Loading...
Loading...
Found 1,484 Skills
Comprehensive n8n workflow testing including execution lifecycle, node connection patterns, data flow validation, and error handling strategies. Use when testing n8n workflow automation applications.
WCAG 2.2 AA compliance expert specializing in audits, automated testing, screen reader validation, and remediation.
Refines a v1 project plan into agent-ready tasks with clear context, implementation steps, and validation criteria. Use after /plan-project has produced a v1 plan.
Reviews finished and in-progress digital products to assess adherence to design specifications and discover potential issues. Use when user says "design review", "design QA", "QA review", "check implementation", "visual bugs", "compare to design", "match the specs", "review the build", "before launch", "pre-launch review", "implementation review", "verify design", "design validation", "spacing issues", "visual discrepancies", "accessibility review", "WCAG compliance", or "responsive testing". Validates implementation against design intent, identifies visual and interaction discrepancies, and provides actionable feedback. Do NOT use when still designing concepts (use design-concepts), need to understand users (use design-research), or nothing has been built yet.
Audit content and assets for brand compliance — style guide validation, tone of voice checking, visual identity consistency, brand asset management, and cross-channel coherence.
Apply Spatie's Laravel and PHP coding standards for any task that creates, edits, reviews, refactors, or formats Laravel/PHP code or Blade templates; use for controllers, Eloquent models, routes, config, validation, migrations, tests, and related files to align with Laravel conventions and PSR-12.
Provides comprehensive guidance for input validation, data serialization, and ID management in backend APIs. This skill should be used when designing validation schemas, transforming request/response data, mapping database IDs to external identifiers, and ensuring type safety across API boundaries.
Audits codebases for common security vulnerabilities that AI coding assistants introduce in "vibe-coded" applications. Checks for exposed API keys, broken access control (Supabase RLS, Firebase rules), missing auth validation, client-side trust issues, insecure payment flows, and more. Use this skill whenever the user asks about security, wants a code review, mentions "vibe coding", or when you're writing or reviewing code that handles authentication, payments, database access, API keys, secrets, or user data — even if they don't explicitly mention security. Also trigger when the user says things like "is this safe?", "check my code", "audit this", "review for vulnerabilities", or "can someone hack this?".
Use this skill when testing REST or GraphQL APIs, implementing contract tests, setting up mock servers, or validating API behavior. Triggers on API testing, Postman, contract testing, Pact, mock servers, MSW, HTTP assertions, response validation, and any task requiring API test automation.
Use this skill when building user interfaces in a Next.js project that uses shadcn/ui. Triggers include any request to create, update, or refactor React components, pages, forms, dialogs, tables, or layouts. Also use when the user asks about component installation, styling with Tailwind, form validation, toast notifications, or theming. Use this skill whenever the project stack involves shadcn/ui, Tailwind CSS, React Hook Form, Zod, or Sonner.
Conduct simulated user research with AI personas. Triggers when the user says 'do user research', 'run user research', 'simulate user interviews', or '/user-research'. Three phases: free growth → pain extraction → product collision, with four quality validation checkpoints. Supports single or multi-concept testing.
Deterministic API endpoint validation with structured pass/fail reporting. Use when endpoints need smoke testing, health checks are required before deployment, or CI/CD pipelines need HTTP validation gates. Use for "validate endpoints", "check api health", "api smoke test", or "are endpoints working". Do NOT use for load testing, browser testing, full integration suites, or OAuth/complex authentication flows.