🔍代码审查 / GitHub MCP 推荐

Performs a comprehensive, multi-step code review of pull requests or local code changes, using iterative refinement (generation, critique, synthesis) to ensure high-quality, actionable feedback. Use when you need to review code changes thoroughly.

Load all relevant GitLab development principles before planning or implementing. Evaluates every principle group to ensure cross-domain coverage.

Review PyTorch pull requests for code quality, test coverage, security, and backward compatibility. Use when reviewing PRs, when asked to review code changes, or when the user mentions "review PR", "code review", or "check this PR".

Use when fixing React hook lint failures in the Keybase client: react-hooks/set-state-in-effect, derived-state effects, prop-change resets, event-hidden-in-effect, stale async results.

Software Mansion's best practices for production React Native and Expo apps on the New Architecture. Trigger on: 'React Native', 'Expo', 'New Architecture', 'Reanimated', 'Gesture Handler', 'react-native-svg', 'ExecuTorch', 'react-native-audio-api', 'react-native-enriched', 'Worklet', 'Fabric', 'TurboModule', 'WebGPU', 'react-native-wgpu', 'TypeGPU', 'GPU shader', 'WGSL', 'svg', 'animation', 'gesture', 'audio', 'rich text', 'AI model', 'multithreading', 'chart', 'vector', 'image filter', 'shared value', 'useSharedValue', 'runOnJS', 'scheduleOnRN', 'thread', 'worklet', or any question involving UI, graphics, native modules, or React Native threading and animation behavior. Also use when a more specific sub-skill matches.

Create REST/GraphQL API endpoint with validation, error handling, and tests. Auto-invoke when user says "add endpoint", "create API", "new route", or "add route".

Generate backend tests (unit, integration, mocks) for existing code. Auto-invoke when user says "write test for", "add test", "test this", or "create test".

Review pending UTM changes before they are submitted. Runs a standard correctness/quality code review of the current branch's diff AND audits it against UTM's contribution rules in CONTRIBUTING.md and AGENTS.md — scope discipline, commit/PR format, AI attribution, logging hooks, generated files, UI/design philosophy, and platform compatibility. Use this before opening or updating a UTM pull request, whenever the user asks to review UTM changes, or when the user runs /utm-review. The /utm-submit workflow expects this to have been run on the current changes first.

Browser automation CLI for AI agents. Use when the user needs to inspect, test, or automate browser behavior: navigating pages, filling forms, clicking buttons, taking screenshots, extracting page data, reading selected Open Design browser-tab context, testing web apps, dogfooding Open Design previews, QA, bug hunts, or reviewing app quality. Prefer local Open Design preview URLs unless the user explicitly asks for external browsing.

Document or design a database schema with entity relationships, table definitions, constraints, indexes, and access patterns. Use when asked to design a database, document an existing schema, model entities and relationships, define table structures, plan an index strategy, or produce a data model for review. Produces a structured schema document covering an ER diagram, table DDL definitions, index strategy, access pattern analysis, normalization decisions, and migration notes.

Write a safe, zero-downtime database migration plan for a schema change. Use when asked to plan a database migration, design a zero-downtime schema change, document an expand/contract migration, produce a rollback procedure for a database change, or coordinate a database schema update with a deployment. Produces a structured migration plan covering migration objectives, backward compatibility analysis, expand/contract phase breakdown, exact SQL, rollback steps per phase, data validation queries, and a deployment runbook.

Write a safe, zero-downtime database migration plan for a schema change. Use when asked to plan a database migration, design a zero-downtime schema change, document an expand/contract migration, produce a rollback procedure for a database change, or coordinate a database schema update with a deployment. Produces a structured migration plan covering migration objectives, backward compatibility analysis, expand/contract phase breakdown, exact SQL, rollback steps per phase, data validation queries, and a deployment runbook.

Document or design a database schema with entity relationships, table definitions, constraints, indexes, and access patterns. Use when asked to design a database, document an existing schema, model entities and relationships, define table structures, plan an index strategy, or produce a data model for review. Produces a structured schema document covering an ER diagram, table DDL definitions, index strategy, access pattern analysis, normalization decisions, and migration notes.

Security review patterns for Langfuse. Use during code review, design, or planning whenever a change accepts user-supplied URLs, host/endpoint/baseURL fields, secrets, cross-tenant data, new outbound HTTP requests, new integrations (webhooks, blob storage, LLM connections, image proxies), redirect-following behavior, or new auth/permission scopes. Covers SSRF/outbound URL validation today and is intentionally extensible to other recurring security findings (tenant isolation, secret handling, redirect mishandling, file upload, RBAC scope drift).

通过 Evotown Database MCP Proxy 对已注册的业务数据库执行只读 SQL 查询。当用户需要查 CRM、订单、报表等结构化数据时使用；禁止直连数据库或写入 SQL。

Research-driven feature design with implementation plan. Combines brainstorming and planning into one flow. Use when designing a new feature. Triggers on "design", "brainstorm", "plan a feature", "how should we build X".

Database migrations and Drizzle ORM guidelines for the vm0 project

Rule matrix security fixture for sql_injection used by security rule matrix integration tests; not intended for production deployment.

