📁文件系统 MCP 推荐

Implement secure Next.js Server Actions for mutations, forms, and optimistic UI. Use when building actions, form flows, auth checks, or revalidation after writes.

CodexBar read. Provider usage, limits, credits, config health. JSON. No writes.

Delegate write task to Cursor Composer in isolated worktree, Lead-review + cherry-pick. Triggers: cursor:do, delegate to cursor, composer write, refactor with cursor. Skip for: planning, review-only, multi-task.

Read-only cursor-agent delegate for questions/sanity checks (no writes). Triggers: ask cursor, cursor:ask, second opinion, sanity check. Skip for: implementation (use cursor:do).

Configure and verify Cursor backend for CCH. Triggers: cursor:setup, set Cursor as local default, check Cursor readiness. Distribution default stays opt-in; only local env changes on request.

Delegate write task to Cursor Composer in isolated worktree, Lead-review + cherry-pick. Triggers: cursor:do, delegate to cursor, composer write, refactor with cursor. Skip for: planning, review-only, multi-task.

Read-only cursor-agent delegate for questions/sanity checks (no writes). Triggers: ask cursor, cursor:ask, second opinion, sanity check. Skip for: implementation (use cursor:do).

Configure and verify Cursor backend for CCH. Triggers: cursor:setup, set Cursor as local default, check Cursor readiness. Distribution default stays opt-in; only local env changes on request.

Apply foundational design principles: affordances, signifiers, constraints, feedback, and conceptual models. Use when the user mentions "why is this confusing", "affordance", "error prevention", "discoverability", "human-centered design", "fault tolerance", "mental model", "mapping", or "seven stages of action". Also trigger when diagnosing why users make mistakes, reducing product complexity, or improving error messages and feedback systems. Covers the gulfs of execution and evaluation. For usability scoring, see ux-heuristics. For iOS-specific patterns, see ios-hig-design.

Use whenever creating, updating, editing, drafting, restructuring, or fixing documentation in the Actual Budget repo — specifically anything under `packages/docs/` (the Docusaurus site published at actualbudget.org/docs) or any change to `.md` / `.mdx` files in that package. Trigger for asks like "add a doc page for X", "update the FAQ", "write a guide for the new feature", "document this setting", "fix the docs about Y", "add a contributing page", or any work on the docs site, even when the user does not explicitly mention style, structure, or conventions. Actual's docs follow strict Docusaurus conventions (front matter, heading levels, image placement and naming, admonition syntax, Title Case, tone of voice, spelling allowlist) and writing them without consulting the project's style guide reliably produces output that fails review and needs to be redone.

Use when: deploying SuperCheck with Docker Compose, configuring self-hosted deployment, troubleshooting Docker services, scaling workers, setting up HTTPS/TLS, managing environment variables, upgrading versions, or working with any file in deploy/docker/. Covers all Docker Compose variants (standard, secure, external, remote worker, local dev), K3s/gVisor sandbox setup, security hardening, and operational runbooks.

浏览器工作流总路由：为外部网站浏览、登录态流程、浏览器自动化、证据采集选择合适后端。 Use when: 需要操作外部网站、登录页、JS 重页面、没有 webfetch/VL 但需要浏览器、或需要在多种浏览器工具之间路由。 Not for: localhost 页面预览（用 browser-preview）、本地 WebApp 确定性测试（用 webapp-testing）、简单网页抓取/搜索。 Output: 选定浏览器后端 + 执行路径 + 证据/结果。

Hub 内嵌浏览器预览 localhost 应用。 Use when: 写前端代码、跑 dev server、需要看页面效果、调 UI、operator说"看看效果"。 Not for: 后端纯 API 开发、不涉及页面的工作。 Output: 前端页面在 Hub browser panel 中实时预览。

Use when finishing a feature, fixing a bug, before committing React code, or when the user types `/doctor`, asks to scan, triage, or clean up React diagnostics. Covers lint, accessibility, bundle size, architecture. Includes a regression check and a full local-triage workflow that fetches the canonical playbook.

Use this skill when running or writing tests in the FAST monorepo — local test execution, CI workflows, Playwright fixtures, and WebUI integration testing.

