Variant Analysis: Locate a Bug and Eliminate All Similar Ones
Trail of Bits’ variant-analysis has turned the daily variant analysis work of security engineers into an Agent Skill: after confirming a vulnerability, it extracts the root cause, calibrates with precise patterns, searches the entire codebase while relaxing only one condition at a time, and finally triages and leaves CI rules. This article explains the five-step workflow, the selection of ripgrep, Semgrep and CodeQL, as well as the installation and invocation methods of Claude Code, Codex and Cursor, based on the official SKILL.md, plugin README and policy documents.
Read MoreSemgrep-Rule-Creator: Using Agent to Write Testable Semgrep Security Rules
`semgrep-rule-creator` is an Agent Skill launched by Trail of Bits, used to create custom Semgrep rules that can detect security vulnerabilities, bug patterns and code patterns. Instead of running existing rule sets, it forces the Agent to produce rules following the workflow of test-first, AST analysis, priority given to taint mode, and optimization only after all tests pass. This article organizes the installation method, seven-step workflow, eval taint example and usage boundaries based on the official SKILL.md, plugin README and skill market description.
Read More# Property-Based Testing: Trail of Bits Turns Property Testing into Reusable Agent Skills
Trail of Bits' property-based-testing is a cross-language skill guide for property testing that includes smart contracts. It teaches agents to identify encoding/decoding, parsing, normalization, and contract invariants, write tests based on properties like round-trip and idempotence, and distinguish between test errors and real bugs when tests fail. Based on the official SKILL.md, plugin READMEs and market repositories, the article explains the installation of Claude Code / Codex, the `npx skills add` command, and reproducible examples such as Hypothesis.
Read MoreDifferential Review: Trail of Bits formalizes PR security differential review into an executable workflow
Differential-review is an Agent Skill released by Trail of Bits, which conducts security-focused reviews on PRs, commits and diffs: it classifies tasks by risk rather than line count, uses git history to detect regressions, quantitatively calculates the blast radius, treats missing tests as a higher risk factor, and enforces the output of a Markdown report with line numbers and attack scenarios. This article checks the official SKILL.md, plugin README and documentation website, explaining what problems it solves, how to install it in Claude Code / Codex / the general Skill catalog, as well as three official usage scenarios and inapplicable scenarios.
Read MoreUsing firecrawl-build-search: Start from queries and write web discovery into product code
`firecrawl-build-search` is an official Agent Skill for Firecrawl, specifically designed to connect the `/search` endpoint to product code: the functionality starts from queries instead of URLs. It first discovers, ranks and selects sources, then decides whether to hydrate the content or hand it over to `/scrape`. This article cross-verifies installation commands, authentication fields, one-step/two-step call differences, and error-prone upgrade paths such as paper indexing and developer indexing based on GitHub's SKILL.md, repository README, officialskills.sh and docs.firecrawl.dev.
Read MoreIntegrate Web Search, Crawling and Browser Interaction into Application Code with firecrawl-build
`firecrawl-build` is the official application integration entry Skill of Firecrawl, located in the `firecrawl/skills` repository. It targets scenarios where products, agents or workflows need to obtain webpage data through code. It first clarifies what data to fetch and how to fetch it, then routes the requirements to `/scrape`, `/search` or `/interact`, instead of mixing "help me search a page in the current session" with "integrate Firecrawl into the backend". This article checks the installation commands, environment variables, SDK, sub-skill division, smoke test, and the boundaries with CLI/Workflow skills against the SKILL.md, repository README and official documentation.
Read MoreSandbox SDK Skill: Let AI Securely Execute Untrusted Code with Cloudflare Sandbox
### Official Translation: This article introduces Cloudflare's sandbox-sdk Agent Skill: it explains how to guide Cursor / Claude Code / Codex to use the Sandbox SDK to execute untrusted code in Workers isolated containers. The article verifies the current status of the project being split into sandbox-stable, sandbox-next, and sandbox-migrate-to-next in August 2026, and provides official installation methods, minimal Worker examples and lifecycle, as well as restrictions such as transport and image alignment.
Read More# workers-best-practices Skill: Review and Write Cloudflare Workers in Accordance with Production Agreements
Cloudflare's official workers-best-practices Skill is used to review and write Workers code in accordance with production conventions: it pulls current documentation and types first, then checks `wrangler.jsonc`, streaming responses, floating promises, global state, secrets and observability. This article verifies the installation method, rule list and anti-patterns based on the original GitHub content and the official best practice page, and explains that Durable Objects, Workflows and the wrangler CLI need to switch to other Skills in the same repository.
