Testing & Security skills

Scaffold end-to-end testing infrastructure. Use when the user says "e2e scaffold" or "set up e2e testing"

The English summary is being prepared. Showing the original description.

Initialize game test framework for Unity, Unreal, or Godot. Use when the user says "test framework" or "set up testing"

The English summary is being prepared. Showing the original description.

Generate automated game tests for gameplay systems. Use when the user says "automate tests" or "generate tests"

The English summary is being prepared. Showing the original description.

Design game performance testing strategy. Use when the user says "performance test" or "benchmark"

The English summary is being prepared. Showing the original description.

Write SEO pages that rank on Google AND get cited by LLMs. Uses live SERP data, 500-token chunk architecture, RAG optimization for Gemini 3.5 Flash, the Two-Gate AEO framework (retrieval-pool entry + selected-citation extraction), the Anti-NLP Stuffing Protocol (structural entity placement, no keyword-density stuffing), strict single-service local isolation, and the Reddit Test quality gate. Triggers on: "write an SEO page", "seo-agi", "seo page for [keyword]", "rank for [keyword]", "rewrite this page for SEO", "GEO", "AEO", "write a page that ranks".

The English summary is being prepared. Showing the original description.

Analyze vulnerable code to identify underlying root causes such as violated assumptions, incorrect invariants, missing validation checks, or unsafe component interactions. Use when investigating security vulnerabilities, CVEs, exploit code, or security audit findings. Infers why the vulnerability exists beyond surface symptoms, identifies systemic issues, and explains the chain of failures that enable exploitation.

The English summary is being prepared. Showing the original description.

Detects security vulnerabilities by matching code against known vulnerability patterns, insecure coding idioms, and CVE-style patterns. Explains why patterns are risky and under what conditions they are exploitable. Use when analyzing code for security issues, reviewing for common vulnerabilities, or assessing exploitability of suspicious code patterns.

The English summary is being prepared. Showing the original description.

Analyze formal verification artifacts (Isabelle, Coq, Dafny, etc.) and produce structured reports identifying the precise boundary between verified, assumed, and unverified components. Use when assessing verification coverage, understanding trust boundaries, auditing formal proofs, or documenting verification scope. Reports explicitly list verified code, assumptions, axioms, trusted computing base, and unverified components. Conservative and explicit about verification status without attempting to repair or mask gaps.

The English summary is being prepared. Showing the original description.

Automatically generates comprehensive unit tests for functions, classes, and modules. Use when you need to create tests for Python (pytest, unittest) or Java (JUnit, TestNG) code. Generates tests with comprehensive coverage including happy paths, edge cases, and error conditions. Analyzes existing test patterns in the codebase to match style and conventions. Supports mocking, parameterized tests, fixtures, and follows best practices for each framework.

The English summary is being prepared. Showing the original description.

Builds traceability matrices connecting requirements to design documents to source code implementation, tracking the complete development lifecycle. Use when you need to verify implementation completeness, ensure all requirements are implemented in code, generate compliance documentation, audit requirement coverage, identify orphaned code, or create traceability reports for stakeholders. Supports parsing requirements from Markdown, Word, and PDFs; extracting design from architecture docs and API specs; and scanning source code for implementations. Outputs to Markdown tables, Excel/CSV, and HTML visualizations.

The English summary is being prepared. Showing the original description.

Collect, normalize, and structure execution traces from instrumented programs (strace, ltrace) into JSON format for downstream analysis. Use when working with system call traces, library call traces, or execution logs that need to be analyzed for debugging, test case reproduction, or verification. Supports parsing strace/ltrace output, filtering noise, extracting debug information, and preparing traces for bug analysis or reproduction workflows.

The English summary is being prepared. Showing the original description.

Scan repositories for newly disclosed CVEs in dependencies after a specific cutoff date. Takes a repository path, cutoff date (YYYY-MM-DD), and optional parameters for transitive dependencies. Parses dependency manifests (package.json, pom.xml, requirements.txt, go.mod, Cargo.toml) and lockfiles to extract exact versions. Queries vulnerability databases (OSV.dev, NVD, GitHub Advisory) to identify CVEs disclosed strictly after the cutoff date. Distinguishes between newly disclosed CVEs and previously known CVEs. Use when: (1) Performing security audits to find new vulnerabilities since last review, (2) Checking if new CVEs affect a historical codebase version, (3) Generating compliance reports showing vulnerability status at specific dates, (4) Tracking security posture changes over time. Supports npm, Maven, pip, Go modules, Cargo, and other major ecosystems.

The English summary is being prepared. Showing the original description.

Analyzes test suites and suggests optimal test execution order based on code change impact and project requirements. Use when optimizing CI/CD pipelines, deciding which tests to run before committing, or selecting critical tests under time constraints. Prioritizes tests by analyzing recently modified files, test dependencies, and coverage overlap. Outputs detailed rankings with priority scores and reasoning to help teams run the most impactful tests first.

The English summary is being prepared. Showing the original description.

