Testing & Security skills

STRIDE + OWASP-based security audit with optional auto-fix. Scans code for vulnerabilities, categorizes by severity, and can iteratively fix findings using vc-autoresearch pattern.

The English summary is being prepared. Showing the original description.

Audit agent harness health: Claude/Codex agent parity, skill registry consistency, README.md sync, and protocol file wiring. Use when agents, skills, README.md, or development-protocol files move, split, or drift.

The English summary is being prepared. Showing the original description.

Use when checking the overall health of a skills library. Run doctor, validate, check for stale skills, and verify generated docs are in sync.

The English summary is being prepared. Showing the original description.

Verify claims, quotations, citations and references against live primary sources, and produce a reproducible audit record instead of an assertion. Use when asked to: check whether a quotation, verse, statistic, date, attribution or citation is accurate; verify references before publishing a report, thesis, article, slide deck or legal filing; confirm a text against an authoritative database; cross-check a claim across independent sources; build a citation register or verification appendix; find out whether two datasets agree; detect a misattributed or fabricated quotation; or audit a document's existing citations. Source-agnostic by design, with working providers for REST/JSON APIs, scraped HTML, bulk corpora, bibliographic catalogues (OpenLibrary), DOI resolution (Crossref) and reference works (Wikipedia) -- including scriptural tiers (Qur'an.com, sunnah.com and an independent hadith corpus) with full diacritic handling for Arabic, Hebrew, Greek and any script with optional marks. Covers content-addressed matching when sources disagree on numbering, graded match verdicts, byte-level integrity checks, published-string verification, and a catalogue of silent failure modes (identifier divergence, mojibake, scraper blocking, false-positive keyword rules, missing glyphs, unreliable PDF text layers).

The English summary is being prepared. Showing the original description.

Use for all Blender work. Default code-first execution, local QA and bounded Jev diagnostic advice.

The English summary is being prepared. Showing the original description.

Use for video QA. Default local-first Jev frame triage with targeted review, audits and private-media fallback.

The English summary is being prepared. Showing the original description.

Design, improve, and evaluate reusable agent skills with high-quality SKILL.md files, precise trigger descriptions, progressive disclosure, and testable behavior. This skill should be used when users ask to create a new skill, rewrite or review an existing skill, audit a skill collection such as `config/source/skills` for redundancy or overlap, improve skill trigger quality, organize skill references, or evaluate whether a skill should trigger and behave correctly.

The English summary is being prepared. Showing the original description.

Perform a full codebase review, categorize findings by severity, file GitHub issues, then fix each issue in an isolated git worktree and submit PRs. Use this skill when the user asks to audit the codebase, do a comprehensive code review, find and fix security/quality/reliability issues, or run a proactive health check across the entire repository.

The English summary is being prepared. Showing the original description.

Use when auditing repository documentation for drift, stale statements, broken references, or README mismatches, especially across published docs under `doc/` and key entry surfaces such as `README.md` (English default), `README.zh-CN.md`, `mcp/README.md`, and `mcp/README.zh-CN.md` during periodic maintenance or before preparing corrective PRs.

The English summary is being prepared. Showing the original description.

Fast path for a minimal CloudBase Web + database demo (最小前后端 / 最小可用 fullstack / Lovable-like BaaS). Defaults to @cloudbase/js-sdk client CRUD (NoSQL app.database / PG app.rdb), MCP-only schema, preview-first, and forbids cloud functions unless secrets, cron/background jobs, or logic that security rules/RLS cannot express. Use for 搭一套 demo、留言板、Todo、Notes、Kanban, or when users say 带云函数+云数据库 but only need CRUD. NOT for production multi-service backends, CloudRun, WeChat Mini Programs, or tasks that truly need server secrets.

The English summary is being prepared. Showing the original description.

Code learning and audit framework. Analyze any codebase — new, legacy, or AI-generated — and produce educational explanations or architectural audits. Use when the user wants to understand WHAT and WHY behind any code, not just accept it.

The English summary is being prepared. Showing the original description.

Turn a vague task into a testable definition of done and generate an executable goal-test script for it, optionally with a bounded retry loop around a headless agent. Use when the user wants to run an agent in a loop, asks how to know when an agent task is finished, or says a goal like "improve X" needs to become checkable. Do NOT use for building eval suites over many cases — that is evals-bootstrap.

