[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-jetbrains-security-best-practices":3,"mdc--1fud1-key":36,"related-org-jetbrains-security-best-practices":320,"related-repo-jetbrains-security-best-practices":451},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":11,"stars":25,"repoUrl":26,"updatedAt":27,"license":28,"forks":29,"topics":30,"repo":31,"sourceUrl":34,"mdContent":35},"security-best-practices","perform security best-practice code reviews","Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review\u002Freport, or secure-by-default coding help. Trigger only for supported languages (python, javascript\u002Ftypescript, go). Do not trigger for general code review, debugging, or non-security tasks.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},"jetbrains","JetBrains","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fjetbrains.png",[12,16,19,22],{"name":13,"slug":14,"type":15},"Security","security","tag",{"name":17,"slug":18,"type":15},"Code Review","code-review",{"name":20,"slug":21,"type":15},"Best Practices","best-practices",{"name":23,"slug":24,"type":15},"Code Analysis","code-analysis",252,"https:\u002F\u002Fgithub.com\u002FJetBrains\u002Fskills","2026-07-17T06:06:50.748652",null,17,[],{"repoUrl":26,"stars":25,"forks":29,"topics":32,"description":33},[],"Curated agent skills collection verified by JetBrains","https:\u002F\u002Fgithub.com\u002FJetBrains\u002Fskills\u002Ftree\u002FHEAD\u002Fsecurity-best-practices","---\nname: \"security-best-practices\"\ndescription: \"Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review\u002Freport, or secure-by-default coding help. Trigger only for supported languages (python, javascript\u002Ftypescript, go). Do not trigger for general code review, debugging, or non-security tasks.\"\nmetadata:\n  short-description: \"Security reviews and secure-by-default guidance\"\n  author: OpenAI\n  source: https:\u002F\u002Fgithub.com\u002Fopenai\u002Fskills\u002Ftree\u002Fmain\u002Fskills\u002F.curated\u002Fsecurity-best-practices\n---\n\n# Security Best Practices\n\n## Overview\n\nThis skill provides a description of how to identify the language and frameworks used by the current context, and then to load information from this skill's references directory about the security best practices for this language and or frameworks.\n\nThis information, if present, can be used to write new secure by default code, or to passively detect major issues within existing code, or (if requested by the user) provide a vulnerability report and suggest fixes.\n\n## Workflow\n\nThe initial step for this skill is to identify ALL languages and ALL frameworks which you are being asked to use or already exist in the scope of the project you are working in. Focus on the primary core frameworks. Often you will want to identify both frontend and backend languages and frameworks.\n\nThen check this skill's references directory to see if there are any relevant documentation for the language and or frameworks. Make sure you read ALL reference files which relate to the specific framework or language. The format of the filenames is `\u003Clanguage>-\u003Cframework>-\u003Cstack>-security.md`. You should also check if there is a `\u003Clanguage>-general-\u003Cstack>-security.md` which is agnostic to the framework you may be using.\n\nIf working on a web application which includes a frontend and a backend, make sure you have checked for reference documents for BOTH the frontend and backend!\n\nIf you are asked to make a web app which will include both a frontend and backend, but the frontend framework is not specified, also check out `javascript-general-web-frontend-security.md`. It is important that you understand how to secure both the frontend and backend.\n\nIf no relevant information is available in the skill's references directory, think a little bit about what you know about the language, the framework, and all well known security best practices for it. If you are unsure you can try to search online for documentation on security best practices.\n\nFrom there it can operate in a few ways.\n\n1. The primary mode is to just use the information to write secure by default code from this point forward. This is useful for starting a new project or when writing new code.\n\n2. The secondary mode is to passively detect vulnerabilities while working in the project and writing code for the user. Critical or very important vulnerabilities or major issues going against security guidance can be flagged and the user can be told about them. This passive mode should focus on the largest impact vulnerabilities and secure defaults.\n\n3. The user can ask for a security report or to improve the security of the codebase. In this case a full report should be produced describe anyways the project fails to follow security best practices guidance. The report should be prioritized and have clear sections of severity and urgency. Then offer to start working on fixes for these issues. See #fixes below.