Testing & Security skills

独立开发者与微型 SaaS — 单人或极小团队 (≤3 人) 构建可持续订阅收入的软件产品商业, 有别于自由职业/咨询、企业级 SaaS 和开源维护: (a) 产品发现与验证 (自己的痒 vs 市场优先 Nugent/Walling; 着陆页冒烟测试; 先接 Stripe 再写代码; JTBD 访谈适配独立开发者场景; Reddit/HN/X/社区痛点挖掘; Mom Test 验证框架; 公开构建作为验证机制); (b) 独立开发者技术架构 (无聊技术论 McKinley; 单体优先; serverless vs VPS 在 ≤$100/月预算下的取舍; Rails/Django/Laravel/Next.js 等框架的出货速度选型; 托管服务优先于自建; Supabase/PlanetScale/Neon 数据库即服务; Clerk/Auth0 认证即服务; Stripe/Paddle/LemonSqueezy 支付; Vercel/Fly.io/Railway 部署; AI 辅助编码 Cursor/Copilot 作为力量倍增器); (c) 无营销团队的分发与增长 (SEO 作为微型 SaaS 护城河; Product Hunt 发布; AppSumo 终身授权利弊; 冷邮件; Twitter/X 公开构建; IndieHackers 社区分发; 集成市场 Shopify/WordPress/Zapier/Slack 应用目录; 联盟计划; 一人内容营销); (d) 定价与变现 (SaaS 定价心理学; freemium vs 免费试用 vs 纯付费; 按席位 vs 按用量 vs 固定费率; 年付折扣; 老用户保价; 微型 SaaS 流失率控制; MRR/ARR/LTV/CAC 在微型规模的含义; $10K MRR 里程碑心理学); (e) 独立创始人心智模型与生活设计 (default alive vs default dead Graham; 拉面盈利 Levels; 生活方式生意 vs 增长生意的光谱; 独立开发者倦怠预防; 时间管理与上下文切换成本; 地理套利与远程优先; 一次构建反复销售的资产思维; 社区作为支持网络 IndieHackers/WIP/MicroConf); (f) 法务与运营基础 (公司注册地选择 LLC/Ltd/GmbH 税效; Stripe Atlas vs Firstbase vs 本地律师; 服务条款与隐私政策; GDPR/CCPA 低成本合规; 知识产权基础; 首次雇人的承包商 vs 员工选择; 独立开发者会计 SaaS — Xero/QuickBooks; 多辖区税务义务)。中国独立开发者生态: 出海作为主导策略 (从中国构建面向全球市场的产品以避开国内竞争/监管); 即刻/V2EX/少数派作为社区枢纽; 微信小程序作为替代分发; 小报童/爱发电作为中文市场变现; 人民币定价心理学; 支付宝/微信支付集成; ICP 备案要求; 中国区 App Store 审核差异; 独立开发者周刊。诚实处理: 生存偏差 (每一个 Pieter Levels 背后是数千个从未达到 $1K MRR 的人), AI 对微型 SaaS 生态位的颠覆 (wrapper 产品脆弱), 独自构建的孤独与心理健康成本, 公开构建的表演性质 vs 真正透明, AppSumo 终身授权上瘾毁坏单位经济, 样板代码销售的伦理边界。不含: 企业级 SaaS (不同 GTM/销售/融资模型), 不含: 自由职业/咨询 (用时间换钱非建资产), 不含: 开源维护 (不同可持续性模型), 不含: 风投支持的创业 (不同增长期望), 不含: 无代码/低代码平台构建 (相邻但不同受众), 不含: 内容创作作为主业。 (Independent Developer and Micro-SaaS — the craft of single-person or tiny-team (≤3 people) software product businesses that generate sustainable recurring revenue without venture capital, distinct from freelancing/consulting, enterprise SaaS, and open-source maintainership: (a) product discovery and validation (scratching your own itch vs market-first Nugent/Walling; landing page smoke tests; Stripe checkout before code; Jobs-to-Be-Done interview adapted to solo context; Reddit/HN/X/community pain-point mining; idea validation frameworks Fitzpatrick Mom Test; build-in-public as validation mechanism); (b) technical architecture for solo operators (boring technology thesis Mckinley; monolith-first; serverless vs VPS tradeoffs for ≤$100/mo infra; framework selection for shipping speed — Rails/Django/Laravel/Next.js/Remix/SvelteKit; managed services over self-hosted whenever possible; database-as-a-service Supabase/PlanetScale/Neon/Turso; auth-as-a-service Clerk/Auth0/Supabase Auth; payment integration Stripe/Paddle/LemonSqueezy; deployment Vercel/Fly.io/Railway/Render; monorepo vs polyrepo for solo; AI-assisted coding Cursor/Copilot as force multiplier); (c) distribution and growth without a marketing team (SEO as moat for micro-SaaS Ahrefs-style content marketing on 1-person budget; Product Hunt launches; AppSumo lifetime deals tradeoffs; cold email outreach; Twitter/X building in public; IndieHackers community distribution; integration marketplaces Shopify/WordPress/Zapier/Slack app directories as channels; affiliate programs; content marketing at scale-of-one); (d) pricing and monetization (SaaS pricing psychology Patel/Campbell; freemium vs free trial vs paid-only; per-seat vs usage-based vs flat-rate; annual discount strategies; grandfathering existing customers; churn reduction for micro-SaaS — Baremetrics/ProfitWell/ChartMogul analytics; MRR/ARR/LTV/CAC at micro scale; the $10K MRR milestone psychology); (e) solo founder mental model and lifestyle design (default alive vs default dead Graham; ramen profitability Levels; lifestyle business vs growth business spectrum; burnout prevention for solo operators — no team to delegate to; time management and context-switching costs; geographic arbitrage and remote-first; the 'build once sell twice' asset mindset; community as support network IndieHackers/WIP/MicroConf); (f) legal and operational basics (incorporation LLC/Ltd/Gm

