Testing & Security skills

Generate comprehensive edge cases and test scenarios by decomposing features across 12 dimensions. Use before implementation or testing to catch issues early.

The English summary is being prepared. Showing the original description.

Audit project context routing, shared-skill discoverability, and Claude/Codex wiring. Use when context docs or skill surfaces move, split, or drift.

The English summary is being prepared. Showing the original description.

Web testing with Playwright, Vitest, k6. E2E/unit/integration/load/security/visual/a11y testing. Use for test automation, flakiness, Core Web Vitals, mobile gestures, cross-browser.

The English summary is being prepared. Showing the original description.

Audit agent harness health: Claude/Codex agent parity, skill registry consistency, README.md sync, and protocol file wiring. Use when agents, skills, README.md, or development-protocol files move, split, or drift.

The English summary is being prepared. Showing the original description.

STRIDE + OWASP-based security audit with optional auto-fix. Scans code for vulnerabilities, categorizes by severity, and can iteratively fix findings using vc-autoresearch pattern.

The English summary is being prepared. Showing the original description.

Optional design-improvement pass for when you have spare usage to drain. Finds the shallowest modules in the code the spec touches, researches a deeper design, and proposes refactors that shrink interfaces and hide decisions — behavior held constant, tests green before and after. Proposes §I/§V/§T edits, never silent rewrites. Triggers when the user says "deepen this", "improve the design", "this module feels shallow", "pull complexity down", "use spare budget on the codebase", or invokes /ck:deepen. Leans on the codebase-design skill's deep-module vocabulary when present.

The English summary is being prepared. Showing the original description.

Read-only drift detector. Diffs SPEC.md against current code and reports violations grouped by severity. Writes nothing — suggests remedies via the spec or build skills but never invokes them. Triggers when the user asks to check drift, audit the spec, verify invariants, or ask whether code still matches the spec. Phrasings: "check drift", "audit the spec", "does the code still match §V", "check invariants", "spec vs code".

The English summary is being prepared. Showing the original description.

Calibrated interrogation of a fuzzy idea before it becomes a spec. Asks one question at a time, recommends an answer, and lands each answer in §G (goal) or §C (constraints) — unknowns parked as `?` items, never guessed. The cheapest place to kill a bad idea is before §T exists. Triggers when the user has a vague idea, says "grill me", "stress-test this", "challenge my plan", "interview me before I spec", or invokes /ck:grill. Defers the actual write to the spec skill.

The English summary is being prepared. Showing the original description.

Bug → spec protocol. When a bug is found or a test fails, trace the cause, decide whether a new §V invariant would catch recurrence, append to §B. This is the one non-obvious thing SDD does that plan-then-execute doesn't. Triggers on test failure, bug report, post-mortem, or explicit user ask.

The English summary is being prepared. Showing the original description.

Use when adding a new messaging channel to Tel-Agent or changing an existing one — a transport under api/channels/, its official extension manifest, its settings card, tests, health and docs. Covers the file checklist, the two inbound shapes (dial-out and the public door), the credential and signature rules that are not negotiable, the declarative setup descriptor the generic card draws from, and the test shape every channel ships with.

The English summary is being prepared. Showing the original description.

Use for video QA. Default local-first Jev frame triage with targeted review, audits and private-media fallback.

The English summary is being prepared. Showing the original description.

Use for all Blender work. Default code-first execution, local QA and bounded Jev diagnostic advice.

The English summary is being prepared. Showing the original description.

Use when checking the overall health of a skills library. Run doctor, validate, check for stale skills, and verify generated docs are in sync.

The English summary is being prepared. Showing the original description.

Verify claims, quotations, citations and references against live primary sources, and produce a reproducible audit record instead of an assertion. Use when asked to: check whether a quotation, verse, statistic, date, attribution or citation is accurate; verify references before publishing a report, thesis, article, slide deck or legal filing; confirm a text against an authoritative database; cross-check a claim across independent sources; build a citation register or verification appendix; find out whether two datasets agree; detect a misattributed or fabricated quotation; or audit a document's existing citations. Source-agnostic by design, with working providers for REST/JSON APIs, scraped HTML, bulk corpora, bibliographic catalogues (OpenLibrary), DOI resolution (Crossref) and reference works (Wikipedia) -- including scriptural tiers (Qur'an.com, sunnah.com and an independent hadith corpus) with full diacritic handling for Arabic, Hebrew, Greek and any script with optional marks. Covers content-addressed matching when sources disagree on numbering, graded match verdicts, byte-level integrity checks, published-string verification, and a catalogue of silent failure modes (identifier divergence, mojibake, scraper blocking, false-positive keyword rules, missing glyphs, unreliable PDF text layers).

