Testing & Security skills

全面的代码安全检查和服务器安全审计skill。适用于：(1) 代码漏洞扫描 - 检测SQL注入、XSS、SSRF等OWASP Top 10漏洞，(2) 依赖安全检查 - 识别过时或有漏洞的第三方库，结合实时搜索确认最新CVE，(3) 服务器配置审计 - 检查SSH、防火墙、权限等安全配置，(4) 敏感信息泄露检测 - API密钥、密码、令牌等硬编码检测，(5) 容器安全扫描 - Docker镜像和Kubernetes配置审计，(6) CI/CD安全检查。触发关键词："安全检查"、"漏洞扫描"、"代码审计"、"security audit"、"vulnerability scan"、"SAST"、"dependency check"、"CVE检测"等。不用于：修复单个已定位的bug、编写新的安全功能代码、对无授权的第三方系统做扫描或渗透测试。

The English summary is being prepared. Showing the original description.

解决方案架构师助手。当用户要设计新系统架构、评审现有架构、做技术选型决策、诊断性能/可扩展性/可用性问题、规划架构演进或重构时使用。覆盖微服务、事件驱动、云原生等架构模式，技术趋势通过实时搜索获取而非依赖内置知识。不用于：具体功能的代码实现、安全漏洞审计（用security-audit）、产品需求分析（用product-manager）、只需一句话回答的技术常识问题。

The English summary is being prepared. Showing the original description.

Audit affiliate blog posts and landing pages for SEO issues. Triggers on: "audit my blog post for SEO", "check my SEO", "SEO review", "improve my rankings", "SEO checklist", "on-page SEO audit", "keyword optimization check", "why isn't my page ranking", "SEO score", "content quality audit", "check my meta tags", "internal linking audit", "quick SEO wins".

The English summary is being prepared. Showing the original description.

Monitor existing content for ranking drops and trigger refresh workflows. Triggers on: "check for content decay", "which content needs updating", "content refresh", "ranking drops", "traffic decline", "stale content", "content audit", "what to refresh", "outdated content", "content performance check", "update old articles", "declining rankings", "content maintenance", "refresh priority list", "which articles are losing traffic", "SEO content audit".

The English summary is being prepared. Showing the original description.

Check affiliate content for FTC compliance and platform rules. Triggers on: "check my content for compliance", "FTC disclosure check", "is this legal", "review for compliance", "check affiliate disclosure", "am I FTC compliant", "audit my content", "compliance review", "legal check", "platform rules check", "check before publishing", "disclosure audit", "review my ad copy".

The English summary is being prepared. Showing the original description.

Generate A/B test variants for affiliate content. Triggers on: "create A/B test", "test my headline", "optimize my CTA", "generate variants", "split test ideas", "improve click-through rate", "test my landing page copy", "headline alternatives", "CTA variations", "which version is better", "optimize conversions", "test my email subject line", "compare approaches".

The English summary is being prepared. Showing the original description.

Score product remarkability 1-10 to decide if it's worth promoting. Seth Godin's Purple Cow test. Triggers on: "is this product worth promoting", "should I promote", "product audit", "purple cow", "remarkable product", "is it remarkable", "rate this product", "product quality check", "worth my reputation", "product evaluation", "would I recommend without commission", "product remarkability score", "evaluate this affiliate product", "quality gate for promotion".

The English summary is being prepared. Showing the original description.

Manage capa CLI configuration — `capabilities.yaml` / `capabilities.json`, skills, MCP servers, tools, hooks, sub-agents, rules, plugins, AGENTS.md / CLAUDE.md, security options, tool exposure modes, `capa wrap` shadow workspaces, `--passthrough` native writes, registries (including Claude marketplaces), activity traces, and the local Web UI. Use whenever the user edits the capabilities file, runs any `capa` command (init, install, add, wrap, clean, sh, start/stop/restart/status, auth, upgrade, cache, registry), wires up an MCP server, adds a skill from GitHub / GitLab / a registry / a remote URL / a local path, configures secrets via `${VarName}` placeholders, installs lifecycle hooks, defines sub-agents, or troubleshoots a failed install. Use even when the user only names a fragment ("add a skill", "wire up brave search", "wrap cursor", "block this phrase in skills") without saying "capa" — if a `capabilities.yaml` or `capabilities.json` lives at the project root, this is almost certainly the right skill. If the project does NOT yet have a capabilities file, point at the `bootstrap` skill instead.

The English summary is being prepared. Showing the original description.

Prevent Terraform/OpenTofu hallucinations by diagnosing and fixing failure modes: identity churn, secret exposure, blast-radius mistakes, CI drift, and compliance gate gaps. Use when generating, reviewing, refactoring, or migrating IaC and when building delivery/testing pipelines.

The English summary is being prepared. Showing the original description.

Run a full technical and on-page SEO audit on any website or page. Use when the user says "audit my site", "SEO check", "technical SEO review", "site health", "check my SEO", "what's wrong with my site", or provides a URL and asks for SEO feedback.

The English summary is being prepared. Showing the original description.

Optimize signup and registration conversion funnels. Use when asked to improve signup rates, reduce form abandonment, audit registration flows, or optimize conversion funnels. Trigger phrases: "signup optimization", "registration flow", "form conversion", "signup CRO", "reduce abandonment", "signup funnel", "form optimization", "conversion rate optimization", "registration page".

