Testing & Security skills

Resolve merge conflicts non-interactively, validate build and tests, and finalize conflict resolution

The English summary is being prepared. Showing the original description.

Assess or configure MotherDuck access control: roles (RBAC), share grants, table-, row-, and column-level security, masking, tenant isolation, residency, and Terraform governance.

The English summary is being prepared. Showing the original description.

Use when reviewing, debugging, or giving feedback on Go code in this repo (exercises/part2, website/tools, or any *.go file) or when asked for a "code review", "review this Go", "revisa este código Go", or "crítica de código". Reviews for correctness, idiomatic Go, error handling, resource cleanup, concurrency, performance, and security, and always ends with a test-thinking pass (what a test would catch). For exercises/part2, prefer the go-exercise-reviewer skill which knows the module-mode quirk; this skill covers general Go anywhere in the repo.

The English summary is being prepared. Showing the original description.

Use when asked to audit or harden security in this repo — e.g. "security audit", "auditoría de seguridad", "revisa la seguridad", "is this secure", "hardening", "vulnerabilities". Audits code, config, workflows, and secrets exposure. Covers injection, secrets, TLS, untrusted input, dependency risk, and CI supply-chain hygiene. Runs when the user asks about security, not just for code reviews.

The English summary is being prepared. Showing the original description.

Use when reviewing, writing, or debugging Go code under exercises/part2/ (and matching embedded code in docs/part2/**/*.mdx). Thinks hard about correctness, idiomatic Go, error handling, resource cleanup, concurrency, and — crucially — what the tests would catch: edge cases, races, leaks, timeouts, and port conflicts. Knows the repo's module-mode quirk (GO111MODULE=off) and which dirs carry go.mod.

The English summary is being prepared. Showing the original description.

Use whenever the user wants to find, shortlist, vet, or enrich US cybersecurity firms — pen-testing/red team, security audits, vCISO, SOC 2 readiness, incident response, managed SOC, IAM, cloud security, and AppSec. Triggers on "find me a pen-testing firm for our SOC 2 audit", "shortlist three vCISO services for our healthcare-tech startup", "we need an incident response retainer", or "pull contact info for these 8 security firm domains", even when described indirectly (we got breached, prepare us for the compliance audit, get us SOC 2 ready). Drives the ServiceGraph API (api.servicegraph.co) — a 100k+ US firm catalog filterable by industry, services, location, size, ratings. Skip in-house security hires, "how do I patch CVE-X" or "configure firewall Y" DIY questions, security-product reviews (CrowdStrike vs SentinelOne, etc.), generic security knowledge questions, consumer/personal security advice, non-US firms, individual freelancers and bug-bounty hunters.

The English summary is being prepared. Showing the original description.

Use whenever the user wants to find, shortlist, vet, or enrich US accounting and tax firms (CPA firms) — financial-statement audit, SOC 1/2 audit, corporate tax, bookkeeping for businesses, advisory/fractional CFO, M&A diligence, 409A valuations, R&D tax credits, IPO readiness, sales-and-use tax. Triggers on "find me a CPA firm for our delaware c-corp series A audit", "shortlist three audit firms with SaaS experience", "we need a tax advisor for our M&A", or "pull contact info for these 10 accounting firm domains", even when described indirectly (audit our books, fractional CFO support, file our 1120). Drives the ServiceGraph API (api.servicegraph.co) — a 100k+ US firm catalog filterable by industry, services, location, size, ratings. Skip personal/consumer tax preparation (1040, individual estate, retirement planning), in-house controller/CFO hires, "how do I file my taxes" DIY questions, accounting-software comparisons (QuickBooks vs Xero), non-US firms, individual freelance bookkeepers.

The English summary is being prepared. Showing the original description.

Prepare to contribute to an open source repo. Reads all contribution docs, checks eligibility, assesses the user's knowledge gaps, and fills them before coding starts. Use after finding an issue with oss-find-issue, or when starting work on any OSS repo. Not for installing dependencies or getting the build and tests running. Use oss-setup-dev-env for that.

The English summary is being prepared. Showing the original description.

Find actual code issues in a repo that aren't listed in GitHub issues. missing tests, inconsistent patterns, outdated dependencies, documentation gaps. Presents findings to the user for evaluation. Use when you want to make proactive contributions beyond existing issues, or when no good issues are available. Not for browsing the existing issue tracker. Use oss-find-issue for that.