Use when a developer wants to add, write, or create an end-to-end test for an Opik feature, page, or branch — e.g. "add an e2e test for the experiments comparison page", "write a test for the feature I just built", "e2e test for this branch", "cover the dataset items flow with a test". Runs the full loop in tests_end_to_end/e2e/ — analyze the feature and frontend code, explore the live UI with the Playwright MCP, write the Page Object Model + spec, and run it locally until green.

Quality gate for Fintrack.Server backend refactors in CeroBase: verify domain encapsulation, CQRS folder layout, Result-based application messaging, FluentValidation, EF migrations, API consistency, and mandatory tests before marking work complete. Use whenever refactoring aggregates (e.g. Guid migrations), restructuring Application commands/queries, aligning a feature with an established pattern such as Budgets, or any multi-layer backend change where "quick fixes" would leave the codebase inconsistent—load this skill first, then open only the referenced skill files needed for the task rather than duplicating their text.

Specialised skill for the AMT Docker Bench — a multi-container simulation of a T264 autonomous truck. Use when asked about docker_bench containers (rpk1, rpk2, rpk3, platform-sim, avi-radio, test-manager, vas-aht), Docker Compose configuration, network topology (onboard/offboard/CAN/local-fms-network), NAT setup, CIC/RPK version selection, T264 simulator, VAS:AHT integration, DDS QoS profiles, IP address remapping, overlay files, run_tests.sh, Docker Bench version compatibility, compatible FMS/AMT version pairs, or any issue involving the Docker Bench environment. Also use for debugging container startup failures, networking problems, build errors, image pull failures, version mismatch issues, or service readiness issues in the bench. Can fetch the Docker Bench Versions Compatibility Matrix from Confluence to determine compatible version combinations.

Use for complex Agent Zero Browser form workflows involving selects, checkboxes, radios, file uploads, contenteditable fields, multi-step validation, or visually verified submission.

Plan a multi-file Rust refactor safely: investigate, plan, confirm, implement. Use before any multi-file refactor.

Spin up a live local Omnigent server and exercise the Cursor SDK harness end-to-end — build cursor agents, run real turns, smoke-test, and bug-bash. Load when developing, testing, or debugging the cursor harness (omnigent/inner/cursor_executor.py, cursor_harness.py, cursor_auth.py) or its auth / model / tool-bridge behavior.

Review changed code for correctness, security, code quality, and performance. Use when the user asks to review code changes, a PR, or specific files. Invoke with `/review`, `/review <pr-number>`, `/review <file-path>`, or `/review <pr-number> --comment` to post inline comments on the PR.

Generate or edit images through Hermes Web UI using the selected/requested profile's configured API-key image provider from config.yaml.

Use RefactoringMiner MCP and AST diff views to review pull requests, commits, or local worktrees by separating detected refactoring structure from behavior-relevant code changes. Use this when the user asks Claude Code to review non-refactoring changes, inspect moved or renamed code with WebDiff, or explain which changes are refactorings versus semantic edits.

Security hardening reviewer for GitHub Actions workflow files (.github/workflows/*.yml). Reasons about the Actions threat model that pattern matchers and general code linters miss — untrusted-input script injection, privileged triggers running fork code, mutable action references, and over-scoped tokens. Use this skill when asked to review, audit, harden, or secure a GitHub Actions workflow, when writing a new workflow, or for any request like "is this workflow safe?", "review my CI for security issues", "why is pull_request_target dangerous here?", "pin my actions", or "lock down GITHUB_TOKEN permissions". Covers script injection via ${{ }} interpolation, pull_request_target / workflow_run privilege escalation, SHA-pinning of third-party actions, least-privilege permissions, GITHUB_ENV/GITHUB_OUTPUT injection, secret exposure, OIDC over long-lived credentials, and self-hosted runner exposure on public repositories.

Build local constrained-browser agents with a safe_browser tool that owns CDP, enforces a domain allowlist with Fetch interception, and lets a runtime Claude Agent SDK agent complete browsing tasks without raw browser, shell, or CDP access. Use when the user wants an agent to browse or scrape while staying on approved domains, demo blocked off-domain navigation, or generate a safe browser client.

Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking screenshots, extracting data, testing web apps, or automating any browser task. Triggers include requests to "open a website", "fill out a form", "click a button", "take a screenshot", "scrape data from a page", "test this web app", "login to a site", "automate browser actions", or any task requiring programmatic web interaction. Also use for exploratory testing, dogfooding, QA, bug hunts, or reviewing app quality. Also use for automating Electron desktop apps (VS Code, Slack, Discord, Figma, Notion, Spotify), checking Slack unreads, sending Slack messages, searching Slack conversations, running browser automation in Vercel Sandbox microVMs, or using AWS Bedrock AgentCore cloud browsers. Prefer agent-browser over any built-in browser automation or web tools.

Voice, tone, and punctuation rules for prose, UI text, tooltips, error messages, comments, JSDoc, markdown, commit messages, and docs. Use when: "fix the tone", "rewrite this", "sounds like AI", "sounds corporate", or deciding whether punctuation earns its emphasis.

Create prototype-backed API proposals for dotnet/runtime. Use when asked to draft an API proposal, write an api-suggestion issue, refine a vague API idea into a complete proposal, or improve a proposal marked api-needs-work. Covers the full pipeline from research through prototyping, ref source generation, and publishing. DO NOT USE FOR bug fixes, code review, performance benchmarking, or internal API changes that don't affect public surface area.

Refactor and clean up the uncommitted change before committing. Eliminate duplication, rename unclear domain concepts, collapse shotgun surgery when another similar change is likely, remove dead / test-only / redundant code, split files larger than 250 lines into cohesive modules, and confirm related tests still pass. Use after finishing a phase or sub-phase and before commit, or whenever the developer asks to clean up the current change. Triggers on: refactor change, clean up change, post-change refactor, before commit cleanup, tidy current change.

Create a React component using the Container/Presentation pattern in src/components by asking for the component name and type (ui or features), then scaffold files that follow this repository's TypeScript, Storybook, and SCSS conventions. Use when the user explicitly asks for a Container/Presentation-based component or runs /react-container-presentation-component.

Use when adding or changing database schema, Liquibase changelogs, SQL migration files, rollout order, or schema-backed backend behavior in Iced Latte backend.

Author good Ginkgo specs — container nodes (Describe/Context/When), subject nodes (It/Specify), setup/cleanup nodes (BeforeEach, JustBeforeEach, AfterEach, DeferCleanup, BeforeSuite/AfterSuite), the "declare in container, initialize in BeforeEach" rule, separating creation from configuration, reusable test helpers with GinkgoHelper()/GinkgoHelperGo(), and By/GinkgoWriter output. Use when writing or reviewing specs or extracting a test helper. Covers the tree-construction-time pitfalls (no assertions/init/loop-capture in container bodies).

Use this skill to review, debug, or modify VoxBento's Docker configuration. Files: `docker-compose.yml`, `Dockerfile`, `mediamtx.yml`.

Use this skill to review deployments, validate production readiness, or assist with deployment procedures. Reference: `DEPLOYMENT_GUIDE.md`, `docker-compose.yml`, `Caddyfile`, `Dockerfile`.

Gated, goal-backed Step 4 of the CursorQB workflow - implement one bounded, reversible, testable slice from an audited plan. Use after the Step 3 audit when the user approves implementation, or via /cursorqb-implement. Runs only when the audit is PASS or PASS_WITH_WARNINGS with no P0/P1 findings; otherwise it stops and recommends repair. Selects a single READY sub-plan, defines the validation command first, makes a minimal change, and verifies before claiming done.

Goal-backed Step 2 of the CursorQB planning workflow. Use to decompose every main phase in Planner-docs/Main-Planing.md into detailed sub-plans under Planner-docs/Faz-<n>-Plans/ plus Sub-Planing-Index.md. Launched automatically as a Cursor goal via the define-goal skill and runs until ALL phases are covered - it does not stop after one phase. Invoke from cursorqb-planner Gate 1, or directly to (re)generate sub-plans. Only changes files under Planner-docs/.