The English summary is being prepared. Showing the original description.

DevOps 与站点可靠性工程 (SRE) — 平台 / 基础设施 / 可靠性工程师的认知操作系统, 覆盖软件交付 + 运维全生命周期 (CI/CD 与发布工程 trunk-based + 渐进式发布 canary/blue-green/feature flag + GitOps Argo CD/Flux / 基础设施即代码 Terraform/OpenTofu/Pulumi/Ansible + policy-as-code OPA / 容器与编排 Docker/Kubernetes + Helm/Kustomize + service mesh Istio/Linkerd / 可观测性 Prometheus + Loki + OpenTelemetry + Honeycomb + eBPF + RED/USE / SLO-SLI-error budget 与可靠性工程 Google SRE 学科 + 容量规划 + 优雅降级 / 事件管理与 on-call 事件指挥 + PagerDuty + runbook + 无指责复盘 + MTTR / 云平台与 FinOps AWS/GCP/Azure + 成本优化 + 弹性伸缩 / 平台工程与开发者体验 IDP + Backstage + golden path + Team Topologies / DevSecOps 与供应链安全 shift-left + SBOM + SLSA + sigstore + Vault / 韧性与混沌工程 fault injection + game day + 安全科学 / DORA 指标与工程效能 部署频率 + 变更前置时间 + 变更失败率 + Accelerate 研究 / 数据库与有状态运维 schema 迁移 + 备份容灾) — 不含 通用应用开发 / 纯云销售认证速成 / 'DevOps = 跑 Jenkins 的岗位' 窄化误解 / ITIL 工单文化传统运维 (旧范式仅做边界) / 把手工运维 ClickOps 当稳态 (是 toil, 本 skill 核心反模式) (DevOps & Site Reliability Engineering — the cognitive operating system of platform / infrastructure / reliability practitioners who own the full software delivery + operational lifecycle, covering (a) CI/CD & release engineering (build pipelines, trunk-based development, progressive delivery — canary / blue-green / feature flags, GitOps with Argo CD / Flux), (b) Infrastructure as Code (Terraform / OpenTofu, Pulumi, CloudFormation, Ansible, Crossplane — module design, state management, drift, policy-as-code OPA / Sentinel / Checkov), (c) containers & orchestration (Docker / OCI, Kubernetes — scheduling, networking CNI, storage CSI, operators / CRDs, Helm / Kustomize, service mesh Istio / Linkerd), (d) observability (the three pillars + beyond — metrics Prometheus / VictoriaMetrics, logs Loki / ELK, traces OpenTelemetry / Jaeger / Tempo, high-cardinality observability Honeycomb, eBPF, RED / USE methods, SLO-based alerting), (e) SLO / SLI / error budgets & reliability engineering (Google SRE discipline — service level objectives, error budget policy, toil budgets, capacity planning, load shedding, graceful degradation), (f) incident management & on-call (incident command, PagerDuty / Opsgenie, runbooks, blameless postmortems, MTTR / MTTD, error budget burn), (g) cloud platforms & FinOps (AWS / GCP / Azure well-architected, multi-region, cost optimization, autoscaling), (h) platform engineering & developer experience (internal developer platforms, Backstage, golden paths, self-service, Team Topologies), (i) DevSecOps & supply-chain security (shift-left, SAST / DAST, SBOM, SLSA, sigstore / cosign, secrets management Vault), (j) resilience & chaos engineering (chaos experiments, fault injection, game days, resilience engineering / safety science), (k) DORA metrics & engineering effectiveness (deployment frequency, lead time, change failure rate, MTTR, the Accelerate research), (l) databases & stateful operations (schema migrations, backups / DR, replication); NOT generic software development / app feature coding (是 平行学科, DevOps/SRE 关注 delivery + operability 不是 product feature), NOT pure cloud sales / certification cram without operational depth, NOT 'DevOps = a job title that runs Jenkins' 的窄化误解 (DevOps 是 文化 + 实践, SRE 是 Google 对 reliability 的工程化具体实现), NOT ITIL-heavy 传统运维 工单文化 (是 被 DevOps 取代的旧范式, 仅做边界标注), NOT manual ops / ClickOps as a steady state (是 toil, 本 skill 的核心反模式).) Master OS — automated mastery of DevOps & Site Reliability Engineering — the cognitive operating system of platform / infrastructure / reliability practitioners who own the full software delivery + operational lifecycle, covering (a) CI/CD & release engineering (build pipelines, trunk-based development, progressive delivery — canary / blue-green / feature flags, GitOps with Argo CD / Flux), (b) Infrastructure as Code (Terraform / OpenTofu, Pulumi, CloudFormation, Ansible, Crossplane — module design, state management, drift, policy-as-code OPA / Sentinel / Checkov), (c) containers & orchestration (Docker / OCI, Kubernetes — scheduling, networking CNI, storage CSI, operators / CRDs, He

