Testing & Security skills

Determine the TRUE cause of a failed retort run before attributing it. Ground-truth every failure (run its tests, read its agent logs, inspect its workspace) and classify it as an infrastructure false-fail, a genuine model miss, or an environment issue — never trust the gate verdict or a log signature alone. Use whenever a run is recorded failed (test_coverage=0 / gate fail), a pass rate looks low, or you're deciding whether a "failure" is real before reporting or proceeding.

The English summary is being prepared. Showing the original description.

Evaluate a single retort experiment run. Score the generated code against the task's TASK.md requirements, run its build and tests, compute metrics, and emit a structured evaluation report plus a machine-readable findings file.

The English summary is being prepared. Showing the original description.

Investigate, reproduce, and safely fix a bug with regression protection. Composes context, diagnosis, architecture, code quality, and testing guardrails into a reproduce-first repair workflow. Use when the user says 'fix this bug', 'debug this', 'investigate this failure', 'patch this regression', 'repair this issue', or 'why is this broken'.

The English summary is being prepared. Showing the original description.

Architectural thinking partner for an existing repository — scans the codebase, conducts a structured interview, agrees on current architectural state and recommended direction, and produces a shareable insights document. Scoped to one repository, module, or folder. Does not execute transformation — it orients. Use when the user says 'assess my codebase architecture', 'what direction should my codebase go', 'architecture compass', 'understand my architecture', 'audit architecture drift', 'architectural assessment', or 'help me understand what is wrong with my codebase'.

The English summary is being prepared. Showing the original description.

Perform a structured code review by composing validation checklists from relevant atoms based on what code changed. Loads atoms conditionally -- clean-code always, architecture/DDD/security/tests only when the delta touches their domain. Produces a severity-ordered report with specific locations and fixes. Use when the user asks to 'review this', 'code review', 'quality check', 'validate the code', 'check my code', 'review the delta', or 'review this PR'.

The English summary is being prepared. Showing the original description.

Apply test quality principles when generating or reviewing test code. Enforces Arrange-Act-Assert structure, one behavior per test, assertion quality, test isolation, meaningful naming, and test data management. Use when writing tests, reviewing test code, or when the user mentions 'write tests', 'test this', 'test quality', 'test review', 'improve tests', or 'test structure'. Loaded automatically by the code-generating molecules (code-forge, refactor-safely, bug-fix). This skill governs the craft of writing individual test cases -- not what to test (that is driven by the code being implemented) but how to write tests that are reliable, readable, and maintainable.

The English summary is being prepared. Showing the original description.

Audit any Lattice SKILL.md for language compliance — removes rationale prose, converts soft language to imperatives, adds STOP: gates on hard rules, and cuts redundant repetition. Complements skill-review (which finds behavioral gaps) by fixing phrasing that causes agents to skip or underweight instructions at runtime. Use after writing or significantly changing any skill, or when the user says 'tighten this skill', 'clean up the language', 'make this more effective', 'reduce the bloat', 'tighten the language', or 'skill tighten'. Standalone — does not call other skills.

The English summary is being prepared. Showing the original description.

Audit and fix all Lattice documentation, README, docs/, PROJECT.md, GitHub issue templates, and CLAUDE.md to ensure they are fully aligned with the current skill inventory. Documentation drift is the most common source of user confusion in Lattice — a skill exists in the codebase but not in the docs, or a renamed skill leaves a stale reference in the bug report template. If you've made any change to skills/ and haven't run this, run it now. Use when the user says 'align docs', 'audit docs', 'update documentation', 'skill align', 'check docs are in sync', 'audit skill inventory', 'ensure docs are aligned', 'are the docs up to date', or 'what needs updating'. Standalone — does not call other skills.

The English summary is being prepared. Showing the original description.

Full enhancement pipeline for an existing Lattice skill — rewrites a molecule or atom to modern-capable-model grade: restores degraded grammar, deduplicates, hardens gates and branching to one-unambiguous-action precision, verifies zero behavioral loss against a pre-capture diff, then runs the combined QA gate (skill-review, skill-tighten, skill-validate) and an independent fresh-context verifier, fixing everything found. Consumer-first: optimized for first-time open-source users on fresh repos with minimal .lattice/ setup, running capable models. Use when the user says 'enhance this skill', 'upgrade this molecule', 'modernize this skill', 'optimize this skill', 'make this skill production grade', 'full enhancement', 'polish this molecule like design-blueprint', or names a molecule/atom to overhaul. For gap-finding only use skill-review; for conventions only use skill-validate — this skill runs the whole loop end to end.

The English summary is being prepared. Showing the original description.

Deep behavioral audit of a Lattice skill — proposes 3 review personas relevant to the skill, runs independent scenario analysis from each persona's perspective, then merges only the high-confidence, practical findings into a severity-ordered gap report with proposed fixes. Structural validation (conventions, cross-references) is skill-validate's job — this skill finds gaps that would realistically surface when someone actually uses the skill: missing scenario handling, ambiguous instructions, silent failure cases, and behavioral inconsistencies. Filters out theoretical edge cases, low-likelihood speculation, and findings owned by other skills. Use after writing or significantly changing any skill, or when the user says 'review this skill', 'deep review', 'does this skill work', 'find gaps in this skill', 'stress test this skill', 'review from different angles', or 'skill review'. Standalone — does not call other skills.

