead of treating Word files as plain text.
Weigh upRestricted Anthropic terms apply; this is a source-available reference, not an open-source document package.
6 sources · 2026-09-21
Read the full review Install command in reviewAnthropic custom termsDevelopment workflow · Addy Osmani
API and Interface Design
Designs stable API contracts, consistent errors and retry-safe idempotency behavior.
Why we selected itExplains atomic idempotency claims, payload-hash checks and explicit handling of an unknown downstream outcome.
Weigh upExamples need project-specific transactions, authentication and failure recovery. Trusted internal types do not make stored user-controlled data intrinsically trustworthy.
Testing and reliability · GitHub community
Bug Receipt
Creates an evidence-bearing defect or incident handoff that distinguishes verified, partial and blocked outcomes.
Why we selected itRequires the observed baseline, root-cause evidence, changed artifacts and relevant checks to accompany a completion status.
Weigh upThe validator checks supplied fields and status consistency; it cannot prove that a command actually ran or that a claimed observation is correct.
Research and evidence · GitHub community
Build Evidence Map
Builds a structured map of claims, evidence and unresolved gaps, with a local validator for the map’s structure.
Why we selected itPreserves supporting, contradicting, qualifying and missing evidence as separate relationships instead of flattening a contested choice into confident prose.
Weigh upThe bundled validator checks structure and declared excerpts; it does not establish that a source is true or that the excerpt supports the claim.
Agent development · Cloudflare
Cloudflare Agents SDK
Guides stateful Cloudflare agent applications through current SDK documentation, persistence, scheduling and approval-aware tool flows.
Why we selected itTreats installed SDK versions and current docs as the basis for implementation.
Weigh upThis is specific to Cloudflare’s Agents SDK and runtime, not a general multi-provider agent framework.
Cloud development · Cloudflare
Cloudflare Durable Objects
Designs per-entity state and coordination with explicit persistence, concurrency and runtime-test guidance.
Why we selected itDefines where Durable Objects fit and where stateless Workers or independent requests fit better.
Weigh upA single coordination object can become a bottleneck; object boundaries must fit the workload.
Security · Cloudflare
Cloudflare Turnstile Spin
Sets up, repairs, or migrates Turnstile bot verification with per-framework wiring, secret-safe validation scripts, and explicit scope boundaries.
Why we selected itShips six framework references including SvelteKit plus scripts for validation, widget creation, auth probing, and persistence, with a tests/validation.md checklist.
Weigh upNeeds a Cloudflare account with a Turnstile widget secret; validation runs against live configuration.
Web performance · Cloudflare
Cloudflare Web Performance Audit
Builds a performance review from browser traces, request details and relevant source instead of generic optimization advice.
Why we selected itStarts by discovering available measurement tools and records measurements it could not collect.
Weigh upA lab trace does not establish real-user Core Web Vitals or prove a resource is unused in every interaction.
Cloud development · Cloudflare
Cloudflare Workers Best Practices
Reviews Workers code against its configured runtime, focusing on request lifetime, state isolation, streaming and binding contracts.
Why we selected itUses installed types and compatibility settings instead of assuming the newest package defines the current runtime.
Weigh upWorkers-specific guidance is not interchangeable with a Node server checklist.
Cloud operations · Cloudflare
Cloudflare Wrangler Workflow
Runs Workers configuration and deployment work against the project’s installed Wrangler version and an explicitly identified target.
Why we selected itDistinguishes local simulation from remote bindings so development commands are not assumed to be harmless.
Weigh upThe skill authorizes no cloud action by itself; commands can deploy or mutate real resources.
Security review · Trail of Bits
CodeQL
Builds and checks CodeQL extraction, explicit query suites and project-specific data-flow models.
Why we selected itTreats an empty or poorly extracted database as missing evidence rather than a clean security result.
Weigh upThe skill licence does not grant CodeQL product rights. Public repositories are eligible under CodeQL terms; private use may require GitHub Code Security. Exit 137 alone does not establish an Apple Silicon mismatch.
Development workflow · Addy Osmani
Constraint-driven development
Records project quality constraints with measured baselines, enforcement commands and reviewable exceptions.
Why we selected itPairs each threshold with a concrete check and separates written policy from scripted enforcement.
Weigh upSuggested coverage/performance values are defaults, not measured guarantees. Example scanner commands need exit-code/severity wiring; a green invocation alone is not necessarily a blocking security gate.
Planning and delivery · Matt Pocock
Conversation to Specification
Turns an already-discussed change into a repository-aware specification for the configured issue tracker.
Why we selected itUses existing project context, glossary and architecture decisions before synthesizing requirements.
Weigh upThis is synthesis after discussion, not a discovery interview or a check that every stakeholder requirement is present.
AI application development · Datadog Labs
Datadog LLM Observability Instrumentation
Instruments a Python or Node.js/Next.js backend with Datadog LLM Observability, auditing session-ID plumbing and persisting the dependency before reporting.
Why we selected itRuns detection before editing: runtime, LLM framework, app framework, existing instrumentation, and the manifest to persist into are all identified in Phase 1.
Weigh upEdits source and dependency manifests, so every change needs review and a test run before it ships.
Model evaluation · Datadog Labs
Datadog Trace RCA
Root-causes production AI failures from LLM traces through phased span analysis, then converts the failure taxonomy into evaluator code.
Why we selected itStructures the analysis as explicit phases from input resolution through open and axial coding to recommendations, instead of offering generic debugging advice.
Weigh upRequires the Datadog LLMO MCP toolset with API credentials and existing LLM Observability data; without traces there is nothing to analyze.
Databases · dbt Labs
dbt Documentation Maintenance
Audits descriptions in a dbt manifest and drafts missing model or column documentation in the project’s existing style.
Why we selected itUses dbt’s resolved manifest rather than guessing YAML layout, and clearly limits column coverage to columns declared in that manifest.
Weigh upThe audit measures nonempty descriptions, not their correctness or every physical warehouse column; imported model nodes can also appear in a manifest.
Testing and reliability · Matt Pocock
Diagnosing Bugs
A debugging procedure that establishes a reproducible symptom, tests competing explanations and preserves a regression check.
Why we selected itRequires a red-capable reproduction before edits, so an apparent improvement has a concrete behavior to compare against.
Weigh upThe included human-in-the-loop shell script is an editable single-line-input template, not a ready-made test runner or secret-redaction tool.
Research and documentation · GitHub community
Diataxis Documentation Writer
Writes docs under Diataxis discipline: clarify the quadrant, audience, goal and scope first, approve an outline, then draft tutorials, how-tos, reference or explanation in project tone.
Why we selected itThe quadrant gate (tutorial, how-to, reference, explanation) plus a mandatory outline-approval step stops documentation from being written before its purpose and scope are agreed.
Weigh upFramework-first and deliberately procedural; overkill for one-paragraph answers and small edits.
Development workflow · Superpowers
Dispatching Parallel Agents
Splits independent investigations into bounded agent assignments and checks their integration afterward.
Why we selected itRequires independence and explicit file or subsystem scope before work is parallelized.
Weigh upShared mutable state, sequential dependencies and overlapping file edits defeat the independence assumption.
Security review · Sentry
Django access review
Traces Django and DRF ownership, query scoping and tenant boundaries to investigate authorization gaps.
Why we selected itSeparates authentication from object ownership and follows inherited classes, middleware and managers before reporting.