\n\n## Workflow Decision Tree\n\n- If the language\u002Fframework is unclear, inspect the repo to determine it and list your evidence.\n- If matching guidance exists in `references\u002F`, load only the relevant files and follow their instructions.\n- If no matching guidance exists, consider if you know any well known security best practices for the chosen language and or frameworks, but if asked to generate a report, let the user know that concrete guidance is not available (you can still generate the report or detect for sure critical vulnerabilities)\n\n# Overrides\n\nWhile these references contain the security best practices for languages and frameworks, customers may have cases where they need to bypass or override these practices. Pay attention to specific rules and instructions in the project's documentation and prompt files which may require you to override certain best practices. When overriding a best practice, you MAY report it to the user, but do not fight with them. If a security best practice needs to be bypassed \u002F ignored for some project specific reason, you can also suggest to add documentation about this to the project so it is clear why the best practice is not being followed and to follow that bypass in the future.\n\n# Report Format\n\nWhen producing a report, you should write the report as a markdown file in `security_best_practices_report.md` or some other location if provided by the user. You can ask the user where they would like the report to be written to.\n\nThe report should have a short executive summary at the top.\n\nThe report should be clearly delineated into multiple sections based on severity of the vulnerability. The report should focus on the most critical findings as these have the highest impact for the user. All findings should be noted with an numeric ID to make them easier to reference.\n\nFor critical findings include a one sentence impact statement.\n\nOnce the report is written, also report it to the user directly, although you may be less verbose. You can offer to explain any of the findings or the reasons behind the security best practices guidance if the user wants more info on any findings.\n\nImportant: When referencing code in the report, make sure to find and include line numbers for the code you are referencing.\n\nAfter you write the report file, summarize the findings to the user.\n\nAlso tell the user where the final report was written to\n\n# Fixes\n\nIf you produced a report, let the user read the report and ask to begin performing fixes.\n\nIf you passively found a critical finding, notify the user and ask if they would like you to fix this finding.\n\nWhen producing fixes, focus on fixing a single finding at a time. The fixes should have concise clear comments explaining that the new code is based on the specific security best practice, and perhaps a very short reason why it would be dangerous to not do it in this way.\n\nAlways consider if the changes you want to make will impact the functionality of the user's code. Consider if the changes may cause regressions with how the project works currently. It is often the case that insecure code is relied on for other reasons (and this is why insecure code lives on for so long). Avoid breaking the user's project as this may make them not want to apply security fixes in the future. It is better to write a well thought out, well informed by the rest of the project, fix, then a quick slapdash change.\n\nAlways follow any normal change or commit flow the user has configured. If making git commits, provide clear commit messages explaining this is to align with security best practices. Try to avoid bunching a number of unrelated findings into a single commit.\n\nAlways follow any normal testing flows the user has configured (if any) to confirm that your changes are not introducing regressions. Consider the second order impacts the changes may have and inform the user before making them if there are any.\n\n# General Security Advice\n\nBelow is a few bits of secure coding advice that applies to almost any language or framework.\n\n### Avoid Using Incrementing IDs for Public IDs of Resources\n\nWhen assigning an ID for some resource, which will then be used by exposed to the internet, avoid using small auto-incrementing IDs. Use longer, random UUID4 or random hex string instead. This will prevent users from learning the quantity of a resource and being able to guess resource IDs.\n\n### A note on TLS\n\nWhile TLS is important for production deployments, most development work will be with TLS disabled or provided by some out-of-scope TLS proxy. Due to this, be very careful about not reporting lack of TLS as a security issue. Also be very careful around use of \"secure\" cookies. They should only be set if the application will actually be over TLS. If they are set on non-TLS applications (such as when deployed for local dev or testing), it will break the application. You can provide a env or other flag to override setting secure as a way to keep it off until on a TLS production deployment. Additionally avoid recommending HSTS. It is dangerous to use without full understanding of the lasting impacts (can cause major outages and user lockout) and it is not generally recommended for the scope of projects being reviewed by codex.