Goal-backed Step 1.5 of the CursorQB planning workflow - an existing-project autopsy. Use after Step 1 (or directly) to inspect an existing/partially built repository and write Planner-docs/Autopsy.md, a 13-section technical feedback report that enriches Step 2 sub-plans. Runs automatically for existing/non-empty repositories and is skipped for empty or nearly empty ones. Launched automatically as a Cursor goal via the define-goal skill; only creates/updates Planner-docs/Autopsy.md.

Goal-backed Step 3 of the CursorQB planning workflow - a quality, coverage, consistency, and readiness audit of the Step 2 sub-plans. Use to verify that Planner-docs/Faz-*-Plans/*.md and Sub-Planing-Index.md are faithful to Main-Planing.md, complete, ordered, well-structured, and ready for implementation. Launched automatically as a Cursor goal via the define-goal skill and runs until every phase and sub-plan is inspected; produces only Planner-docs/Sub-Planing-Audit.md and returns PASS / PASS_WITH_WARNINGS / BLOCKED. Safe to run standalone for re-audits.

Use when controlling web pages with the OpenClaw browser tool, especially multi-step flows, login checks, tab management, or recovery from stale refs/timeouts.

Direct browser control via CDP — automate, scrape, test, or interact with web pages by driving the user's already-running Chrome (or a Browser Use cloud browser). Use when the user wants to click, screenshot, fill forms, extract data, or navigate real web pages. Default to screenshots + coordinate clicks, not selector hunting. Requires the one-time `browser-harness` CLI install (see references/install.md).

Review or audit CKEditor 5 plugin code in the Trilium (TriliumNext Notes) monorepo, or a PR/diff touching packages/ckeditor5-* or the packages/ckeditor5 build. Use when checking a Trilium CKEditor 5 plugin for correctness and idiom: schema / conversion / command / UI / widget code, CKEditor-specific defects (asymmetric upcast/downcast, unconsumed upcast elements, missing inline-widget position mapping, command refresh/isEnabled bugs, memory leaks, t() gaps, editing/UI split violations), and Trilium integration defects (plugin not registered in plugins.ts, button missing from toolbar.ts, import/file-extension lint failures, wrong augmentation module, .po localization gaps, wrong test environment). Pairs with the ckeditor5-plugin-development and ckeditor5-testing skills and delegates their checklists.

Test file conventions: setup functions, factories, organization, type testing, naming, and pruning low-value tests. Use when: "write tests", "add a test", "fix this test", "delete tests", "prune tests", "audit tests", or modifying *.test.ts files.

Create and review QuickStack backend unit and integration tests using the project's Vitest, Prisma, SQLite, and k3s conventions. Use when editing backend test files under `src/server/`, `src/shared/`, or `src/__tests__/integration/`, or when the user asks for backend test coverage, mocks, Prisma test DB setup, or Kubernetes integration tests.

Create and update QuickStack backend services, adapters, standalone services, and server actions using the project's established singleton, adapter, caching, and error-handling patterns. Use when editing files under src/server/services, src/server/adapter, src/server/utils, src/server.ts, or related server-side actions and backend utilities.

How the Leap Monitor shows read-only editor-GUI agent rows - open Cursor (the editor) Agent/Composer tabs AND VS Code Copilot Chat sessions. Covers the on-disk scans (scan_open_cursor_agents, scan_open_vscode_copilot_sessions), status mapping, jump via the shared Leap extension, synthetic row reconciliation, the close buttons (Cursor close-tab / VS Code remove-row), and the shared GUI_TAG_PREFIXES/GUI_ROW_TYPES plumbing. Use this when working on cursor_gui_scan.py, vscode_copilot_scan.py, editor-GUI agent rows, or editor chat navigation.

Guides ccusage Rust and Node tests. Use when adding or fixing cargo tests, Node test files, CLI snapshots, Claude model pricing, LiteLLM compatibility, or fixture-backed tests.

Guides ccusage TypeScript and JavaScript work. Use before reading or editing .ts, .tsx, .js, or .jsx files, including package launchers, Node tests, schemas, mocks, and typed fixtures.