Verified Skills

Every skill below ships inside a verified plugin and passed the skill-safety check: no command shadowing, honest triggers, no injection language, no unsafe scripts. Install the parent plugin and the skill loads automatically when it applies.

58 skills · re-verified by CI on every change

audit

New✓ verified

Review or draft prose so it reads like a person wrote it, not an AI. Catches AI-slop tells (cliché clusters, promotional register, "not just X but Y" parallelisms, copula avoidance, uniform sentence rhythm, and em-dash or emoji overuse) and suggests rewrites. Use when writing, editing, or reviewing docs, READMEs, blog posts, release notes, or marketing copy, or when the user asks to check content for AI slop, "sloppy AI", or to make writing sound human.

from slop-checkdocumentation

FlowForge

New✓ verified

TRIGGER when: user asks to draw, illustrate, or visualize any process, structure, or concept — "画个流程图", "draw an architecture diagram", "帮我画个对比图", "visualize this process", "make a diagram for this doc", or mentions 流程图/架构图/示意图/对比图/时序图/泳道图/时间线. Also trigger when user provides a document/article and asks for illustrations or diagrams. DO NOT trigger for: chart/plot requests (bar charts, line graphs — those need a charting library, not draw.io), or artistic image requests (logos, mascots, drawings of objects/people — those need an image tool).

run

New

Pre-commit gate. Run tests, lint and type check; report PASS/FAIL per step and anything that could not run. Use before any commit or PR.

run

New

Plain-English review of the current git diff with risky lines flagged. Use for a second read before merging.

run

New

Run six offline StoreKit / Xcode pre-flight file checks on this repo and print a PASS/FAIL/WARN/SKIP table. Use before uploading an iOS build with in-app purchases or subscriptions.

Recover the original goal of a long Claude Code or Codex session using the hermes-blind CLI. Trigger when the user asks what the original goal or ask was, wants the session re-anchored, or a long session seems to have drifted from its first turn.

Review a baseline report, baseline study, baseline assessment, baseline survey, or pre-intervention measurement for indicator coverage, sampling methodology, disaggregation, measurement consistency, data quality, and target validation. Use when a user pastes, references, or asks about a baseline report, baseline study, baseline assessment, baseline survey results, pre-intervention data, or situation analysis.

Review a data quality assessment, DQA report, DQA plan, data quality audit, data verification report, or VIPRT assessment for scope adequacy, verification rigor, VIPRT coverage, systems assessment, and action plan quality. Use when a user pastes, references, or asks about a DQA, data quality assessment, data quality audit, data verification, data quality check, or VIPRT assessment.

Review an evaluation final report for structural completeness, finding quality, evidence anchoring, limitation awareness, recommendation specificity, and accessibility. Use when a user pastes, references, or asks about an evaluation report, final report, endline report, impact assessment, performance review, mid-term evaluation, summative evaluation, or evaluation findings document.

indicator-quality

✓ verified

Assess indicator quality using SMART and CREAM frameworks, identify disaggregation gaps, suggest improvements, and check data collection feasibility. Use when a user asks about indicator quality, SMART criteria, CREAM criteria, KPIs, performance metrics, measurement, indicator development, indicator reference sheets, disaggregation, or performance indicators.

logframe-review

✓ verified

Review a logframe or results framework for logic gaps, weak indicators, missing assumptions, and structural issues. Use when a user pastes, references, or asks about a logframe, log frame, LFA, logical framework, results framework, results chain, results matrix, performance framework, M&E framework, intervention logic, project design matrix, program design document, OVI, objectively verifiable indicator, overall objective, or specific objective.

me-plan-review

✓ verified

Review a monitoring and evaluation plan, MEAL plan, Performance Management Plan (PMP), MEL plan, or indicator framework for completeness, indicator quality, data collection feasibility, roles and responsibilities, reporting schedule, and quality assurance provisions. Use when a user pastes, references, or asks about an M&E plan, MEL plan, MEAL plan, monitoring plan, PMP, performance management plan, indicator framework, indicator reference sheets, data management plan, results measurement plan, M&E framework, or PIRS.

