テスト・セキュリティのスキル

Record a reproducible defect, independent triage, immutable attempts, and evidence-backed retest state.

日本語の概要は準備中です。原文の説明を表示しています。

Review a code diff or explicit file set through independent correctness and QA lenses. Use when the user asks for a code review, test-coverage assessment, pre-merge audit, or review gate in a PWDEV Flow workflow.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user asks for the state of pwdev-feat plans — 'status do feat', 'quais planos estão pendentes', 'show feature status' — listing pending, complete, with-caveats, failed and resumable plans plus codebase-context health. Read-only. Do NOT use to execute (feat-exec) or query the audit trail (feat-audit).

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user wants tests planned for existing code or a test audit — unit, integration, E2E scenarios exportable to Playwright, playwright-cli UI checks, a coverage matrix — 'criar testes para o UserService', 'plano de testes E2E do login', 'auditar a cobertura'. Writes .planning/feat/features/{slug}/plan.md. Do NOT use for code review (feat-review), for implementing features (feat-feature) or to run an existing plan (feat-exec).

日本語の概要は準備中です。原文の説明を表示しています。

Execute approved PWDEV Flow plans one atomic task at a time with test-first implementation, fresh verification, blocker handling, and durable evidence. Use after the plan gate is approved or for approved Flow correction tasks.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user wants the existing codebase analyzed for planning — 'mapear o código', 'analisar o projeto', 'atualizar o contexto', 'map codebase' — or when a planning skill reports a missing or stale map. Runs a deterministic read-only evidence scan and writes codebase.md plus the architecture, conventions, testing and concerns context documents under .planning/feat/. Do NOT use for code review (feat-review), architecture decisions, or writing the project instructions file (feat-setup).

日本語の概要は準備中です。原文の説明を表示しています。

Use when implementation is complete, tests pass, and the work needs integrating - merging, opening a pull request, or being left in place

日本語の概要は準備中です。原文の説明を表示しています。

Decompose an approved PWDEV Flow specification into dependency-aware waves and atomic executable tasks. Use when design is approved and the user needs exact file scope, test-first actions, verification commands, and an execution gate.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user wants a code review of an explicit range or set of files — correctness, security, performance, conventions, tests — with stable findings (CR-nnn, BLOCKER..INFO) and rule citations — 'revisar os últimos commits', 'code review da feature X', 'review base..HEAD'. Plans a REPORT-mode review (no code changes, no commit). Do NOT use to fix code (feat-feature / feat-quick), to write tests (feat-test) or for UI/UX design critique.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user wants to execute an existing pwdev-feat action plan — 'executar o plano user-crud', 'exec latest', 'rodar o plano', 'retomar a execução'. Dispatches the executor (subagent when the runtime has one, inline otherwise) in IMPLEMENT or REPORT mode, handles NEEDS_ADVICE with the advisor, and supports --resume. Do NOT use to create plans (feat-feature, feat-backend, feat-frontend, feat-test, feat-review) or for tasks without a plan (feat-quick).

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user wants a full feature action plan (backend + frontend + tests) with the PWDEVIA 7-question method before any code is written — 'planejar a feature X', 'criar plano de feature', 'plan the user CRUD'. Interviews the human (max 2 rounds) and writes .planning/feat/features/{slug}/plan.md. Do NOT use to write code (feat-exec), for small 1–3 file changes (feat-quick), backend-only or UI-only scope (feat-backend / feat-frontend), tests for existing code (feat-test) or code review (feat-review).

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user wants to set up pwdev-feat in a project — 'inicializar o pwdev-feat', 'configurar o feat', 'init feat workspace' — choosing language, model profile and the optional audit trail, and creating the .planning/feat/ workspace. Do NOT use to analyze the codebase (feat-map), to write the project instructions file (feat-setup) or to create plans.

日本語の概要は準備中です。原文の説明を表示しています。

Enable, record, query, summarize, or verify the opt-in PWDEV Flow semantic audit trail. Use when the user asks what Flow actions occurred, wants audit integrity checked, or needs a portable JSONL record of workflow gates and artifacts.