The English summary is being prepared. Showing the original description.

Design, improve, and evaluate reusable agent skills with high-quality SKILL.md files, precise trigger descriptions, progressive disclosure, and testable behavior. This skill should be used when users ask to create a new skill, rewrite or review an existing skill, audit a skill collection such as `config/source/skills` for redundancy or overlap, improve skill trigger quality, organize skill references, or evaluate whether a skill should trigger and behave correctly.

The English summary is being prepared. Showing the original description.

Use when auditing repository documentation for drift, stale statements, broken references, or README mismatches, especially across published docs under `doc/` and key entry surfaces such as `README.md` (English default), `README.zh-CN.md`, `mcp/README.md`, and `mcp/README.zh-CN.md` during periodic maintenance or before preparing corrective PRs.

The English summary is being prepared. Showing the original description.

Perform a full codebase review, categorize findings by severity, file GitHub issues, then fix each issue in an isolated git worktree and submit PRs. Use this skill when the user asks to audit the codebase, do a comprehensive code review, find and fix security/quality/reliability issues, or run a proactive health check across the entire repository.

The English summary is being prepared. Showing the original description.

Fast path for a minimal CloudBase Web + database demo (最小前后端 / 最小可用 fullstack / Lovable-like BaaS). Defaults to @cloudbase/js-sdk client CRUD (NoSQL app.database / PG app.rdb), MCP-only schema, preview-first, and forbids cloud functions unless secrets, cron/background jobs, or logic that security rules/RLS cannot express. Use for 搭一套 demo、留言板、Todo、Notes、Kanban, or when users say 带云函数+云数据库 but only need CRUD. NOT for production multi-service backends, CloudRun, WeChat Mini Programs, or tasks that truly need server secrets.

The English summary is being prepared. Showing the original description.

Code learning and audit framework. Analyze any codebase — new, legacy, or AI-generated — and produce educational explanations or architectural audits. Use when the user wants to understand WHAT and WHY behind any code, not just accept it.

The English summary is being prepared. Showing the original description.

Find the decisions in a pipeline that do not need the expensive model and propose the gate for each: a rule, a classic classifier, or a small model, with fail-closed routing. Use when the user asks to cut model costs or latency, says the big model handles everything, or wants a triage / routing / filter layer in front of an agent. Analysis plus an optional baseline scaffold. Do NOT use for auditing context layout (context-audit) or for building eval suites (evals-bootstrap).

The English summary is being prepared. Showing the original description.

Audit an agent's harness against the four rings: containment, guides, sensors, permissions. Use when the user asks whether their agent setup is safe, wants a review of sandboxing / permissions / hooks / AGENTS.md guardrails, or asks what a bad session could break. Read-only: reports the blast radius and a hardening list, changes nothing. Do NOT use for context layout (context-audit) or cost routing (gate-check).

The English summary is being prepared. Showing the original description.

Audit an agent's context layout against the four places: system prompt, tools, history, tail. Use when the user asks to audit, review or fix their agent's context, prompt caching, token spend per turn, or CLAUDE.md / AGENTS.md layout. Read-only: reports findings and a fix list, changes nothing. Do NOT use for writing evals (evals-bootstrap) or for loop design (goal-test).

The English summary is being prepared. Showing the original description.

Audit a second-brain vault for structural problems and repair them: broken wikilinks, orphan pages, empty stubs, frontmatter that violates the schema, near-duplicate pages, and stale index entries. Use this skill whenever the user asks to lint, clean, audit or check the health of their vault, says pages feel messy or links are broken, after a large bulk import, or when a scheduled maintenance run fires. Do NOT use for ingesting new sources, for answering questions from the vault, or for rewriting page content that is structurally fine but reads badly.

The English summary is being prepared. Showing the original description.

Generate questions from the user's own concept pages so they can find out what they saved but never learned, and compare their answers against what the pages say. Use this skill when the user wants to test themselves, revise, make flashcards from their notes, or asks what they have forgotten. Do NOT use for generic quizzing on a topic the vault does not cover, or for answering a question from the vault.

The English summary is being prepared. Showing the original description.