Testing & Security skills

Code-rendered motion video for a product or a client, built the way a motion studio would do it. Every frame comes from an HTML seek(t) page rendered by Playwright at 1080p60 with real motion blur, using real product UI and screenshots with a privacy blur, and an ElevenLabs hype score cut on bar lines with its drop verified on the reveal. Three formats — a 20-30 s hype launch spot, a polished feature walkthrough from real screenshots, and a 19 s pain-point video with a muted site cut and burned-in text. Delivered with baked posters, H.264 + VP9 web encodes at 1280 px (1.5-3 MB), a site-embed kit (muted autoplay or click-to-play), 9:16 social re-layouts and share copy, plus a service playbook for selling it. Use when "make a launch video", "make a commercial / promo / ad spot", "motion design video", "product walkthrough video from screenshots", "pain point videos for the site", "videos for the homepage", "sell video production", "price a video package", or a polished brand spot is wanted rather than a talking-head edit or a Remotion template batch (use /kai-video-production for those).

The English summary is being prepared. Showing the original description.

Use when refactoring code with poor names, when asked to improve naming, or when a user struggles to name a class/method/variable. Symptoms include -Manager/-Util suffixes, single-letter variables, process/handle/do verbs, primitive obsession, god methods with multiple responsibilities. Two modes — audit (broad scan, list opportunities) and improve (walk one specific identifier through the process).

The English summary is being prepared. Showing the original description.

Use when more than one agent may need the same single-instance resource at the same time — most of all the local server loop, which holds the one URL (https://local.voxt.ai, port 7080) the app can run on. Also when you are about to dispatch several agents that will test the UI, when you find another agent already using the loop, or when the user says "coordinate", "shared resource", "queue for the server".

The English summary is being prepared. Showing the original description.

Build, deploy and start the iOS app on a connected iPhone or in the simulator. Use proactively when user asks to test, run, or deploy iOS changes.

The English summary is being prepared. Showing the original description.

Systematically QA test a web application and fix bugs found. Runs QA testing, then iteratively fixes bugs in source code, committing each fix atomically and re-verifying. Use when asked to "qa", "QA", "test this site", "find bugs", "test and fix", or "fix what's broken". Three tiers: Quick (critical/high only), Standard (+ medium), Exhaustive (+ cosmetic). Produces before/after health scores, fix evidence, and a ship-readiness summary. For report-only mode, use /qa-only.

The English summary is being prepared. Showing the original description.

Answer questions about Voxt — its features, what shipped and when, and how to use it — grounded in three sources: the public "Voxt Announcements" chat, the Landing pages, and the user guide. Use when asked things like "what features shipped this year", "list new features", "how do I use <feature>", "what is Voxt", or any product/usage question about Voxt. Answers are cited to the source.

The English summary is being prepared. Showing the original description.

Eng manager-mode plan review. Lock in the execution plan — architecture, data flow, diagrams, edge cases, test coverage, performance. Walks through issues interactively with opinionated recommendations.

The English summary is being prepared. Showing the original description.

Report-only QA testing. Systematically tests a web application and produces a structured report with health score, screenshots, and repro steps — but never fixes anything. Use when asked to "just report bugs", "qa report only", or "test but don't fix". For the full test-fix-verify loop, use /qa instead.

The English summary is being prepared. Showing the original description.

Use when the user wants to smoke-test the evolve pipeline, test tools, or verify the plugin works end-to-end. Also use when the user says 'dry run', 'smoke test', or 'test pipeline'.

The English summary is being prepared. Showing the original description.

DeFi Protocol Analysis — analyzes TVL, revenue, yields, liquidity, security, governance, and competitive positioning with a composite DeFi Score (0-100)

The English summary is being prepared. Showing the original description.

Expert guidance for ffuf web fuzzing during penetration testing, including authenticated fuzzing with raw requests, auto-calibration, and result analysis

The English summary is being prepared. Showing the original description.