Weigh upThis is source reasoning, not a executed multi-user access test or security certificate. Upstream notes OWASP-derived reference material under CC BY-SA; retain those notices.
Mobile development · Expo
Expo Design System
Builds a token theme (color, spacing, typography, radius, shadow, motion) plus variant/size/state component conventions inside an Expo app, with grep-based drift audits and a named gallery of AI-generated-looking anti-patterns.
Why we selected itAdopt-before-you-build rule: extend an existing styling library in its own idiom and never introduce a second token system beside it, so adoption cannot become drift.
Weigh upWhat looks native (palettes, HIG rules, controls) is delegated to the sibling expo-native-ui skill; this skill governs where values live, not which values to pick.
Mobile development · Expo
Expo Router Navigation
File-based routing for Expo Router apps: route groups, NativeTabs, native stacks, headers and search bars, modals and form sheets, with SDK-version-aware option names.
Why we selected itVersion-aware guidance throughout: headerLargeTitleEnabled for SDK 56+ versus the deprecated headerLargeTitle, and expo-router/react-navigation instead of direct react-navigation imports.
Weigh upSeveral flagship patterns are iOS-gated (header search bar iOS only, Apple Zoom iOS 18+, liquid-glass sheet styling iOS 26+); Android equivalents need separate verification.
Mobile development · Expo
Expo Web to Native Migration
Migrates a web React codebase to a native Expo app screen by screen: native shell first, whole web UI shippable in DOM components on day one, then strangler-order nativization with device verification.
Why we selected itThe migration spine keeps the app shippable at every step: assess into a durable worklist, scaffold, DOM-component shell as the day-one milestone, then one nativized screen per pass in value order.
Weigh upThe verification recipe is opinionated about tooling: it asks the user to install agent-browser and argent simulators rather than falling back to manual screenshots.
Security review · Trail of Bits
False Positive Check
Investigates a specific suspected security bug through reachability, attacker control and counter-evidence.
Why we selected itRestates the exact root-cause claim before selecting standard or deeper verification.
Weigh upThis is finding verification, not discovery or security certification. Preserve an inconclusive outcome when evidence is missing rather than forcing a confident binary verdict.
Planning and delivery · GitHub community
GitHub Release Workflow
Cuts a library release end to end: tag-derived versioning, code-diff-first SemVer analysis against commit intent, Keep a Changelog authoring, and a gated release-branch plus PR handoff.
Why we selected itVersion analysis prefers the code diff as primary signal with commit messages secondary, and states the reconciliation rule outright: on conflict the diff wins, with worked examples.
Weigh upSingle-package GitHub repositories are assumed; monorepos and non-SemVer tag schemes fall outside the versioning logic.
Design and interfaces · Google Labs / Stitch
Google Stitch Design-System Extraction
Reads frontend source and theme files to draft a structured DESIGN.md for design-system documentation or later Stitch use.
Why we selected itStarts with tokens and theme definitions, then inspects representative components to separate intended conventions from scattered overrides.
Weigh upSource extraction does not verify rendered appearance, accessibility or the effects of runtime themes. Descriptions of intent remain interpretation.
Development workflow · Hugging Face
Gradio App Builder
A Gradio reference and example collection for building Python interfaces, event-driven layouts and chat demos.
Why we selected itConnects component signatures and event listeners to complete examples covering forms, streaming and chat interfaces.
Weigh upThe static signatures are a source snapshot, not a version compatibility guarantee; check current Gradio documentation and your installed package.
Data and research · Hugging Face
Hugging Face Dataset Workflows
Explores Hub dataset splits and rows through the Dataset Viewer API and documents separate dataset-upload workflows.
Why we selected itStarts with subset/split discovery before pagination, search or filtering.
Weigh upAlthough the opening describes read-only exploration, later sections create repositories and upload files or raw agent traces.
Model development · Hugging Face
Hugging Face LLM Trainer
Prepares and submits managed training jobs with dataset checks, monitoring and explicit persistence of trained artifacts.
Why we selected itTreats dataset shape, credentials and model persistence as prerequisites rather than leaving them until a job fails.
Weigh upThe skill directs immediate job submission for training requests; make the target, hardware and spending scope explicit before invocation.
Model evaluation · Hugging Face
Hugging Face Local Model Evaluations
Chooses a local evaluation framework and inference backend, starting with a small smoke run before scaling evaluation work.
Why we selected itSeparates local GPU inference from a locally launched client that calls remote Inference Providers.
Weigh upThe provider-backed helper still sends inference requests over the network; local script execution does not mean local inference.
Data and research · Hugging Face
Hugging Face Paper Reading
Retrieves AI research-paper text and structured metadata, with fallbacks to the original arXiv page or PDF when Hub text is incomplete.
Why we selected itSeparates paper text from metadata such as authors and linked code, models and datasets, helping a research task collect the right evidence.
Weigh upHub indexing and HTML availability vary; confirm that the fetched text is the actual paper before summarizing methods or results.
Model development · Hugging Face
Hugging Face Trackio
Adds training metrics and diagnostic alerts, then retrieves run data through Trackio’s CLI or a local or hosted dashboard.
Why we selected itSeparates logging, alerting and retrieval into focused references, including a route from an alert to metrics around the relevant training step.
Weigh upThe private flag only affects newly created Spaces; inspect an existing Space’s visibility before uploading metrics. Webhooks and remote synchronization send data outside the machine.
Documentation and knowledge · Anthropic
Internal Communications
Formats source-backed team updates, internal newsletters and employee FAQs for a defined audience.
Why we selected itRoutes the request to separate Progress/Plans/Problems, newsletter, FAQ and general-communication guides.
Weigh upTemplates reflect one organization’s style; adapt audience, length and date range to your team.
Testing and reliability · Grafana Labs
k6
Authors k6 protocol and browser test scripts from task-specific examples with an explicit validation step.
Why we selected itDistinguishes inspection of arrival-rate load scenarios from a small local execution and checks functional assertions as well as exit status.
Weigh upA threshold breach accepted during script validation is not an SLO pass. Recheck version-specific APIs and VU-state behavior against current k6 docs; generated scripts have not been executed in this review.
Testing and reliability · Grafana Labs
k6 test maintenance
Maintains k6 scripts with behavior-change classification, validation and cloud-script hash checks.
Why we selected itSeparates syntax-only edits from changes to thresholds, targets, assertions and load shape that need an explicit review.
Weigh upA parse check cannot establish SLO or target correctness. Even short smoke requests require authorized targets; companion cloud workflows and service operations were not exercised.
Documentation and knowledge · Sentry
Maintaining AGENTS.md
Creates concise repository instructions from actual commands, conventions and existing policy files.
Why we selected itInspects manifests, CI and established documentation before drafting instructions.
Weigh upIts preferred line limit and closest-file simplification are editorial conventions, not permission to discard governing policy or override higher-priority instructions.
Web development · Matt Pocock
Matt Pocock Codebase Design
Evaluates module boundaries through caller complexity, dependency seams and alternative interface designs.
Why we selected itDefines a deep module by what callers can accomplish through a small interface, rather than by its line count.
Weigh upThe adapter and interface rules are design heuristics, not universal requirements; local substitutes do not prove production integration behavior.
Research and documentation · Matt Pocock
Matt Pocock Domain Modeling
Builds a project glossary and short architecture decision records while testing domain terms against code and concrete edge cases.
Why we selected itDistinguishes canonical domain terms from implementation notes and uses conflicting examples to expose overloaded language.
