Top Skills for Engineering

Escape generic AI-generated UIs. Forces a bold, distinctive design direction before any code is written.

WordPress’s own answer to agents writing pre-Gutenberg code: blocks, block themes, plugins, the modern APIs.

One skill covering every document format the category exists for — including scanned PDFs and RAG chunking — from the maintainers of the parser itself.

Write HTML, render video. Agent-native, deterministic, no build step.

The jobs, not the endpoints: migrate a live site, connect the domain, keep WordPress patched.

Structured multi-step development. Brainstorm → spec → plan → build → review → merge — TDD baked in.

Firebase-authored. Init, configure, and one-step deploy to Firebase Hosting / App Hosting.

Microsoft's first-party Playwright skill, invoked through the CLI — the reference implementation for driving a real browser, with no credentials required.

Stripe's own integration playbook: pick the right API, set up Connect and billing, and handle keys and webhooks securely.

Provision a Postgres, Redis, auth, or LLM provider through the Stripe Projects catalog rather than signing up by hand.

Resend's own API skill: send transactional and batch email, handle inbound webhooks, and manage domains, templates, and keys.

Resend's deliverability playbook: SPF/DKIM/DMARC, spam avoidance, bounce handling, and CAN-SPAM/GDPR/CASL compliance.

Build cross-client HTML emails as React components, with a visual editor and Resend-ready rendering.

Give an agent a webhook-driven inbox with the sender-allowlist and content-filtering patterns that block prompt injection from inbound email.

Diagrams generated from live infrastructure rather than from a prompt — it reads the actual resource group and draws what is really there.

Deploy and register the domain in the same session — Zeabur is its own registrar, so both are one CLI.

Local browser with no credentials, or a hosted Browserbase session with CAPTCHA solving and residential proxies when the target is protected.

Diff-aware adversarial QA: it reads the git diff and tests only what changed, across correctness, accessibility, layout and UX.

The marketplace architecture decision, made with a compatibility matrix that blocks invalid Connect configurations instead of describing them.

Stripe's version-upgrade guide: move API versions and SDKs without breaking your integration.

Stripe's answer to agentic checkout: one-time payment credentials so an agent can buy without ever seeing the underlying card.

Chrome's own team, giving agents the DevTools protocol: drive it, inspect it, debug it.

Hookdeck's webhook playbook: 40 provider-specific skills covering signature verification, idempotency, and event handling — each with runnable examples.

One skill across Postgres, MySQL, SQL Server, MariaDB and SQLite — and its actual job is forcing explore-before-query on real schemas.

The only vendor-official skill from a major diagramming product — and it emits editable .drawio files rather than a throwaway image.

Multimodal extraction across documents, images, audio and video through one Azure client — Microsoft-authored, with an explicit trigger list.

Batch document translation that preserves layout — the part that breaks when you translate a PDF by extracting text and re-flowing it.

Transcription and subtitle generation as a first-class skill — the media job agents are asked for most and could not previously do well.

The registrar half of the stack: buy the domain, set the DNS, stand up the site — from one plugin.

1,000+ SaaS integrations as one skill. OAuth lifecycle, scoped credentials, structured actions.

The generalist Postgres skill the ecosystem was missing — schema, indexing, extensions and migrations, from a Postgres company.

Zero-downtime Postgres migrations, with the locking behaviour spelled out — which ALTER TABLE takes an AccessExclusiveLock and what to do instead.

Schema design decisions made explicitly: data types, key strategy, JSONB versus columns, and when partitioning earns its complexity.

A self-updating vector-database skill: it fetches current Qdrant guidance at run time instead of shipping a snapshot that rots.

Composio's official skill for connecting agents to 1000+ external apps: auth configs, per-user connections, tool execution, and triggers.

The deepest MoR skill coverage after Stripe: 17 skills from checkout to go-live.

SaaS email as skills: Loops API, CLI, LMX markup, deliverability practice.

Full-stack WorkOS implementation with auth provider migration paths.

Drop-in WorkOS widgets with backend token wiring across every major framework.

Paddle's own integration playbook: ten skills for Checkout, webhooks, pricing pages, and subscription lifecycle on the merchant-of-record platform.

Twilio's official Developer Kit: 55 skills across SMS, WhatsApp, Voice, Verify, SendGrid, and compliance — plus the Twilio MCP. Public beta.

Local document extraction with no API key — read the file, not the whole file.

Box as an agent surface, plus the contract-review workflows nothing else in the catalog covers.

Self-contained HTML artifacts with React + shadcn/ui — no build step, just paste and run.

Pre-handoff a11y audit that catches what design QA misses.

Supabase done right. RLS policies, edge functions, realtime, auth — in idiomatic patterns.

Neon serverless Postgres done right — branching, pooling, and scale-to-zero, from Neon.

Stripe done right. Checkout, subscriptions, webhooks, idempotency, metered billing.

Shopify Storefront API: cart, checkout, metafields, customer accounts, Hydrogen patterns.

Slack's own Block Kit skill — and the rare vendor skill that needs no token, because it validates against Slack's public API.

OpenAI's chart-design skill: the judgement layer that decides which chart the question actually needs before any plotting code is written.

