Testing & Security skills

Generates Angular code and provides architectural guidance. Trigger when creating projects, components, services, or HTTP communication, or for best practices on reactivity (signals, linkedSignal, resource, httpResource), queries and content projection, forms, dependency injection, routing, server and hybrid rendering (SSR, prerendering, hydration), accessibility (ARIA), animations, styling (component styles, Tailwind CSS), testing, naming conventions, or CLI tooling.

The English summary is being prepared. Showing the original description.

Operate HitKeep safely in isolated Git worktrees. Use when inspecting workspace state, resolving ports or URLs, starting or stopping development services, coordinating concurrent agents or QA runs, reusing active runs, reading bounded logs, or preparing a secret-free handoff.

The English summary is being prepared. Showing the original description.

Expert Go programming skill authored by spf13 (former Go team lead, author of Cobra, Viper, Hugo, Afero). Covers idiomatic Go — package design, error handling, interfaces, concurrency, testing, and project layout, current through Go 1.27. Use whenever Go code is written, reviewed, debugged, or refactored — any .go file, go.mod, CLI tool, or web service, and whenever the user mentions Go or golang, even if they don't ask for "idiomatic" code.

The English summary is being prepared. Showing the original description.

Expert skill for building CLI applications with Cobra and Viper, authored by spf13 — the original creator of both libraries. Covers command-first architecture, decoupled business logic, configuration management, environment variable binding, context-aware commands, and in-memory CLI testing. Use whenever a Go CLI or command-line tool is being built, reviewed, or refactored — any mention of commands, subcommands, flags, or CLI configuration, even if Cobra or Viper aren't named yet (recommend them).

The English summary is being prepared. Showing the original description.

Implement and route HitKeep contributions through the repository-owned hk developer platform. Use for any HitKeep code, UI, API, database, analytics-feature, seed, screenshot, documentation, integration, or release-preparation change, as well as setup, local development, builds, smoke tests, and contributor workflow discovery.

The English summary is being prepared. Showing the original description.

Plan, execute, investigate, and report HitKeep quality gates through hk. Use while iterating, before calling contributor work complete, when choosing change-aware versus PR-parity versus exhaustive validation, when CI parity matters, or when investigating a failed or asynchronous gate.

The English summary is being prepared. Showing the original description.

This skill should be used when developing, debugging, refactoring, or building Genesis itself — tasks like "fix this in Genesis", "add a new MCP tool", "wire up the runtime", "Genesis won't start", "create a worktree", "debug the bridge", or "add a capability". Applies to any task modifying files under src/, .claude/, or tests/. Do NOT load for Genesis-as-tool work ("summarize this", "write a LinkedIn post", "research X") or general questions unrelated to Genesis internals.

The English summary is being prepared. Showing the original description.

This skill should be used when a session's job is POST-MERGE VERIFICATION — taking merged PRs and establishing whether the change actually does what it claimed, then recording the result against its `pr_verifications` obligation. "validate the merged PRs", "work the verification backlog", "did that PR actually work", "run the post-merge E2E". It owns the obligation ledger the repo-pulse worker fills. Do NOT load it for building a change and opening its PR (that is `build-session`), or for driving open PRs to merge (that is `closing-session`).

The English summary is being prepared. Showing the original description.

This skill should be used before answering "does Genesis have X", "does Genesis lack X", auditing Genesis capabilities, comparing Genesis to an external system, or reviewing/summarizing the architecture. It routes to the canonical judgment-layer subsystem map so audits start from the map, not from a cold grep. Also fires after changing a subsystem's capabilities, to keep the map current.

The English summary is being prepared. Showing the original description.

Implements behavior changes with a test-first red-green-refactor loop: write one meaningful failing test, watch it fail for the intended reason, make the smallest change, then refactor while green. Use for new behavior, bug fixes, refactors with preserved contracts, and regression tests. Not required for disposable prototypes, generated files, or documentation-only edits.

The English summary is being prepared. Showing the original description.

Threat-models and hardens an application, API, data flow, dependency, or deployment against authentication and authorization flaws, injection, secrets exposure, unsafe deserialization, SSRF, abuse, privacy loss, and supply-chain risk. Use for security review, threat modeling, hardening, or sensitive changes. Not for generic code style review or an unexplained bug without a security hypothesis.

The English summary is being prepared. Showing the original description.

Validates a running application, CLI, API, service, or generated artifact as a user or operator against a prewritten observable behavior contract while remaining source-blind. Use for acceptance checks, runtime proof, anti-fake probes, release smoke tests, or an independent companion to code review. Not for source-quality findings, root-cause diagnosis, or visual design judgment outside the contract.

The English summary is being prepared. Showing the original description.

