Top Skills for Engineering

Escape generic AI-generated UIs. Forces a bold, distinctive design direction before any code is written.

One skill covering every document format the category exists for — including scanned PDFs and RAG chunking — from the maintainers of the parser itself.

Write HTML, render video. Agent-native, deterministic, no build step.

Structured multi-step development. Brainstorm → spec → plan → build → review → merge — TDD baked in.

Microsoft's first-party Playwright skill, invoked through the CLI — the reference implementation for driving a real browser, with no credentials required.

Firebase-authored. Init, configure, and one-step deploy to Firebase Hosting / App Hosting.

Local browser with no credentials, or a hosted Browserbase session with CAPTCHA solving and residential proxies when the target is protected.

Diff-aware adversarial QA: it reads the git diff and tests only what changed, across correctness, accessibility, layout and UX.

Diagrams generated from live infrastructure rather than from a prompt — it reads the actual resource group and draws what is really there.

Stripe's own integration playbook: pick the right API, set up Connect and billing, and handle keys and webhooks securely.

Provision a Postgres, Redis, auth, or LLM provider through the Stripe Projects catalog rather than signing up by hand.

Resend's own API skill: send transactional and batch email, handle inbound webhooks, and manage domains, templates, and keys.

Resend's deliverability playbook: SPF/DKIM/DMARC, spam avoidance, bounce handling, and CAN-SPAM/GDPR/CASL compliance.

Build cross-client HTML emails as React components, with a visual editor and Resend-ready rendering.

Give an agent a webhook-driven inbox with the sender-allowlist and content-filtering patterns that block prompt injection from inbound email.

The marketplace architecture decision, made with a compatibility matrix that blocks invalid Connect configurations instead of describing them.

Multimodal extraction across documents, images, audio and video through one Azure client — Microsoft-authored, with an explicit trigger list.

Batch document translation that preserves layout — the part that breaks when you translate a PDF by extracting text and re-flowing it.

Chrome's own team, giving agents the DevTools protocol: drive it, inspect it, debug it.

Stripe's answer to agentic checkout: one-time payment credentials so an agent can buy without ever seeing the underlying card.

The only vendor-official skill from a major diagramming product — and it emits editable .drawio files rather than a throwaway image.

Transcription and subtitle generation as a first-class skill — the media job agents are asked for most and could not previously do well.

Stripe's version-upgrade guide: move API versions and SDKs without breaking your integration.

A self-updating vector-database skill: it fetches current Qdrant guidance at run time instead of shipping a snapshot that rots.

One skill across Postgres, MySQL, SQL Server, MariaDB and SQLite — and its actual job is forcing explore-before-query on real schemas.

Local document extraction with no API key — read the file, not the whole file.

Hookdeck's webhook playbook: 40 provider-specific skills covering signature verification, idempotency, and event handling — each with runnable examples.

Composio's official skill for connecting agents to 1000+ external apps: auth configs, per-user connections, tool execution, and triggers.

1,000+ SaaS integrations as one skill. OAuth lifecycle, scoped credentials, structured actions.

Supabase done right. RLS policies, edge functions, realtime, auth — in idiomatic patterns.

Neon serverless Postgres done right — branching, pooling, and scale-to-zero, from Neon.

The generalist Postgres skill the ecosystem was missing — schema, indexing, extensions and migrations, from a Postgres company.

Zero-downtime Postgres migrations, with the locking behaviour spelled out — which ALTER TABLE takes an AccessExclusiveLock and what to do instead.

Schema design decisions made explicitly: data types, key strategy, JSONB versus columns, and when partitioning earns its complexity.

The deepest MoR skill coverage after Stripe: 17 skills from checkout to go-live.

SaaS email as skills: Loops API, CLI, LMX markup, deliverability practice.

Box as an agent surface, plus the contract-review workflows nothing else in the catalog covers.

Full-stack WorkOS implementation with auth provider migration paths.

Drop-in WorkOS widgets with backend token wiring across every major framework.

PlanetScale's schema branching and index-aware queries, packaged for agents.

shadcn/ui context: components, patterns, and the right composition by default.

Prisma migrations and queries by the book. Index-aware, migration-safe, type-correct.

Paddle's own integration playbook: ten skills for Checkout, webhooks, pricing pages, and subscription lifecycle on the merchant-of-record platform.

Twilio's official Developer Kit: 55 skills across SMS, WhatsApp, Voice, Verify, SendGrid, and compliance — plus the Twilio MCP. Public beta.

The SQLite slot, filled by Turso — and unusually, a skill that actively steers the agent off the stale API surface web search returns.

Slack's own Block Kit skill — and the rare vendor skill that needs no token, because it validates against Slack's public API.

OpenAI's chart-design skill: the judgement layer that decides which chart the question actually needs before any plotting code is written.

Dashboards with source definitions and a QA step — the parts that separate a monitoring view from a wall of charts nobody trusts.

Transactional email the Postmark way: send, inbound, templates, webhooks.

Self-contained HTML artifacts with React + shadcn/ui — no build step, just paste and run.

Sentry the right way. Source maps, releases, breadcrumbs, performance, structured tags.