Weigh upThe root and bounded-context instructions do not fully agree on glossary and ADR placement; agree the target paths and numbering convention first.
Research and documentation · Matt Pocock
Matt Pocock Grilling
Interviews the user through dependency-ordered decisions before the agent acts on a plan or idea.
Why we selected itOnly asks decisions whose prerequisites are settled, so answers do not depend on unanswered questions from the same round.
Weigh upThe interview has no built-in round cap and can be too demanding for a small task; choose its scope deliberately.
Cloud operations · Microsoft
Microsoft Azure Cost Management
Connects Azure cost reports to actual billing queries, utilization evidence and separately identified savings estimates.
Why we selected itRequires the total bill and service breakdown alongside optimization suggestions.
Weigh upRequires Azure billing/monitoring permissions and supporting CLI or MCP tools.
Cloud operations · Microsoft
Microsoft Azure Diagnostics
Routes Azure incidents through resource health, recent changes, logs and service-specific troubleshooting guides.
Why we selected itSeparates App Service, Functions, AKS, compute and messaging investigations.
Weigh upThe AKS helper selects Azure resources by arguments but uses the existing kubectl context; confirm both point to the same cluster.
Research and documentation · Microsoft
Microsoft Docs Research
Finds current Microsoft documentation with task-specific queries and retrieves full pages when excerpts are insufficient.
Why we selected itAsks for version, platform and task context in documentation searches.
Weigh upThis is a retrieval workflow, not an implementation validator; official documentation still needs to match the installed version and target environment.
Research and documentation · Microsoft
Microsoft Wiki Researcher
Traces architecture and data flow through source code to produce an explanation with file references, diagrams and stated uncertainties.
Why we selected itRequires code-reading before architectural claims and traces actual calls and data flow rather than trusting directory names.
Weigh upIts git command identifies the current branch, although the prose calls it the default branch; choose the actual revision and host-specific link format yourself.
Development workflow · Trail of Bits
Modern Python
Sets up or modernizes Python projects with uv, Ruff, pytest and explicit migration checks.
Why we selected itSeparates new-project setup from requested migration and documents when legacy Python requirements are outside its preferred path.
Weigh upTool substitutions and coverage thresholds are recommendations, not equivalence proofs. Preserve old lockfiles and environments until the actual project passes its checks.
AI application development · Neon
Neon AI Gateway
Adds multi-provider LLM calling through Neon's branch-scoped gateway with one credential, resolving model IDs against the live catalog instead of hardcoded lists.
Why we selected itIntegrates with OpenAI, Anthropic, google-genai, Vercel AI SDK, and Mastra by changing only the base URL, with separate recommended and lower-level paths.
Weigh upGateway availability and the served catalog are plan-gated; the skill's own Availability section says to check gating first.
Observability · Addy Osmani
Observability and instrumentation
Plans feature telemetry around operational questions and verifies logs, metrics, traces and alerts in staging.
Why we selected itKeeps request correlation separate from the entry point that actually initiated a shared job.
Weigh upSample thresholds and the prescribed alerting policy are starting points, not universal SLOs. Validate untrusted request IDs and measure overhead, sampling and privacy in the real system.
AI application development · OpenAI
OpenAI Agents SDK Workflow
Builds a small Agents SDK application around an explicit workflow contract, then checks the real agent path and optional local deployment.
Why we selected itStarts with a single agent and adds tools, delegation or sandboxing only when the application needs them.
Weigh upA companion credential gate can pause work before implementation even when a key already exists.
6 sources · 2026-09-21
Read the full review Upstream setup linkedProprietary (declared in plugin manifest)AI application development · OpenAI
OpenAI API Troubleshooting
Classifies a failed OpenAI request using its actual transport or API error and routes credentials, billing, throttling and access issues separately.
Why we selected itDistinguishes exhausted quota from ordinary rate limiting even when the HTTP status is the same.
Weigh upIt relies on companion documentation and credential skills; it does not provision or rotate keys itself.
6 sources · 2026-09-21
Read the full review Upstream setup linkedProprietary (declared in plugin manifest)Security · OpenAI
OpenAI Codex Security Threat Model
Creates or reuses a repository threat model bound to the actual target and revision, preserving supplied context and explicit review gaps.
Why we selected itBinds reusable models to repository/version identity and avoids mixing scan-specific context into a shared cache.
Weigh upThis is one phase in the Codex Security plugin, not a standalone full security scan.
7 sources · 2026-09-21
Read the full review Upstream setup linkedProprietary (declared in plugin manifest)Data and research · OpenAI
OpenAI Data Analytics Notebooks
Turns SQL or Python analysis into a traceable notebook whose conclusions are tied to executed outputs and stated assumptions.
Why we selected itRecords query links, input versions, filters and cohort definitions next to the analysis.
Weigh upWarehouse and operational-log placeholders depend on the host’s configured connectors; exports or supplied data are fallback paths.
5 sources · 2026-09-21
Read the full review Upstream setup linkedProprietary (declared in plugin manifest)Agent development · OpenAI
OpenAI Evaluate Skill
Connects a local skill review to structural checks, budget explanations and an explicitly separate live benchmark workflow.
Why we selected itDistinguishes static instruction-size estimates from observed usage collected by real agent runs.
Weigh upStatic scores and budget bands are tool heuristics, not proof of task quality or safety.
8 sources · 2026-09-21
Read the full review Upstream setup linkedMIT (declared in plugin manifest)Security review · Trail of Bits
Post-patch validation
Compares a pinned vulnerable revision and security patch with controls, variants and explicit validation gaps.
Why we selected itRequires exploit reachability markers and benign controls so an import failure cannot masquerade as reproduction.
Weigh upThe runner’s worktree/environment isolation is not an OS sandbox. This review did not audit or execute every helper, and passing supplied checks still requires coverage review.
API design · GitHub community
Protobuf gRPC API Review
Reviews .proto and gRPC changes as long-lived contracts across binary wire, JSON and text formats, generated APIs and runtime behavior, with mixed-version rollout tracing and a four-rung verdict.
Why we selected itCompatibility is evaluated on four independent dimensions (binary wire, named formats, generated source API, behavior and operations) instead of a single wire-compatibility verdict.
Weigh upVerdicts are only as good as the declared compatibility envelope; the skill itself requires lowering confidence when encodings, consumers or deployment order are unknown.
Infrastructure development · HashiCorp
Provider configuration
Designs Terraform provider credential resolution, unknown-value guards and redacted diagnostics.
Why we selected itResolves credentials as complete sets and distinguishes absent credentials from a misconfigured source.
Weigh upThe examplecloud code is illustrative. Credential and endpoint precedence must match the real provider; do not treat endpoint or insecure-setting mismatches as automatically harmless.
Infrastructure development · HashiCorp
Provider framework migration
Migrates individual Terraform provider resources from SDKv2 to the Plugin Framework while checking state compatibility.
Why we selected itUses muxing to avoid a whole-provider rewrite and treats existing schema and block syntax as compatibility contracts.
Weigh upSimple schemas still need measured compatibility. The included server example must be adapted to the real provider; no state migration or acceptance tests ran here.
Creative production · Remotion
Remotion Video Workflows
Routes video work to focused Remotion guides for creation, preview, rendering, media and reusable video applications.
Why we selected itKeeps new-project scaffolding separate from adding a composition to an existing project.