\n",{"data":37,"body":42},{"name":4,"description":6,"metadata":38},{"short-description":39,"author":40,"source":41},"Security reviews and secure-by-default guidance","OpenAI","https:\u002F\u002Fgithub.com\u002Fopenai\u002Fskills\u002Ftree\u002Fmain\u002Fskills\u002F.curated\u002Fsecurity-best-practices",{"type":43,"children":44},"root",[45,53,60,66,71,77,82,104,109,122,127,132,152,158,185,191,196,202,215,220,225,230,235,240,245,250,256,261,266,271,276,281,286,292,297,304,309,315],{"type":46,"tag":47,"props":48,"children":49},"element","h1",{"id":4},[50],{"type":51,"value":52},"text","Security Best Practices",{"type":46,"tag":54,"props":55,"children":57},"h2",{"id":56},"overview",[58],{"type":51,"value":59},"Overview",{"type":46,"tag":61,"props":62,"children":63},"p",{},[64],{"type":51,"value":65},"This skill provides a description of how to identify the language and frameworks used by the current context, and then to load information from this skill's references directory about the security best practices for this language and or frameworks.",{"type":46,"tag":61,"props":67,"children":68},{},[69],{"type":51,"value":70},"This information, if present, can be used to write new secure by default code, or to passively detect major issues within existing code, or (if requested by the user) provide a vulnerability report and suggest fixes.",{"type":46,"tag":54,"props":72,"children":74},{"id":73},"workflow",[75],{"type":51,"value":76},"Workflow",{"type":46,"tag":61,"props":78,"children":79},{},[80],{"type":51,"value":81},"The initial step for this skill is to identify ALL languages and ALL frameworks which you are being asked to use or already exist in the scope of the project you are working in. Focus on the primary core frameworks. Often you will want to identify both frontend and backend languages and frameworks.",{"type":46,"tag":61,"props":83,"children":84},{},[85,87,94,96,102],{"type":51,"value":86},"Then check this skill's references directory to see if there are any relevant documentation for the language and or frameworks. Make sure you read ALL reference files which relate to the specific framework or language. The format of the filenames is ",{"type":46,"tag":88,"props":89,"children":91},"code",{"className":90},[],[92],{"type":51,"value":93},"\u003Clanguage>-\u003Cframework>-\u003Cstack>-security.md",{"type":51,"value":95},". You should also check if there is a ",{"type":46,"tag":88,"props":97,"children":99},{"className":98},[],[100],{"type":51,"value":101},"\u003Clanguage>-general-\u003Cstack>-security.md",{"type":51,"value":103}," which is agnostic to the framework you may be using.",{"type":46,"tag":61,"props":105,"children":106},{},[107],{"type":51,"value":108},"If working on a web application which includes a frontend and a backend, make sure you have checked for reference documents for BOTH the frontend and backend!",{"type":46,"tag":61,"props":110,"children":111},{},[112,114,120],{"type":51,"value":113},"If you are asked to make a web app which will include both a frontend and backend, but the frontend framework is not specified, also check out ",{"type":46,"tag":88,"props":115,"children":117},{"className":116},[],[118],{"type":51,"value":119},"javascript-general-web-frontend-security.md",{"type":51,"value":121},". It is important that you understand how to secure both the frontend and backend.",{"type":46,"tag":61,"props":123,"children":124},{},[125],{"type":51,"value":126},"If no relevant information is available in the skill's references directory, think a little bit about what you know about the language, the framework, and all well known security best practices for it. If you are unsure you can try to search online for documentation on security best practices.",{"type":46,"tag":61,"props":128,"children":129},{},[130],{"type":51,"value":131},"From there it can operate in a few ways.",{"type":46,"tag":133,"props":134,"children":135},"ol",{},[136,142,147],{"type":46,"tag":137,"props":138,"children":139},"li",{},[140],{"type":51,"value":141},"The primary mode is to just use the information to write secure by default code from this point forward. This is useful for starting a new project or when writing new code.",{"type":46,"tag":137,"props":143,"children":144},{},[145],{"type":51,"value":146},"The secondary mode is to passively detect vulnerabilities while working in the project and writing code for the user. Critical or very important vulnerabilities or major issues going against security guidance can be flagged and the user can be told about them. This passive mode should focus on the largest impact vulnerabilities and secure defaults.",{"type":46,"tag":137,"props":148,"children":149},{},[150],{"type":51,"value":151},"The user can ask for a security report or to improve the security of the codebase. In this case a full report should be