The English summary is being prepared. Showing the original description.

Audit an agent's context layout against the four places: system prompt, tools, history, tail. Use when the user asks to audit, review or fix their agent's context, prompt caching, token spend per turn, or CLAUDE.md / AGENTS.md layout. Read-only: reports findings and a fix list, changes nothing. Do NOT use for writing evals (evals-bootstrap) or for loop design (goal-test).

The English summary is being prepared. Showing the original description.

Find the decisions in a pipeline that do not need the expensive model and propose the gate for each: a rule, a classic classifier, or a small model, with fail-closed routing. Use when the user asks to cut model costs or latency, says the big model handles everything, or wants a triage / routing / filter layer in front of an agent. Analysis plus an optional baseline scaffold. Do NOT use for auditing context layout (context-audit) or for building eval suites (evals-bootstrap).

The English summary is being prepared. Showing the original description.

Audit a second-brain vault for structural problems and repair them: broken wikilinks, orphan pages, empty stubs, frontmatter that violates the schema, near-duplicate pages, and stale index entries. Use this skill whenever the user asks to lint, clean, audit or check the health of their vault, says pages feel messy or links are broken, after a large bulk import, or when a scheduled maintenance run fires. Do NOT use for ingesting new sources, for answering questions from the vault, or for rewriting page content that is structurally fine but reads badly.

The English summary is being prepared. Showing the original description.

Scaffold a first eval suite for an agent: mine real failures into cases, write behavioural checks over traces, and generate the runner. Use when the user wants evals, regression tests for an agent, a golden set, or asks how to know a prompt/model change did not break things. Do NOT use for a single task's done-check (goal-test) or for auditing context (context-audit).

The English summary is being prepared. Showing the original description.

Audit an agent's harness against the four rings: containment, guides, sensors, permissions. Use when the user asks whether their agent setup is safe, wants a review of sandboxing / permissions / hooks / AGENTS.md guardrails, or asks what a bad session could break. Read-only: reports the blast radius and a hardening list, changes nothing. Do NOT use for context layout (context-audit) or cost routing (gate-check).

The English summary is being prepared. Showing the original description.

Generate questions from the user's own concept pages so they can find out what they saved but never learned, and compare their answers against what the pages say. Use this skill when the user wants to test themselves, revise, make flashcards from their notes, or asks what they have forgotten. Do NOT use for generic quizzing on a topic the vault does not cover, or for answering a question from the vault.

The English summary is being prepared. Showing the original description.

Crabbox/Testbox remote proof: portable provider routing, untrusted isolation, Linux/macOS/Windows/WSL2, live E2E, diagnostics, cleanup.

The English summary is being prepared. Showing the original description.

Use when adding a new docs section or product area, editing llms.ts / the llms.txt or llms/[...slug] / llms-full.txt routes / get-llm-text / skill.md / .well-known endpoints, or working on the "agent score", "llms.txt", or anything "agent-ready" in the docs and site apps. Explains the invariants the Mintlify agent-readiness audit measures and how to hold them.

The English summary is being prepared. Showing the original description.

Generate a CCAM reliability report from session outcomes, hook events, alerts, tool failures, and data freshness. Use for health reviews, incident follow-up, hook-delivery audits, or reliability trend summaries.

The English summary is being prepared. Showing the original description.

Audit hook delivery health from Agent Monitor data — balance PreToolUse vs PostToolUse (a gap means tools that started but never reported back), detect missing Stop/SubagentStop terminators (sessions/subagents that never closed), and check for stale ingestion (no recent events). Use when hooks look unreliable or events seem to be dropping.

The English summary is being prepared. Showing the original description.

Audit model delegation and subagent effectiveness for a session — which models handled which subagent types, per-type success rates and average durations, and wasted delegations (heavy models on trivial work or types that consistently fail) — using the Agent Monitor workflow intelligence API. Use when reviewing how a session delegated work across models and subagents.

The English summary is being prepared. Showing the original description.

Inspect and safely edit the Claude Code and Codex configuration surfaces exposed by CCAM. Use when auditing skills, agents, commands, plugins, marketplaces, MCP servers, hooks, settings, memory, keybindings, profiles, rules, or instruction files, and when a backup-backed allowlisted edit is required.

The English summary is being prepared. Showing the original description.