テスト・セキュリティのスキル

Put on the adversarial hat and systematically attack any document, plan, strategy, or idea to expose its weakest points before commitment. Structured devil's advocate with red team rigour — not pessimism, but evidence-based critique across three phases: diagnostic (are claims accurate?), creative (is the problem artificially constrained?), challenge (are solutions robust?). Load when the user asks to stress test a document, red team this plan, poke holes in this, devil's advocate this, challenge my assumptions, or when product-soul, brainstorming, prd-writing, or inversion calls for adversarial review. Also triggers on "what am I missing", "what could kill this", "find the flaws", or "critique this rigorously".

日本語の概要は準備中です。原文の説明を表示しています。

Test and debug browser UIs using Chrome DevTools MCP — DOM inspection, console errors, network requests, performance traces, and visual verification. Load when building or debugging anything that renders in a browser, verifying a UI fix, profiling Core Web Vitals in a real page, or the user asks for browser testing with DevTools. Requires chrome-devtools MCP configured. Not for backend-only or CLI work. Pairs with frontend-design and performance-optimization.

日本語の概要は準備中です。原文の説明を表示しています。

Write a rigorous, decision-grade experiment spec — falsifiable hypothesis, primary metric, guardrails, randomisation unit, exposure definition, method (A/B, holdout, switchback, quasi-experiment, MAB), MDE/duration plan, peek policy, validity threats, and pre-committed decision rule. Platform-agnostic. Load when the user has a candidate experiment and needs to spec it before launch, or says "spec this experiment", "write the test plan", "design this A/B test", "what's the hypothesis", "how big a sample do we need", "how long should we run this", "define the metrics for this test", or when the experimentation orchestrator routes here.

日本語の概要は準備中です。原文の説明を表示しています。

Map symbol dependencies, callers, and blast radius before editing code. Load when the user asks what depends on a symbol, what breaks if they change something, blast radius of a change, reverse dependencies, or which tests cover a function. Also triggers on "who calls this", "impact of changing", "dependency map", "what uses this", "find callers", or before any non-trivial edit when safe-change is not yet active. Pairs with codebase-understanding for broad architecture; this skill is symbol-scoped and edit-gated.

日本語の概要は準備中です。原文の説明を表示しています。

Surface every assumption embedded in a plan, strategy, or document, assess how critical and how validated each one is, and identify which ones to test first. Load when the user asks to map assumptions, surface hidden beliefs, find what must be true for this to work, run an assumption audit, or when deep-thinking diagnoses an assumption frame. Also triggers on "what are we assuming", "what must be true for this to work", or "find the untested beliefs". Based on David Bland and Alex Osterwalder's assumption mapping method from Testing Business Ideas.

日本語の概要は準備中です。原文の説明を表示しています。

Orchestrator for the experimentation skill suite — turn assumptions and product questions into rigorous, well-instrumented experiments and decision-grade readouts. Routes through backlog → spec → runbook → readout based on user need and existing artefacts. Platform-agnostic with PostHog as the primary binding. Load when the user asks to design an experiment, A/B test something, set up an experiment, run a holdout, test a hypothesis, decide what to test next, read out experiment results, analyse a test, or says "should we A/B test this", "experiment on the landing page", "is this lift real", "ship or kill this test", "what should we test next", "build an experiment backlog", "test the pricing page", "validate this with an experiment".

日本語の概要は準備中です。原文の説明を表示しています。

Harden an application against common security risks — validate inputs at boundaries, least-privilege access, safe secrets handling, dependency hygiene, and secure defaults. Load when shipping user-facing code, adding auth/session flows, handling untrusted data, exposing APIs, or the user asks for "security hardening", "OWASP hardening", "secure this feature". Not for skill-library security gates (use secure-skill family).

日本語の概要は準備中です。原文の説明を表示しています。

Run Mom Test–style customer-discovery interviews to validate or kill an unbuilt idea — generate a non-leading interview guide, conduct or coach the conversations, and synthesize signal vs compliments. Load when the user asks to do customer discovery, run problem interviews, validate an idea with users, run a Mom Test, design an interview guide, or says "talk to customers", "validate the problem", "interview users", "Mom Test this", "did real users want it", "synthesize my interviews", "I just talked to N people". Sub-skill of `venture-exploration`. Hard-bans "would you use this?", solution-pitching, friend/family-only ICP, and treating compliments as validation. Calls `secure-*` before synthesizing any pasted external transcripts.