The English summary is being prepared. Showing the original description.

Goal-driven E2E testing where a browser agent (Playwright MCP / computer-use) reads a natural-language goal and explores the app via the accessibility tree to assert outcomes — no pre-written script. Covers when intent-driven beats scripted, making agent runs repeatable and bounded (pinned model, temperature 0, seeded data, bounded steps, explicit success assertion, snapshot-not-pixel), cost/latency control, the accessibility-tree-first interaction model, CI gating, and graduating a stable run into a scripted Playwright test. Use when: "agentic browser test," "goal-driven browser test," "let an agent explore the app," "natural-language E2E," "browser agent smoke test," "Playwright MCP test." Not for: Writing/maintaining deterministic scripted Playwright tests — that is playwright-automation. Testing your product's OWN LLM features — that is ai-system-testing. Related: playwright-automation, ai-system-testing, exploratory-testing, test-reliability, qa-project-context.

The English summary is being prepared. Showing the original description.

Define, track, and act on QA metrics: test coverage percentage, flakiness rate, defect escape rate, MTTR, test execution time trends, automation ROI, quality gates, and SLAs for test suites. Includes metric formulas, realistic targets by company stage, and the action to take when each metric goes red. Use when: "QA metrics," "test metrics," "quality KPIs," "test health," "flakiness rate," "defect escape rate." Not for: building the dashboard UI (Allure/Grafana) — use qa-dashboard; measuring coverage gaps and mutation score — use coverage-analysis. Related: qa-dashboard, coverage-analysis, ci-cd-integration, release-readiness, quality-postmortem.

The English summary is being prepared. Showing the original description.

Route a plain-language QA situation to the next 1-2 skills, then carry out the requested workflow with evidence and a readable report. Use ONLY when the request does not match any other skill's trigger phrases. Use when: "which skill should I use," "where do I start," "validate this app," "run QA and report," "/qa-do," or any vague QA situation that doesn't map to one skill. Not for: bootstrapping a brand-new project with no QA — use qa-start. Not for: capturing project setup/context — use qa-project-context. If the request clearly matches another skill, invoke that skill directly instead of routing through here. Related: qa-start, qa-project-context, test-strategy.

The English summary is being prepared. Showing the original description.

Design analytics-driven browser test matrices and execute cross-browser tests. Covers BrowserStack/Sauce Labs configuration, Playwright browser channels, common cross-browser CSS/JS divergences, a known-issues documentation log, and progressive enhancement validation. Use when: "cross-browser," "browser matrix," "BrowserStack," "Safari issues," "browser compatibility," "Edge," "works in Chrome but not Safari." Not for: pixel-level baseline strategy and threshold tuning — use visual-testing; device-farm testing of native/hybrid apps — use mobile-testing. Related: visual-testing, playwright-automation, ci-cd-integration, mobile-testing.

The English summary is being prepared. Showing the original description.

Build and visualize QA dashboards and reports with Allure Report, Grafana, and ReportPortal. Covers test execution visualization, stakeholder-facing quality reports, trend/flakiness panels, release-readiness gates, alerting, and CI integration for automated report generation. Use when: "test dashboard," "Allure," "test report," "quality dashboard," "Grafana," "ReportPortal," "test results visualization." Not for: defining which KPIs to measure or how to interpret them — use qa-metrics (this skill builds the panels; qa-metrics decides what they should show). Related: qa-metrics, ci-cd-integration, ai-bug-triage.

The English summary is being prepared. Showing the original description.

Validate that analytics and marketing tracking fire CORRECTLY: GA4/GTM dataLayer events, Meta/TikTok/LinkedIn pixels, and ad-tech tags. Covers building a tracking plan as the contract, intercepting collect-endpoint beacons and dataLayer.push in Playwright, asserting event name + params + values + timing + de-duplication, Consent Mode v2 gating, CI regression gating, and news-media events (article-view, scroll-depth, paywall). Use when: "test analytics tracking," "GA4 event test," "verify the pixel fires," "dataLayer test," "tracking plan," "Meta Pixel dedup," "scroll-depth tracking test," "gate tracking in CI." Not for: whether tracking is ALLOWED to fire under consent law (GDPR/CMP) — that is compliance-testing; this skill checks the data is CORRECT. SEO meta tags / structured data — out of scope. Related: compliance-testing, playwright-automation, api-testing, qa-project-context.

The English summary is being prepared. Showing the original description.

Measure and improve test coverage meaningfully. Covers Istanbul/V8/coverage.py configuration, coverage gap analysis by risk, coverage-as-ratchet in CI (never let it decrease), PR coverage diff checks, mutation testing for assertion quality, and distinguishing meaningful from vanity coverage. Use when: "code coverage," "coverage gap," "Istanbul," "coverage threshold," "coverage report," "branch coverage." Not for: writing the tests that raise coverage — use unit-testing; coverage as a tracked KPI trend over time — use qa-metrics. Related: unit-testing, ci-cd-integration, qa-metrics, ai-qa-review.