Weigh upThis is a router into a larger reference package, so copying the definition alone loses the working guidance.
6 sources · 2026-09-21
Read the full review Install command in reviewNo redistribution license foundDevelopment workflow · Superpowers
Requesting Code Review
Prepares a requirements-aware review brief around an explicit base and head revision.
Why we selected itGives the reviewer concrete requirements, implementation context and a bounded Git comparison.
Weigh upA base-to-head comparison excludes uncommitted changes; include those separately when they are in scope.
Languages and tooling · GitHub community
Ruff Recursive Fix
Enforces Python code quality with scoped Ruff runs: safe fixes first, unsafe fixes second with diff review each pass, then targeted manual remediation under explicit stop criteria.
Why we selected itFix passes are ordered by blast radius: safe autofixes with diff review and formatting first, unsafe fixes only if findings remain, then minimal manual edits.
Weigh upUnsafe autofixes can change behavior; the workflow's value depends on actually performing its mandated diff reviews rather than waving them through.
Security review · Trail of Bits
Rust review
Orchestrates a scoped Rust security review with worker coverage records, duplicate review and explicit incomplete results.
Why we selected itSeparates finding scope from broader read-only context and validates worker artifacts before accepting completion.
Weigh upInstalling only this SKILL.md directory does not install the parent plugin scripts, prompts and named agents. Host-specific tool/cache assumptions and security findings need independent verification.
Testing and reliability · Trail of Bits
SARIF Parsing
Extracts and summarizes SARIF findings with reusable jq examples and a Python helper.
Why we selected itExplains run structure and severity inheritance instead of treating every absent result.level as the same severity.
Weigh upThe helper is not a complete SARIF validator: invocation-level ruleConfigurationOverrides and extension rule components are not resolved.
Security and privacy · Trail of Bits
Semgrep Rule Creator
Turns a concrete bug pattern into a Semgrep rule with positive and negative test cases.
Why we selected itRequires vulnerable and safe examples before rule implementation, then runs Semgrep validation and rule tests.
Weigh upA passing fixture suite establishes behavior on those examples; it does not prove complete detection or an acceptable false-positive rate on other repositories.
Research and documentation · Sentry
Sentry API Endpoint Documentation
Aligns a Sentry API endpoint’s runtime response, TypedDict definitions and drf-spectacular OpenAPI schema.
Why we selected itChecks runtime serialization against types and schema, including the difference between an absent field and a nullable one.
Weigh upThe file paths, ownership checks and validation commands are specific to Sentry; this is not a drop-in guide for every Django API.
Git commits · Functional Software, Inc. dba Sentry
Sentry commit message
Guides Sentry-style conventional commit messages, branch checks and one coherent local commit at a time.
Why we selected itRequires a branch check before committing and a feature branch by default, making the target of a local commit explicit.
Weigh upThe skill can create a feature branch and a git commit; it is not a read-only message formatter. It does not instruct a push.
Testing and reliability · Sentry
Sentry Django Performance Review
Reviews Django code for proven performance issues only, with ordered rules for N+1 queries, serializers, model properties, and unbounded querysets.
Why we selected itStates its evidence rule up front and repeats it as a validation checklist: research the codebase to confirm each issue and report only what can be proven.
Weigh upDjango-only; its ORM rules do not transfer to other frameworks or raw SQL tuning.
Testing and reliability · Sentry
Sentry Find Bugs
Reviews a branch diff against surrounding code and existing tests, reporting only substantiated issues and explicit coverage limits.
Why we selected itRequires the complete diff to be read before findings and follows changed behavior into surrounding implementations and tests.
Weigh upThe initial command compares committed branch history and omits uncommitted edits; inspect those separately if they are in scope.
AI application development · Sentry
Sentry Prompt Optimizer
Optimizes agent and system prompts through contracts, context inventory, and evals, including porting prompts between model families.
Why we selected itRequires a captured contract and external-context inventory before wording changes, which keeps optimization causal instead of stylistic.
Weigh upPorted prompts still need verification on the target model; family notes are guidance, not equivalence proofs.
Security review · Sentry
Skill scanner
Reviews an agent skill’s instructions, scripts and requested permissions for adoption risks.
Why we selected itDistinguishes malicious instructions from security examples discussing the same syntax.
Weigh upA clean pattern scan cannot certify a skill safe, and repository hosting on GitHub or PyPI does not establish trust. Scanner scripts and detection effectiveness were not runtime-tested here.
Planning and delivery · Matt Pocock
Specification to Dependency-Aware Tickets
Splits an agreed plan into small vertical slices, with explicit blocking relationships and a review before publication.
Why we selected itAsks for user agreement on the proposed breakdown before creating the tickets.
Weigh upTicket publication is not transactional: partial failures or repeated runs can leave duplicates and incomplete dependency links.
Databases · Supabase
Supabase Development
Covers the full Supabase surface beyond Postgres tuning: Auth flows, client and SSR integration, CLI and MCP use, declarative or imperative schema changes, and structured debugging.
Why we selected itSeparates declarative schemas from imperative migrations and pairs each path with committing guidance instead of treating all schema edits alike.
Weigh upTriggers on any Supabase task, so it can load for work the narrower Postgres skill would handle better; pick the skill per task.
Databases · Supabase
Supabase Postgres Best Practices
Connects Postgres schema and query decisions to worked SQL examples, connection guidance and row-level security checks.
Why we selected itPairs incorrect and corrected SQL with query-plan examples instead of offering only generic database advice.
Weigh upIllustrative speedups and blanket indexing rules are not measurements of your workload; inspect actual plans and write costs.
Testing and reliability · Jesse Vincent / Superpowers
Superpowers Receiving Code Review
Checks review feedback against the code and project constraints before making and testing each requested change.
Why we selected itTreats reviewer suggestions as hypotheses to verify, with explicit checks for existing behavior, platform constraints and unused functionality.
Weigh upIts conversational tone rules are a style preference, and its pause-on-ambiguity rule may be too restrictive for independent review items.
Testing and reliability · Jesse Vincent / Superpowers
Superpowers Systematic Debugging
Moves debugging from reproducible evidence through a single hypothesis to a verified fix, with a stop point for repeated failed attempts.
Why we selected itAsks for evidence at component boundaries and backward tracing of bad values before proposing a patch.
Weigh upThe bundled polluter helper assumes npm tests, hides their output and swallows their failing exit statuses.
Testing and reliability · Jesse Vincent / Superpowers
Superpowers Test-Driven Development
Makes an observed failing behavior test the entry point for implementation and checks that assertions can detect real production mistakes.
Why we selected itRequires verifying why a test fails before changing implementation, then running the project suite after the fix.
Weigh upThe workflow is deliberately prescriptive: it tells an agent to discard implementation written before tests and seek permission for exceptions.
Testing and reliability · Jesse Vincent / Superpowers
Superpowers Verification Before Completion
Requires a fresh command result or direct check for each completion claim and distinguishes passing tests from fulfilling requirements.
Why we selected itMaps common claims to appropriate evidence, including compiler/build status, original bug reproduction and requirements checks.
Weigh upThis is a behavioral checklist, not an automatic enforcement mechanism or runtime test harness.
Research and documentation · Jesse Vincent / Superpowers
Superpowers Writing Plans
Turns an agreed specification into file-specific implementation tasks with verification steps and a structured plan review.
Why we selected itMakes each task name concrete files, expected behavior and meaningful failing/passing checks rather than leaving implementation placeholders.
