browser-auth-flow
Probe a site's authentication flow for redirect leaks, missing CSRF, weak session cookies, and OAuth misconfiguration; produces an auth findings.md
⌘ K
Newest skills
95 skills
ux-css-layout
VS Code CSS conventions, file organization, class naming, standard sizes, SplitView/Grid layout, scrollable content, responsive layout, and text overflow/ellipsis patterns. Use when writing CSS, building layouts, or fixing text truncation issues.
integrated-browser
Use this when working on the VS Code integrated browser ("browserView") to understand its architecture and mental model. Covers the embedded Chromium browser, its editor tab, navigation, overlay/layout, sessions, and agent browser tools under `src/vs/platform/browserView` and `src/vs/workbench/contrib/browserView`.
webview-trpc-messaging
Implements tRPC-based communication between VS Code extension host and React webviews. Use when creating new webview procedures (queries, mutations, subscriptions), adding a new webview router, wiring up a webview controller, using the tRPC client from React components, applying telemetry middleware (telemetryMiddlewareBody), or supporting AbortSignal-based cancellation in webview operations.
react-webview-architecture
Architecture patterns for React-based webviews in the vscode-documentdb extension. Use when creating new webview components, modifying existing views (CollectionView, DocumentView), working with state management (Context API), integrating Fluent UI components, handling Monaco Editor or SlickGrid, solving stale closure bugs with refs, or debugging webview rendering issues. Does NOT cover tRPC messaging (see webview-trpc-messaging skill) or accessibility/ARIA (see accessibility-aria-expert skill).
applicationinsights-web-ts
Instrument browser/web apps with the Application Insights JavaScript SDK (@microsoft/applicationinsights-web). Use for Real User Monitoring (RUM) — page views, clicks, AJAX/fetch dependencies, exceptions, custom events, and browser-side GenAI agent traces correlated to backend OpenTelemetry traces. Covers SDK Loader Script and npm setup, framework extensions (React, React Native, Angular), Click Analytics, telemetry initializers, and OTel GenAI semantic conventions for agent/tool/model spans emitted from the browser.
wiki-vitepress
Packages generated wiki Markdown into a VitePress static site with dark theme, dark-mode Mermaid diagrams with click-to-zoom, and production build output. Use when the user wants to create a browsable website from generated wiki pages.
react-flow-node-ts
Create React Flow node components with TypeScript types, handles, and Zustand integration. Use when building custom nodes for React Flow canvas, creating visual workflow editors, or implementing node-based UI components.
migrate-bootstrap
Migrates a traditional Power Pages site from Bootstrap 3 to Bootstrap 5. Downloads the site, runs the pac pages bootstrap-migrate engine, reviews the change report, applies AI-assisted fixes for the residual hierarchy/CSS changes the engine only flags, uploads the migrated site (which auto-enables the Bootstrap 5 runtime flag), verifies the flag, and validates. Use when the user wants to upgrade an older Bootstrap-3 portal to Bootstrap 5. NOT for code sites (React/Vue/Angular/Astro) — those are never Bootstrap-3.
manage-firewall
Inspects and configures the web application firewall (WAF) in front of a Power Pages production site. Lists the current state, recommends enabling protection when it is off, and walks the user through adding, updating, or removing custom rules — IP blocks, country blocks, path blocks, and rate limits. Use when the user wants to turn on WAF, block traffic by IP or country, rate-limit login or signup pages, protect pages from brute-force attempts, restrict access to specific paths, review the current firewall configuration, or asks "is my site protected against bots / common web attacks?" — even
create-webroles
Creates and configures web roles for a Power Pages code site. Web roles control access and permissions for site users, including authenticated and anonymous roles. Use when the user wants to create, add, set up, or manage web roles for their site.
add-cloud-flow
Integrates Power Automate cloud flows into a Power Pages site. Lists available flows, suggests relevant ones based on intent, identifies scenarios and web roles, creates metadata files, and generates client-side code to call flows. Handles both new flow registration and adding already-registered flows to additional pages without re-creating metadata. Use when the user wants to add, connect, register, or link a Power Automate cloud flow to their site.