The English summary is being prepared. Showing the original description.

红队渗透 / 攻防 — 受授权的红队作业者 + 渗透测试工程师 + 攻击型安全顾问的认知操作系统 (侦察 OSINT / 外网渗透 / 内网 AD 渗透 BloodHound + Kerberoasting + ADCS 利用 + 横向移动 / Web 应用渗透 OWASP WSTG / 移动 OWASP MASTG / 云渗透 AWS Azure GCP IAM 路径 + 容器逃逸 + K8s / C2 操作 Cobalt Strike Sliver Mythic Havoc + OPSEC / 初始访问 + AV EDR 绕过 (仅授权场景) / 无线 RF / 物理社工 / 报告与整改 / 框架 MITRE ATT&CK + D3FEND + PTES + OSSTMM + NIST 800-115 + Kill Chain / 法律伦理 CFAA + 网络安全法 + 刑法 285 286 + 数据安全法 + GDPR + 授权书 + 范围 + 交战规则 — 不含 黑产 / 未授权攻击 / 大规模 exploitation / 供应链投毒 / 未授权 DoS — 这是 重罪 + 行业封杀 + 律师吊销, 本 skill 严守 authorized-only 边界 — 也不含 蓝队 SOC + 恶意软件 即服务 / 僵尸网络 / 勒索软件作者 — 这是 cybercrime 不是 红队) (Cybersecurity Red Team / Offensive Security Operations — the cognitive operating system of authorized red team operators, penetration testers, and offensive security consultants covering (a) reconnaissance & OSINT (passive + active discovery, asset surface mapping), (b) external network pentest (perimeter, exposed services, web), (c) internal network / Active Directory pentest (AD enumeration via BloodHound, Kerberos abuse — Kerberoasting / AS-REP-roasting / Unconstrained delegation / S4U2self, NTLM relay, ADCS abuse, GPO abuse, lateral movement, privilege escalation), (d) web application pentest (OWASP WSTG, authentication, authorization, SSRF, XXE, deserialization, SSTI, prototype pollution, GraphQL, JWT, API), (e) mobile pentest (OWASP MASTG, iOS / Android, instrumentation Frida / Objection, MASVS), (f) cloud pentest (AWS / Azure / GCP — IAM enumeration, privilege escalation paths, container escape, K8s RBAC, serverless), (g) C2 operations & post-exploitation (Cobalt Strike / Sliver / Mythic / Havoc, beacon ops, malleable profiles, OPSEC), (h) initial access & evasion (phishing infrastructure, payload development, AV / EDR evasion, BYOVD, AMSI / ETW bypass — strictly for authorized engagements), (i) wireless / RF (WPA2/3, evil twin, Wi-Fi pivots), (j) physical / social engineering (badge cloning, pretexting, vishing — under engagement letter), (k) reporting & remediation (executive summary, technical findings, CVSS, MITRE ATT&CK mapping, retest), (l) frameworks & methodology (MITRE ATT&CK, MITRE D3FEND, PTES, OSSTMM, NIST SP 800-115, OWASP WSTG / MASTG, Cyber Kill Chain, Unified Kill Chain, Diamond Model), (m) law & ethics (CFAA US, Computer Misuse Act UK, 中国 刑法 285/286 + 网络安全法 + 数据安全法, GDPR for tested EU systems, engagement letter, scope, rules of engagement, safe harbor for bug bounty); NOT criminal hacking / 黑产 / unauthorized targeting / mass exploitation / supply-chain compromise / DoS against unconsented systems (这是 重罪 + 业内开除 + 律师执照吊销, 本 skill 严守 authorized-only 边界), NOT pure defensive blue team / SOC analyst tradecraft (是 平行学科, 仅做 边界标注 + ATT&CK 反推方向), NOT malware-as-a-service development / botnet ops / ransomware authoring (是 cybercrime 不是 红队), NOT 'ethical hacking' 在 'just curious 看看' 自我合理化的灰色操作 (违反 authorization 原则即不是 红队).) Master OS — automated mastery of Cybersecurity Red Team / Offensive Security Operations — the cognitive operating system of authorized red team operators, penetration testers, and offensive security consultants covering (a) reconnaissance & OSINT (passive + active discovery, asset surface mapping), (b) external network pentest (perimeter, exposed services, web), (c) internal network / Active Directory pentest (AD enumeration via BloodHound, Kerberos abuse — Kerberoasting / AS-REP-roasting / Unconstrained delegation / S4U2self, NTLM relay, ADCS abuse, GPO abuse, lateral movement, privilege escalation), (d) web application pentest (OWASP WSTG, authentication, authorization, SSRF, XXE, deserialization, SSTI, prototype pollution, GraphQL, JWT, API), (e) mobile pentest (OWASP MASTG, iOS / Android, instrumentation Frida / Objection, MASVS), (f) cloud pentest (AWS / Azure / GCP — IAM enumeration, privilege escalation paths, container escape, K8s RBAC, serverless), (g) C2 operations & post-exploitation (Cobalt Strike / Sliver / Mythic / Havoc, beacon ops, malleable profiles, OPSEC), (h) initial access & evasi

The English summary is being prepared. Showing the original description.