Read More# 翻译结果 Durable Objects Skill: Build Chatrooms, Collaboration and Stateful RPC According to Official Conventions
### 正式翻译（符合技术文档译法，兼顾准确性与行业惯例）： The official Cloudflare durable-objects Skill is used to create and review Durable Objects: sharding by chat rooms, game sessions or tenants, routing via `getByName`, carrying stateful edge logic with SQLite, RPC, alarms and WebSockets, and testing with Vitest. This article verifies the installation, configuration and anti-patterns against the original GitHub source and official documentation, and notes that while the Skill example still uses migrations, the current getting-started documentation recommends declaring SQLite classes via `exports`.
Read More# Cloudflare Skill: A Progressive Loading Full Platform Manual for AI
Cloudflare's official cloudflare Skill is a cross-platform entry point for Agents: users can select the right primitive among Workers, Pages, KV/D1/R2, Workers AI, Network & Security, and Terraform/Pulumi via a decision tree, then load 63 product reference directories on demand. This article cross-verifies the installation method, binding syntax and typical usage based on the original GitHub text and official documentation, and notes that reference materials may expire — for example, the example model @cf/meta/llama-3.1-8b-instruct has been discontinued as of 2026-05-30, and the quota limits and model names shall be subject to the latest Cloudflare documentation.
Read MoreConnect 1000+ External Apps to Agents with Composio Skill
Composio's official Skill teaches AI programming assistants to connect to 1000+ external applications such as Gmail, Slack, GitHub, Notion via a unified CLI and SDK. This article verifies the installation commands, the search→link→execute workflow, user-isolated sessions, as well as the usage boundaries of OAuth and Triggers based on SKILL.md, the repository README and docs.composio.dev.
Read More# Voltagent Best Practices: Incorporating VoltAgent Architecture Conventions into Agent Skills
`voltagent-best-practices` is an architecture quick-reference Skill officially maintained by VoltAgent, covering trade-offs between Agent and Workflow, src directory conventions, memory default values, Hono/Elysia/serverless servers, and VoltOps observation access. This article cross-verifies the installation and activation methods, code snippets and precautions based on the official SKILL.md, VoltAgent documentation and VoltAgent/skills repository, and explains the division of labor between it and the create-voltagent scaffolding Skill.
Read More# create-voltagent: Initialize AI Agent Project in Accordance with VoltAgent Specification Using Official Skill
`create-voltagent is an Agent Skill officially maintained by VoltAgent, which guides users to create TypeScript AI Agent projects via the `create-voltagent-app` CLI or complete manual steps. This article is cross-verifies based on the official `SKILL.md`, Quick Start and VoltAgent/skills repository: it covers the installation and activation methods, Hono/Elysia and six model providers, directory and environment variable conventions, weather Tool and reimbursement approval Workflow examples, as well as its differences from the general "project scaffolding" Skill.
Read MoreWrite Your First Agent Skill Using the Official template-skill
Template-skill is the starting skeleton of Skill in Anthropic's official repository anthropics/skills, with only one SKILL.md file containing name and description placeholders in the directory. Agent Skills became an open standard in December 2025, and the same file can be enabled by scanning directories in Cursor, Claude Code, and Codex CLI respectively. This article follows the official template and agentskills.io specifications to explain the frontmatter fields, directory structure, installation paths of each tool, and how to fill in the template to create the first triggerable Skill.
Read More`find-bugs: Let AI scan the current branch for bugs and security issues according to the checklist`
find-bugs is an Agent Skill publicly released by the Sentry Engineering Team in the getsentry/skills repository, which is used to review the changes made in a local branch relative to the default branch. It executes in five stages: obtaining the complete diff via Git and GitHub CLI, mapping the attack surface, going through 11 security checklists such as Injection, XSS, authentication, and IDOR item by item, verifying false positives, and finally generating a report with evidence, while explicitly stating that it will not modify any code. It can be installed via the Claude Plugin Marketplace or `npx skills add`, and is compatible with tools that support SKILL.md such as Cursor, Claude Code, and Codex.
Read More# 正确的翻译结果如下： Configure `uv`, `ruff` and `ty` for Python Projects with the `modern-python` Skill
Trail of Bits rebranded its internal cookiecutter-python template as Agent Skill modern-python, replacing pip, flake8, black, mypy and pre-commit with uv, ruff, ty, pytest and prek. This article verifies the installation method, minimal project, PEP 723 scripts and migration steps from requirements.txt / setup.py based on the official SKILL.md and documentation site, and notes limitations such as Python 3.11+ requirement and the beta status of ty.