Weigh upDetailed code in a plan can become stale as the repository changes; planned checks are not evidence that tests have run.
Security and privacy · Trail of Bits
Supply Chain Risk Auditor
Collects dependency identity, advisory and repository-maintenance evidence while retaining unassessable cases.
Why we selected itKeeps ecosystem and resolved package versions attached to evidence and distinguishes unknown results from clean checks.
Weigh upDocumented project inputs include npm package-lock/shrinkwrap, Python uv.lock and supported Go module files; other lock formats need a separate extraction step.
Framework development · Svelte
Svelte Core Best Practices
Svelte-maintained guidance for reactivity, component composition and integration with browser APIs.
Why we selected itExplains when to derive state instead of synchronizing it with effects, and when reactive wrappers or subscriptions are needed.
Weigh upThe references span several Svelte releases and include experimental async behavior. Check the installed compiler version and required flags before applying an example.
Infrastructure development · HashiCorp
Terraform Provider Resources
Guides Terraform Plugin Framework CRUD, import, waiters and state-preserving provider changes.
Why we selected itSeparates read-time not-found removal from deletion, and compares planned attributes with state before update calls.
Weigh upThe fictional examplecloud snippets are patterns, not a standalone compiled provider. Install the accompanying references and companion test guidance; no cloud CRUD was exercised.
Infrastructure development · HashiCorp
Terraform Stacks
Guides Terraform Stacks components, deployments, workload identity and deployment monitoring.
Why we selected itKeeps component and deployment languages separate and documents ephemeral credentials and provider bindings.
Weigh upExamples are not tested deployments. A rule forbidding deletions alone does not make every remaining update safe; review resource changes, billing and approval policy.
Development workflow · HashiCorp
Terraform style guide
Applies Terraform HCL organization, naming, variable documentation and formatting conventions.
Why we selected itShows separation of providers, variables, resources and outputs, with sensitivity and version-control guidance.
Weigh upThe resource snippets omit project-specific required values and are not deployment-ready. Suggested versions and latest-provider guidance do not authorize an upgrade.
Security · Trail of Bits
Trail of Bits Audit Context Building
Builds a cited dossier of function invariants, assumptions and dependencies before a separate vulnerability-hunting pass.
Why we selected itFollows callees and unsuccessful paths instead of trusting names such as validate or authorize.
Weigh upThe skill is a router into a plugin workflow and named function analyzer; a copied standalone SKILL.md is insufficient.
Security · Trail of Bits
Trail of Bits Differential Security Review
Reviews security-relevant changes against their baseline, removed protections, callers and concrete attacker scenarios.
Why we selected itUses git history to ask why a removed check existed and whether a previous fix is being undone.
Weigh upThe methodology includes checking out the baseline and head; use a suitable worktree so the review does not disrupt uncommitted work.
Languages and tooling · Trail of Bits
Trail of Bits Modern C++
Moves C++ toward C++20/23/26 idioms with a 30-pattern migration table, usability-tiered feature guidance, and compiler-hardening and sanitizer minimums for security-critical code.
Why we selected itFeature tiers rank by practical usability today (use now, deploy without a standard bump, plan for, watch) instead of reciting the standard in version order.
Weigh upC++26 positions (reflection availability, contracts caution, execution immaturity) are roadmap judgments; verify against the installed toolchain before restructuring around them.
Testing and reliability · Trail of Bits
Trail of Bits Mutation Analysis
Interprets mutation campaign results and turns survivors into qualified test-gap reports or separately reproduced bug findings.
Why we selected itSeparates test-gap analysis from bug hunting, so an uncaught mutation is not automatically presented as a vulnerability.
Weigh upThis selection focuses on existing-report analysis. Setup and optimization need separate review: examples hardcode src/, retain a pre-optimization acceptance check and mix counting formats. Do not copy their campaign estimates or purge steps unchanged.
Testing and reliability · Trail of Bits
Trail of Bits Property-Based Testing
Chooses meaningful invariants and generators for tests that explore an input domain, while rejecting tautological or vacuous assertions.
Why we selected itExplains how tests can pass while restating implementation or filtering away nearly every input.
Weigh upProperty selection still needs a valid specification; an incorrect invariant can generate misleading failures.
Security · Trail of Bits
Trail of Bits Sharp Edges
Examines APIs and configuration for cases where ordinary developer mistakes can disable a security boundary.
Why we selected itLooks at zero, empty, negative and mixed-up values rather than only intended happy-path usage.
Weigh upThis is a design-review method, not a general implementation bug scanner.
Evidence and evaluation · Undominated.ai
Undominated · AI resource intake audit
Review a skill, agent or MCP server for pinned source identity, licensing, requested permissions and observable verification before adding it to a trusted collection.
Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.
Weigh upDeterministic local checks over supplied evidence; not a guarantee of source truth or production suitability.
Evidence and evaluation · Undominated.ai
Undominated · Alias resolution
Resolve an explicitly supplied alias to one distinct concrete target, refusing unresolved or conflicting candidate evidence. Use before treating a latest-style pointer as a concrete model ID.
Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.
Weigh upChecks one caller-supplied candidate set, refusing unresolved, conflicting and self-targets. It does not verify target existence, candidate completeness, recency or recursively resolve aliases.
Evidence and evaluation · Undominated.ai
Undominated · Benchmark cohort audit
Audit a benchmark comparison for matched model identity, missing coverage, restricted populations and misleading confidence-interval interpretations.
Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.
Weigh upDeterministic local checks over supplied evidence; not a guarantee of source truth or production suitability.
Evidence and evaluation · Undominated.ai
Undominated · Context-tier ladder audit
Check a past-this-length price multiple against every rung, so the dearest rung is not applied at the first boundary.
Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.
Weigh upDeterministic local check of a supplied ladder; it does not fetch vendor prices or model marginal block billing.
Evidence and evaluation · Undominated.ai
Undominated · Dominance wording audit
Classify a two-model comparison before publishing it, so a tie or a dropped requirement is not called both better and cheaper.
Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.
Weigh upDeterministic local checks over one supplied pair and the listed requirements; not a guarantee of source truth.
Evidence and evaluation · Undominated.ai
Undominated · Evidence audit
Audit a numeric claim against locally saved source evidence, including denominator and reproducible calculations, before citing or publishing it.
Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.
Weigh upDeterministic local checks over supplied evidence; not a guarantee of source truth or production suitability.
Evidence and evaluation · Undominated.ai
Undominated · Filter invariance
Check that filtering preserves the relative order of retained IDs. Use for search or facet behavior that is intended to hide rows without re-sorting them.
Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.
Weigh upChecks one supplied ordered population and subsequence, including empty arrays. It does not check scores, numeric ranks, frontier membership or dominance labels.
Evidence and evaluation · Undominated.ai
Undominated · Final-host audit
Refuse a vendor quote when the final host you recorded is not the host you requested. A redirect is not that vendor. www is not stripped, and this checker sends no request.
Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.
Weigh upCompares the two host strings you supply. It does not send a request, read a body, or strip www. A pass is not a rate card.
Evidence and evaluation · Undominated.ai
Undominated · Final-path audit
Refuse a page claim when the final path you recorded is not the path you requested. A redirect to the homepage is not that page. The host is a different checker, and this one sends no request.
Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.
Weigh upChecks recorded path strings in a narrow ASCII subset. It rejects whitespace, doubled leading slashes, URLs, queries, fragments and dot segments; it does not fetch, compare hosts, decode percent escapes, or verify page content.