Reviews an existing codebase for structural friction, unclear ownership, leaky or shallow interfaces, excessive coupling, misplaced state, poor testability, and risky dependency direction, then prioritizes evidence-backed improvement candidates. Use for architecture audits, modularization, modernization, or recurring cross-cutting change pain. Not for designing one new interface, simplifying a local function, or fixing a reproduced bug.

The English summary is being prepared. Showing the original description.

Executes an approved implementation plan through fresh implementer and reviewer agents for each task, with explicit handoffs, focused tests, and task-by-task integration. Use for multi-task work where independent agent context improves implementation and review quality. Not for a single small edit, an unresolved design, or a failure that still needs root-cause analysis.

The English summary is being prepared. Showing the original description.

Plans risk-based test coverage for a feature, service, release, or system by mapping user and business risk to test levels, environments, data, failure paths, automation, exploratory checks, and release gates. Use when choosing what to test or how much evidence is enough. Not for writing one test case, applying TDD to a single behavior, or debugging a failing test.

The English summary is being prepared. Showing the original description.

Coordinates an active production incident by establishing command, reducing blast radius, preserving evidence, communicating verified impact, restoring service, validating recovery, and creating owned follow-up actions. Use for outages, severe degradation, security or data-integrity events, failed releases, and urgent operational triage. Not for a normal local bug, routine alert tuning, or a postmortem after the incident is already closed.

The English summary is being prepared. Showing the original description.

Writes a detailed, executable implementation plan from an approved design or multi-step requirement, including exact files, interfaces, tests, commands, checkpoints, and rollback considerations. Use before touching code for a substantial feature, migration, refactor, or cross-cutting change. Not for a one-file bounded fix or for executing a plan that already exists.

The English summary is being prepared. Showing the original description.

Designs and runs reproducible evaluations for AI agents, prompts, tools, skills, and model-backed workflows using realistic datasets, isolated baselines, objective assertions, rubric grading, trajectory analysis, cost/latency tracking, and regression comparison. Use when measuring agent quality, optimizing skill triggering, comparing prompts or models, or gating an AI feature release. Not for ordinary deterministic unit tests.

The English summary is being prepared. Showing the original description.

Tests a real web user flow with a browser by asserting semantic behavior, network and loading states, keyboard access, responsive layouts, and stable visual evidence. Use for browser bugs, end-to-end UI behavior, responsive or accessibility checks, and screenshot baselines. Not for static source review without a browser or for backend-only tests.

The English summary is being prepared. Showing the original description.

Check color contrast ratios against WCAG AA and AAA accessibility standards. Use when the user wants to verify if their color combinations are accessible, check contrast between text and background colors, or audit a palette for accessibility.

The English summary is being prepared. Showing the original description.

Audit a .glb or .gltf and make it small, correct, and fast to load in a browser, with a measured before/after report. Use when a model is "too big" or "slow to load", when the user asks to "optimize this GLB", "compress this glTF", or "export for web", or when they mention Draco, meshopt, gltfpack, KTX2, Basis, texture VRAM, draw calls, or a Blender / CAD / photogrammetry / Pascal export headed for Three.js, React Three Fiber (drei useGLTF), Babylon.js, or model-viewer. Covers inspection, spec validation, geometry and texture compression, scene-graph cleanup, and the correctness checks (metres, Y-up, node names, animations, PBR fidelity, alpha modes, vertex colors) that must not regress. Not for editing or modelling geometry, authoring or laying out a scene, generating 3D from text or images, converting from FBX/OBJ/CAD, or debugging a runtime frame rate that has nothing to do with asset size.

The English summary is being prepared. Showing the original description.

Repository-local audit instructions.

The English summary is being prepared. Showing the original description.

Use when optimizing, auditing, or preparing to ship web animations or rendering performance work: frame loops, scroll/viewport reveals, mount/unmount transitions, canvas/WebGL lifecycles, reduced motion, lazy rendering, and deferred off-screen work. Use for jank, per-frame allocations, forced reflows, render loops, animations that do not pause off-screen, content-visibility, requestIdleCallback, analyzing Chrome DevTools performance traces for animation or rendering issues, or choosing between browser-driven CSS/WAAPI, minimal JS, phase, and Motion/GSAP. Use when the user explicitly asks about phase APIs or behavior. Do not use during exploratory animation ideation, prototyping, visual iteration, or trying variants, even when the code already imports phase; wait until the user asks for performance guidance, an audit, production implementation, ship-readiness review, or about phase itself.

The English summary is being prepared. Showing the original description.

Implement and route HitKeep contributions through the repository-owned hk developer platform. Use for any HitKeep code, UI, API, database, analytics-feature, seed, screenshot, documentation, integration, or release-preparation change, as well as setup, local development, builds, smoke tests, and contributor workflow discovery.

The English summary is being prepared. Showing the original description.