Testing & Security skills

Audits any developer documentation site across 33 checks in 7 categories and produces a scored report (out of 100) with Pass / Warn / Fail status per check. Use this skill whenever a user provides a docs URL and asks to audit it, review it, score it, check its quality, or evaluate it for AI discoverability, SEO, structure, content, or completeness. Also trigger when the user says "run a docs audit", "audit these docs", "check this documentation", "how good are the docs for X", or pastes a docs URL with any evaluative intent. Always use this skill — do not attempt a freeform docs review without following this structured workflow.

The English summary is being prepared. Showing the original description.

Audits any SDK documentation site and produces a fully scored, downloadable HTML report. Use this skill whenever a user provides a documentation URL and asks to audit, review, analyse, score, or check the quality of SDK docs. Also trigger for phrases like "audit the SDK docs at X", "check if the docs at X are complete", "review this SDK documentation", "how good are these docs", "run an SDK audit on X", or any time a user pastes a URL alongside words like audit, review, crawl, check, analyse, quality, completeness, or gaps. ALWAYS use this skill — do not attempt the audit without following this structured crawl → analyse → cross-reference → report workflow.

The English summary is being prepared. Showing the original description.

Design rigorous A/B tests with hypotheses, variants, metrics, and sample size calculations.

The English summary is being prepared. Showing the original description.

Runs a full dead-end page audit for any website. Discovers all blog/content pages, detects which ones have zero outgoing links to any URL on the same domain, fetches keywords, clusters pages by topic, and generates 3 outgoing link suggestions per dead-end page with anchor text, placement guidance, and ready-to-paste context copy. Outputs a styled HTML report matching report-style-reference.html. Automatically detects site framework (Next.js, static, WordPress) and uses the correct detection method: RSC header for Next.js/Vercel sites, standard curl for static and traditional CMS sites. Trigger when a user provides a domain or URL and asks for a dead-end page audit, outgoing internal links audit, "which pages don't link out", "find pages with no internal links in the content", "pages that are link dead-ends", or any variation of finding pages that have zero outgoing links to the same domain. Always use this skill for dead-end page audits — never attempt the workflow without following every step here.

The English summary is being prepared. Showing the original description.

Audits any domain's AI-readiness by using curl to directly probe robots.txt, llms.txt, and llms-full.txt, then scores each file against a structured checklist and delivers a formatted report with pass/warn/fail findings and actionable fixes. Use this skill whenever a user provides a domain or URL and wants to know if llms.txt or llms-full.txt is available, discoverable, or properly structured. Trigger on phrases like "check llms.txt for", "does this site have llms.txt", "find llms.txt", "check llms for this url", "audit llms.txt", "is llms-full.txt available", or any time a user shares a domain/docs URL and wants AI-readiness checked. Also trigger when the user wants to verify GEO/AEO readiness of a documentation site.

The English summary is being prepared. Showing the original description.

Full-site blog health assessment scanning all blog files for quality scores, orphan pages, topic cannibalization, stale content, and AI citation readiness. Spawns parallel subagents for comprehensive analysis. Produces per-post scores and a prioritized action queue. Use when user says "audit blog", "blog audit", "site audit", "blog health", "audit all posts", "check all blogs".

The English summary is being prepared. Showing the original description.

Write or edit tests for a voice agent that can run on the Egma platform.

The English summary is being prepared. Showing the original description.

Integrate Egma into a repository containing voice agent code. Use when the developer asks to integrate voice agent testing, monitoring or both

The English summary is being prepared. Showing the original description.

Grill the user relentlessly about a plan, decision, or idea. Use when the user wants to stress-test their thinking, or uses any 'grill' trigger phrases.

The English summary is being prepared. Showing the original description.

Test-driven development. Use when the user wants to build features or fix bugs test-first, mentions "red-green-refactor", or wants integration tests.

The English summary is being prepared. Showing the original description.

Use when the user wants preview QA, failure interpretation, release readiness, or an explicit publish handoff.

The English summary is being prepared. Showing the original description.

EXPERIMENTAL. Use when working the project-wide out-of-scope backlog at .reviews/code/backlog.md and .reviews/security/backlog.md — cleaning it of entries that are already fixed or gone, or picking the next entry and fixing it end-to-end. Not for producing backlog entries — that is the agentic-review skill — and not for reviewing a branch diff.

The English summary is being prepared. Showing the original description.

EXPERIMENTAL. Use when working the project-wide out-of-scope backlog at paad/code-reviews/backlog.md and paad/security/backlog.md — cleaning it of entries that are already fixed or gone, or picking the next entry and fixing it end-to-end. Not for producing backlog entries — that is /agentic-review — and not for reviewing a branch diff.

The English summary is being prepared. Showing the original description.

Use when auditing a user-facing app — web, mobile (iOS/Android/React Native/Flutter), desktop, CLI, or games — for accessibility barriers or WCAG 2.2 conformance, before shipping UI changes, or in response to concerns about screen-reader, keyboard, low-vision, motor, cognitive, or photosensitive users. Not for general bug hunting or code correctness.

The English summary is being prepared. Showing the original description.

Analyzes a repository and any existing test suite, grades existing tests for weakness, classifies mocks, emits a phased roadmap for building a test suite that catches real regressions, then executes those phases one at a time. Use when planning or building a test suite, assessing whether existing tests are worth anything, adding tests to a legacy codebase, or when the user mentions test coverage, test strategy, or weak tests. Not for reviewing a branch for bugs, and not for fixing the bugs it logs.

The English summary is being prepared. Showing the original description.

Use when reviewing a spec, PRD, requirements doc, or design plan before implementation begins — especially when the doc feels too big, bundles unrelated features, may contradict the current codebase, or seems vague, infeasible, or thin on security and error handling. Not for cross-checking a spec against a plan — that's the alignment skill.

The English summary is being prepared. Showing the original description.

Use when reviewing a spec, PRD, requirements doc, or design plan before implementation begins — especially when the doc feels too big, bundles unrelated features, may contradict the current codebase, or seems vague, infeasible, or thin on security and error handling. Not for cross-checking a spec against a plan — that's /alignment.

The English summary is being prepared. Showing the original description.

Use when creating or updating a Makefile for a project, especially when standard targets (build, test, lint, format, etc.) are missing or when modifying targets that may already be wired into other tooling. Not for debugging why a build fails.

The English summary is being prepared. Showing the original description.

EXPERIMENTAL. Use when code needs a security review against the OWASP Top 10:2025 — access control, misconfiguration, supply chain, cryptography, injection, insecure design, authentication, integrity, logging and alerting, and mishandled exceptional conditions. Not for penetration testing a running system, not for infrastructure-only scanning, and not for fixing what it finds.

The English summary is being prepared. Showing the original description.

Route HugeGraph MCP regression testing tasks to the current public tool surface, including inspection, read-only queries, Gremlin generation, extraction, controlled import, schema validate/dry-run, safety guards, and admin-gated tool checks.

The English summary is being prepared. Showing the original description.

Use when writing tests, improving coverage, or deciding what to test in this CLI

The English summary is being prepared. Showing the original description.

Use when manual work, prior sessions, or an operator interview must be audited for repeatable skill, automation, or bounded-loop candidates.

The English summary is being prepared. Showing the original description.

Use when an Obsidian wiki needs a reproducible health audit for structure, provenance, links, understanding, lifecycle, and promotion readiness.

The English summary is being prepared. Showing the original description.

Use when a startup needs an evidence-weighted health check, investor lens, runway diagnosis, top constraint, or cheapest next validation test.

The English summary is being prepared. Showing the original description.