Testing & Security skills

Reference guide for the Twelve-Factor App methodology — 15 principles (12 original + 3 modern extensions) for building portable, resilient, cloud-native applications. Use when evaluating application architecture, designing cloud-native services, reviewing codebases for methodology compliance, advising on configuration, scaling, observability, security, and deployment patterns. Incorporates the 2025 open-source community evolution and cloud-native reinterpretations of each factor.

The English summary is being prepared. Showing the original description.

Use when the user explicitly asks Rewrite Room to route documentation work, or when audit/sync/freshness, user-facing authoring, citation-driven writing, docs-to-skill conversion, and AI-instruction optimization overlap and exactly one workflow must be chosen.

The English summary is being prepared. Showing the original description.

Use when the primary outcome is comparing documentation claims with implementation evidence, synchronizing docs from verified changes, or freshness review, including drift, missing coverage, stale claims, and post-change updates.

The English summary is being prepared. Showing the original description.

Review pytest test effectiveness against authoritative contracts, relevant faults, behavior-preserving refactors, realistic boundaries, isolation, and diagnostics. Use for test-quality audits, coverage-gap reviews, regression-test changes, or mocking reviews; preserve existing project gates rather than inventing coverage targets.

The English summary is being prepared. Showing the original description.

Investigate pytest failures without treating tests or implementation as automatic authority. Use when diagnosing regressions, debugging test errors, or deciding whether to fix a test or code; trace the contract, product, fixture, and observation before choosing an evidence-backed correction.

The English summary is being prepared. Showing the original description.

Analyze specific pytest failures using authoritative contracts and a cited product/test evidence chain. Use for failing test names or pytest output, distinguishing product, interface, oracle, and harness defects without automatically changing expectations or forcing an architectural redesign.

The English summary is being prepared. Showing the original description.

Routes Python engineering tasks to specialist skills by matching trigger patterns before any architecture, plan, or code is written. Use when working with Typer CLI frameworks, Rich or Textual terminal UIs, CLI UI/UX design, questionary prompts, FastMCP/MCP servers, ty type checker, uv package manager, Hatchling build backend, TOML editing, pre-commit/prek hooks, async Python, PyPI packaging, complex linting, technical debt modernization, testing workflows, feature development, or stdlib-only scripting.

The English summary is being prepared. Showing the original description.

Use when implementing a Python feature, adding CLI commands, writing pytest suites, reviewing Python code, debugging, or refactoring. The primary Python engineering workflow orchestrator — classifies the task and delegates through this plugin's own specialist agents (architect → implement → test → review), sized to the task. Delegates to python-cli-architect (implementation), python-pytest-architect (tests), code-reviewer (review), python-cli-design-spec (architecture). Triggers on any Python task requiring specialist agent coordination or multi-agent execution.

The English summary is being prepared. Showing the original description.

Use when building or debugging Typer/Rich CLI applications. Activates on Rich table rendering, console output in non-TTY environments, CliRunner testing with Rich output, snapshot testing, Typer command wiring, exception chain prevention with AppExit/AppExitRich patterns, table width at 80-column wrapping, Progress/Live in non-interactive contexts, stderr/stdout separation, or force_terminal vs width configuration. Grounds AI-generated CLI code in verified correctness patterns and prevents known Typer/Rich integration mistakes.

The English summary is being prepared. Showing the original description.

Use when the user asks for a read-only, actionable audit of Python code quality, modernization, maintenance burden, ecosystem opportunities, or Pythonic design across a PR, git diff, staged/unstaged changes, files, or directories.

The English summary is being prepared. Showing the original description.

Use when building terminal UI apps with the Textual framework — creating widgets, screens, layouts, handling events, managing reactive attributes, testing with Pilot, snapshot testing with pytest-textual-snapshot, or running background workers. Covers App lifecycle, CSS styling, screen stack, custom messages, actions, bindings, and the Worker API.

The English summary is being prepared. Showing the original description.

Pytest testing patterns for Python — fixtures, behavioral naming, behavior/risk-driven coverage, property-based testing with Hypothesis when useful, and mutation testing when justified. Use when writing tests, designing fixtures, configuring coverage, or applying parametrize, async testing, or property-based strategies.

The English summary is being prepared. Showing the original description.

Guides pytest test architecture for Python 3.11+ using behavioral contracts, risk, and maintenance-adjusted value. Use when choosing unit/integration/property/e2e boundaries, fixture strategy, coverage measurement, or mutation testing. Preserves existing project gates but does not invent test-pyramid ratios, coverage percentages, mutation-score targets, or tests for implementation detail.

The English summary is being prepared. Showing the original description.