临床诊断思维 (临床诊断思维 / 临床推理 (Clinical Diagnostic Reasoning) — 医生『怎么想病』的元学科:从症状/体征/检查到诊断结论的认知操作系统,从业者(临床医生/住院医/规培生,尤其全科/急诊/大内科等以未分化主诉为生的科室)、医学生与医学教育者、诊断安全与质量改进研究者、以及做医疗 AI 辅助诊断产品的人的视角。覆盖: (a) 第一性张力 — **直觉模式识别 (System 1: illness scripts 疾病脚本 / pattern recognition / gestalt, 『资深人一眼认出 aunt Minnie』) ⇄ 分析性推理 (System 2: hypothetico-deductive 假设演绎 / Bayesian 概率更新)** 的 dual-process 双过程理论 (Kahneman→Croskerry/Norman 谱系), 资深≠更会分析而是『脚本库更大+校准更好』; 更深层论战 — **『认知去偏可教 (Croskerry: bias awareness / cognitive forcing strategies / diagnostic timeout) ⇄ 偏倚标签是马后炮、知识结构才是主因 (Norman/Sherbino/Monteiro: debiasing 干预 transfer 证据弱, bias 是 hindsight 标签)』** — 本行最核心学术对垒; 『概率思维 (验前概率 × 似然比 → 验后概率, Pauker-Kassirer test/treatment threshold 阈值模型) ⇄ 穷尽式排查 (rule-out everything / 防御性医疗 / VOMIT)』; 『临床 gestalt ⇄ 结构化临床决策规则 (Wells/PERC/HEART)』; 『诊断简约 Occam's razor ⇄ Hickam's dictum (病人可以同时得 N 个病)』; 『床旁体格检查复兴 (Verghese Stanford 25 / McGee 循证体检) ⇄ 影像检验替代床旁』; (b) 方法论正典 — illness script theory (Schmidt/Boshuizen: enabling conditions/fault/consequences 三段结构), problem representation + semantic qualifiers 问题表征与语义限定词 (Bowen NEJM 2006, 把病人翻成 one-liner), hypothetico-deductive model (Elstein 1978《Medical Problem Solving》: 早期假设生成+定向检验), Bayesian 工具箱 (sensitivity/specificity/LR/Fagan nomogram/SnNout-SpPin), threshold model (Pauker-Kassirer NEJM 1975/1980), 认知偏倚分类学 (anchoring/premature closure/availability/confirmation/base-rate neglect/search satisficing/diagnostic momentum — Croskerry 偏倚清单), 去偏与元认知策略 (diagnostic timeout/cognitive forcing/Ely checklist/calibration), schema-based reasoning (Clinical Problem Solvers schemas: 按 pivot 症状走分支), reflective practice 结构化反思 (Mamede/Schmidt), 诊断错误科学 (NAM 2015 报告定义 / Newman-Toker Big Three / Hardeep Singh e-triggers / SAFER Dx 框架); (c) 行业结构与角色 — 医学生→实习/住院医 (晨会 morning report/查房被 pimping/汇报训练)→主治 attending→master clinician (NEJM CPC discussant/晨会大师如 Dhaliwal); 配套生态: 医学教育者 (clinical reasoning curriculum + 评估: script concordance test/key features exam/OSCE), 诊断安全研究者 (SIDM/AHRQ), 诊断辅助与 CDS 工具开发者 (DDx generator/AI); (d) 核心工作流 — 数据采集 (病史为王 + 循证体检 + 针对性检验影像) → 问题表征 (one-liner + semantic qualifiers) → 鉴别诊断生成 (schema / 解剖定位法 / VINDICATE-M 病因筛, 按『常见可能 × 致命不能漏 can't-miss』双轴排序) → 假设定向检验 (按 LR 选检查 / 阈值决策) → working diagnosis + 安全网 (red flags 交代 / test of time / test of treatment) → 反馈校准 (follow-up / M&M / diagnostic timeout); 教学工作流: 晨会渐进披露汇报 / CPC / SNAPPS / one-minute preceptor / virtual morning report; AI 增强工作流 (2023-2026: LLM 鉴别诊断头脑风暴 / OpenEvidence 检索 / ambient scribe 释放认知带宽 + 自动化偏倚 guardrails); (e) 产出物 — one-liner, problem list, prioritized DDx, assessment & plan (按问题分层), 晨会/CPC 汇报, M&M 复盘, 诊断不确定性沟通 (『最可能是 X, 但出现 Y 红旗立刻回来』); (f) 教育与评估 — script concordance test / key feature exam / EPA / 里程碑; 中国语境: 人卫《诊断学》教材 / 执业医师考试 / 规培结业临床思维考核; (g) 争议/批判 — debiasing 之争 (Croskerry vs Norman-Sherbino『knowledge is the cure』, 去偏 RCT 效果弱 / bias 标签不可证伪), 诊断错误率数字之争 (『10-15%』经典估计 / Newman-Toker 79.5 万美国年严重伤害外推方法被质疑 / 尸检符合率), dual-process 二分被批过度简化 (连续谱 / 难以实证分离), 决策规则 vs gestalt (资深 gestalt 常不输 Wells 类规则 / 算法厌恶), vignette 研究外推性 + context/case specificity (推理高度内容绑定不可通用迁移 [Norman/Eva] — 对『教推理通用课』产业的根本批判), AI 辅助诊断 2023-2026 (GPT-4 在 NEJM CPC/vignette 追平或超医生 [Kanjee 2023 JAMA / Goh 2024 JAMA Netw Open『AI alone > physician+AI』悖论] / Google AMIE / OpenEvidence 爆发 vs 自动化偏倚 / 去技能化 / 真实环境验证缺失), 防御性医疗与过度检查 (incidentaloma 瀑布 / VOMIT), 体检衰亡之争, pimping 教学法争议; (h) 流派/思想谱系 — 决策科学/Bayesian 派 (Ledley-Lusted 1959 → Elstein/Kassirer/Sox/Pauker/Eddy → Brush) vs 认知心理/双过程派 (Kahneman-Tversky → Croskerry/Graber) vs 教育认知派 (Schmidt/Boshuizen illness scripts → Norman/Eva/Mamede/Durning 情境认知) vs 诊断安全/系统派 (NAM 2015 / Newman-Toker / Hardeep Singh / Graber-SIDM: 错误=系统×认知共因) vs 床旁临床派 (Osler 传统 → Tierney aphorisms / Verghese / McGee / Dhaliwal / Saint: 病史体检为王 + 刻意练习) vs AI/计算派 (INTERNIST-1/DXplain 专家系统 → Isabel → LLM 世代 Rodman/Topol)。不含: 具体专科治疗方案与手术决策深度 (足踝外科/种植牙等另有 skill), 中医辨证 (另有 skill), EBM 文献批判性评价方法学 (相关但本 skill 聚焦诊断推理本身), 护理诊断体系 (NANDA), 影像/病理知觉型读片训练 (相邻但独立), 精神科 DSM 结构化访谈细节, 医患沟通技巧全集 (只覆盖诊断不确定性沟通), 患者自查/自我诊断指