Comprehensive testing patterns and anti-patterns for writing and reviewing tests

Use this skill for Laravel MCP development. Trigger when creating or editing MCP tools, resources, prompts, servers, or UI apps in Laravel projects. Covers: artisan make:mcp-* generators, routes/ai.php, Tool/Resource/Prompt/AppResource classes, schema validation, shouldRegister(), OAuth setup, URI templates, read-only attributes, MCP debugging, MCP UI apps, the x-mcp::app Blade component, createMcpApp(), default AppResource handle() auto-infers view from class name, Response::view(), AppMeta/Csp/Permissions/appMeta() configuration, #[RendersApp] attribute, Library enum for CDN libraries (Tailwind, Alpine), and host theming via CSS variables. Use this whenever the user mentions MCP apps, MCP UI, interactive MCP resources, styling MCP apps with Tailwind or Alpine, or building visual interfaces for AI agents.

Automation Governance skill for the OpenCode ecosystem

Kubernetes workload patterns, resource management, RBAC, probes, autoscaling, ConfigMap/Secret handling, and kubectl debugging for production-grade deployments.

Visual design direction for new or redesigned frontend surfaces: layout, typography, color, motion, and anti-generic aesthetics. Use when designing pages, dashboards, posters, marketing surfaces, or exploratory UI variations.

Fix Cursor RTL rendering issues end-to-end with visual verification. Use when the user provides a cursor-ext-rtl GitHub issue, mentions RTL visual bugs, Markdown tables, Hebrew/Arabic/Persian layout, Cursor chat rendering, or asks to develop and visually test a fix.

Delegate coding to OpenAI Codex CLI (features, PRs).

Create professional CSS animations, transitions, micro-interactions, and complex motion design. Use when adding animations, hover effects, loading states, page transitions, scroll animations, or any motion design work.

Use the mcpc CLI to work with MCP (Model Context Protocol) servers from the shell - connect to a server as a persistent session, then list and call tools, read resources, get prompts, and run async tasks. Use --json for scripting and code mode. Reach for this whenever interacting with MCP servers, calling MCP tools, or accessing MCP resources programmatically.

Reference for OrangeHRM's test layers — PHPUnit per-plugin testsuites declared in `phpunit.xml`, the test-DB lifecycle (`instance:create-test-db` builds a populated MySQL DB plus a `CoreFixtureService` dump that bootstrap restores per test), test base classes (`TestCase` for plain unit tests, `KernelTestCase` for tests that need the full framework + DI container, `EntityTestCase` for entity-only tests, `EndpointTestCase` and `EndpointIntegrationTestCase` for API endpoint tests with request mocking + exception expectations), the YAML fixture pattern (per-plugin `test/fixtures/<DaoName>.yml` + `TestDataService::populate($yamlPath)` in `setUp()`), Jest configuration for frontend unit tests (`@vue/cli-plugin-unit-jest/presets/typescript-and-babel`, `__tests__/` siblings), and Cypress for E2E (separate workspace under `src/test/functional/`). Use whenever the user is writing a test, deciding which base class to extend, debugging fixture loading, setting up the test DB, running a single test class, or trying to fig

Personal automation expertise covering IFTTT applets, Apple Shortcuts, Android automation, financial automation (bill pay, savings, investing), notification management, routine automation, smart home orchestration, and building systems that reduce cognitive load and save time on repetitive life tasks. Use when the user asks about automation for life, related techniques, best practices, or needs guidance in this domain. Do NOT use when the request is outside the scope of automation for life or requires a different specialized skill.

Workflow automation design using Zapier, Make, and n8n covering trigger-action architecture, multi-step automation workflows, error handling strategies, personal versus business automation patterns, ROI calculation, and a library of common automation recipes. Use when the user asks about automation architect, related techniques, best practices, or needs guidance in this domain. Do NOT use when the request is outside the scope of automation architect or requires a different specialized skill.

SQLite expertise for application development covering WAL mode configuration, concurrent access patterns, FTS5 full-text search, JSON support, virtual tables, PRAGMA optimization, backup strategies, file locking behavior, embedding patterns for desktop and mobile apps, migration strategies, and understanding size and concurrency limits. Use when the user asks about sqlite specialist, sqlite specialist best practices, or needs guidance on sqlite specialist implementation. Do NOT use when the user needs a different specialized skill or is asking about an unrelated technology domain.

Advanced SQL expertise including window functions, CTEs, recursive queries, query optimization with EXPLAIN plans, indexing strategies, pivot/unpivot operations, JSON operations, full-text search, stored procedures, and identification of performance anti-patterns across PostgreSQL, MySQL, and SQL Server. Use when the user asks about sql master, sql master best practices, or needs guidance on sql master implementation. Do NOT use when the user needs a different specialized skill or is asking about an unrelated technology domain.

Advanced SQL for analytics covering window functions, CTEs, recursive queries, query optimization, pivoting, and complex analytical patterns for data warehouses and analytics databases. Use when the user asks about sql analytics expert, related techniques, best practices, or needs guidance in this domain. Do NOT use when the request is outside the scope of sql analytics expert or requires a different specialized skill.