Runs deterministic Python quality checks against a path or scope — formatting, linting, type checking, and typing-boundary policy. Use when checking or fixing code quality via prek, ruff, ty, pytest, or the check-typing-boundaries policy script. Reports results grouped by category; fixes only when explicitly requested.

The English summary is being prepared. Showing the original description.

Use when building CLI applications with Typer — creating commands, defining arguments and options with enum restrictions, path validation, date and UUID types, composing subcommands, testing with CliRunner, or using advanced features like colored output, progress bars, shell autocompletion, and version callbacks.

The English summary is being prepared. Showing the original description.

Reviews Python code across type safety, error handling, security, performance, modern patterns, design clarity, typed-boundary compliance, test quality, and documentation. Use when performing code review, PR review, pre-merge quality checks, or assessing Python for security vulnerabilities, bare except clauses, Any usage outside boundaries, or missing input validation at system boundaries.

The English summary is being prepared. Showing the original description.

Hook system fundamentals — all events, configuration structure, matchers per event type, environment variables, execution behavior, security, and debugging. Use when creating hooks, understanding hook events, matchers, configuration locations, environment variables, or troubleshooting hook issues.

The English summary is being prepared. Showing the original description.

Guide for creating Claude Code plugin hooks — language selection heuristic (Node.js default, match project runtime when obvious), hooks.json configuration, event selection, prompt-based vs command hooks, ${CLAUDE_PLUGIN_ROOT} paths, stdio suppression, timeout sizing, and testing. Use when adding hooks to a plugin, creating PreToolUse/PostToolUse/Stop/SubagentStop/SessionStart/UserPromptSubmit hooks, or wiring hook scripts to hooks.json.

The English summary is being prepared. Showing the original description.

Audit skill lifecycle by tracing call chains, detecting circular dependencies, finding instruction contradictions, identifying duplicated datasets, analyzing bidirectional coherence, discovering scriptable sequences, and learning patterns. Use when checking skill coherence, validating skill workflow, finding semantic gaps in plugin structure, or auditing plugin before marketplace submission. Generates audit reports to .plugin-creator/audits/ with findings by dimension.

The English summary is being prepared. Showing the original description.

Runs the description-drift experiment — spawns all Claude Code agents simultaneously to collect self-reported capabilities, then compares them against static frontmatter descriptions to reveal how reliable orchestrator routing based on descriptions actually is. Use when measuring description drift across the agent fleet, re-running the capability collection experiment, analyzing a specific agent's self-reported capabilities, or auditing whether frontmatter descriptions accurately reflect agent behavior.

The English summary is being prepared. Showing the original description.

Audit agent lifecycle — validates agent execution capability against configuration. Accepts plugin path, runs 8 semantic audits (capability vs config alignment, skill loading correctness, inter-agent contracts, prompt contradictions, tool sufficiency, dead agents, scriptable patterns, pattern learning), writes reports to .plugin-creator/audits/. Use when auditing agent lifecycle, checking agent capabilities, verifying tool access, finding dead agents, validating agent contract alignment, or confirming agents can execute workflows.

The English summary is being prepared. Showing the original description.

Per-project plugin configuration via .local.md files — covers the .claude/plugin-name.local.md pattern for storing user-configurable settings with YAML frontmatter and markdown body. Use when implementing plugin settings, reading YAML frontmatter from hooks, creating configuration-driven behavior, managing agent state files, or adding per-project plugin configuration. Covers file structure, parsing techniques, common patterns (temporarily active hooks, agent state management, configuration-driven behavior), security considerations, and best practices.

The English summary is being prepared. Showing the original description.

Use when writing delegation instructions to subagents, authoring CLAUDE.md files, rules, skills, or agent definitions, or auditing existing AI-facing content for bloat. Activates on "write a rule for", "add to CLAUDE.md", "create an agent", "update memory", or any request to author AI-facing instruction content. Removes discoverable data, explained-away knowledge, invented constraints, and stale cached facts.

The English summary is being prepared. Showing the original description.

Optimize existing CLAUDE.md, SKILL.md, agent definitions, and other AI-facing files for Claude comprehension and economy. Scope: optimization of existing content only — not upstream sync, not read-only auditing. Measures baseline metrics, delegates to the ai-doc-optimizer agent with file-type-specific context, runs independent verification via second agent, measures post-optimization metrics, and presents comprehensive before/after report. Supports iterative mode for large targets. Use when improving prompt effectiveness, reducing token waste, or rewriting instructions for LLM consumption. Invoke with /optimize-claude-md <file-or-directory>.

The English summary is being prepared. Showing the original description.