Evidence and evaluation · Undominated.ai
Undominated · Header-not-row audit
Refuse a unit claim that borrows the table's display header when that row does not state its own unit. A per-million header is not every row's invoice unit. Amounts are not read.
Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.
Weigh upThe header is ignored. rowUnit has to come from that row's own sentence, or be null. It does not read amounts or convert units. A pass is not a vendor quote.
Evidence and evaluation · Undominated.ai
Undominated · Indicative-rate audit
Refuse a global-rate claim when the excerpt says the figure is indicative, varies by country, starts at a floor, or is a list price beside a credit. One sentence is not every region's rate.
Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.
Weigh upLooks for qualifying wording in the excerpt you supply. Negation is not parsed. It does not read amounts or pick a country. A pass is not a vendor quote.
Evidence and evaluation · Undominated.ai
Undominated · Licence-boundary audit
Check a redistribution claim against the licence evidence you recorded. A public page is not a licence.
Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.
Weigh upDeterministic consistency check of a filled licence note; it does not interpret licence text or fetch the licence.
Evidence and evaluation · Undominated.ai
Undominated · Model migration preflight
Check a proposed model replacement for required modalities, context, tool use, structured output and evaluation coverage before calling it a safe saving.
Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.
Weigh upDeterministic local checks over supplied evidence; not a guarantee of source truth or production suitability.
Evidence and evaluation · Undominated.ai
Undominated · Multiplier-aside audit
Refuse a base-rate claim when the excerpt names a multiplier. Priority, fast, and scale factors are not the on-demand rate. The number in 2x is not read as a price.
Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.
Weigh upLooks for multiplier wording in the excerpt you supply. Negation is not parsed. It does not read amounts or apply a factor. A pass is not a vendor quote.
Evidence and evaluation · Undominated.ai
Undominated · Payback basis
Check switching-cost payback against savings per period using exact arithmetic. Use when a migration claims to pay back in a stated number of periods.
Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.
Weigh upExact savings-based arithmetic only; repeating results remain rational pairs. Currency and period alignment, taxes, timing, discounting and source truth are not verified.
Evidence and evaluation · Undominated.ai
Undominated · Plan-quote hygiene
Keep unverified subscription quotes out of a USD monthly ceiling. A source sentence is not a price.
Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.
Weigh upDeterministic local checks over a supplied plan table; not a guarantee that a vendor page still matches.
Evidence and evaluation · Undominated.ai
Undominated · Provider quote comparison
Compare like-for-like provider quotes with complete context tiers and distinct sellers; recompute workload cost without inventing cache or reasoning discounts.
Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.
Weigh upDeterministic local checks over supplied evidence; not a guarantee of source truth or production suitability.
Evidence and evaluation · Undominated.ai
Undominated · Resource release proof
Verify local release artifacts and meaningful public-response receipts without confusing a build, HTTP 200 or registry metadata with a working installation.
Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.
Weigh upDeterministic local checks over supplied evidence; not a guarantee of source truth or production suitability.
Evidence and evaluation · Undominated.ai
Undominated · Schema-not-quote audit
Refuse a model-rate claim when the excerpt describes a pricing field or a schema. "Values are in" a unit is a field description, not a model's rate. Amounts are not read.
Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.
Weigh upLooks for schema phrases in the excerpt you supply. Negation is not parsed. It does not read amounts. A plain pass is not a vendor quote.
Evidence and evaluation · Undominated.ai
Undominated · Seller-spread audit
Check a price-spread multiple against distinct seller owners, so one vendor's own service tiers are not counted as competition.
Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.
Weigh upDeterministic local checks over supplied rows and caller-assigned seller owners; not a guarantee of source truth or market coverage.
Evidence and evaluation · Undominated.ai
Undominated · Serving-mode attribution
Check that an explicit claimed score belongs to its named model or serving mode. Use when a model headline may have inherited a mode-specific score.
Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.
Weigh upChecks explicit claimedScore and named-subject equality only. It does not verify benchmark provenance, source truth or shared measurement conditions.
Evidence and evaluation · Undominated.ai
Undominated · Single-base audit
Refuse a single-base price claim when the excerpt names both sides of a cache split or a peak split. Spelling USD per million does not make cache-hit and cache-miss one rate.
Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.
Weigh upChecks two splits in the excerpt you supply. It does not fetch a page, read amounts, or decide which sentence is the invoice. Batch, region, and input-versus-output are outside this check. A pass is not a vendor quote.
Evidence and evaluation · Undominated.ai
Undominated · Slug-is-not-body audit
Refuse a currency or quantity claim whose words appear only in a URL, a slug, or a title. The excerpt is the body. A path named pricing-details-usd does not state USD.
Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.
Weigh upReads the excerpt only. A locator is ignored. It does not fetch a page or read amounts. A pass is not a vendor quote.
Evidence and evaluation · Undominated.ai
Undominated · Source-pin audit
Refuse a source identity that is only a branch, a tag, or a short SHA. A full 40-hex revision is the pin. The name v7 or main does not become that revision.
Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.
Weigh upChecks the revision string you supply. It does not fetch a repository, resolve a tag, or prove the tree was read. A pass is not a source review.
Evidence and evaluation · Undominated.ai
Undominated · Status-not-page audit
Check a supplied status against a conservative integer-200-only gate and refuse every quote claim based on status alone. No status proves a body was received or read. This checker sends no request.
Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.
Weigh upChecks a conservative status policy only. A 200 result is status-eligible; every other valid status needs review and every quote claim is refused. No status establishes that a response body was received or read; bodyVerified is always false.
Evidence and evaluation · Undominated.ai
Undominated · Withdrawal residue
Check an explicitly observed withdrawn numeric field and its named dependents for leftover values. Use after a source value has been removed from a snapshot.
Why we selected itPairs a bounded workflow with an offline Python checker and explicitly synthetic example inputs.
Weigh upRequires the explicit observed withdrawnValue and named numeric dependents. It cannot verify withdrawal or discover omitted dependencies; zero remains residue and empty coverage requires review.
Data and analytics · dbt Labs
Upgrading dbt
Plans a dbt v1 migration to 1.12 using adapter-specific issue bundles and a recorded verification gate.
Why we selected itSeparates sequential pre-1.8 changes from detected behavior flags and preserves unresolved outside-repository job changes.
Weigh upIts stated target is 1.12, not a promise to reach whichever release is newest. Starting versions 1.3–1.7 have bundles; later versions have narrower flag handling. Parsing alone does not prove migration correctness.
Security and privacy · Trail of Bits
Variant Analysis
Expands a confirmed vulnerability into related-code searches while preserving root-cause evidence and triage decisions.
Why we selected itStarts from a verified instance and broadens one abstraction at a time, with explicit false-positive review.
Weigh upPattern matches are candidates, not confirmed vulnerabilities; reachability, sanitization and impact still need review.
Cloud operations · Vercel
Vercel Optimize
Runs a metrics-first Vercel audit: collects usage signals before reading source, gates candidates deterministically, then produces ranked cost and performance recommendations.
Why we selected itEnforces an observability-first pipeline: no source file is inspected until signals.json exists and a deterministic gate names a route, file, or setting, which blocks speculative rewrites.
Weigh upNeeds Vercel project access and usage metrics; without signals the workflow stops by design and produces nothing.