Read More# shadcn Skill: Let AI Search, Install and Combine shadcn/ui Components According to Project Configuration
shadcn is the official Agent Skill for shadcn/ui. After installation, it will read the project's components.json, inject the framework, aliases, installed components, icon library and underlying primitives via `shadcn info --json`, then search, install, debug and stitch together UIs according to the official combination rules. It was released alongside CLI v4 in March 2026, and can be added to tools like Cursor, Claude Code and Codex via `pnpm dlx skills add shadcn/ui`, preventing assistants from writing components that do not match the project based on memory.
Read More# 翻译结果： firecrawl-cli: Let AI Agents Scrape, Search, Crawl and Map Web Pages via CLI
firecrawl-cli is the official Firecrawl Agent Skill (located in the directory skills/firecrawl-cli, with the frontmatter named firecrawl). It enables assistants such as Cursor, Claude Code, and Codex to search, scrape, map, crawl and interact with web pages via the Firecrawl CLI, with results saved in .firecrawl/ in Markdown/JSON format. Based on the official SKILL.md and CLI documentation, this article explains the installation and authentication procedures, the workflow of search→scrape→map→crawl→interact, as well as key notes including credits and rate limits for users without an API key.
Read MoreImprove Codebase Architecture: Let AI Conduct Architecture Review First Before Deciding Where to Modify
Matt Pocock’s `improve-codebase-architecture` is a user-invoked Agent Skill: it scans for shallow modules and leaky seams based on recent commit hotspots, filters candidates using deletion tests, drafts deepening opportunities into an off-repo HTML report (built with Tailwind + Mermaid), then conducts a grilling on the item you select. It does not modify business code, with the output being testable and navigable architectural decisions, before proceeding to to-spec, to-tickets and implementation stages. It is suitable for regular technical debt governance and structural health checks before major overhauls, rather than automated refactoring.
Read MoreUse Matt Pocock's TDD Skills for Vertical Slice Test-Driven Development
This article introduces Matt Pocock's tdd Skill constrained programming Agent that follows vertical slice TDD: first agree on the public seams, then write exactly one failing test and just enough implementation code to pass it each time. Based on GitHub's SKILL.md, tests.md, mocking.md and aihero.dev, the article sorts out the testing standards, three anti-patterns, mocking boundaries, installation methods for Cursor / Claude Code / Codex, as well as restrictions such as refactoring being moved to code review and not suitable for glue code.
Read Moregrill-me: Before you start coding, let the Agent ask you thoroughly first
grill-me is the user-triggered entry point in Matt Pocock’s skill set: before the Agent takes action, it conducts round-by-round questioning via a decision tree to refine unformed ideas into actionable commitments. It is stateless, does not write files, and the topics do not have to be related to code. The actual interview loop is located in the grilling directory within the same repository, and simply deploying grill-me often fails to run properly. Based on the official SKILL.md and aihero.dev documentation, this article organizes the installation method, question format, the division of labor between grill-with-docs and wayfinder, as well as common pitfalls such as passive nodding, overly broad scope, and unloaded Skill.
Read MoreAdding Analytics: Let AI Agent Integrate PostHog into Web Applications According to Standard Procedures
# 官方正式翻译结果： adding-analytics is a SKILL.md in the awesome-cursor-skills repository, which formalizes the process of integrating PostHog into web applications: identify the framework, install posthog-js/posthog-node, initialize the Provider, supplement pageview tracking for SPAs, manage keys using environment variables, and add custom events, Feature Flags and session replays as needed. This article cross-verifies based on the original Skill content and official documents of PostHog, Cursor, Claude Code and Codex, explains the installation directory, reproducible examples, as well as the differences between variable names, React package paths, pageview default behavior, input desensitization and other aspects compared with current official documents.