produced describe anyways the project fails to follow security best practices guidance. The report should be prioritized and have clear sections of severity and urgency. Then offer to start working on fixes for these issues. See #fixes below.",{"type":46,"tag":54,"props":153,"children":155},{"id":154},"workflow-decision-tree",[156],{"type":51,"value":157},"Workflow Decision Tree",{"type":46,"tag":159,"props":160,"children":161},"ul",{},[162,167,180],{"type":46,"tag":137,"props":163,"children":164},{},[165],{"type":51,"value":166},"If the language\u002Fframework is unclear, inspect the repo to determine it and list your evidence.",{"type":46,"tag":137,"props":168,"children":169},{},[170,172,178],{"type":51,"value":171},"If matching guidance exists in ",{"type":46,"tag":88,"props":173,"children":175},{"className":174},[],[176],{"type":51,"value":177},"references\u002F",{"type":51,"value":179},", load only the relevant files and follow their instructions.",{"type":46,"tag":137,"props":181,"children":182},{},[183],{"type":51,"value":184},"If no matching guidance exists, consider if you know any well known security best practices for the chosen language and or frameworks, but if asked to generate a report, let the user know that concrete guidance is not available (you can still generate the report or detect for sure critical vulnerabilities)",{"type":46,"tag":47,"props":186,"children":188},{"id":187},"overrides",[189],{"type":51,"value":190},"Overrides",{"type":46,"tag":61,"props":192,"children":193},{},[194],{"type":51,"value":195},"While these references contain the security best practices for languages and frameworks, customers may have cases where they need to bypass or override these practices. Pay attention to specific rules and instructions in the project's documentation and prompt files which may require you to override certain best practices. When overriding a best practice, you MAY report it to the user, but do not fight with them. If a security best practice needs to be bypassed \u002F ignored for some project specific reason, you can also suggest to add documentation about this to the project so it is clear why the best practice is not being followed and to follow that bypass in the future.",{"type":46,"tag":47,"props":197,"children":199},{"id":198},"report-format",[200],{"type":51,"value":201},"Report Format",{"type":46,"tag":61,"props":203,"children":204},{},[205,207,213],{"type":51,"value":206},"When producing a report, you should write the report as a markdown file in ",{"type":46,"tag":88,"props":208,"children":210},{"className":209},[],[211],{"type":51,"value":212},"security_best_practices_report.md",{"type":51,"value":214}," or some other location if provided by the user. You can ask the user where they would like the report to be written to.",{"type":46,"tag":61,"props":216,"children":217},{},[218],{"type":51,"value":219},"The report should have a short executive summary at the top.",{"type":46,"tag":61,"props":221,"children":222},{},[223],{"type":51,"value":224},"The report should be clearly delineated into multiple sections based on severity of the vulnerability. The report should focus on the most critical findings as these have the highest impact for the user. All findings should be noted with an numeric ID to make them easier to reference.",{"type":46,"tag":61,"props":226,"children":227},{},[228],{"type":51,"value":229},"For critical findings include a one sentence impact statement.",{"type":46,"tag":61,"props":231,"children":232},{},[233],{"type":51,"value":234},"Once the report is written, also report it to the user directly, although you may be less verbose. You can offer to explain any of the findings or the reasons behind the security best practices guidance if the user wants more info on any findings.",{"type":46,"tag":61,"props":236,"children":237},{},[238],{"type":51,"value":239},"Important: When referencing code in the report, make sure to find and include line numbers for the code you are referencing.",{"type":46,"tag":61,"props":241,"children":242},{},[243],{"type":51,"value":244},"After you write the report file, summarize the findings to the user.",{"type":46,"tag":61,"props":246,"children":247},{},[248],{"type":51,"value":249},"Also tell the user where the final report was written to",{"type":46,"tag":47,"props":251,"children":253},{"id":252},"fixes",[254],{"type":51,"value":255},"Fixes",{"type":46,"tag":61,"props":257,"children":258},{},[259],{"type":51,"value":260},"If you produced a report, let the user read the report and ask to begin performing fixes.",{"type":46,"tag":61,"props":262,"children":263},{},[264],{"type":51,"value":265},"If you passively found a critical finding, notify the user and ask if they would like you to fix this finding.",{"type":46,"tag":61,"props":267,"children":268},{},[269],{"type":51,"value":270},"When producing fixes, focus on fixing a single finding at a time. The fixes should have concise clear comments explaining that the new code is based on the specific security best practice, and perhaps a