Review a progress report, quarterly report, annual report, semi-annual report, APR, donor report, performance report, or narrative report for indicator coverage, data plausibility, disaggregation, narrative-data alignment, variance explanation, and internal consistency. Use when a user pastes, references, or asks about a progress report, monitoring report, quarterly report, annual report, semi-annual report, donor report, performance report, narrative report, APR, or PUDR.

proposal-me-review

✓ verified

Review the M&E section of a proposal, grant application, concept note, or project document for approach quality, results framework alignment, indicator selection, data collection methods, evaluation planning, data quality provisions, learning and adaptation, M&E budget, and M&E staffing. Use when a user pastes, references, or asks about a proposal M&E section, grant application M&E approach, concept note M&E component, project document monitoring plan, or funding application M&E design.

Review a sampling plan, sampling strategy, sample size calculation, sampling methodology, survey design, or sampling frame for method appropriateness, sample size justification, frame quality, selection procedure, disaggregation feasibility, and practical feasibility. Use when a user pastes, references, or asks about a sampling plan, sample size, sampling strategy, sampling frame, survey methodology, survey design, or sampling approach.

survey-review

✓ verified

Review a survey instrument, questionnaire, data collection tool, KII guide, or FGD guide for design quality, question clarity, ethical compliance, sampling adequacy, and practical feasibility. Use when a user pastes, references, or asks about a survey, questionnaire, data collection tool, data collection instrument, household survey, exit survey, KII guide, key informant interview guide, FGD guide, focus group discussion guide, rapid assessment tool, intake form, or registration form.

Review a theory of change, ToC, causal pathway, results chain, impact pathway, change model, or program logic for logical coherence, assumption quality, evidence base, measurability, and scope clarity. Use when a user pastes, references, or asks about a theory of change, ToC, causal model, causal framework, impact logic, program theory, results chain, or change pathway.

tor-review

✓ verified

Review an evaluation Terms of Reference (TOR) for methodological rigor, scope feasibility, ethical compliance, team composition, and budget realism. Use when a user pastes, references, or asks about an evaluation TOR, terms of reference, scope of work, SOW, evaluation brief, commissioning brief, evaluation RFP, or request for proposals for evaluation.

Expert in responsive and mobile-first web design. Use for breakpoint strategy, fluid layout, touch targets, viewport bugs, and safely retrofitting responsiveness onto an existing site without breaking its desktop layout.

Explain perimenopause and menopause symptoms, stages, testing, HRT and non-hormonal options, lifestyle approaches, supplements, and appointment preparation using current evidence and clear safety boundaries. Use when someone asks whether a change could be perimenopause, how to manage it, or what to discuss with a clinician. Do not use for pregnancy, fertility, or unrelated health questions unless menopause is materially involved.

fhir-ci-quality

✓ verified

Generate or review FHIR validator CI workflows and derive candidate healthcare data-quality rules from local FHIR examples. Use when the user asks to add FHIR validation to GitHub Actions or another CI/CD system, create conformance quality gates, infer project conventions, or turn recurring validation expectations into reviewed automation.

from recordsdevelopment

Inspect an HL7 FHIR, FSH/SUSHI, or Implementation Guide project for validator runtimes, FHIR package dependencies, cache state, version signals, privacy gates, and setup blockers. Use when FHIR validation cannot start, profiles or packages are missing, IG Publisher/Firely/HAPI/Records availability is unclear, or the user asks to diagnose or prepare a FHIR conformance project.

from recordsdevelopment

fhir-validation

✓ verified

Validate HL7 FHIR R4 JSON resources, FHIR profile and Implementation Guide examples, and AI-created FHIR output; explain OperationOutcome and StructureDefinition issues; map defects back to FSH; and run safe validate-patch-revalidate loops. Use when the user asks for a FHIR validator, FHIR conformance check, profile validation, issue explanation, or mechanical repair. Use fhir-project-doctor for runtime/package setup and fhir-ci-quality for CI or inferred quality rules.