The English summary is being prepared. Showing the original description.

Write tests for untested OSS code as a standalone contribution. Identifies coverage gaps, studies the repo's test conventions, and guides the user through writing tests that match existing patterns. Use when contributing tests to an open source repo, looking for a low-risk first contribution, or improving test coverage. Not for writing tests alongside a bug fix — use oss-contribute for that.

The English summary is being prepared. Showing the original description.

Submit a pull request following the repo's contribution guidelines. Reviews the diff, checks for common rejection reasons, and helps the user write their own PR description. The LLM reviews. the user writes. Use when implementation is complete and tests pass. Not for responding to review comments after the PR is open. Use oss-post-pr for that.

The English summary is being prepared. Showing the original description.

Set up a complete development environment for an unfamiliar OSS repo. Handles dependency installation, building, running tests, and configuring dev tooling. Use when cloning a new OSS repo and setting up for development, when the repo's setup instructions don't work, or when you need to debug environment issues. Not for setting up your own project — this is for getting someone else's repo running.

The English summary is being prepared. Showing the original description.

Research an issue deeply and present all context to the user. but the user writes the code. The LLM investigates code paths, finds relevant files, explains patterns, and identifies constraints. The user thinks through the approach and implements it. Use when ready to start working on an issue after oss-prep-to-contribute. Not for writing tests or documentation as a standalone contribution. Use oss-write-tests or oss-write-docs for those.

The English summary is being prepared. Showing the original description.

Maintain the opt-in encrypted Documents API, immutable account ownership, SQLite ciphertext storage, chunk transactions, recipient key envelopes, configuration parser, and TLS/browser cryptographic tests. The separately maintained React application has its own integration skill.

The English summary is being prepared. Showing the original description.

Maintain required external authorization decisions, gatekeeper and validator hooks, the HTTP JSON plugin, reusable parsers, and protected-request E2E coverage. Excludes credential authentication and claims enrichment.

The English summary is being prepared. Showing the original description.

Maintain authorization ACL rules, typed custom claim fields, their reusable parser, policy integration, and signed-token or authenticated-user E2E coverage.

The English summary is being prepared. Showing the original description.

Maintain the pure-Go SQLite single-use ticket identity provider, public parser, trusted issuance API, HTTP login capability, cookie and realm binding, portal signing, and TLS consumer tests. Excludes OAuth/SAML protocols and anonymous ticket issuance services.

The English summary is being prepared. Showing the original description.

Scope AuthCrunch validation to changed behavior and affected consumers, require corresponding Go and E2E coverage, remediate diagnostics, and maintain pinned tested reports and CI gates.

The English summary is being prepared. Showing the original description.

Maintain the pure-Go SQLite notification outbox, public parser, runtime messaging-provider injection, worker leases, bounded SMTP delivery, and registration notification E2E tests. Excludes registration enrollment state.

The English summary is being prepared. Showing the original description.

Maintain the pure-Go SQLite password identity store, reusable parser, immutable account evidence, idempotent enrollment, portal injection, and login E2E tests. Excludes local JSON database internals and MFA/profile feature implementation.

The English summary is being prepared. Showing the original description.

Create or revise repo-local skills connected by actionable routing statements from AGENTS.md through broad and increasingly specialized skills. Use when documenting AuthCrunch engineering knowledge, adding or routing a skill, reorganizing the skill hierarchy, or auditing that every skill is reachable and useful to contributors.

The English summary is being prepared. Showing the original description.

Maintain upstream SAML identity-provider authentication, request/response browser binding, ACS and assertion validation, pinned signing certificates, and signed TLS/browser tests.

The English summary is being prepared. Showing the original description.

Maintain upstream OAuth identity-provider directive parsers, shared configuration dispatch, injectable OAuth login storage, OAuth/OIDC discovery, GitHub identity claims, JWKS and static public PEM verification, EdDSA/Ed25519 token validation, key refresh, and real portal OAuth E2E tests. Excludes portal signing-key publication and gatekeeper-owned direct OAuth sessions.

The English summary is being prepared. Showing the original description.

Maintain AuthCrunch authentication event attribution, logging skip rules, the reusable directive parser, immutable Zap filters, root logger wiring, and TLS log-output tests. Excludes host-specific access-log configuration and changes to authentication decisions.

The English summary is being prepared. Showing the original description.