very short reason why it would be dangerous to not do it in this way.",{"type":46,"tag":61,"props":272,"children":273},{},[274],{"type":51,"value":275},"Always consider if the changes you want to make will impact the functionality of the user's code. Consider if the changes may cause regressions with how the project works currently. It is often the case that insecure code is relied on for other reasons (and this is why insecure code lives on for so long). Avoid breaking the user's project as this may make them not want to apply security fixes in the future. It is better to write a well thought out, well informed by the rest of the project, fix, then a quick slapdash change.",{"type":46,"tag":61,"props":277,"children":278},{},[279],{"type":51,"value":280},"Always follow any normal change or commit flow the user has configured. If making git commits, provide clear commit messages explaining this is to align with security best practices. Try to avoid bunching a number of unrelated findings into a single commit.",{"type":46,"tag":61,"props":282,"children":283},{},[284],{"type":51,"value":285},"Always follow any normal testing flows the user has configured (if any) to confirm that your changes are not introducing regressions. Consider the second order impacts the changes may have and inform the user before making them if there are any.",{"type":46,"tag":47,"props":287,"children":289},{"id":288},"general-security-advice",[290],{"type":51,"value":291},"General Security Advice",{"type":46,"tag":61,"props":293,"children":294},{},[295],{"type":51,"value":296},"Below is a few bits of secure coding advice that applies to almost any language or framework.",{"type":46,"tag":298,"props":299,"children":301},"h3",{"id":300},"avoid-using-incrementing-ids-for-public-ids-of-resources",[302],{"type":51,"value":303},"Avoid Using Incrementing IDs for Public IDs of Resources",{"type":46,"tag":61,"props":305,"children":306},{},[307],{"type":51,"value":308},"When assigning an ID for some resource, which will then be used by exposed to the internet, avoid using small auto-incrementing IDs. Use longer, random UUID4 or random hex string instead. This will prevent users from learning the quantity of a resource and being able to guess resource IDs.",{"type":46,"tag":298,"props":310,"children":312},{"id":311},"a-note-on-tls",[313],{"type":51,"value":314},"A note on TLS",{"type":46,"tag":61,"props":316,"children":317},{},[318],{"type":51,"value":319},"While TLS is important for production deployments, most development work will be with TLS disabled or provided by some out-of-scope TLS proxy. Due to this, be very careful about not reporting lack of TLS as a security issue. Also be very careful around use of \"secure\" cookies. They should only be set if the application will actually be over TLS. If they are set on non-TLS applications (such as when deployed for local dev or testing), it will break the application. You can provide a env or other flag to override setting secure as a way to keep it off until on a TLS production deployment. Additionally avoid recommending HSTS. It is dangerous to use without full understanding of the lasting impacts (can cause major outages and user lockout) and it is not generally recommended for the scope of projects being reviewed by codex.",{"items":321,"total":450},[322,340,349,358,367,377,390,399,408,418,427,440],{"slug":323,"name":323,"fn":324,"description":325,"org":326,"tags":327,"stars":337,"repoUrl":338,"updatedAt":339},"mps-aspect-accessories","configure JetBrains MPS module dependencies","Wire MPS module and model dependencies, used languages, used devkits, extended languages, runtime solutions, accessory models, and language\u002Fdependency versions. Use when adding\u002Fremoving module dependencies, importing languages or devkits into a model, declaring runtime solutions, or shipping accessory content visible to consumers without explicit import.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[328,331,334],{"name":329,"slug":330,"type":15},"Architecture","architecture",{"name":332,"slug":333,"type":15},"Configuration","configuration",{"name":335,"slug":336,"type":15},"Engineering","engineering",1650,"https:\u002F\u002Fgithub.com\u002FJetBrains\u002FMPS","2026-07-17T06:06:57.311661",{"slug":341,"name":341,"fn":342,"description":343,"org":344,"tags":345,"stars":337,"repoUrl":338,"updatedAt":348},"mps-aspect-actions","define and edit MPS node factories","Use when defining or editing MPS node factories (the \"actions\" aspect) — `NodeFactories` roots, per-concept `NodeFactory` setup functions that initialize a freshly created node and optionally copy data from a replaced `sampleNode`, plus the actions aspect's `CopyPasteHandlers` and `PasteWrappers` roots. Reach for this skill when a substitution, side transform, completion replacement, or `add new initialized(...)` should preserve fields from the node it is replacing, or when defaults set in a constructor are not enough.