The English summary is being prepared. Showing the original description.

Use when the user wants a Xiaohongshu posting calendar, weekly review board, first-10-post launch plan, 10-20-post positioning test, or data-based next-step plan. Trigger phrases: "排期", "复盘", "30 天计划", "前10条", "10-20条测试", "发了没数据", "weekly review", "content calendar", "XHS schedule". Do not use for first-draft editing or initial account positioning.

The English summary is being prepared. Showing the original description.

Family-G proof & derivation integrity forensics: does a THIRD PARTY's written proof/derivation actually establish its theorem, or does it skip an obligation, assume its own conclusion, take an invalid step, drift a symbol's meaning, or smuggle an unstated assumption? Decides from the WRITTEN proof/derivation — verdict-bearing at L1 (the LaTeX source; PDF-extracted math is unreliable, so an L0 PDF-only run surfaces info only) — never asserts 'fabricated', only that the step shown does not hold. A fresh cross-model reviewer reads the theorem/proof + an extraction-only obligation scaffold and proposes per-obligation findings, each span-anchored to the evidence ledger (claims.json); reviewer≠adjudicator. Emits proof-derivation-forensics.findings.json; NEVER computes the verdict. dimension=proof, can be critical. Triggers: "proof forensics", "check this proof", "derivation integrity", "audit the math", "证明审计", "推导有没有漏洞".

The English summary is being prepared. Showing the original description.

Audit experiment integrity against the evidence ledger. At L2 (repo + result files present) a fresh cross-model reviewer reads the eval code line-by-line for fake/derived ground truth, score self-normalization, phantom results (a paper number with no backing file/key), dead/uncalled metric code, verified-scope inflation, method-described ≠ method-evaluated drift, synthesized-looking results, placeholder/fake data still wired into a released result, code-output ≠ reported-number mismatch, and missing reproducibility artifacts (an empirical/agent/LLM paper shipping neither code nor the prompts/configs its results need) — every finding span-anchored to a ledger claim_id. At L0/L1 (PDF / source only) the same patterns are surfaced as info-level 'could-not-verify' signals where the ledger gives an anchor (observability_level_required:2) — NEVER a fraud verdict from a PDF. The reviewer PROPOSES findings; tools/adjudicate_findings.py computes the verdict. Detect-only. Triggers: "experiment forensics", "audit the results", "check the eval code", "实验诚实度".

The English summary is being prepared. Showing the original description.

