> ## Documentation Index
> Fetch the complete documentation index at: https://qodex.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Built-in skills

> Qodex ships with focused skills for API testing, UI testing, security testing, bug replication and fixing, setup, analysis, performance checks, and reporting.

# Built-in skills

Qodex ships with skills for the most common testing and review jobs. The coordinator chooses from these skills based on what you ask it to do.

You usually do not need to pick a skill manually. Ask for the outcome you want, such as "test my checkout API" or "create UI tests for login", and Qodex routes the work.

## Shipped skills

| Skill | What it does | When Qodex uses it |
| - | - | - |
| `setup` | Saves environments, credentials, base URLs, and API keys. | During onboarding or when you provide new configuration. |
| `auth` | Discovers API login flows and saves reusable auth profiles. | When Qodex needs credentials before testing protected endpoints. |
| `analyze` | Summarizes an imported API collection. | After OpenAPI or Postman import. |
| `explore` | Crawls a web app and builds a page, form, endpoint, and artifact catalog. | Before UI scenario authoring or when the page catalog is stale. |
| `api` | Tests API endpoints, creates passing scenarios, and reports real API bugs. | API testing prompts and endpoint-focused requests. |
| `api-author` | Authors API scenarios for a focused endpoint group. | Spawned by `api` during parallel scenario creation. |
| `ui` | Plans UI testing work and coordinates browser-driven scenario authoring. | UI flow testing prompts. |
| `ui-author` | Drives one UI scenario end to end in the browser. | Spawned by `ui` for individual flows. |
| `security` | Checks OWASP-style security issues and files confirmed vulnerabilities. | Security scan, OWASP, IDOR, headers, or access-control prompts. |
| `performance` | Measures API latency and response-time baselines. | Performance regression or SLO prompts. |
| `technical-seo` | Audits technical SEO and Core Web Vitals the way Lighthouse does. | SEO, meta tag, structured data, or page-speed prompts. |
| `integration` | Runs one focused task against a connected integration's tools. | Connector runs and `@connector` mentions in chat. |
| `replicate` | Reproduces one reported bug on a test environment as a saved scenario, runs it, and reports whether the bug is really there. | The Replicate bugs on staging [Autopilot](https://qodex.ai/docs/autopilot.md) agent. |
| `fix` | Reads the code behind one open bug, finds the cause, and opens a pull request for a person to review. | The Auto-fix bugs Autopilot agent and **Fix in code** on a finding. |
| `report` | Summarizes a multi-step run into a short report. | At the end of larger agent workflows. |

## Orchestrator and author skills

Some skills plan the work. Others do a narrow slice of it.

`api` and `ui` are orchestrator skills. They understand the full request, split it into smaller pieces, and decide which sub-agents to run.

`api-author` and `ui-author` are authoring skills. They are usually spawned by the orchestrator and focus on one scenario or one endpoint group at a time.

This split helps Qodex stay organized during larger runs. The coordinator keeps the main goal in view while sub-agents collect evidence and create scenarios in parallel.

## Security scope

Use `security` for structured security testing: OWASP checks, access-control probes, headers, and repeatable security scenarios. Penetration-testing prompts in chat also route to `security`.

## Performance scope

The `performance` skill measures API baselines and regressions. It is not a full load-testing engine. It records latency signals such as p50, p95, p99, and jitter.

Browser Core Web Vitals and page-speed audits belong to the `technical-seo` skill.

## Skills on the roadmap

Older internal docs mention skills that are not currently shipped as `.skill.md` files. The main planned gap is an accessibility skill for axe-core, WCAG checks, contrast, keyboard navigation, screen reader behavior, and responsive zoom.

Current shipped equivalents:

| Older label | Current skill |
| - | - |
| `functionality` | `api` or `ui`, depending on the target |
| `security-tests` | `security` |
| `penetration-tests` | `security` |
| `pentest` | `security` |
| `vulnerability-tests` | `security` |
| `analyze-collection` | `analyze` |

## Next steps

> [card] [The .skill.md format](https://qodex.ai/docs/skills-format.md)
>
> See how these skills are defined.

> [card] [Author a skill](https://qodex.ai/docs/skills-authoring.md)
>
> Add a project-specific skill.

> [card] [Distribute a skill](https://qodex.ai/docs/skills-distributing.md)
>
> Share a skill with your team.

> [card] [Skills overview](https://qodex.ai/docs/skills.md)
>
> Learn why skills exist in Qodex.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.