powercat-overflow
Reviews every Power Automate cloud flow inside a Power Platform solution (.zip) against Microsoft's coding guidelines and produces a [SolutionName].findings.json next to the uploaded solution, then opens the hosted PowerCAT-Overflow viewer at https://microsoft.github.io/power-cat-skills/PowerCAT-Overflow.html and uploads both files so the user can explore the results. Triggers: 'powercat overflow', 'overflow my solution', 'review my solution', 'evaluate flows in this solution', 'audit Power Auto
theme-authoring
Add a new color theme to the Ontology Playground. Use when someone wants to create, author, or plug in a theme, palette, color scheme, dark mode, or light mode, or add an entry to the theme picker. Covers the appStore registration plus the CSS token block.
travel-cost-estimator
Use this skill whenever the user needs a cost estimate for a business trip — including "what will it cost to get to X", "price up that customer visit", "I need a travel budget for the offsite", or a manager asking for a number before approving travel. Prices flights and hotels live from the company's browser-based booking tool, benchmarks the non-bookable lines against the user's own approved expense reports, and produces a forwardable estimate. Do NOT use this skill to actually book, hold, or confirm travel.
sharepoint-list-insight-report-generator
Use this skill whenever the user asks for an insights/reporting analysis of a SharePoint list from a connected SharePoint knowledge source; first validate the list exists, then generate and save a single-file interactive HTML report to a pre-approved SharePoint destination whose audience is no broader than the source list and items, and return its SharePoint URL.
rich-html-presentation
Use this skill whenever the user asks to create, build, or revise a self-contained HTML or web slide presentation, browser slideshow, keynote-style deck, arrow-key-navigable presentation, or a deck matching a previous HTML presentation. Use it before authoring the HTML so the shared design system, channel-specific delivery, and verification steps are applied. Do not use it for PowerPoint (.pptx), static documents, or data dashboards.
cowork-use-case-one-pager
Turn a Cowork conversation or workflow into a high-value Cowork use case one-pager as a printable HTML page. Use when the user asks to "write up a Cowork use case", "make a one-pager for this workflow", "document what this scheduled task does", "turn this into a case example", "create a slide-style use case summary", or capture a task as a shareable internal case example. Do NOT use for a multi-slide deck, an editable Word or Excel document, or a plain written summary — this skill produces a single printable HTML page.
call-for-speakers-digest
Weekly digest of open conference Call for Speakers (CFP) opportunities matching the person's topics of interest, delivered as an HTML email. Use this skill when someone asks to be notified about speaking opportunities, wants a recurring CFP digest, asks "what conferences are taking submissions right now", or wants to set up a weekly speaker opportunity search. Also use on the skill's own recurring weekly run to refresh the digest, and when the person wants to update their topics, location or format preferences, or exclude a conference they're already committed elsewhere for.
browser-uat-analyst
Use this skill whenever the user asks to test, validate, UAT, regression-check, or investigate the behaviour of a browser-based application — including Copilot Studio agents, Power Platform apps and flows, Dataverse, Dynamics 365, Microsoft 365 admin centres, Teams web, and custom web apps. Covers test charter design, Playwright-driven execution, screenshot evidence capture, expected-vs-observed analysis, and stakeholder reporting. Use it BEFORE claiming any UI behaviour works or is broken. Do NOT use this skill for unit tests, API-only contract tests, or load testing.
system-type-web-service
Domain patterns for web service architecture — API design (REST/GraphQL/gRPC), scaling, data layer, observability, failure modes, and anti-patterns. Use when designing or evaluating a web service, API, or request/response system.
imagegen-frontend-web
Elite frontend image-direction skill for generating premium, conversion-aware website design references. CRITICAL OUTPUT RULE — generate ONE separate horizontal image FOR EVERY section. A landing page with 8 sections produces 8 images. Never compress multiple sections into one image. Enforces composition variety (not always left-text / right-image), background-image freedom, varied CTAs, varied hero scales (giant / mid / mini minimalist), narrative concept spine, second-read moments, and a single consistent palette across all images. Optimized for landing pages, marketing sites, and product co