Testing & Security skills

Use when reviewing Node.js or TypeScript server code - Express/Fastify/Nest handlers, Next.js server actions and route handlers, child_process, ORM raw queries, prototype pollution, template engines, JWT and outbound HTTP clients

The English summary is being prepared. Showing the original description.

Use when semgrep, osv-scanner, github-security or snyk MCP tools appear in your tool list - what each server is for, how to call it safely, what data leaves the machine, and how its findings are triaged

The English summary is being prepared. Showing the original description.

Use when you have a candidate security finding and before it goes in a comment - restate it as a crossed boundary, prove reachability, impact and a concrete exploit, apply triage dismissals, route out-of-repository facts to needs-validation, keep the effect no stronger than the trace, then the self-refute and verifier passes

The English summary is being prepared. Showing the original description.

Use when reviewing game code in C#, GDScript or C++ (Unity, Godot, Unreal, custom engines) - client vs server authority, RPC and packet validation, in-app purchases and economy, save and replay files, mod and script loading, secrets in client builds

The English summary is being prepared. Showing the original description.

Use when the diff changes a GitHub Actions workflow, a reusable action, a CI cache or artifact handoff, a Dockerfile or compose file, Terraform/HCL, Kubernetes manifests or Helm values, an environment overlay, a workload identity binding or a cloud OIDC trust policy - judged only where concretely exploitable

The English summary is being prepared. Showing the original description.

Use when a Godot project uses or considers C# (.NET) or native code - when C# is the right call and its export limits (no web export), C# node patterns with generated SignalName/StringName caching, plain C# rule libraries tested with dotnet test, and GDExtension (godot-cpp, godot-rust) pinning and build hygiene.

The English summary is being prepared. Showing the original description.

Use when working on any browser game (Phaser, PixiJS, three.js, Babylon.js, PlayCanvas, Excalibur, KAPLAY) - requestAnimationFrame with clamped delta and visibility pause, zero-allocation frame loops, measuring in DevTools, bundle and asset size budgets, Vitest with seeded RNG and injected time, and a seeded Playwright smoke test with console capture.

The English summary is being prepared. Showing the original description.

Use when building a 3D web game with three.js, Babylon.js or PlayCanvas - render loop and delta per library, fixed-step physics with Rapier or Havok, explicit dispose of GPU resources, instancing and draw-call budgets, glTF with Draco/meshopt/KTX2, pixel ratio and resize, WebGPU opt-in, React Three Fiber notes, and headless testing.

The English summary is being prepared. Showing the original description.

Use when writing or running Unreal Engine tests - which test type fits (simple/complex automation tests, Automation Specs, functional tests, CQTest, Low-Level Tests, Gauntlet), naming and filters, latent tests, and the headless UnrealEditor-Cmd run with report export, exit handling and screenshot captures.

The English summary is being prepared. Showing the original description.

Use when the repository is Defold, MonoGame, pygame/pygame-ce, Excalibur or KAPLAY (or melonJS, Stride, Python arcade, macroquad/ggez) - each engine's lifecycle and delta, where logic goes, the test runner, the headless build/run command, and how to capture a frame.

The English summary is being prepared. Showing the original description.

Use when writing or running Godot tests - gdUnit4 or GUT (whichever the repo has), unit tests on typed GDScript classes, scene runners for frames, physics, input and signals, headless CLI with --import first, reports and exit codes, and C# tests via gdUnit4Net or plain dotnet test.

The English summary is being prepared. Showing the original description.

Use when writing Bevy (Rust ECS) game code - pin and respect the repo's minor version, plugins/systems/queries/resources, schedules with FixedUpdate and Time, states and run conditions, messages vs observers across versions, required components, testing systems with App::update and a manual time strategy, compile-time and allocation hygiene.

The English summary is being prepared. Showing the original description.

Use when touching Unity per-frame code, spawning, physics queries, UI updates or rendering setup - profiling with numbers, zero-GC hot paths (caching, NonAlloc queries, no LINQ/closures/boxing, TMP SetText), ObjectPool, allocation tests, Burst/Jobs for bulk math, and rendering/physics settings that cost frames.

The English summary is being prepared. Showing the original description.

Use when writing or running Unity tests - Unity Test Framework EditMode vs PlayMode, test assembly definitions, testing plain C# and ScriptableObjects, PlayMode scene/physics/input tests, batchmode CLI with result XML, coverage, and the dotnet test fallback when no editor is installed.

The English summary is being prepared. Showing the original description.

Use when working in a Unity project that uses Entities (DOTS) or when a task needs thousands of simulated objects - when ECS is worth it, components/bakers/ISystem with IJobEntity and Burst, entity command buffers for structural changes, native memory rules, and testing systems in a test World.

The English summary is being prepared. Showing the original description.

Use when a change trains a model, reports a metric, or touches seeds, data or model versions, the lockfile, MLflow or DVC — what every run must log, seeding, environment pinning, data versioning and keeping tests off the shared tracking server

The English summary is being prepared. Showing the original description.

Use when writing tests for data or ML code — what to test at each layer (transforms, schemas, properties, pipeline smoke, model-quality thresholds, determinism and parity), how to build small synthetic fixtures, and what not to test

The English summary is being prepared. Showing the original description.

Use when you are about to hand off any number, table, chart or analysis someone will act on (a metric query, a dbt mart, a report, an experiment readout) — the pre-delivery checklist for data quality, calculation, reasonableness and presentation, and the pitfalls that produce plausible wrong numbers

The English summary is being prepared. Showing the original description.

Use when building or changing features, preprocessing, encoders, resampling or train/validation/test splits — keep every fitted transform inside a Pipeline fitted on training folds only, and build time and group features without seeing the future or the same entity twice

The English summary is being prepared. Showing the original description.

Use when you write the `plan` section of an analiz report - steps that pin files, signatures, tests and verify commands, nothing more

The English summary is being prepared. Showing the original description.

Use in code_review when the diff touches input handling, auth, queries, files, outbound requests, secrets, dependencies or LLM calls, and in analysis for any new endpoint or data flow

The English summary is being prepared. Showing the original description.

Use when a criterion mentions speed or limits, or the change touches a list, query, endpoint or page that could get slower - timing loops, the N-vs-10N data check and Lighthouse on a production build

The English summary is being prepared. Showing the original description.

Use before booting anything - choosing local (start_task_preview or a workspace boot), the task's preview or stage, confirming the build is the PR head, and what to do when nothing can run

The English summary is being prepared. Showing the original description.

Use when moving tasks or reporting status - the kanban column semantics, which columns are human/architect/QA gates, and where the PM actually acts

The English summary is being prepared. Showing the original description.