Flagship intra-paper self-consistency forensics: does the paper contradict ITSELF across abstract/intro/tables/body/appendix, and does the method DESCRIBED match the method EVALUATED? Needs no external ground truth — works PDF-only (L0). Runs a deterministic arithmetic pass + a fresh cross-model semantic pass, every finding span-anchored to the evidence ledger (claims.json), reviewer≠adjudicator. Emits consistency-audit.findings.json; NEVER computes the verdict. Triggers: "consistency audit", "check the paper against itself", "self-consistency", "内部自洽".

The English summary is being prepared. Showing the original description.

Audit whether a paper's baseline comparisons are COMPLETE, FAIR, and SIGNIFICANT: a required recent SOTA baseline is missing while 'best/SOTA' is claimed (HP-MISSING-BASELINE); a baseline is undertuned / given less compute-tuning-data, run at a mismatched config, or the equal-budget ablation-as-baseline is absent (HP-WEAK-BASELINE); 'outperforms' is asserted over overlapping error bars or with no variance/seeds (HP-SIG-OVERLAP); and a cross-row 'improves over baseline by X%' is arithmetically wrong (HP-DELTA-ERROR, cross-row form only). A versioned per-domain baseline profile + a live leaderboard/recency search are assembled by the EXECUTOR as structured facts; a fresh cross-model reviewer (gpt-5.6-sol xhigh, read-only, fresh thread per dimension) PROPOSES findings, each span-anchored to a ledger claim_id; tools/adjudicate_findings.py DECIDES the verdict. Works at L0 (stated comparisons) and deepens at L2 (configs/result files). A completeness question it cannot settle internally becomes needs_external_check, never a guessed missing baseline. Emits baseline-comparison-audit.findings.json; computes NO verdict. Detect-only. Triggers: "baseline audit", "missing baselines", "is the comparison fair", "weak baseline", "baseline 误报", "SOTA earned?".

The English summary is being prepared. Showing the original description.

Build the deterministic evidence ledger (artifact_manifest.json + claims.json) that every other Anti-Autoresearch auditor reads. One pass inventories artifacts, derives the observability level (L0 PDF-only / L1 +LaTeX / L2 +repo+results) by fixed rule, and extracts span-anchored, hashed, checkable claims (numbers, comparisons, scope, method, baselines, citations, captions, table cells) into claims.json. An OPTIONAL additive cross-model pass ADDS span-anchored semantic claims — method, theorem statements with their assumptions, definitions, proof/derivation steps and equations, scope, baselines, conclusions, the motivation span, and reproducibility-artifact references (the proof, derivation, and structure anchors the family B/D/G auditors need) — it never invents a number, emits a finding, or computes a verdict. Run FIRST, before any audit skill. Triggers: "build the ledger", "extract claims", "prep for integrity audit", "evidence ledger", "建证据账本".

The English summary is being prepared. Showing the original description.

Transparent, itemized impressions of AI-generated WRITING STYLE — the repo's ONLY non-integrity track. Two passes: a deterministic defensive-hedge density screen (tools/check_ai_style.py, AIS-DEFENSIVE-HEDGE) plus a fresh cross-model GROSS-cases-only semantic pass over the 13 AIS-* style tells (broken narrative arc, LLM phrase tics, jargon-stuffing, invented codenames, clause/formula walls, gratuitous pseudocode, bullet overuse, bold-module spam, restatement loops, focus drift, single-style figures, appendix dumping). Every finding is named, LOCATED, span-anchored to the evidence ledger (claims.json), carries not_integrity_finding:true + false_positive_risk:high + an fp_case, and gets ZERO verdict weight: the adjudicator forces it to info, excludes it from overall_verdict, and renders it in a SEPARATE report section. NOT an AI-text classifier — no scores, no "this is AI-written", no authorship probability; a paper can be CLEAN_GIVEN_EVIDENCE and still list many. Emits ai-style-impressions.findings.json; computes NO verdict; if a tell is actually substantive it routes to the integrity auditor. Triggers: "AI style", "vibe check", "writing fingerprint", "AI 文风", "vibe paper".

The English summary is being prepared. Showing the original description.