Guides expert-level refactoring patterns implementation: refactoring and clean-code decision frameworks, production-ready patterns, and concrete templates for refactoring patterns workflows. Use when the user asks about refactoring patterns, refactoring patterns configuration, or refactoring best practices for refactoring projects. Do NOT use when the user needs a different developer tools capability -- check sibling skills in the developer tools subcategory.

Code refactoring specialist applying Martin Fowler's catalog, code smell detection, safe transformation steps, and metrics-driven refactoring decisions. Use when the user asks about refactoring guru, refactoring guru best practices, or needs guidance on refactoring guru implementation. Do NOT use when the user needs a different specialized skill or is asking about an unrelated technology domain.

Advanced CSS expertise covering Grid and Flexbox mastery, custom properties architecture, responsive design methodology, CSS methodology selection, animation performance, container queries, cascade layers, and specificity management. Use when the user asks about css master, css master best practices, or needs guidance on css master implementation. Do NOT use when the user needs a different specialized skill or is asking about an unrelated technology domain.

Guides expert-level css architecture implementation: html-css and web-development decision frameworks, production-ready patterns, and concrete templates for css architecture workflows. Use when the user asks about css architecture, css architecture configuration, or html-css best practices for css projects. Do NOT use when the user needs a different web development capability -- check sibling skills in the web development subcategory.

Mobile accessibility development expertise covering iOS VoiceOver and Android TalkBack integration, accessibility APIs for SwiftUI and Jetpack Compose, touch target sizing, gesture alternatives, dynamic type support, color contrast compliance, screen reader testing, and WCAG mobile-specific success criteria. Use when the user asks about accessible mobile developer, related techniques, best practices, or needs guidance in this domain. Do NOT use when the request is outside the scope of accessible mobile developer or requires a different specialized skill.

Expert mobile UI/UX patterns covering platform design guidelines (Material Design, Human Interface), responsive layouts, gesture handling, offline-first UI, skeleton screens, pull-to-refresh, infinite scroll, bottom sheets, and haptic feedback. Use when the user asks about mobile ui designer, mobile ui designer best practices, or needs guidance on mobile ui designer implementation. Do NOT use when the user needs a different specialized skill or is asking about an unrelated technology domain.

Expert mobile app testing covering unit testing (XCTest, JUnit), UI testing (Espresso, XCUITest, Detox), screenshot testing, device farm testing, performance testing, network condition simulation, accessibility testing, and crash reporting. Use when the user asks about mobile testing, mobile testing best practices, or needs guidance on mobile testing implementation. Do NOT use when the user needs a different specialized skill or is asking about an unrelated technology domain.

Mobile application security covering certificate pinning implementation, secure local storage patterns, jailbreak and root detection, code obfuscation and tamper detection, API security for mobile clients, biometric authentication, secure key management, network security, reverse engineering defense, and compliance with OWASP MASVS. Use when the user asks about mobile security engineer, mobile security engineer best practices, or needs guidance on mobile security engineer implementation. Do NOT use when the user needs a different specialized skill or is asking about an unrelated technology domain.

Expert mobile continuous integration and delivery covering Fastlane automation, code signing management, TestFlight and Google Play deployment pipelines, App Center distribution, automated testing in CI, build versioning strategies, environment configuration, and release management for iOS and Android apps. Use when the user asks about mobile cicd, mobile cicd best practices, or needs guidance on mobile cicd implementation. Do NOT use when the user needs a different specialized skill or is asking about an unrelated technology domain.

Comprehensive mobile application quality assessment covering performance, UX, accessibility, security, and app store compliance to produce an actionable audit scorecard. Use when the user asks about mobile app quality audit, related techniques, best practices, or needs guidance in this domain. Do NOT use when the request is outside the scope of mobile app quality audit or requires a different specialized skill.

Expert mobile analytics covering attribution tracking, funnel analysis, crash reporting integration, A/B testing frameworks, retention and cohort analysis, event taxonomy design, privacy-compliant data collection, real-time dashboards, and actionable metric strategies for iOS and Android applications. Use when the user asks about mobile analytics, mobile analytics best practices, or needs guidance on mobile analytics implementation. Do NOT use when the user needs a different specialized skill or is asking about an unrelated technology domain.

Mobile privacy expertise covering app permission management, tracking prevention on iOS and Android, secure messaging app selection, device encryption, privacy-focused browser and DNS configuration, location tracking minimization, app audit methodology, and building a privacy-conscious mobile setup without sacrificing usability. Use when the user asks about mobile privacy guide, related techniques, best practices, or needs guidance in this domain. Do NOT use when the request is outside the scope of mobile privacy guide or requires a different specialized skill.

Free-to-play mobile game design covering F2P design patterns, retention mechanics, short session design, monetization models (IAP, ads, battle pass), mobile UX, onboarding flows, A/B testing, analytics-driven design, and live operations strategy. Use when the user asks about mobile game designer or needs help with related topics. Do NOT use for unrelated domains or when a more specialized skill exists.