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[346,347],{"name":329,"slug":330,"type":15},{"name":335,"slug":336,"type":15},"2026-07-17T06:04:48.066901",{"slug":350,"name":350,"fn":351,"description":352,"org":353,"tags":354,"stars":337,"repoUrl":338,"updatedAt":357},"mps-aspect-behavior","define and edit MPS concept behavior","Use when defining or editing MPS `ConceptBehavior` — per-concept methods (non-virtual \u002F virtual \u002F abstract \u002F static \u002F virtual static), constructors, virtual dispatch (MRO), super and interface-default calls (`super\u003CInterface>.method`), overriding methods from `lang.core.behavior` interfaces such as `ScopeProvider.getScope` \u002F `INamedConcept.getName` \u002F `BaseConcept.getPresentation`, calling sibling methods (`LocalBehaviorMethodCall`) and behavior methods from other aspects via `node.method(...)`. Reach for this skill whenever the task involves authoring or modifying `\u003Clang>\u002FlanguageModels\u002Fbehavior.mps`.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[355,356],{"name":329,"slug":330,"type":15},{"name":335,"slug":336,"type":15},"2026-07-13T06:45:21.757084",{"slug":359,"name":359,"fn":360,"description":361,"org":362,"tags":363,"stars":337,"repoUrl":338,"updatedAt":366},"mps-aspect-constraints","define JetBrains MPS language constraints","Use when defining or editing MPS language constraints — property validators \u002F setters \u002F getters, referent search scopes (imperative or inherited via `ScopeProvider.getScope`), `referentSetHandler` side effects, default-scope blocks, `canBeChild` \u002F `canBeParent` \u002F `canBeAncestor` \u002F `canBeRoot` placement rules, `defaultConcreteConcept` for abstract concepts, `set \u003Cread-only>` and `{name}` aliasing, and scope helpers (`SimpleRoleScope`, `ListScope`, `CompositeScope`, `HidingByNameScope`). Reach for this skill whenever the task involves authoring or modifying `\u003Clang>\u002FlanguageModels\u002Fconstraints.mps`.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[364,365],{"name":329,"slug":330,"type":15},{"name":23,"slug":24,"type":15},"2026-07-23T05:41:33.639365",{"slug":368,"name":368,"fn":369,"description":370,"org":371,"tags":372,"stars":337,"repoUrl":338,"updatedAt":376},"mps-aspect-dataflow","define and debug MPS dataflow builders","Use when defining or debugging MPS dataflow builders for a concept — control\u002Fdata flow declarations that drive reachability analysis and variable-use checking. Covers DataFlowBuilderDeclaration, BuilderBlock, emit instructions (code for, jump, ifjump, label, read, write, ret, mayBeUnreachable), positions (AfterPosition, BeforePosition, LabelPosition), the jetbrains.mps.lang.dataFlow language, the NodeParameter implicit, BL+smodel usage inside builder bodies, and IBuilderMode for advanced analyses such as nullable\u002Fnon-null tracking.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[373],{"name":374,"slug":375,"type":15},"Data Analysis","data-analysis","2026-07-13T06:45:19.114674",{"slug":378,"name":378,"fn":379,"description":380,"org":381,"tags":382,"stars":337,"repoUrl":338,"updatedAt":389},"mps-aspect-editor","define MPS editor layouts","Use when creating or changing MPS editor definitions — the overall workflow from scaffolding a `ConceptEditorDeclaration` through componentizing reusable `EditorComponentDeclaration`s, refining cell models and cell layouts, applying style sheets and indent-layout style items, wiring smart references, leveraging inheritance via super-concepts and interfaces, inspecting (`print_node_json`, `show_node_representation`) and validating (`check_root_node_problems`). Covers `jetbrains.mps.lang.editor` cell models (`CellModel_RefNode`\u002F`CellModel_RefNodeList`\u002F`CellModel_RefCell`\u002F`CellModel_Property`\u002F`CellModel_Constant`), layout choices, and JSON blueprints for common editor shapes. For the non-layout side (action maps, keymaps, transformation\u002Fsubstitute menus) use `mps-aspect-editor-menus-and-keymaps`.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[383,386],{"name":384,"slug":385,"type":15},"Design","design",{"name":387,"slug":388,"type":15},"UI Components","ui-components","2026-07-23T05:41:56.638151",{"slug":391,"name":391,"fn":392,"description":393,"org":394,"tags":395,"stars":337,"repoUrl":338,"updatedAt":398},"mps-aspect-editor-menus-and-keymaps","author MPS editor menus and keymaps","Use when authoring the **non-layout** parts of the MPS editor aspect — what happens when the user types, presses a key, triggers completion, pastes, or invokes a context action. Covers action maps (`CellActionMapDeclaration`), cell keymaps (`CellKeyMapDeclaration`), transformation menus (`TransformationMenu_Default` \u002F `_Named` \u002F `_Contribution`), substitute menus (`SubstituteMenu_Default` \u002F `SubstituteMenu` \u002F contributions), side transforms (LEFT\u002FRIGHT), legacy cell menus, paste wrappers and copy-paste handlers (in the actions language), completion styling, reference presentation, two-step deletion, and the editor selection API. Trigger terms: `actionMap`, `keyMap`, `delete_action_id`, `transformationMenu`, `substituteMenu`, `Ctrl+Space`, `Ctrl+Alt+B`, side transform, paste wrapper, completion styling, `PasteWrappers`, `CopyPasteHandlers`. For the **layout** side (cells, layouts, style sheets) use `mps-aspect-editor` instead.