6 sources · 2026-10-07
Read the full review Install command in reviewMIT (declared in upstream README)Web development · Vercel
Vercel React Best Practices
Organizes React and Next.js performance reviews around request waterfalls, bundles, server work and rendering costs.
Why we selected itPairs rules with incorrect and corrected code, making recommendations easier to inspect.
Weigh upPublished impact labels and example speedups are not measurements of your application.
7 sources · 2026-09-21
Read the full review Install command in reviewMIT (declared in upstream README)Web development · Vercel
Vercel React Composition Patterns
Replaces growing boolean-mode APIs with explicit component composition and provider-owned state contracts.
Why we selected itShows complete before-and-after component variants rather than only naming the compound-component pattern.
Weigh upContext and compound components can add indirection to a simple component; apply the pattern where variation warrants it.
7 sources · 2026-09-21
Read the full review Install command in reviewMIT (declared in upstream README)Mobile development · Vercel
Vercel React Native Skills
Provides React Native and Expo patterns for scrolling, animations, native navigation and dependency layout.
Why we selected itIncludes worked mobile-specific examples rather than reusing browser performance guidance.
Weigh upThe list rule recommends virtualization even for short lists; that is a prescriptive default, not a measured requirement for every screen.
7 sources · 2026-09-21
Read the full review Install command in reviewMIT (declared in upstream README)Design and interfaces · Vercel
Vercel Web Interface Guidelines
Reviews interface code against a freshly fetched guideline set and returns file-specific findings.
Why we selected itCovers concrete interaction details such as focus visibility, form labeling, asynchronous announcements and URL state.
Weigh upThe skill fetches a mutable external rules file at runtime; pinning the skill alone does not freeze the guidance.
6 sources · 2026-09-21
Read the full review Install command in reviewMIT (declared in upstream README)Localization · GitHub community
VS Code Extension Localization
Localizes VS Code extensions by routing each string to its correct target: package manifest files, walkthrough markdown, or code l10n bundles.
Why we selected itThree localization approaches keyed to resource type (manifest, walkthrough, code strings) instead of one blanket rule applied to all strings.
Weigh upVS Code extensions only; not a general i18n-framework guide and silent on pluralization, ICU formats and RTL layout.
Web development · Addy Osmani
Web Quality Audit
Runs an evidence-led site audit across performance, accessibility, SEO, best practices and agentic browsing, routing each check to live traces first with CLI fallbacks, and closes with re-run verification.
Why we selected itMeasured findings and code-only hypotheses are kept in separate columns, and the Performance section tracks the Lighthouse move to shared Performance Insights instead of requiring retired audit IDs.
Weigh upIts own reference list points at the sibling accessibility skill withheld in wave 1 over a px-versus-pt contrast-table error; follow this audit's ratio-only checks and current WCAG text instead of that table.
Security review · Trail of Bits
Zeroize audit
Investigates C, C++ and Rust secret-memory cleanup with source, compiler and optional runtime evidence.
Why we selected itRequires build context and compiler output before attributing a missing wipe to optimization.
Weigh upRead-only target intent does not sandbox compilers or generated checks. Evidence labels and example reports are not independently verified zeroization proofs; AArch64 and unsupported Rust categories require manual review.
03 / BEHIND THE SELECTION
The review is part of the product.
A useful recommendation tells you why it fits—and what still needs checking.
What we inspect
We inspect the skill instructions and relevant supporting material, look for a concrete workflow and useful checks, and record dependencies, permissions and limitations. Each review names the files actually examined. Directory popularity is a discovery signal, not a quality verdict.
What a selection means
Each resource has a concrete use case, original selection reasons, named limitations and a dated review record. We favour specific instructions, useful scope and inspectable setup. The list is curated; it is not a census of everything available or an independently benchmarked league table.
Before using it
Read the complete review, check the upstream revision and match the resource to your own host and permissions. Review notes apply to the material named at the recorded date. Installation commands may retrieve a newer upstream version.
Where we looked
- Publisher skill repositories ↗
- Publisher skill repositories ↗
- Publisher skill repositories ↗
- Publisher skill repositories ↗
- Publisher skill repositories ↗
- Publisher skill repositories ↗
- Publisher skill repositories ↗
- Publisher skill repositories ↗
- Publisher skill repositories ↗
- Publisher skill repositories ↗
- Publisher skill repositories ↗
- Publisher skill repository inspected during expanded screening ↗
- Publisher skill repository inspected during expanded screening ↗
- Publisher skill repository inspected during expanded screening ↗
- Publisher skill repository inspected during expanded screening ↗
- Publisher repository screened for the Skills expansion ↗
Original skill definitions and relevant supporting files informed selection; repository inclusion is not a blanket endorsement.
- Publisher repository screened for the Skills expansion ↗
Original skill definitions and relevant supporting files informed selection; repository inclusion is not a blanket endorsement.
- Publisher repository screened for the Skills expansion ↗
Original skill definitions and relevant supporting files informed selection; repository inclusion is not a blanket endorsement.
- Publisher repository screened for the Skills expansion ↗
Original skill definitions and relevant supporting files informed selection; repository inclusion is not a blanket endorsement.
- Publisher repository screened for the Skills expansion ↗
Original skill definitions and relevant supporting files informed selection; repository inclusion is not a blanket endorsement.
- Publisher repository screened for the Skills expansion ↗
Original skill definitions and relevant supporting files informed selection; repository inclusion is not a blanket endorsement.
- Publisher repository screened for the Skills expansion ↗
Original skill definitions and relevant supporting files informed selection; repository inclusion is not a blanket endorsement.
- Publisher repository screened for the Skills expansion ↗
Original skill definitions and relevant supporting files informed selection; repository inclusion is not a blanket endorsement.
- Publisher repository screened for the Skills expansion ↗
Original skill definitions and relevant supporting files informed selection; repository inclusion is not a blanket endorsement.
- Svelte primary source ↗
Direct source screening; popularity was not treated as evidence of quality.
Selections we withheld (33)
These are documented decisions from this review, not a blacklist of the wider ecosystem.