日本語の概要は準備中です。原文の説明を表示しています。

Deliver a small, bounded code change through inspection, a mini-plan, implementation, testing, review, and adversarial verification. Use for bug fixes, configuration changes, and features expected to touch no more than five files.

日本語の概要は準備中です。原文の説明を表示しています。

Define, documenta e aplica a voz da marca — formalidade, personalidade, vocabulário preferido, palavras proibidas e tratamento do leitor. Use quando o usuário disser "voz da marca", "tom de voz", "brand voice", "guia de estilo", "padronizar o tom", "não parece nossa marca", "manual de redação", ou quando precisar auditar se um texto está aderente. Extrai a voz de amostras reais em vez de inventar adjetivos, e grava o resultado na seção 5 de .claude/pwdev-copy-context.md para todas as demais skills consumirem.

日本語の概要は準備中です。原文の説明を表示しています。

Audita e diagnostica SEO — técnico, on-page e qualidade de conteúdo. Use quando o usuário disser "auditoria de SEO", "não estou rankeando", "SEO técnico", "meta tags", "Core Web Vitals", "revisar SEO do site".

日本語の概要は準備中です。原文の説明を表示しています。

Quality gates determinísticos para PHP e Laravel. Use quando o usuário pedir "quality gate PHP", "quality gate Laravel", "PHPStan", "Larastan", "Pest", "PHPUnit", "PHPMD", "Composer Audit", cobertura PHP ou baseline PHP.

日本語の概要は準備中です。原文の説明を表示しています。

Use when the user wants to query the local pwdev audit trail — 'ver auditoria', 'relatório de auditoria', 'audit stats', 'exportar auditoria em PDF' — summary, events, decisions, artifacts, statistics, a Markdown/PDF export or a custom read-only SELECT. Do NOT use to enable the audit (feat-init) or for plan status (feat-status).

日本語の概要は準備中です。原文の説明を表示しています。

Segurança de infraestrutura e pipeline — Trivy, Falco, CrowdSec, Fail2Ban, WAF, TLS, IAM, secrets, OWASP, Security Hub. Use quando o usuário disser "segurança", "vulnerabilidade", "CVE", "hardening", "WAF", "secrets", "exposto", "auditoria de segurança", "pentest".

日本語の概要は準備中です。原文の説明を表示しています。

Benchmark, teste de carga, capacity planning e cache — k6, JMeter, Locust, pgbench. Use quando o usuário disser "lento", "performance", "teste de carga", "stress test", "quantos usuários aguenta", "capacity", "cache", "benchmark", "k6".

日本語の概要は準備中です。原文の説明を表示しています。

Create professional, dark-themed architecture diagrams as standalone HTML files with SVG graphics. Use when the user asks for system architecture diagrams, infrastructure diagrams, cloud architecture visualizations, security diagrams, network topology diagrams, or any technical diagram showing system components and their relationships.

日本語の概要は準備中です。原文の説明を表示しています。

Proactively search for security threats, vulnerabilities, and suspicious patterns in applications and infrastructure before they cause damage. Use when conducting security audits, identifying vulnerabilities, analyzing security logs, detecting suspicious patterns, investigating potential breaches, performing penetration testing, or implementing security monitoring.

日本語の概要は準備中です。原文の説明を表示しています。

Write comprehensive end-to-end tests that verify complete user workflows, integration between components, and system behavior from user perspective using Playwright, Cypress, or similar frameworks. Use when testing user flows, verifying feature integration, testing across real browsers, ensuring UI interactions work correctly, validating form submissions end-to-end, testing authentication flows, catching regressions, automating QA processes, testing API integrations, or building confidence in production deployments.

日本語の概要は準備中です。原文の説明を表示しています。

Implement comprehensive security patterns to protect applications against OWASP Top 10 vulnerabilities including XSS, CSRF, SQL injection, authentication bypass, and data exposure. Use when handling user data, implementing authentication and authorization, validating input, encrypting sensitive data, preventing injection attacks, securing API endpoints, managing sessions and tokens, implementing rate limiting, configuring security headers, or building security-critical features that require defense-in-depth protection.

日本語の概要は準備中です。原文の説明を表示しています。