The English summary is being prepared. Showing the original description.

Write production-grade Playwright tests in TypeScript: Page Object Model, fixtures, auto-waiting, user-facing locators, parallel execution, CI integration, sharding, and installed-version checks. Includes an explicit "do not" list for AI agents. Use when: "Playwright," "write E2E test," "page object," "new Playwright suite," "Playwright config." Not for: fixing one flaky test at runtime — use test-reliability. Not for: bulk regenerating selectors after a UI refactor — use selector-drift-recovery. Not for: visual baseline creation/management — use visual-testing. Not for: deep WCAG/axe audits — use accessibility-testing. Related: visual-testing, ci-cd-integration, api-testing, test-reliability, selector-drift-recovery, accessibility-testing.

The English summary is being prepared. Showing the original description.

Test application performance with k6 load/stress/soak/spike scripts and k6 scenarios, Lighthouse CI for Web Vitals, and performance budgets as CI gates. Covers load profiles, custom metrics, bottleneck identification, and Core Web Vitals (LCP, INP, CLS). Use when: "performance test," "load test," "stress test," "soak test," "spike test," "k6," "k6 scenarios," "Lighthouse," "Web Vitals," "Core Web Vitals," "performance budget." Not for: scheduled production probes — use synthetic-monitoring; pixel-diff regressions — use visual-testing; designing tests from prod telemetry — use observability-driven-testing. Related: ci-cd-integration, qa-metrics, release-readiness.

The English summary is being prepared. Showing the original description.

Analyze escaped defects and test suite health through blameless postmortems. Covers bug pattern analysis, test suite health reviews, 5 Whys root cause analysis, process improvement cycles, and postmortem/retro meeting templates with action item tracking. Use when: "QA retro," "escaped bugs," "postmortem," "quality incident," "defect analysis," "improvement cycle." Not for: live release go/no-go decisions — use release-readiness. Not for ongoing metric dashboards — use qa-metrics. Not for reviewing existing test code quality — use ai-qa-review. Related: qa-metrics, test-reliability, test-strategy.

The English summary is being prepared. Showing the original description.

Test payment and checkout flows end to end against PSP sandboxes — Stripe first, with the general pattern for Adyen/Braintree/PayPal. Covers Stripe test-mode card numbers and their decline codes, the 3DS/SCA challenge flow and its nested-iframe handling in Playwright, test clocks for subscription/billing-cycle simulation, webhook testing (stripe listen/trigger, signature verification, idempotency), failed/retried payments and refunds, and never using real cards. Use when: "test Stripe checkout," "payment test," "3DS test," "test webhook signature," "test subscription renewal," "test clock," "refund test," "decline card test," "checkout E2E." Not for: General API contract testing of non-payment endpoints — api-testing. PCI-DSS/regulatory compliance audit — compliance-testing. Related: api-testing, playwright-automation, compliance-testing, test-data-management, qa-project-context.

The English summary is being prepared. Showing the original description.

Review EXISTING test code for quality, smells, and testability issues. Detects test smells across six dimensions — readability, reliability, diagnostic value, design, AI-generated, and coverage — analyzes testability of application code, and backs the qualitative smells with mutation testing. Use when: "review my tests," "test quality audit," "test smells," "testability analysis," "are these tests any good." Not for: generating new tests — use `ai-test-generation`. Not for: testing AI features in your product — use `ai-system-testing`. Related: unit-testing, shift-left-testing, coverage-analysis, ai-test-generation.

The English summary is being prepared. Showing the original description.

Implement consumer-driven contract testing with Pact-JS (v16). Covers consumer test writing, broker-driven provider verification, Pact Broker setup, can-i-deploy as a deployment gate, webhook-triggered verification, pending pacts, and schema-first vs consumer-first approaches (OpenAPI/Ajv, Schemathesis). Use when: "contract test," "Pact," "consumer-driven," "API contract," "provider verification," "can-i-deploy." Not for: stubbing or mocking a dependency to isolate a test — use service-virtualization; general REST/GraphQL endpoint assertions against your own API — use api-testing. Related: api-testing, service-virtualization, ci-cd-integration, test-environments.

The English summary is being prepared. Showing the original description.

Test native, React Native, hybrid, and Flutter mobile apps with Appium 3.x, Detox, Maestro, and Patrol. Covers device farm setup (BrowserStack, Sauce Labs), gesture simulation, deep link and cold-start testing, push notifications, biometric (Face ID) auth, offline/poor-network simulation, and iOS/Android permission dialog handling. Use when: "mobile test," "Appium," "Detox," "Maestro," "Patrol," "Flutter test," "iOS test," "Android test," "device farm," "deep link," "biometric," "Face ID," "permission dialog," "React Native test." Not for: device/browser matrix strategy in the abstract — use cross-browser-testing; app startup/memory/battery profiling depth — use performance-testing; mobile screenshot diffing — use visual-testing. Related: ci-cd-integration, cross-browser-testing, performance-testing, test-data-management, test-reliability.

The English summary is being prepared. Showing the original description.