Test design, vulnerability assessment, and quality assurance (13.1K skills)
Security leadership for growth-stage companies. Use when building security programs, selecting compliance frameworks (SOC 2, ISO 27001, HIPAA, GDPR), managing incidents, or assessing vendor risk.
The English summary is being prepared. Showing the original description.
A minimal test skill that greets the user and demonstrates the ASM publish workflow.
The English summary is being prepared. Showing the original description.
Add GitHub skill repos to the ASM index: clone, audit, eval, regenerate index, rebuild catalog, open PR. Use when given GitHub URLs to onboard. Don't use for refreshing indexed repos (refresh-index), improving skills (skill-creator), or install.
The English summary is being prepared. Showing the original description.
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.
The English summary is being prepared. Showing the original description.
Use when the task requires automating a real browser from the terminal (navigation, form filling, snapshots, screenshots, data extraction, UI-flow debugging) via `playwright-cli` or the bundled wrapper script.
The English summary is being prepared. Showing the original description.
Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, update or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.
The English summary is being prepared. Showing the original description.
Real-time web search using Playwright-controlled browser. Use this skill when you need current information, latest documentation, recent news, or any data beyond your knowledge cutoff (January 2025).
The English summary is being prepared. Showing the original description.
Help the user turn their Retentioneering ideas, friction reports, bug findings, or feature needs into high-quality upstream contributions: from capturing and validating the idea, through minimal reproductions and issue drafts, to preparing, testing, and submitting a pull request that follows this repository's conventions. Use when the user says they found a bug, wants a feature, wrote a workaround worth upstreaming, or asks how to contribute, open an issue, or make a PR to retentioneering-tools.
The English summary is being prepared. Showing the original description.
Prevent 此地无银三百两式 residue: finalize artifacts without echoing rejected session-only alternatives into labels, metadata, commits, PRs, or handoffs. Use after corrections or discarded proposals. Not for ordinary deletion, deprecation, migration, or exclusions materially required for safety, accuracy, compatibility, audit, quotation, or requested comparison.
The English summary is being prepared. Showing the original description.
Systematically QA test a web application with browser-based bug fixing. Four modes: diff-aware (automatic on feature branches), full (systematic exploration), quick (30-second smoke test), regression (compare against baseline). Atomic bug-fix workflow with regression testing. Health scoring across 8 categories.
The English summary is being prepared. Showing the original description.
Headless Chromium CLI for QA testing and site dogfooding. 100-200ms per command after startup. Persistent state with cookies, tabs, sessions. Snapshot system with element refs. Navigate, interact, verify page state, take screenshots, check responsive layouts, test forms, handle dialogs.
The English summary is being prepared. Showing the original description.
Systematic root-cause debugging. Iron Law: no fixes without root cause investigation first. Four phases: Root Cause Investigation, Pattern Analysis (6 known patterns), Hypothesis Testing (3-strike rule), Implementation. Structured debug report output.
The English summary is being prepared. Showing the original description.
Fully automated ship workflow: pre-flight, merge base, run tests, coverage audit, pre-landing review, design review, adversarial review, version bump, CHANGELOG generation, TODOS.md update, bisectable commits, push and PR creation, auto-sync docs via document-release.
The English summary is being prepared. Showing the original description.
Pre-landing PR review with two-pass checklist. Pass 1 critical: SQL safety, race conditions, LLM trust boundaries, enum completeness. Pass 2 informational: side effects, magic numbers, dead code, test gaps. Adversarial review auto-scaled by diff size. Scope drift detection.
The English summary is being prepared. Showing the original description.
Report-only QA — same browser-based testing as qa but documents bugs with screenshots and repro steps only, no code changes. Health score formula weighted across 8 categories. Outputs to .gstack/qa-reports/.
The English summary is being prepared. Showing the original description.
Eng manager-mode plan review. Scope challenge, architecture review, code quality review, detailed test coverage diagram, performance review. Produces test plan artifact for downstream QA. Optional cross-model outside voice.
The English summary is being prepared. Showing the original description.
Generates Spring Boot 3.x configurations, creates REST controllers, implements Spring Security 6, sets up Spring Data JPA, and configures reactive WebFlux endpoints.
The English summary is being prepared. Showing the original description.
Generates test files, creates mocking strategies, analyzes code coverage, designs test architectures, and produces test plans across functional, performance, and security testing.
The English summary is being prepared. Showing the original description.
Challenges ideas, plans, decisions, and proposals using structured critical reasoning as devil's advocate, pre-mortem, red team, or evidence audit.
The English summary is being prepared. Showing the original description.
Optimizes Active Record queries, implements Turbo Frames and Streams, configures Action Cable WebSockets, sets up Sidekiq workers, and writes RSpec test suites for Rails 7+.
The English summary is being prepared. Showing the original description.
Builds security-focused full-stack web applications with integrated frontend and backend components implementing layered security including auth, validation, encoding, and parameterized queries.
The English summary is being prepared. Showing the original description.
Identifies security vulnerabilities, generates structured audit reports with severity ratings, and provides actionable remediation guidance for SAST, DevSecOps, and compliance.
The English summary is being prepared. Showing the original description.
Writes E2E tests with Playwright including test scripts, page objects, test fixtures, reporters, CI integration, API mocking, and visual regression testing.
The English summary is being prepared. Showing the original description.
Asset naming and pipeline validation
The English summary is being prepared. Showing the original description.