- playwright: The publisher explicitly deprecated this repository and directs current skill/plugin users to openai/plugins. Its source was inspected but it is not selected as a current recommendation.Source ↗
- security-best-practices: The publisher explicitly deprecated this repository and directs current skill/plugin users to openai/plugins. Its source was inspected but it is not selected as a current recommendation.Source ↗
- security-threat-model: The publisher explicitly deprecated this repository and directs current skill/plugin users to openai/plugins. Its source was inspected but it is not selected as a current recommendation.Source ↗
- gh-fix-ci: The publisher explicitly deprecated this repository and directs current skill/plugin users to openai/plugins. Its source was inspected but it is not selected as a current recommendation.Source ↗
- jupyter-notebook: The publisher explicitly deprecated this repository and directs current skill/plugin users to openai/plugins. Its source was inspected but it is not selected as a current recommendation.Source ↗
- speech: The publisher explicitly deprecated this repository and directs current skill/plugin users to openai/plugins. Its source was inspected but it is not selected as a current recommendation.Source ↗
- transcribe: The publisher explicitly deprecated this repository and directs current skill/plugin users to openai/plugins. Its source was inspected but it is not selected as a current recommendation.Source ↗
- figma-implement-design: The publisher explicitly deprecated this repository and directs current skill/plugin users to openai/plugins. Its source was inspected but it is not selected as a current recommendation.Source ↗
- Expo EAS Workflows: Withheld pending clearer setup and trigger guidance. The helper depends on import.meta.main but declares no Node.js version requirement. The embedded key list describes a trigger as required, while the current service schema requires only jobs and official documentation allows manual runs without on. Resolve these differences before relying on the installed instructions.Source ↗
- Neon Postgres Branching: Withheld at the inspected revision: its lifecycle policy returns no changes for every existing branch, while the subsequent guidance says to apply that policy to an existing branch. The branching and reset material remains useful background, but this reconciliation path needs correction before recommending the installable workflow.Source ↗
- Sentry Skill Inspection: Withheld at the inspected revision: the helper copies a matching source line into its secret-detection evidence without redacting the matched value, despite a masking comment. It also reads files before reporting symlinks. Resolve these output and input-handling concerns before running it on sensitive or untrusted material.Source ↗
- Neon Postgres Egress Review: Withheld pending clearer operational examples. The bundled compute policy returns no changes for every existing branch while the next command is described as applying it to the current branch. Its query rankings use row and call counts rather than network bytes, and resetting statistics discards the existing measurement window. These need reconciliation before a guided cost-reduction recommendation.Source ↗
- Sentry Django Access Review: Withheld pending clarification of the examples and reference loading. The DRF reference places an unscoped return before the scoped return in the same function, making the latter unreachable if copied. The main definition also does not link its four useful references. The investigation method has value, but the installable material needs more precise guidance before selection.Source ↗
- Expo SDK Upgrade: Withheld after inspecting the complete references: the main workflow says to migrate uses before removing expo-av, while the video reference tells readers to uninstall it before installing expo-video. Reconcile this migration order against the target app and current Expo documentation before adoption.Source ↗
- Stripe Best Practices: Withheld at the inspected revision: required payment and security reference links point to documentation URLs that returned HTTP 404 during this review. Related files exist in the repository, but the installed workflow needs its reference routing checked before recommendation.Source ↗
- Stripe Upgrade Workflow: Withheld pending reconciliation: the useful live-version and no-downgrade guidance is paired with legacy global/module-level SDK examples, while the companion current best-practices skill explicitly rejects those patterns. Follow current SDK documentation instead of copying the bundled examples unchanged.Source ↗
- Microsoft Playwright CLI Skill: Withheld at the inspected revision: its test-generation guide requires scenario files inside tests/<group>/ but imports ./fixtures even though the shown fixture lives at tests/fixtures.ts. The same guide gives conflicting sequential/parallel instructions. Correct those examples before relying on its generation workflow.Source ↗
- Addy Osmani Accessibility: Withheld at the inspected revision: its contrast table uses CSS pixels where WCAG’s large-text exception uses points. Applying that lower size threshold could accept insufficient contrast; verify the current W3C criterion rather than copying the table.Source ↗
- Microsoft Azure Monitor OpenTelemetry for Python: Withheld pending correction: the main definition presents instrumentations as an allow-list, while its own reference and Microsoft’s current API documentation use instrumentation_options with enable/disable entries. The configuration and default behavior need reconciliation before recommendation.Source ↗
- Superpowers Git Worktree Setup: Withheld at the inspected revision: the ignore check succeeds when either .worktrees or worktrees is ignored, rather than checking the directory actually selected. This can let an unignored local worktree path pass the stated safety check.Source ↗
- GitHub Implementation Plan: Withheld pending reconciliation: the required GOAL example is not a declaration under the skill’s own rules, and its separate regex checks miss cross-form duplicates. The advertised template-validation contract therefore does not match the checks provided.Source ↗
- Datadog Monitor Management: Withheld at the inspected revision: the noisy-monitor audit sorts state-change timestamps rather than alert counts, and its ownership test looks for a literal team: tag rather than a team-prefixed tag. Those examples can misclassify the monitors they claim to audit.Source ↗
- Datadog Flaky-Test Triage: Withheld pending reconciliation: one step sends an unknown cause to quarantine while a later decision table sends a low-rate unknown cause to escalation. The same inputs can produce different actions, including a shared test-management state change.Source ↗
- Trail of Bits Modern Python: Withheld at the inspected revision: the requirements migration loop continues after an individual dependency import fails, then instructs removal of the old requirements files and environment. Confirm a complete dependency migration before following that destructive cleanup.Source ↗
- Hugging Face AWS Context Discovery: Withheld at this revision: the identity branch treats an IAM Identity Center/SSO ARN as evidence that IAM roles cannot be created. Effective permissions depend on the assigned permission set and policies, so the identity alone cannot settle the preflight.Source ↗
- Hugging Face SageMaker IAM Preflight: Withheld at this revision: the workflow inherits the assumption that an SSO principal cannot create a role and tells the user to stop on that basis. Check actual assigned IAM permissions instead of deriving this restriction from the sign-in type.Source ↗
- Hugging Face Local Models: Withheld at this revision: the llama.cpp setup still instructs users to run make, while the current upstream Makefile explicitly rejects that removed build path and directs users to CMake.Source ↗
- Matt Pocock Resolving Merge Conflicts: Withheld for broad use: the compact workflow directs the agent to always resolve, never abort, and stage everything before committing. It does not bound those writes to the requested conflict or protect unrelated work in a shared checkout.Source ↗
- Svelte Code Writer: Withheld at this revision: the Bash documentation example expands rune names inside double quotes, while the inline-code example preserves an unwanted backslash inside single quotes. Both examples need corrected shell quoting before they are reliable installation/use guidance.Source ↗
- Terraform Test: The pinned main guide documents terraform test -no-cleanup and a positional test-file invocation, and treats -filter as a run-block name. The current official Terraform test command contract documents option-only invocation and -filter=testfile. Correct upstream commands before recommending this execution guide.Source ↗
- Security Code Review: The pinned Do Not Flag list excludes code paths that require prior authentication. That blanket exclusion can hide authenticated authorization and privilege-escalation vulnerabilities, contradicting the stated broad security-review scope. The separate Django access review explicitly handles these cases.Source ↗
- libFuzzer: The recommended byte-to-uint32 harness uses potentially unaligned pointer casts, so a harness can generate its own undefined behavior. The troubleshooting guidance also conflates ASan virtual address reservation with RSS and recommends disabling the RSS guard for out-of-memory. Require corrected harness and resource-limit guidance.Source ↗
- Prometheus cardinality troubleshooter: Its series-per-instance example uses sum of sample values rather than count of series, and it asserts a fixed 14x benefit per removed label plus conclusive causation from temporal correlation. Those statements can misdirect operational diagnosis; cardinality depends on distinct label combinations.Source ↗
04 / PRACTICAL ANSWERS
Before you add it.
What is an AI skill?
A skill packages instructions for a repeatable task. It may also include scripts, reference documents or other files. The host decides when and how to use it; a skill does not replace the underlying model or guarantee its output.
What does “source reviewed” mean here?
We examined the material named in the review record and wrote our own reasons, findings and limitations. This is not an installation test, a security certification or a measured improvement in model performance. Untested aspects are listed on each detail page.
How do I install a listed skill?
Open its review and use the documented command or upstream setup guide. Skills installed through the Skills CLI can include supporting files, so copying only SKILL.md may be incomplete. Choose the intended host and project scope, and inspect the permissions before running the skill.
Are the skills ranked by downloads?
No. The default order is alphabetical. These are editorial selections with named reasons and trade-offs, drawn from multiple publishers and sources. Installation counts and star counts do not establish that a skill is right for your task.