The English summary is being prepared. Showing the original description.

Audit EVERY Google Search Console property at once — rank all sites by clicks and impressions with period-over-period deltas, then diff keywords per site to surface what is newly ranking, rising, dropping, lost, or ranking well without earning clicks. Built for agencies and multi-site owners. Use when asked to compare all sites, rank properties by traffic, find new keywords across a portfolio, or spot which site is down. Trigger phrases: "audit GSC", "all my sites", "rank my properties", "portfolio search performance", "which sites are down", "what new keywords are we ranking for", "client site performance", "GSC report across accounts". For ONE site's queries, pages, or index coverage, use the search-console skill instead.

The English summary is being prepared. Showing the original description.

Audit and reorganize a Claude Code / Codex skill library — enforce a naming convention (prefix each skill by which backend or product it touches), rename skills consistently, fix the symlinks and cross-references a rename breaks, and report broken symlinks and stale name references. Use when the user says "organize my skills", "rename these skills", "clean up the skill library", "enforce a skill naming convention", or "fix broken skill symlinks".

The English summary is being prepared. Showing the original description.

Audit and optimize landing pages for conversion rate. Use when the user asks about conversion rate optimization, CRO, landing page audits, improving sign-ups or sales, reducing bounce rate, A/B test ideas for pages, form optimization, or CTA optimization. Trigger phrases include "conversion rate", "CRO", "landing page audit", "why isn't my page converting", "improve conversions", "optimize my page", "reduce bounce rate", "CTA optimization", "form optimization", "above the fold".

The English summary is being prepared. Showing the original description.

Audit a domain's backlink profile using the SemRush API. Use when the user says "audit backlinks", "check my backlinks", "backlink analysis", "link profile", "toxic links", "disavow", "link building opportunities", "referring domains", "anchor text", or asks about a site's link authority.

The English summary is being prepared. Showing the original description.

Design, plan, and analyze A/B tests with statistical rigor. Use when the user asks about A/B testing, split testing, experiment design, statistical significance, sample size calculation, test duration, multivariate testing, or conversion experiments. Trigger phrases include "A/B test", "split test", "experiment", "statistical significance", "sample size", "test duration", "which version wins", "conversion experiment", "hypothesis test", "variant testing".

The English summary is being prepared. Showing the original description.

Fetch Google review ratings and review counts for businesses via DataForSEO API. Use when the user asks to check Google reviews, get review counts, compare business ratings, audit Google Maps presence, or analyze competitor reviews.

The English summary is being prepared. Showing the original description.

Find which ChatGPT search queries mention a given brand. Tests long-tail queries against ChatGPT's web-search-enabled model and reports which ones surface the brand. Use when the user asks to "find queries for [brand]", "check GEO visibility", "which queries mention [brand]", "geo query finder", "find AI mentions", or "test ChatGPT queries for [brand]".

The English summary is being prepared. Showing the original description.

Publish a generated harness to npm — runs the smoke test, signs the witness manifest, and dispatches `npm publish --provenance` from your tagged release.

The English summary is being prepared. Showing the original description.

7-section readiness scorecard for a LOCAL repo. Reports repo type + agent topology + MCP risk + test confidence + release readiness + recommended harness plan + scorecard. Exit 0 ready, 1 needs-work, 2 blocked. --json for the 6-field scorecard, --bundle for the ADR-031 schema-1 envelope.

The English summary is being prepared. Showing the original description.

Emit .harness/oia-manifest.json declaring layer alignment with the OIA v0.1 9-layer reference architecture. Self-describes the harness's MCP wiring, witness signing, audit log, identity posture (always 'none' at v0.1). --check verifies an existing manifest, --dry-run prints without writing, --json emits to stdout.

The English summary is being prepared. Showing the original description.

5-dimension scorecard (0-100, grade A/B/C/F) for a scaffolded harness. Dimensions: Repo understanding (25%), Agent usefulness (25%), MCP safety (20%), Test coverage (15%), Publish readiness (15%). Emits a 6-field badges block (score + mcpRisk + 4 booleans) ready for the harness README. Exit 0 A/B, 1 C, 2 F.

The English summary is being prepared. Showing the original description.

Search VRBO (Vrbo / Expedia Group) vacation rentals including entire homes, condos, and cabins via Patchright browser automation. VRBO sits behind Akamai Bot Manager so plain HTTP and standard Playwright get a 429 bot wall. Use for whole-home or group stays, multi-bedroom rentals, and Airbnb-vs-VRBO comparisons. Trigger phrases include search VRBO, Vrbo rentals, vacation rental, cabin rental, whole house, condo for the group.

The English summary is being prepared. Showing the original description.

Audit and tend to existing travel reservations. Reads a user-provided reservations file, then systematically checks every booking for price drops, better cabin availability, improved routings, schedule changes, nearby airport alternatives, and award repricing opportunities. Invoke proactively on a regular cadence or when the user says "garden", "check my bookings", "audit reservations", "price drop", "better routing", "did my flight change", "tend reservations", "reservation maintenance", or "check my trips".

The English summary is being prepared. Showing the original description.