Read MoreDatabase Design: Let AI Agents Design Table Relationships, Indexes, Constraints and ORM According to Specifications
# SKILL.md for Database Design (Included in awesome-cursor-skills) ## Overview This is a database modeling skill collected in awesome-cursor-skills, which covers entity identification, table relationships, constraints, indexes, and Prisma/Drizzle configuration. ## Six-step Workflow Verified against the official original text, the workflow is as follows: 1. **Entity Identification**: Extract core business entities from requirements 2. **Define Entity Attributes**: Clarify each entity's fields and data types 3. **Establish Table Relationships**: Map one-to-one, one-to-many, and many-to-many associations between entities 4. **Set Up Constraints**: Add NOT NULL, unique, primary key, foreign key and other constraints to ensure data integrity 5. **Design Indexes**: Create appropriate indexes to optimize query performance 6. **Generate ORM Configuration**: Write standardized Prisma or Drizzle schema files based on the designed database structure ## PostgreSQL Example & Installation Method ### Example Code ```sql -- Sample PostgreSQL table creation script CREATE TABLE users ( id SERIAL PRIMARY KEY, username VARCHAR(50) UNIQUE NOT NULL, email VARCHAR(255) UNIQUE NOT NULL, created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP ); CREATE TABLE posts ( id SERIAL PRIMARY KEY, title VARCHAR(255) NOT NULL, content TEXT, author_id INTEGER NOT NULL, created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP, FOREIGN KEY (author_id) REFERENCES users(id) ON DELETE CASCADE ); -- Sample index CREATE INDEX idx_posts_author_id ON posts(author_id); ``` ### Prisma Configuration Example ```prisma generator client { provider = "prisma-client-js" } datasource db { provider = "postgresql" url = env("DATABASE_URL") } model User { id Int @id @default(autoincrement()) username String @unique @db.VarChar(50) email String @unique @db.VarChar(255) createdAt DateTime @default(now()) @db.Timestamptz() posts Post[] } model Post { id Int @id @default(autoincrement()) title String @db.VarChar(255) content String? authorId Int author User @relation(fields: [authorId], references: [id], onDelete: Cascade) createdAt DateTime @default(now()) @db.Timestamptz() } ``` ### Drizzle Configuration Example ```typescript import { pgTable, serial, varchar, text, integer, timestamp, unique } from 'drizzle-orm/pg-core'; export const users = pgTable('users', { id: serial('id').primaryKey(), username: varchar('username', { length: 50 }).notNull(), email: varchar('email', { length: 255 }).notNull(), createdAt: timestamp('created_at').defaultNow().notNull() }, (table) => { return { usernameUnique: unique().on(table.username), emailUnique: unique().on(table.email), } }); export const posts = pgTable('posts', { id: serial('id').primaryKey(), title: varchar('title', { length: 255 }).notNull(), content: text('content'), authorId: integer('author_id').notNull(), createdAt: timestamp('created_at').defaultNow().notNull() }, (table) => { return { authorRef: foreignKey({ columns: [table.authorId], foreignColumns: [users.id] }).onDelete('cascade'), authorIndex: index('idx_posts_author_id').on(table.authorId) } }); ``` ## Supplementary Role of AI Programming This skill makes up for the shortcomings of AI programming in schema design: 1. Provides standardized, step-bysted operating specifications to avoid AI from generating incomplete or non-compliant database schemas 2. Combines business requirements with technical implementation, helping AI transform abstract business logic into a practical, production-ready database structure 3. Standardizes the connection between logical design and physical implementation, ensuring the consistency of schema design from demand analysis to ORM code generation ## Usage Restrictions 1. **PostgreSQL Dialect Limitation**: The current skill takes PostgreSQL as the only demonstration database, and may need to be adjusted when adapting to MySQL, SQL Server and other relational databases 2. **ORM Scope Limitation**: Only covers Prisma and Drizzle two mainstream Node.js ORM frameworks, and is not applicable to ORM tools in other programming languages or non-mainstream Node.js ORMs 3. **Basic Database Design Only**: Focuses on conventional relational database modeling, and does not cover special scenarios such as distributed databases, columnar storage databases, and non-relational databases 4. Requires manual verification: AI generated content still needs developers to check for business matching, performance bottlenecks and compliance issues in actual production environments
Read More# Adding Stripe: Enabling AI Agents to Integrate Stripe Payments via Standard Procedures
# Adding Stripe is a community Agent Skill in awesome-cursor-skills, compiling Stripe Checkout, subscription Webhooks and Customer Portal into a 7-step checklist. Based on the original SKILL.md text and cross-referenced with the documentation for Stripe Checkout, Webhooks, Billing Portal and Cursor Skills, this article explains what problem it solves, how to install it in Cursor / Claude Code / Codex, as well as usage notes such as signature verification, Customer ID and API version.
Read MoreUse recording-browser-flow-as-test: Walk through the process in the browser and automatically generate Playwright tests
# Introduction to `recording-browser-flow-as-test` in spencerpauly/awesome-cursor-skills: This tool allows users to walk through user workflows step-by-step using Cursor's built-in browser, record accessibility tree information via `browser_snapshot`, and then generate Playwright tests that use stable locators such as `getByRole` and `getByLabel`. This article verifies the installation commands, prerequisites, recording steps, assertion and hardening suggestions, as well as inapplicable scenarios such as 2FA and verification codes.
Read More