Testing & Security skills

Writes a single failing test that reproduces a bug after its root-cause analysis is complete, before any fix is written. TRIGGER when: a bug has a completed root-cause analysis and you need the failing reproduction test, writing a test that proves a bug exists, the second step of the bug-fixing pipeline. DO NOT TRIGGER when: still triaging or diagnosing the bug → opsmill-dev-analyzing-bugs; implementing the fix once the test exists → opsmill-dev-fixing-bugs; general feature test-first work → superpowers test-driven-development.

The English summary is being prepared. Showing the original description.

Mines a pull request's review threads for lessons that generalize beyond that PR, reconstructs each against the actual code before deciding, checks whether it is already codified, and routes the genuinely-new, durable ones into Infrahub's internal documentation — `dev/knowledge/`, `dev/guides/`, `dev/guidelines/`, the `AGENTS.md` files, and `.agents/rules/` — proposing edits first and applying only with the user's approval. TRIGGER when: the user wants to turn PR review feedback into durable conventions, guidelines, or rules; capture recurring reviewer comments as internal documentation; or check whether review lessons are reflected in the knowledge/guides/guidelines/AGENTS.md/rules layer. DO NOT TRIGGER when: sweeping a feature's changes for documentation coverage across all layers → use `audit-docs`; extracting knowledge from completed spec directories → `speckit-opsmill-extract`; only replying to or resolving review threads → normal git/gh flow.

The English summary is being prepared. Showing the original description.

Performs root-cause analysis of a bug — from a GitHub issue, an issue URL, or a free-text description — before any reproduction or fix is written. TRIGGER when: triaging or diagnosing a bug, investigating why something misbehaves, an issue number/URL handed over for analysis, needing the root cause before touching code. DO NOT TRIGGER when: a failing reproduction test already exists and you are ready to fix → opsmill-dev-fixing-bugs; writing that reproduction test → opsmill-dev-test-driving-bugs; capturing a new bug as a ticket → opsmill-dev-creating-issues.

The English summary is being prepared. Showing the original description.

Stress-tests a fuzzy or vague feature idea before any PRD, spec, or ticket is written. TRIGGER when: the user has a fuzzy feature idea — one or two paragraphs, vague on users / scope / success — and wants to harden it, or says "grill / stress-test / pressure-test this idea." DO NOT TRIGGER when: the idea is already turned into a spec or PRD; bug fixes or refactors; the idea is hardened and you are ready to write the PRD → creating-prd.

The English summary is being prepared. Showing the original description.

Comprehensive code review using specialized agents — orchestrates code, comments, tests, errors, types, and simplify agents sequentially.

The English summary is being prepared. Showing the original description.

Implements and validates the fix for a bug once a failing reproduction test exists. TRIGGER when: a bug has a failing reproduction test and you are ready to make it pass, implementing the root-cause fix, the final step of the bug-fixing pipeline. DO NOT TRIGGER when: no reproduction test exists yet → opsmill-dev-test-driving-bugs; still diagnosing, or asked to fix a bug with no analysis or reproduction test yet → opsmill-dev-analyzing-bugs.

The English summary is being prepared. Showing the original description.

Audits internal (dev/) and external (docs/) documentation completeness for a feature, subject, or set of existing docs, maps changes indicated by the user, across Infrahub's documentation layers, reports gaps, and optionally applies the fixes. TRIGGER when: the user wants to audit or check documentation coverage, find doc gaps after a feature branch, or verify docs are still current for a subject or specific files. DO NOT TRIGGER when: authoring new documentation from scratch → use the add-docs flow; only linting/formatting Markdown → run `uv run invoke docs.lint`.

The English summary is being prepared. Showing the original description.

Analyzes recent CI failures on pull requests to identify flaky tests, using retry outcomes (failed attempt → green re-run) and cross-PR recurrence as evidence, and maintains a local longitudinal ledger so flakiness can be tracked over time. TRIGGER when: the user wants to find flaky tests, correlate recent CI failures, check which tests fail across PRs or recover on retry, or refresh the flakiness trend report. DO NOT TRIGGER when: babysitting a single PR's CI until green → monitoring-pull-requests; diagnosing or fixing one specific failing test → the bug-analysis skills.

The English summary is being prepared. Showing the original description.

Test coverage quality analysis — behavioral coverage, critical gap identification, test resilience evaluation.

The English summary is being prepared. Showing the original description.

Test-driven development workflow with philosophy guide - plan → write tests → implement → validate

The English summary is being prepared. Showing the original description.

Abonelik fiyatlama stratejileri. 3-tier framework, price anchoring, charm pricing, regional pricing (18 ulke), introductory offers, win-back campaigns, churn prevention ve A/B testing methodology.

The English summary is being prepared. Showing the original description.

Comprehensive verification system covering build, types, lint, tests, security, and diff review before a PR.

The English summary is being prepared. Showing the original description.

Find similar vulnerabilities across a codebase after discovering one instance. Uses pattern matching, AST search, Semgrep/CodeQL queries, and manual tracing to propagate findings. Adapted from Trail of Bits. Use after finding a bug to check if the same pattern exists elsewhere.

The English summary is being prepared. Showing the original description.

Screenshot comparison QA for frontend development. Takes a screenshot of the current implementation, scores it across multiple visual dimensions, and returns a structured PASS/REVISE/FAIL verdict with concrete fixes. Use when implementing UI from a design reference or verifying visual correctness.

The English summary is being prepared. Showing the original description.

Comprehensive testing workflow - unit tests ∥ integration tests → E2E tests

The English summary is being prepared. Showing the original description.

Verification loop for Spring Boot projects: build, static analysis, tests with coverage, security scans, and diff review before release or PR.

The English summary is being prepared. Showing the original description.

Test-driven development for Spring Boot using JUnit 5, Mockito, MockMvc, Testcontainers, and JaCoCo. Use when adding features, fixing bugs, or refactoring.

The English summary is being prepared. Showing the original description.

Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.

The English summary is being prepared. Showing the original description.

SOC2 Type II compliance - Trust Service Criteria, access controls, audit logging, change management, incident response, evidence collection

The English summary is being prepared. Showing the original description.

Test pyramid decision matrix, coverage targets, when to write which test type, mock vs real dependency decisions, and test ROI analysis.

The English summary is being prepared. Showing the original description.

Typosquatting detection, install script analysis, dependency confusion prevention, and phantom dependency detection for npm/pip.

The English summary is being prepared. Showing the original description.

Python testing strategies using pytest, TDD methodology, fixtures, mocking, parametrization, and coverage requirements.

The English summary is being prepared. Showing the original description.

Formal theorem proving with research, testing, and verification phases

The English summary is being prepared. Showing the original description.

Pre-launch verification across infrastructure, security, legal, payment, email, analytics, and performance. Day-1 monitoring, rollback plan, incident response skeleton, and post-launch week-1 checklist.

The English summary is being prepared. Showing the original description.