Semgrep's own scanning skill: run the industry-standard SAST engine across 30+ languages, and author custom rules for your codebase's patterns.

A vendor-maintained rule corpus for secure code review — one reference file per vulnerability class, from SQL injection to Terraform misconfiguration.

The vector-database skill that ships executable scripts rather than prose — the agent runs the query instead of describing it.

Pre-handoff a11y audit that catches what design QA misses.

Stripe done right. Checkout, subscriptions, webhooks, idempotency, metered billing.

Notion API: page/database CRUD, block hierarchies, rich text, schema sync.

Shopify Storefront API: cart, checkout, metafields, customer accounts, Hydrogen patterns.

GitGuardian's own secret-detection skill — scans history, images and packages, and ships a written remediation doctrine rather than just a list of hits.

All of Railway in one skill: provision, deploy, debug — listed in the official plugin marketplace.

The geospatial gap, filled by the vendor that defines it: data on a map, done properly.

ADR authoring + design review. Trade-offs, consequences, alternatives.

Disciplined debugging loop. Reproduce, isolate, diagnose, fix.

The pre-ship checklist that catches the embarrassing stuff.

Technical writing that engineers will actually read and update.

Incident triage + comms + blameless postmortem in one harness.

System design from requirements. APIs, data, boundaries, scale.

Honest tech-debt audit with a prioritized cleanup backlog.

Layered test plan sized to the change's risk profile.

Test local webapps with Playwright. Generation, run, report — end-to-end.

Review for reuse, quality, efficiency. Catches over-abstraction and dead code before merge.

The multi-channel notification slot nothing else covers: push, in-app and chat alongside email, with copy guidance per channel. No credentials required.

The widest format matrix of any conversion skill we catalogue, and it executes the conversion rather than describing it.

Real feature verification — run the app, drive it, prove it works.

Bootstrap the right plugin stack for your role in one guided pass.

100+ accessibility and UX rules from Vercel, applied as a structural audit on your UI code.

57 React/Next.js performance rules, applied as a structural review on your code.

Security audits run by a real security firm. CodeQL + Semgrep + audit workflows.

Next.js App Router by the book. Server components, streaming, parallel routes.

Ship to a live Vercel URL from chat — auto-detects the framework, returns a claim link.

OWASP-published review, SCA, secrets and threat-modelling skills — the most citable provenance available for security review vocabulary.

The remediation half of security work: scan, fix, validate the fix, open the PR. Batch mode handles a whole backlog of CVEs in one pass.

Turn a final design into a spec engineers can implement directly.

Design-system hygiene at speed. Audit, document, extend.

Build new MCP servers. The official scaffold + design walkthrough.

Always-current Claude API reference and SDK docs. Bundled with Claude Code.

Internal comms that read consistent. Newsletters, status reports, FAQs, updates.

Actually renders Mermaid to SVG or ASCII instead of emitting text and hoping something downstream draws it. Bundles the render scripts.

The largest payment processor, first-party: checkout to disputes to payouts.

The anti-bot problem, handled: proxies, SERP, and structured extraction at scale.

One-command app launch tailored to your project type.

Pre-merge security sweep on the current branch's diff.

The canonical Anthropic code review. Effort levels from quick to ultra.

Bootstrap a CLAUDE.md so future sessions start informed.

PR review with inline GitHub comments via gh.

Edit settings.json safely. Hooks, perms, env, behaviors.

Rebind keys and add chords without reading the keymap docs.

Cuts the permission-prompt friction by learning your safe-tool patterns.

Recurring task runner. Self-paced or interval-based.

Cron for remote Claude Code agents. Set it and forget it.

Boolean prop hell → compound components. Cleaner React component APIs by construction.

Expo workflows: navigation, EAS, OTA, native modules.

In-process analytical SQL over CSV, Parquet, and Excel — no warehouse, no server.

The heavyweight audit machine: 88 evidence scripts so SEO findings come from data, not vibes.

Data-driven document generation: one template, a thousand filled documents.

Run the marketplace's scrapers, or turn your own scraper into a deployable Actor.

TDD with red/green/refactor as a concrete TypeScript walkthrough.

Netlify-authored deploy flow. Auth, site linking, Deploy Previews, production promotes.

Cloudflare-authored. Workers and Pages deploys, Wrangler config, KV/D1/R2 from chat.

The standalone FHIR skill: modeling, validation, SMART on FHIR — without the full healthcare plugin.

Structured PR reviews with severity-tagged findings — bugs, security, perf, style.

Repo-to-live-URL on GitHub Pages: Actions workflow, custom domain, Jekyll, troubleshoot.

Deploy, debug, and scale on Render: Blueprint generation with validation built in.

A named design canon for charts, not another plotting wrapper.

Tailor a plugin to your org's stack in one pass.

Scaffold a new plugin from scratch with guided prompts.

Excalidraw JSON diagrams from prose, with rendering self-checks.

Terraform expertise on tap. State inspection, module validators, safety-first IaC.

Senior DevOps engineer persona — CI/CD, containers, blue-green/canary, IaC across clouds.