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[396,397],{"name":335,"slug":336,"type":15},{"name":387,"slug":388,"type":15},"2026-07-23T05:41:49.666535",{"slug":400,"name":400,"fn":401,"description":402,"org":403,"tags":404,"stars":337,"repoUrl":338,"updatedAt":407},"mps-aspect-generation-plan","modify MPS generation plans","Use when defining or modifying an MPS generation plan — explicit ordering of generators, checkpoints for cross-model reference resolution, forks for parallel branches, IncludePlan composition, conditional PlanContribution activation, ParameterEquals\u002FConceptListSelector fork selectors, and InitModelAttributes for targetFacet routing. Apply when working with @genplan models, the jetbrains.mps.lang.generator.plan language, attaching plans via DevKits or the Custom generation facet, or debugging cross-model mapping label resolution.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[405,406],{"name":329,"slug":330,"type":15},{"name":335,"slug":336,"type":15},"2026-07-13T06:44:59.507855",{"slug":409,"name":409,"fn":410,"description":411,"org":412,"tags":413,"stars":337,"repoUrl":338,"updatedAt":417},"mps-aspect-generator","define JetBrains MPS generator rules","Use when defining or modifying MPS generators — author a generator module, add or edit root\u002Freduction\u002Fweaving\u002Fpattern mapping rules, attach template macros ($COPY_SRC, $LOOP, $IF, $PROPERTY, $REF, $SWITCH, $MAP_SRC, $WEAVE, $INSERT, $LABEL, $TRACE, $VAR), wire mapping labels, build template switches, write pre\u002Fpost mapping scripts, navigate `genContext`, or debug \"rule didn't fire\", missing references, empty output, infinite reduction loops, and generated-Java compile failures.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[414,415,416],{"name":329,"slug":330,"type":15},{"name":23,"slug":24,"type":15},{"name":335,"slug":336,"type":15},"2026-07-17T06:06:58.042999",{"slug":419,"name":419,"fn":420,"description":421,"org":422,"tags":423,"stars":337,"repoUrl":338,"updatedAt":426},"mps-aspect-intentions","define and edit MPS intentions","Use when defining or editing MPS intentions (the Alt+Enter context-action aspect) — adding `IntentionDeclaration` roots, parameterized or surround-with variants, description\u002FisApplicable\u002Fexecute blocks, child-filter functions, factory-initialized AST splicing, or debugging why an intention is not offered. Lives in the language's `intentions` model and uses `jetbrains.mps.lang.intentions`.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[424,425],{"name":329,"slug":330,"type":15},{"name":335,"slug":336,"type":15},"2026-07-23T05:41:48.692899",{"slug":428,"name":428,"fn":429,"description":430,"org":431,"tags":432,"stars":337,"repoUrl":338,"updatedAt":439},"mps-aspect-migrations","author and debug MPS migration scripts","Use when authoring or debugging MPS migration scripts that upgrade user models after a language definition changes — covers jetbrains.mps.lang.migration (MigrationScript class-based, PureMigrationScript declarative, MoveConcept\u002FMoveContainmentLink\u002FMoveReferenceLink\u002FMoveProperty, ordering via OrderDependency, data exchange via putData\u002FgetData, RefactoringLog, ConceptMigrationReference) and jetbrains.mps.lang.script Enhancement Scripts (MigrationScript with MigrationScriptPart_Instance, ExtractInterfaceMigration, FactoryMigrationScriptPart, CommentMigrationScriptPart) — when a model needs version-gated upgrade, concept rename or removal, link or property rename, instance-level transformation, or composition of migration steps.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[433,436],{"name":434,"slug":435,"type":15},"Debugging","debugging",{"name":437,"slug":438,"type":15},"Migration","migration","2026-07-13T06:45:20.372122",{"slug":441,"name":441,"fn":442,"description":443,"org":444,"tags":445,"stars":337,"repoUrl":338,"updatedAt":449},"mps-aspect-structure-concepts","define concepts in MPS structure aspect","Define concepts, interface concepts, enumerations, and constrained data types in an MPS language's `structure` aspect. Covers smart-reference detection, alias rules, cardinality, INamedConcept usage, bulk creation, and the full `mps_mcp_alter_structure` \u002F `mps_mcp_query_structure` reference. Use when authoring or modifying a language's structure model.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[446],{"name":447,"slug":448,"type":15},"Data Modeling","data-modeling","2026-07-23T05:41:30.705975",188,{"items":452,"total":568},[453,472,485,499,514,537,554],{"slug":454,"name":454,"fn":455,"description":456,"org":457,"tags":458,"stars":25,"repoUrl":26,"updatedAt":471},"algorithmic-art","create generative art with p5.js","Creating algorithmic art using p5.js with seeded randomness and interactive parameter exploration. Use this when users request creating art using code, generative art, algorithmic art, flow fields, or particle systems. Create original algorithmic art rather than copying existing artists' work to avoid copyright violations.