日本語の概要は準備中です。原文の説明を表示しています。

Run a structured retrospective after development-phase runs of your product's agents — interview the owner in plain language about what went well and poorly, draft ranked improvement hypotheses, then design and run small n=1/n=2 experiments with pre-declared success criteria, guardrails, stop conditions, and a cost/ROI kill-switch. Load when the user says how did that run go, retro this run, the agent output was bad, what should we improve, draft hypotheses, run a small experiment, or after repeated dev runs of an agentic system produce uneven quality. Priority: output quality over performance over cost, each with diminishing-returns stops. NOT a product A/B test (experimentation), NOT coding-agent harness repair (harness-evolution), NOT production-scale learning (runtime-learning-loop).

日本語の概要は準備中です。原文の説明を表示しています。

Translate an approved experiment spec into a launch runbook — platform binding (PostHog primary), feature flag setup, assignment unit, exposure event definition, instrumentation QA, dashboard wiring, ramp plan, monitoring, and rollback procedure. Platform-agnostic core with one strong PostHog adapter shipped; GrowthBook, Statsig, LaunchDarkly, Optimizely, and Eppo documented as a single mapping table the user adapts. Load when a spec is approved and ready to launch, or when the user says "set up the experiment", "wire this up in PostHog", "implement the test", "create the runbook", "launch checklist for this test", or when the experimentation orchestrator routes here.

日本語の概要は準備中です。原文の説明を表示しています。

Turn assumptions, funnel opportunities, and product questions into a prioritised, feasibility-checked experiment backlog. Filters by traffic reality, metric latency, and method feasibility — not just ICE/RICE scoring. Maintains a living portfolio with status (idea → designed → running → readout → archived). Load when the user says "what should we test next", "build an experiment backlog", "prioritise our tests", "where should we experiment", "what's worth testing", or when the experimentation orchestrator routes here.

日本語の概要は準備中です。原文の説明を表示しています。

Verify a code change end-to-end in the current worktree: identify what changed, run the relevant tests, get the app running, drive a browser over the affected areas, and report a verdict with screenshots. Generic across project types (Laravel/Herd, Node/bun, frontend, CLI, library). Use when the user wants to verify/QA/smoke-test a change, check that a PR or branch works, validate uncommitted work, or says "/flow", "verify this change", "does this PR work", "test and click through this". Optional target: PR number/URL, branch/ref, or worktree path; default is the current working changes.

日本語の概要は準備中です。原文の説明を表示しています。

Audit UI, docs, or prose for AI-generated tells in design and copy, then fix approved findings. Use when the user says de-slop, slop check, "looks AI-generated", or wants copy humanized.

日本語の概要は準備中です。原文の説明を表示しています。

Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.

日本語の概要は準備中です。原文の説明を表示しています。

Systematic exploratory QA testing of web applications — find bugs, capture evidence, and generate structured reports

日本語の概要は準備中です。原文の説明を表示しています。

Execute comprehensive web application security testing using Burp Suite's integrated toolset, including HTTP traffic interception and modification, request analysis and replay, automated vulnerability scanning, and manual testing workflows.

日本語の概要は準備中です。原文の説明を表示しています。

This skill ensures all code follows security best practices and identifies potential vulnerabilities. Use when implementing authentication or authorization, handling user input or file uploads, or creating new API endpoints.

日本語の概要は準備中です。原文の説明を表示しています。

You extend the browser to give users superpowers. You understand the unique constraints of extension development - permissions, security, store policies. You build extensions that people install and actually use daily. You know the difference between a toy and a tool.

日本語の概要は準備中です。原文の説明を表示しています。

Identify and exploit authentication and session management vulnerabilities in web applications. Broken authentication consistently ranks in the OWASP Top 10 and can lead to account takeover, identity theft, and unauthorized access to sensitive systems.

日本語の概要は準備中です。原文の説明を表示しています。

Azure Resource Manager SDK for Microsoft Playwright Testing in .NET.

日本語の概要は準備中です。原文の説明を表示しています。

Master Bash Automated Testing System (Bats) for comprehensive shell script testing. Use when writing tests for shell scripts, CI/CD pipelines, or requiring test-driven development of shell utilities.

日本語の概要は準備中です。原文の説明を表示しています。

Azure Key Vault Secrets Java SDK for secret management. Use when storing, retrieving, or managing passwords, API keys, connection strings, or other sensitive configuration data.

日本語の概要は準備中です。原文の説明を表示しています。

Azure Key Vault Keys Java SDK for cryptographic key management. Use when creating, managing, or using RSA/EC keys, performing encrypt/decrypt/sign/verify operations, or working with HSM-backed keys.

日本語の概要は準備中です。原文の説明を表示しています。

Azure Key Vault Keys SDK for .NET. Client library for managing cryptographic keys in Azure Key Vault and Managed HSM. Use for key creation, rotation, encryption, decryption, signing, and verification.

日本語の概要は準備中です。原文の説明を表示しています。