from recordsdevelopment

mcp-2026-07-28

✓ verified

This skill should be used when the user mentions "MCP 2026-07-28", "MCP spec", "Model Context Protocol spec", "stateless MCP", "Streamable HTTP", "HTTP+SSE", "MCP transport", "MCP lifecycle", "MCP capabilities", "MCP Apps", "MCP Tasks", "versioned extensions", "protocolVersion", or building/upgrading an MCP server to the current spec. It provides the 2026-07-28 stateless core, transport, lifecycle, and versioned-extensions model.

mcp-authorization

✓ verified

This skill should be used when the user mentions "MCP auth", "MCP OAuth", "MCP authorization", "OAuth 2.1", "OIDC", "access token validation", "audience", "resource server", "protected resource metadata", "token passthrough", "confused deputy", "Entra", "Okta", or securing a remote MCP server's identity and access. It provides the 2026-07-28 OAuth 2.1 / OIDC model for MCP servers as OAuth resource servers.

This skill should be used when the user mentions "MCP security", "MCP server security", "prompt injection", "tool poisoning", "confused deputy", "token passthrough", "MCP threat model", "command injection", "SSRF", "rate limiting MCP", "MCP CORS", or hardening a Model Context Protocol server against attack. It provides the MCP threat model and per-risk mitigations.

mcp-tool-design

✓ verified

This skill should be used when the user mentions "MCP tool", "tool design", "tool schema", "inputSchema", "tool annotations", "readOnlyHint", "destructiveHint", "tool description", "resources vs tools", "MCP prompts", or designing the tools/resources/prompts an MCP server exposes to an agent. It provides the design rules for few, powerful, well-schematized tools with accurate annotations and safe errors.

indexnow

✓ verified

Set up or run IndexNow URL submissions (Bing, Yandex, Seznam, Naver) for a website using the bundled zero-dependency Node script. Use when the user mentions IndexNow, notifying search engines of new/changed URLs, "submit URLs to Bing", or fast indexing. Not applicable to Google — Google ignores IndexNow; use Search Console sitemap submission instead.

onboard-site

✓ verified

Checklist-driven onboarding of a new website into the full search-visibility stack (Search Console, GA4, IndexNow, Bing Webmaster Tools). Use when the user says "add a new site", "onboard example.com", "set up this website", or wants to repeat the setup for another project or client site.

seo-audit

✓ verified

Run a data-driven SEO audit of a website using Google Search Console and GA4 MCP tools. Use when the user asks for an SEO audit, analysis, review, "how is my site doing in search", traffic analysis, indexing status, or sitemap health. Requires the gsc and analytics MCP servers from this plugin to be connected.

Guide the user through connecting Claude to Google Search Console and Google Analytics 4 with a reusable service account. Use when the user wants to set up, connect, or configure Search Console / GA4 access, mentions "setup google access", credentials, service accounts, or when other skills in this plugin fail with authentication or empty-property errors.

This skill should be used when the user mentions "build system", "Makefile", "Bazel", "Gradle", "Maven", "Nx", "Turborepo", "monorepo", "build targets", "how to build", "which command", "build one package", or "affected/changed projects". It provides a methodology for reading and driving common build systems and monorepos, listing targets, reading the dependency graph, and building or testing a single package without building the world.

catalog-hygiene

✓ verified

This skill should be used when the user mentions "translation catalog", "i18n keys", "missing translations", "unused keys", "untranslated", "locale files", "message catalog", "RTL", "right to left", "logical properties", "bidi", or auditing/cleaning translation files and preparing a UI for right-to-left languages. It provides the methodology for keeping catalogs healthy and making layouts direction-agnostic.

error-envelope

✓ verified

This skill should be used when the user mentions "error handling", "problem details", "rfc 9457", "rfc 7807", "request validation", "api errors", "zod", "pydantic", "class-validator", "error response format", "problem+json", "validation error", or making an API return consistent, machine-readable errors. It provides the RFC 9457 Problem Details envelope and idiomatic per-stack request-validation patterns.

eval-authoring

✓ verified

This skill should be used when the user mentions "llm eval", "evaluation", "promptfoo", "deepeval", "regression test", "llm judge", "golden dataset", "eval suite", "test a prompt", or wants to prove a prompt/model change improved rather than regressed behavior. It provides a standardized methodology for authoring assertion-based, LLM-as-judge, and golden-dataset eval suites that gate CI.

icu-messageformat

✓ verified

This skill should be used when the user mentions "i18n", "internationalization", "ICU", "MessageFormat", "pluralization", "plural", "plural rules", "selectordinal", "gender select", "translation", "locale", "formatMessage", or getting number/date/plural agreement right across languages. It provides ICU MessageFormat correctness for pluralization, gender/select, and inline formatting.