Generates automated test oracles to verify correct software behavior. Creates assertion-based oracles (expected values), property-based oracles (invariants), differential oracles (comparing implementations), and metamorphic oracles (input transformations). Use when you need to generate assertions for test cases, identify invariants that should always hold, compare new vs legacy implementations, create metamorphic test relationships, validate function correctness, or improve test coverage with better verification strategies. Supports Python (pytest, unittest, hypothesis) and Java (JUnit, property testing).

The English summary is being prepared. Showing the original description.

Automatically updates a codebase to a new language version, framework version, or library update while ensuring all tests still pass. Use this skill when migrating Python 2→3, upgrading framework versions (React, Django, Angular), updating dependencies, or performing any version migration where tests define correct behavior. The skill analyzes failing tests caused by migration, categorizes errors (import errors, API changes, type errors, behavior changes), proposes systematic fixes, and verifies that test-observable behavior remains unchanged. Triggers when users ask to migrate code versions, upgrade dependencies while keeping tests passing, update framework versions, or perform test-guided version migrations.

The English summary is being prepared. Showing the original description.

Removes unnecessary code from a repository while preserving exactly the behavior exercised by a given test suite. Use this skill when you need to debloat, slim down, or remove unused code from a codebase based on test coverage. The skill analyzes which code elements (files, classes, functions, methods, branches, imports) are exercised by tests, identifies unreachable or unused code, and safely removes it while ensuring all tests continue to pass. Triggers when users ask to remove unused code, debloat based on tests, eliminate dead code guided by test coverage, or slim down a repository to only test-required functionality.

The English summary is being prepared. Showing the original description.

Analyze failing tests to detect functional bugs in code. Takes repository and failing test output as input, analyzes execution behavior, assertions, and stack traces to identify suspicious code regions and root causes. Use when debugging test failures, investigating regression bugs, or understanding why tests fail. Explains the bug mechanism, identifies affected code, and suggests fixes based on test expectations vs actual behavior.

The English summary is being prepared. Showing the original description.

Generate implementation code that passes existing unit tests. Use when the user provides test files (Python pytest/unittest, Java JUnit/TestNG) and asks Claude to implement the code to make those tests pass. Supports full TDD workflow - analyzing tests, generating implementation, running tests, debugging failures, and iterating until all tests pass.

The English summary is being prepared. Showing the original description.

Analyzes test suites to identify redundant and duplicate test cases using coverage analysis, semantic similarity, and execution results. Use this skill when you need to reduce test suite size, identify redundant tests, optimize test execution time, analyze test coverage overlap, find tests with identical behavior, or improve test suite maintainability. Triggers when users ask to deduplicate tests, find redundant test cases, reduce test suite size, identify duplicate tests, or optimize test coverage.

The English summary is being prepared. Showing the original description.

Automatically reduces bug-triggering test cases to minimal form while preserving the failure. Use when debugging with large, complex test cases that need simplification, reproducing bugs with minimal examples, or creating regression tests from verbose failure scenarios. Takes a failing test and systematically removes unnecessary inputs, steps, assertions, and code using delta debugging and other reduction algorithms. Supports unit tests, integration tests, input files, and multiple programming languages (Python, JavaScript, Java, C/C++).

The English summary is being prepared. Showing the original description.

Generate comprehensive test case documentation from test code, test framework output, existing test docs, and source code context. Use when documenting test suites, creating test specifications, generating test coverage reports, onboarding developers to testing practices, or preparing QA documentation. Analyzes test functions (pytest, unittest) to extract test names, docstrings, assertions, and organization, then produces structured markdown with both overview-level summaries and detailed test case specifications including purpose, preconditions, steps, expected results, and test data. Triggers when users ask to document tests, generate test specifications, create test reports, summarize test coverage, or explain what tests do.

The English summary is being prepared. Showing the original description.

Detect and analyze areas with high maintenance cost, poor design, or accumulated technical debt. Use this skill when reviewing codebases for quality issues, planning refactoring efforts, conducting code audits, assessing project health, identifying maintenance hotspots, or prioritizing technical improvements. Analyzes code smells, architectural issues, dependency problems, test quality, documentation gaps, and provides actionable recommendations with priority rankings.

The English summary is being prepared. Showing the original description.

Instruments code to track the flow of untrusted or sensitive data at runtime, enabling detection of injection vulnerabilities, data leaks, and privilege violations. Use when users need to: (1) Track untrusted input propagation through code, (2) Detect SQL injection, XSS, or command injection vulnerabilities, (3) Identify sensitive data leaks, (4) Monitor privilege escalation paths, (5) Perform dynamic taint analysis for security testing. Supports Python, Java, JavaScript, and C/C++ with configurable taint sources and sinks.

The English summary is being prepared. Showing the original description.

Statically analyze code to detect security vulnerabilities including buffer overflows, injection risks (SQL, command, XSS), insecure deserialization, improper authentication, hard-coded credentials, and unsafe cryptography. Use when: (1) Performing security code review, (2) Analyzing code for OWASP Top 10 vulnerabilities, (3) Identifying CWE-classified weaknesses, (4) Generating security audit reports, (5) Reviewing code before deployment, or (6) Assessing third-party code security. Findings categorized by CWE ID and severity (Critical/High/Medium/Low).

The English summary is being prepared. Showing the original description.