Dashboards with source definitions and a QA step — the parts that separate a monitoring view from a wall of charts nobody trusts.

All of Railway in one skill: provision, deploy, debug — listed in the official plugin marketplace.

ADR authoring + design review. Trade-offs, consequences, alternatives.

Disciplined debugging loop. Reproduce, isolate, diagnose, fix.

The pre-ship checklist that catches the embarrassing stuff.

Technical writing that engineers will actually read and update.

Incident triage + comms + blameless postmortem in one harness.

System design from requirements. APIs, data, boundaries, scale.

Honest tech-debt audit with a prioritized cleanup backlog.

Layered test plan sized to the change's risk profile.

Test local webapps with Playwright. Generation, run, report — end-to-end.

Review for reuse, quality, efficiency. Catches over-abstraction and dead code before merge.

Semgrep's own scanning skill: run the industry-standard SAST engine across 30+ languages, and author custom rules for your codebase's patterns.

A vendor-maintained rule corpus for secure code review — one reference file per vulnerability class, from SQL injection to Terraform misconfiguration.

GitGuardian's own secret-detection skill — scans history, images and packages, and ships a written remediation doctrine rather than just a list of hits.

The SQLite slot, filled by Turso — and unusually, a skill that actively steers the agent off the stale API surface web search returns.

Transactional email the Postmark way: send, inbound, templates, webhooks.

Real feature verification — run the app, drive it, prove it works.

Bootstrap the right plugin stack for your role in one guided pass.

100+ accessibility and UX rules from Vercel, applied as a structural audit on your UI code.

57 React/Next.js performance rules, applied as a structural review on your code.

Security audits run by a real security firm. CodeQL + Semgrep + audit workflows.

PlanetScale's schema branching and index-aware queries, packaged for agents.

shadcn/ui context: components, patterns, and the right composition by default.

Prisma migrations and queries by the book. Index-aware, migration-safe, type-correct.

Next.js App Router by the book. Server components, streaming, parallel routes.

Notion API: page/database CRUD, block hierarchies, rich text, schema sync.

Ship to a live Vercel URL from chat — auto-detects the framework, returns a claim link.

OWASP-published review, SCA, secrets and threat-modelling skills — the most citable provenance available for security review vocabulary.

The vector-database skill that ships executable scripts rather than prose — the agent runs the query instead of describing it.

The multi-channel notification slot nothing else covers: push, in-app and chat alongside email, with copy guidance per channel. No credentials required.

The geospatial gap, filled by the vendor that defines it: data on a map, done properly.

Turn a final design into a spec engineers can implement directly.

Design-system hygiene at speed. Audit, document, extend.

Build new MCP servers. The official scaffold + design walkthrough.

Always-current Claude API reference and SDK docs. Bundled with Claude Code.

Internal comms that read consistent. Newsletters, status reports, FAQs, updates.

Sentry the right way. Source maps, releases, breadcrumbs, performance, structured tags.

The remediation half of security work: scan, fix, validate the fix, open the PR. Batch mode handles a whole backlog of CVEs in one pass.

Actually renders Mermaid to SVG or ASCII instead of emitting text and hoping something downstream draws it. Bundles the render scripts.

The widest format matrix of any conversion skill we catalogue, and it executes the conversion rather than describing it.

The anti-bot problem, handled: proxies, SERP, and structured extraction at scale.

One-command app launch tailored to your project type.

Pre-merge security sweep on the current branch's diff.

The canonical Anthropic code review. Effort levels from quick to ultra.

Bootstrap a CLAUDE.md so future sessions start informed.

PR review with inline GitHub comments via gh.

Edit settings.json safely. Hooks, perms, env, behaviors.

Rebind keys and add chords without reading the keymap docs.

Cuts the permission-prompt friction by learning your safe-tool patterns.

Recurring task runner. Self-paced or interval-based.

Cron for remote Claude Code agents. Set it and forget it.

Boolean prop hell → compound components. Cleaner React component APIs by construction.

Expo workflows: navigation, EAS, OTA, native modules.

The largest payment processor, first-party: checkout to disputes to payouts.

TDD with red/green/refactor as a concrete TypeScript walkthrough.

In-process analytical SQL over CSV, Parquet, and Excel — no warehouse, no server.

Netlify-authored deploy flow. Auth, site linking, Deploy Previews, production promotes.

Cloudflare-authored. Workers and Pages deploys, Wrangler config, KV/D1/R2 from chat.

The heavyweight audit machine: 88 evidence scripts so SEO findings come from data, not vibes.

Data-driven document generation: one template, a thousand filled documents.

Structured PR reviews with severity-tagged findings — bugs, security, perf, style.

Repo-to-live-URL on GitHub Pages: Actions workflow, custom domain, Jekyll, troubleshoot.

Run the marketplace's scrapers, or turn your own scraper into a deployable Actor.

Tailor a plugin to your org's stack in one pass.

Scaffold a new plugin from scratch with guided prompts.

The standalone FHIR skill: modeling, validation, SMART on FHIR — without the full healthcare plugin.

Deploy, debug, and scale on Render: Blueprint generation with validation built in.