This skill should be used when the user mentions "idempotency", "idempotency key", "retries", "exactly once", "double charge", "pagination", "cursor", "offset", "rate limit", "rate limiting", "Retry-After", "safe retries", or making an unsafe HTTP method safe to retry. It provides idempotency-key store recipes, safe-retry semantics for POST/PATCH/DELETE, and cursor/offset pagination plus standard rate-limit headers.

job-reliability

✓ verified

This skill should be used when the user mentions "background jobs", "queue", "worker", "dead letter", "DLQ", "retry", "at-least-once", "exactly once", "outbox", "idempotent consumer", "visibility timeout", "BullMQ", "Celery", "Sidekiq", "SQS", "Pub/Sub", "Kafka", or "RabbitMQ", or auditing background-job/message-consumer code for reliability. It provides at-least-once handling patterns, DLQ/backoff/visibility recipes per broker, and message-deduplication strategies.

openapi-drift

✓ verified

This skill should be used when the user mentions "openapi", "swagger", "spec drift", "api contract", "breaking change", "oasdiff", "graphql schema", "api versioning", "the docs don't match the code", "requestBody", "response schema", or reconciling an API specification with its handler code. It provides a static methodology for detecting spec-vs-code drift across web frameworks and for classifying changes as breaking or non-breaking with oasdiff-style semantics.

owasp-llm-top10

✓ verified

This skill should be used when the user mentions "prompt injection", "jailbreak", "owasp llm", "llm security", "guardrails", "data exfiltration", "insecure output", "tool abuse", "indirect injection", or "is this agent safe". It provides the OWASP Top 10 for LLM Applications mapped to code-level signals, plus a library of concrete attack strings to test against.

This skill should be used when the user mentions "prompt engineering", "prompt versioning", "prompt management", "system prompt", "prompt template", "manage prompts", or "prompts scattered in code". It provides a methodology for treating prompts as versioned, reviewable, testable code rather than magic strings buried in application logic.

setup-diagnosis

✓ verified

This skill should be used when the user mentions "setup", "getting started", "install dependencies", "dev environment", "onboarding", "won't run", "version mismatch", "devcontainer", "env vars", "works on my machine", or a failing local install/build. It maps where a repo declares its runtime needs and how to diagnose and fix the common setup failures that block a green build on day one.

structured-output

✓ verified

This skill should be used when the user mentions "structured output", "json mode", "tool schema", "function calling", "json parse error", "response_format", "pydantic ai", "invalid json from the model", or "the model's JSON keeps breaking". It provides a methodology for getting reliably valid, schema-conformant structured output from LLMs across providers, plus a validate-and-retry fallback.

wcag-remediation

✓ verified

This skill should be used when the user mentions "accessibility", "a11y", "WCAG", "ARIA", "screen reader", "keyboard navigation", "focus", "focus trap", "color contrast", "alt text", "aria-label", "aria-expanded", "accessible name", or making a component usable by assistive technology. It provides the WCAG 2.2 remediation methodology and the cross-element fixes that automated tools miss.

This skill should be used when the user mentions "breaking change", "semver", "semantic versioning", "major minor patch", "version bump", "backward compatible", "API compatibility", or "deprecation". Provides a decision matrix and per-ecosystem signals for reasoning about behavioral (not just syntactic) breaking changes.

changelog-assembly

✓ verified

This skill should be used when the user mentions "changelog", "release notes", "keep a changelog", "conventional commits", "commit message", "what changed", or "release summary". Provides a standardized methodology to turn raw, possibly non-conventional git history into human-readable changelogs and release notes.

dockerfile-smells

✓ verified

This skill should be used when the user mentions "Dockerfile", "docker image size", "container security", "multi-stage build", "distroless", "run as root", "docker layer caching", or is reviewing/optimizing a container image. It provides a catalog of Dockerfile anti-patterns and the hardening principles that fix them.