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[459,462,465,468],{"name":460,"slug":461,"type":15},"Creative","creative",{"name":463,"slug":464,"type":15},"Generative Art","generative-art",{"name":466,"slug":467,"type":15},"Graphics","graphics",{"name":469,"slug":470,"type":15},"JavaScript","javascript","2026-07-13T06:41:35.540127",{"slug":473,"name":473,"fn":474,"description":475,"org":476,"tags":477,"stars":25,"repoUrl":26,"updatedAt":484},"antfu","configure JavaScript projects with Anthony Fu's tools","Anthony Fu's opinionated tooling and conventions for JavaScript\u002FTypeScript projects. Use when setting up new projects, configuring ESLint\u002FPrettier alternatives, monorepos, library publishing, or when the user mentions Anthony Fu's preferences.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[478,479,480,481],{"name":20,"slug":21,"type":15},{"name":335,"slug":336,"type":15},{"name":469,"slug":470,"type":15},{"name":482,"slug":483,"type":15},"TypeScript","typescript","2026-07-13T06:43:13.153309",{"slug":486,"name":486,"fn":487,"description":488,"org":489,"tags":490,"stars":25,"repoUrl":26,"updatedAt":498},"brand-guidelines","apply Anthropic brand guidelines","Applies Anthropic's official brand colors and typography to any sort of artifact that may benefit from having Anthropic's look-and-feel. Use it when brand colors or style guidelines, visual formatting, or company design standards apply.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[491,494,495],{"name":492,"slug":493,"type":15},"Branding","branding",{"name":384,"slug":385,"type":15},{"name":496,"slug":497,"type":15},"Typography","typography","2026-07-13T06:43:06.077629",{"slug":500,"name":500,"fn":501,"description":502,"org":503,"tags":504,"stars":25,"repoUrl":26,"updatedAt":513},"canvas-design","create visual art and design assets","Create beautiful visual art in .png and .pdf documents using design philosophy. You should use this skill when the user asks to create a poster, piece of art, design, or other static piece. Create original visual designs, never copying existing artists' work to avoid copyright violations.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[505,506,507,510],{"name":460,"slug":461,"type":15},{"name":384,"slug":385,"type":15},{"name":508,"slug":509,"type":15},"Images","images",{"name":511,"slug":512,"type":15},"PDF","pdf","2026-07-13T06:39:58.803113",{"slug":515,"name":515,"fn":516,"description":517,"org":518,"tags":519,"stars":25,"repoUrl":26,"updatedAt":536},"ci-cd-containerization-advisor","design CI\u002FCD pipelines for Kotlin applications","Design reproducible build, image, and deployment pipelines for Kotlin plus Spring applications, including CI verification, layered containers, rollout safety, and deployment-time migration coordination. Use when creating or improving Dockerfiles, CI workflows, image hardening, Kubernetes manifests, release gates, or deployment strategies for Spring Boot services, especially where build reproducibility and operational safety matter.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[520,523,526,529,530,533],{"name":521,"slug":522,"type":15},"CI\u002FCD","ci-cd",{"name":524,"slug":525,"type":15},"Containers","containers",{"name":527,"slug":528,"type":15},"Deployment","deployment",{"name":335,"slug":336,"type":15},{"name":531,"slug":532,"type":15},"Kotlin","kotlin",{"name":534,"slug":535,"type":15},"Spring","spring","2026-07-13T06:41:47.83899",{"slug":538,"name":538,"fn":539,"description":540,"org":541,"tags":542,"stars":25,"repoUrl":26,"updatedAt":553},"cloudflare-deploy","deploy applications to Cloudflare","Deploy applications and infrastructure to Cloudflare using Workers, Pages, and related platform services. Use when the user asks to deploy, host, publish, or set up a project on Cloudflare.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[543,546,549,552],{"name":544,"slug":545,"type":15},"Cloudflare","cloudflare",{"name":547,"slug":548,"type":15},"Cloudflare Pages","cloudflare-pages",{"name":550,"slug":551,"type":15},"Cloudflare Workers","cloudflare-workers",{"name":527,"slug":528,"type":15},"2026-07-17T06:04:42.853896",{"slug":555,"name":555,"fn":556,"description":557,"org":558,"tags":559,"stars":25,"repoUrl":26,"updatedAt":567},"compose-ui-control","interact with Compose Desktop applications","Control a running Compose Desktop application via HTTP. Use when you need to interact with UI elements, click buttons, enter text, wait for elements to appear, or capture screenshots in a Compose Desktop app that has compose-ui-test-server enabled.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":9},[560,563,566],{"name":561,"slug":562,"type":15},"Automation","automation",{"name":564,"slug":565,"type":15},"Desktop","desktop",{"name":387,"slug":388,"type":15},"2026-07-13T06:40:38.798626",128]