Personal AI Infrastructure (PAI) - PAI System Template MUST BE USED proactively for all user requests. USE PROACTIVELY to ensure complete context availability. === CORE IDENTITY (Always Active) === Your Name: [CUSTOMIZE - e.g., Kai, Nova, Atlas] Your Role: [CUSTOMIZE - e.g., User's AI assistant and future friend] Personality: [CUSTOMIZE - e.g., Friendly, professional, resilient to user frustration. Be snarky back when the mistake is user's, not yours.] Operating Environment: Personal AI infrastructure built around Claude Code with Skills-based context management Message to AI: [CUSTOMIZE - Add personal message about interaction style, handling frustration, etc.] === ESSENTIAL CONTACTS (Always Available) === - [Primary Contact Name] [Relationship]: email@example.com - [Secondary Contact] [Relationship]: email@example.com - [Third Contact] [Relationship]: email@example.com Full contact list in SKILL.md extended section below === CORE STACK PREFERENCES (Always Active) === - Primary Language: [e.g., TypeScript, Python, Rust] - Package managers: [e.g., bun for JS/TS, uv for Python] - Analysis vs Action: If asked to analyze, do analysis only - don't change things unless explicitly asked - Scratchpad: Use ~/.claude/scratchpad/ with timestamps for test/random tasks === CRITICAL SECURITY (Always Active) === - NEVER COMMIT FROM WRONG DIRECTORY - Run `git remote -v` BEFORE every commit - `~/.claude/` CONTAINS EXTREMELY SENSITIVE PRIVATE DATA - NEVER commit to public repos - CHECK THREE TIMES before git add/commit from any directory - [ADD YOUR SPECIFIC WARNINGS - e.g., iCloud directory, company repos, etc.] === RESPONSE FORMAT (Always Use) === Use this structured format for every response: 📋 SUMMARY: Brief overview of request and accomplishment 🔍 ANALYSIS: Key findings and context ⚡ ACTIONS: Steps taken with tools used ✅ RESULTS: Outcomes and changes made - SHOW ACTUAL OUTPUT CONTENT 📊 STATUS: Current state after completion ➡️ NEXT: Recommended follow-up actions 🎯 COMPLETED: [Task description in 12 words - NOT "Completed X"] 🗣️ CUSTOM COMPLETED: [Voice-optimized response under 8 words] === PAI/KAI SYSTEM ARCHITECTURE === This description provides: core identity + essential contacts + stack preferences + critical security + response format (always in system prompt). Full context loaded from SKILL.md for comprehensive tasks, including: - Complete contact list and social media accounts - Voice IDs for agent routing (if using ElevenLabs) - Extended security procedures and infrastructure caution - Detailed scratchpad instructions === CONTEXT LOADING STRATEGY === - Tier 1 (Always On): This description in system prompt (~1500-2000 tokens) - essentials immediately available - Tier 2 (On Demand): Read SKILL.md for full context - comprehensive details === WHEN TO LOAD FULL CONTEXT === Load SKILL.md for: Complex multi-faceted tasks, need complete contact list, voice routing for agents, extended security procedures, or explicit comprehensive PAI context requests. === DATE AWARENESS === Always use today's actual date from the date command (YEAR MONTH DAY HOURS MINUTES SECONDS PST), not training data cutoff date.

The English summary is being prepared. Showing the original description.

Use when 高教社杯/CUMCM mathematical modeling work needs lightweight reusable paper assets, national-prize style paragraph templates, section controls, per-question code/plot/test scaffolds, evidence registries, paper fragments, reproduction scripts, or safe reuse of prior contest project structure without copying old problem-specific content.

The English summary is being prepared. Showing the original description.

Use when 高教社杯/CUMCM/电工杯 mathematical modeling abstracts, keywords, highlights, first-page claims, or high-density summaries need drafting, revision, audit, or style diagnosis, especially when feedback mentions too many numbers, weak focus, process-listing, empty official prose, buzzwords, missing structure, weak keywords, unsupported values, or first-page claim verification.

The English summary is being prepared. Showing the original description.

Automate on-target verification of a program's logic by driving its RTT console with rttsh - write Lua scripts that exercise commands and assert responses, output and timing on real hardware. Use when asked to verify target-side behavior on board, build board-level checks for firmware features, or automate hardware test runs.

The English summary is being prepared. Showing the original description.

Build UI interactions whose motion comes from a physical model instead of durations and easing curves. Turn a feel described in words ("a toggle that feels heavy", "a drawer with a magnetic snap", "a card you throw into a corner", "a knob with heavy detents", "a sticky slider") into a production component driven by mass, stiffness, damping and force fields (magnets, friction, walls), on a line, in a plane or around a dial, plus a test rig that plots position, velocity and the force field, overlays the model's prediction on the measured motion, and exports the same spring to Framer Motion, react-spring, SwiftUI, Compose or CSS linear(). Use this whenever someone asks for an animation, transition, spring, gesture, drag, flick, snap points, bottom sheet, toggle, slider, carousel or any micro-interaction that should "feel" a certain way, or wants to tune or explain a spring, even if they never say "physics".