This skill should be used when the user mentions "EXPLAIN", "explain analyze", "query plan", "slow query", "seq scan", "sequential scan", "nested loop", "index scan", "query optimization", "buffers", "why is this query slow", or pastes a query plan to interpret. It provides a methodology for reading Postgres and MySQL query plans and turning them into concrete index or rewrite recommendations.

This skill should be used when the user mentions "github actions failing", "CI failure", "workflow failed", "actions permission denied", "secret not found", "matrix", "cache miss", "GITHUB_TOKEN", "pipeline red", or is diagnosing a red GitHub Actions run. It provides a taxonomy of failure classes with log signals, root causes, and exact YAML fixes.

incident-response

✓ verified

This skill should be used when the user mentions "postmortem", "incident", "root cause analysis", "blameless", "severity", "SEV1", "on-call", "RCA", or "outage", or is writing up an incident. It provides a blameless postmortem methodology, a severity model, and reliability metric definitions.

This skill should be used when the user mentions "kubernetes manifest", "k8s yaml", "deployment not ready", "pod crashloop", "resource limits", "liveness readiness probe", "securityContext", or "helm values", or is validating manifests before deploy. It provides the silent failure modes of K8s manifests plus a PASS/WARN/FAIL validation checklist.

safe-migrations

✓ verified

This skill should be used when the user mentions "migration", "schema change", "zero downtime", "add column", "alter table", "add index", "lock", "expand contract", "backfill", "ALTER COLUMN", "NOT NULL", "CREATE INDEX", or rewriting a DDL change to avoid downtime. It provides the expand-contract (parallel-change) methodology and a per-dialect catalog of which DDL operations take blocking locks and their safe alternatives.

This skill should be used when the user mentions "schema design", "database anti-pattern", "N+1", "foreign key index", "normalization", "data types", "constraints", "ORM performance", "missing primary key", "VARCHAR 255", "boolean as int", or reviewing DDL/models for design problems. It provides a relational schema design anti-pattern catalog plus a per-ORM N+1 pattern library.

This skill should be used when the user asks to "generate architecture diagrams", "create dependency graph", "draw sequence diagram", "visualize system architecture", "C4 model", "Mermaid diagram", "component diagram", "ER diagram", or "data flow diagram". Provides C4 model methodology and Mermaid diagram templates for architecture documentation.

assessment-scoring

✓ verified

This skill should be used when the user asks to "score a codebase", "rate code quality", "generate assessment score", "calculate weighted score", "final assessment", or when any code-auditor agent needs to produce a scoring summary. Provides the standardized scoring methodology for code assessment reports.

This skill should be used when the user asks to "document code", "add documentation", "write docstrings", "add JSDoc", "fix documentation", "update docs", "check documentation quality", "add doc comments", or "generate API docs". Provides language-specific documentation format knowledge and quality standards for generating, updating, and auditing code documentation.

from doc-generatordocumentation

mermaid-diagrams

✓ verified

This skill should be used when the user asks to "create a diagram", "generate a flowchart", "add a sequence diagram", "visualize architecture", "create an ER diagram", "draw a state machine", "add mermaid diagram", "diagram the data model", "show the workflow", or "map out the process". Provides Mermaid diagram syntax knowledge, diagram type selection guidance, and visual conventions for generating clear, well-structured diagrams from code or requirements.

from doc-generatordocumentation

This skill should be used when the user mentions "OWASP", "CWE", "CVE", "security compliance", "security scoring", "security maturity model", "vulnerability classification", "risk rating", or "dependency vulnerability scanning". Provides security assessment frameworks and vulnerability classification methodology.

Built a skill worth trusting? Skills ship inside plugins, and plugins can be verified in an afternoon.