Synthesize the single strongest EVIDENCE-BOUND reviewer case to reject a paper, built ONLY from the evidence ledger (claims.json) + the other auditors' confirmed findings — never free-floating LLM critique. Two fresh cross-model codex threads: an attack writes the ~200-word rejection paragraph (every accusation tagged to an existing claim_id/finding_id), a defense decomposes it and rules each point against the anchored evidence. MEMO-ONLY: emits adversarial-case-builder.memo.md (fed to the adjudicator via --memo) and carries NO verdict weight — tools/adjudicate_findings.py lists it in ZERO_WEIGHT_SKILLS and caps it at info. Honest-null allowed (the paper may survive). Run LAST. Detect-only. Adapted from ARIS kill-argument. Triggers: "adversarial case", "strongest objection", "rejection memo", "kill argument", "最强拒稿点".

The English summary is being prepared. Showing the original description.

Black-box QA audit of slop-guard across MCP, CLI, fit, docs, agent workflows, and writing-effectiveness. Files GitHub issues for real problems found.

The English summary is being prepared. Showing the original description.

Calibrated grilling session for stress-testing a plan, design, idea, or decision. First assesses the user's topic knowledge, confidence, and desired pressure level, then asks one question at a time with recommended answers. Use when user says "grill me", "stress-test this", "challenge my plan", "interview me", or wants a plan probed without being overwhelmed.

The English summary is being prepared. Showing the original description.

Runs the Implement→Review→Test→Fix cycle until the work is actually clean, with evidence. Use after any non-trivial implementation and before claiming it is done.

The English summary is being prepared. Showing the original description.

Scans staged changes for secrets, debug statements, TODOs without references, and other common commit mistakes. Use before creating any commit.

The English summary is being prepared. Showing the original description.

Refuses "flaky" as a diagnosis. Turns an intermittent failure into a reproduction by isolating it from the environment, naming the variable that controls it, forcing that variable, and measuring before and after with enough runs to count. Separates real defects from environment contention with evidence, and never retries to green or widens a threshold. Use when a test, performance check, or deploy step fails intermittently or passes on rerun.

The English summary is being prepared. Showing the original description.

Strips AI-generation "smell" from prose before it ships (READMEs, docs, release notes, PR descriptions, posts, emails). Counts measurable tells first (keyword saturation, tricolons and anaphora, the "not X, it's Y" reflex, fragment-for-emphasis, bolded thesis lines, listicle-ization, signpost phrases, filler vocabulary, em-dashes, engineered-quotable closers), then applies a "doing work or reflex?" test to each instance so genuine voice survives. Use when asked to de-slop text or make it sound human, when text reads as machine-written, and as the final pass on prose the agent drafted.

The English summary is being prepared. Showing the original description.

Generates a behavioral scenario acceptance matrix for comprehensive test coverage planning. Maps user scenarios to acceptance criteria with stable IDs. Use when planning test coverage for a complex feature, before a release or milestone review, or when someone asks what is tested.

The English summary is being prepared. Showing the original description.

Implements snapshot/golden file tests with temporal normalization so tests don't break daily. Use when implementing tests that compare output against expected snapshots.

The English summary is being prepared. Showing the original description.

Generates fuzz test scaffolding for parsers handling external input (YAML, JSON, config files, user input). Seeds corpus from existing fixtures and runs initial pass. Use when implementing or changing a parser, or any code that ingests user input, webhook payloads, API responses, or file formats.

The English summary is being prepared. Showing the original description.

Keeps specification documents and code in agreement. Audit mode finds every divergence when an implementation is claimed complete; sync mode detects spec drift in staged changes and updates the spec after user approval, so each commit is a reconciled snapshot of spec, tests, and code. Use when an implementation is claimed complete against a spec, before committing changes that may drift from the spec, or after approving decisions that must flow back into it.

The English summary is being prepared. Showing the original description.

Assesses production readiness or audits a codebase against its specs. Supports quick static mode, deep 17-dimension audit, or single-dimension focus. Use before a production launch, after a major refactor, when inheriting a codebase, or when someone asks how done the project is.

The English summary is being prepared. Showing the original description.

Closes a large backlog of findings (a gap analysis, an audit, or 10+ bugs) in prioritized waves. Loops through triage, dependency analysis, parallel fix streams, a test gate, and re-audit until the target is met. Use after a gap analysis, audit, or review produces 10+ findings, or to burn down a large bug or tech-debt backlog.

The English summary is being prepared. Showing the original description.