9 Best Agent Skills Examples & Templates [2026]

---
name: commit
description: >
  Generate a semantic commit message from staged git changes.
  Use when user wants to commit or asks "what commit message should I write".
---
# Commit Skill
Analyze the staged diff and write a commit following conventional commits:
Format: type(scope): description
Types: feat, fix, docs, style, refactor, test, chore, perf
Rules: ≤72 chars subject, imperative mood, no period at end
Output: Just the commit message, ready to copy-paste.

---
name: review-pr
description: >
  Perform a comprehensive code review. Use when user asks to review
  code, check a PR, or wants feedback on changes.
---
# PR Review Skill
Review the provided code/diff for:
1. Correctness: Logic errors, off-by-one, null safety
2. Security: OWASP Top 10, input validation, auth gaps
3. Performance: N+1 queries, unnecessary re-renders, memory leaks
4. Style: Naming, DRY, complexity
Format each issue: [SEVERITY] file:line — description — suggestion
Severity: CRITICAL / HIGH / MEDIUM / LOW / INFO

---
name: test-runner
description: >
  Generate unit tests for functions or modules. Use when user asks to
  "write tests", "add test coverage", or "test this function".
---
# Test Runner Skill
Framework: Auto-detect (Jest/Vitest/pytest/Go test)
Write tests covering:
- Happy path (normal inputs)
- Edge cases (empty, null, boundary values)
- Error states (throws, rejects)
- Integration points (mocked dependencies)
Format: Full test file, importable and runnable
Include: describe blocks, setup/teardown, assertion messages

---
name: deploy
description: >
  Run a deployment checklist and guide through the deploy process.
  Use when user mentions deploying, shipping, or going to production.
---
# Deploy Skill
Pre-deployment checks:
1. All tests passing? (show test command)
2. Migrations reviewed? List any schema changes
3. Environment variables configured? List required vars
4. Dependencies updated? (npm audit / pip check)
5. Rollback plan: How to revert if something breaks
6. Monitoring: What to watch in the first 30 minutes
Output: Go/No-Go recommendation with specific blockers listed

---
name: refactor
description: >
  Refactor code for clarity and quality. Use when user asks to clean up,
  improve, or refactor code, or says the code is messy/hard to read.
---
# Refactor Skill
Analyze the provided code and rewrite it following these priorities:
1. Readability: Clear naming, single responsibility, remove magic numbers
2. Maintainability: Extract functions >15 lines, add types, remove duplication
3. Performance: Identify O(n²) → O(n) opportunities, lazy loading, memoization
4. Modern patterns: Replace legacy patterns with current language idioms
Format: Before/After sections with explanation of each change

---
name: debug
description: >
  Debug an issue step by step. Use when user is stuck on a bug,
  reports an error, or says "this isn't working" or "why is this broken".
---
# Debug Skill
Follow this debugging methodology:
1. Reproduce: What exact steps trigger the issue?
2. Observe: What IS happening vs. what SHOULD happen?
3. Hypothesize: List 3 most likely root causes, ranked by probability
4. Isolate: Suggest smallest test case to confirm each hypothesis
5. Fix: Write the specific code change with explanation
6. Verify: How to confirm the fix works and regression tests to add

---
name: document
description: >
  Generate documentation for code. Use when user asks to document,
  add comments, write docs, or generate JSDoc/TSDoc.
---
# Document Skill
Generate documentation based on what's provided:
- Functions/methods: JSDoc with @param, @returns, @throws, @example
- Classes: Class description, constructor, public methods
- REST endpoints: OpenAPI/Swagger format with request/response schemas
- Modules: Module-level overview with exports table
Quality bar: Each doc should answer "what does this do and how do I use it?"

---
name: security-audit
description: >
  Audit code for security vulnerabilities. Use when user asks about
  security, wants a security review, or is preparing to deploy.
---
# Security Audit Skill
Check for OWASP Top 10 + common issues:
1. Injection (SQL, NoSQL, command, LDAP)
2. Broken Authentication / Authorization
3. Sensitive Data Exposure (hardcoded secrets, logging PII)
4. XSS and CSRF vulnerabilities
5. Insecure Dependencies (list outdated packages)
6. Security Misconfiguration
Per finding: File:line, description, severity (Critical/High/Medium/Low), remediation code

---
name: migrate
description: >
  Generate database migration scripts. Use when user needs to change
  a schema, add columns, rename tables, or migrate data.
---
# Migrate Skill
For the described schema change, generate:
1. UP migration: SQL with forward migration
2. DOWN migration: SQL to completely reverse the change
3. Data migration: Script to transform existing rows if needed
4. Validation query: SELECT to verify migration succeeded
5. Estimated impact: Rows affected, lock time estimate, downtime risk
Target: PostgreSQL by default, flag if MySQL/SQLite syntax differs