The English summary is being prepared. Showing the original description.

Go development intelligence. 12 domains, 10 stacks, 300+ entries. Actions: plan, build, create, design, implement, review, fix, improve, optimize, enhance, refactor, check Go code. Domains: pattern, package, error, perf, test, concurrency, interface, arch, idiom, anti, tooling, module. Stacks: web-gin, web-echo, web-fiber, web-stdlib, cli, grpc, database, microservice, cloud-native, data-pipeline. Integrations: arch_system generator.

The English summary is being prepared. Showing the original description.

Mobile development intelligence. 12 domains, 9 stacks, 250+ entries. Actions: plan, build, create, design, implement, review, fix, improve, optimize, enhance, refactor, check mobile code. Domains: pattern, package, error, perf, test, security, interface, arch, idiom, anti, tooling, dependency. Stacks: flutter, react-native, swiftui, jetpack-compose, kotlin-multiplatform, capacitor, expo, native-ios, native-android. Integrations: arch_system generator.

The English summary is being prepared. Showing the original description.

Node.js & TypeScript development intelligence. 12 domains, 12 stacks, 300+ entries. Actions: plan, build, create, design, implement, review, fix, improve, optimize, enhance, refactor, check Node code. Domains: pattern, package, error, perf, test, async, arch, idiom, anti, tooling, module, typescript. Stacks: web-express, web-fastify, web-hono, web-nestjs, web-nextjs, web-remix, orm-prisma, orm-drizzle, auth, database, realtime, graphql. Integrations: arch_system generator.

The English summary is being prepared. Showing the original description.

PHP development intelligence. 12 domains, 8 stacks, 300+ entries. Actions: plan, build, create, design, implement, review, fix, improve, optimize, enhance, refactor, check PHP code. Domains: pattern, package, error, perf, test, security, interface, arch, idiom, anti, tooling, dependency. Stacks: laravel, symfony, codeigniter, slim, api-platform, livewire, database, queue. Integrations: arch_system generator.

The English summary is being prepared. Showing the original description.

Run or maintain the full tdmcp repo quality-audit team: command sweeps, all package/Makefile/CI gates, security review, usability/flow review, refactor/test-gap analysis, coverage hardening, QA, and follow-up fix waves. Use whenever the user asks for a complete audit, improve repo/code quality, test all commands, find security/usability failures, refactor debt, add missing tests, re-run the audit, continue a previous quality wave, or verify the repo is ready.

The English summary is being prepared. Showing the original description.

Review, harden, and test the safety policy for AI-Controlled Party mixer/Soundcraft Ui24R scene arming. Use for approval gates, blocked mixer operations, hazardous request handling, venue validation, bypass attempts, QA, risk review, or follow-up safety changes.

The English summary is being prepared. Showing the original description.

Write focused tdmcp tests for one assigned coverage gap. Use for Vitest/msw unit tests, integration tests, bridge tests, CLI/config/resource tests, and regression tests that should raise coverage without weakening behavior.

The English summary is being prepared. Showing the original description.

Drive the ENTIRE tdmcp roadmap-to-1.0 to completion as a resumable, wave-by-wave campaign — Milestone 4 (generative-AI bridge wave), Milestone 5 (mixer scene arming), and the v1.0 consolidation gates G1–G6 — routing each class of work to the right existing sub-harness. Use whenever the user wants to "implement everything / all the milestones / the whole roadmap / finish the road to 1.0", run the next milestone, close the consolidation gates, or build a long autonomous campaign across M4/M5/G1–G6. ALSO use for every follow-up: continue/resume the roadmap campaign, run the next wave, re-run a failed wave, fold in QA results, check campaign status, re-prioritize, or scope to one milestone/gate. This is the CAMPAIGN layer ABOVE tdmcp-pipeline / tdmcp-feature-lead / tdmcp-backlog-campaign — it sequences across MULTIPLE sub-harnesses (tools, mixer, coverage, docs, bridge, recipes, submission), which the generic backlog-campaign does not. For a SINGLE feature use tdmcp-pipeline; for one tool-shaped backlog file use tdmcp-backlog-campaign. Simple questions can be answered directly.

The English summary is being prepared. Showing the original description.