Testing & Security skills

[Deprecated] quality gate now covers tests + canary. Use `cm-quality-gate` instead.

The English summary is being prepared. Showing the original description.

Safe i18n: multi-pass batching, parallel-per-language dispatch, 8 audit gates, HTML integrity. Use for translating or mass-converting hardcoded strings to t() calls.

The English summary is being prepared. Showing the original description.

Use before any deployment or completion claim. Enforces test gates, evidence-based verification, and frontend safety checks. No deploy without passing. No claims without evidence.

The English summary is being prepared. Showing the original description.

Use when implementing any feature or bugfix. Routes to the core Red-Green-Refactor loop, test quality guidance, rationalization handling, examples, or stuck-state recovery.

The English summary is being prepared. Showing the original description.

Use when you need visual QA, screenshots, or post-deploy smoke testing through a real browser with Playwright.

The English summary is being prepared. Showing the original description.

Use to run the full sprint pipeline: brainstorm → plan → design → tdd → build → review → qa → security → ship → monitor → retro.

The English summary is being prepared. Showing the original description.

Bootstrap any new project: identity, design system, staging+production, i18n, SEO, test infrastructure, 8-gate deploy pipeline. Prevents tech debt from day 0.

The English summary is being prepared. Showing the original description.

Audit websites and landing pages for conversion issues and design evidence-based A/B tests. Use when the user mentions "landing page isn't converting", "conversion rate", "A/B test", "why visitors leave", or "objection handling". Covers funnel mapping, persuasion assets, and objection/counter-objection frameworks. For overall marketing strategy, see one-page-marketing. For usability issues, see ux-heuristics.

The English summary is being prepared. Showing the original description.

Fallback local Playwright daemon for real-browser visual QA / screenshots / smoke. Use ONLY when the host platform has no native browser mode — prefer the host browser first.

The English summary is being prepared. Showing the original description.

Working memory protocol — routes to session protocol, memory audit, MCP/URI integration, or storage details based on the current need. Keeps default continuity usage cheap.

The English summary is being prepared. Showing the original description.

Idiomatic Go 1.25 practices: errors, interfaces, concurrency, generics, testing, security, tooling. Use when writing or reviewing Go code.

The English summary is being prepared. Showing the original description.

Laravel 13 best practices: architecture, Eloquent, security, queues, testing, tooling. PHP 8.3+. Use when writing or reviewing Laravel applications.

The English summary is being prepared. Showing the original description.

Modern PHP 8.5 practices: type system, OOP, security, architecture, async, testing, tooling. Use when writing or reviewing PHP code.

The English summary is being prepared. Showing the original description.

Development workflows for WordPress ATmosphere plugin including wp-env setup, testing commands, linting, and build processes. Use when setting up development environment, running tests, checking code quality, or working with wp-env.

The English summary is being prepared. Showing the original description.

Testing patterns for PHPUnit tests. Use when writing tests, debugging test failures, setting up test coverage, or implementing test patterns for ATmosphere features.

The English summary is being prepared. Showing the original description.

Use when starting a session and suspecting configuration issues, after hook failures, MCP connection errors, or degraded vault performance. Also useful as a periodic health audit.

The English summary is being prepared. Showing the original description.

Use for .NET test design and validation with xUnit v3, Moq, focused regression tests, command tests, service/manager tests, code generation tests, Roslyn helper tests, MiniDb isolation, HTTP stubs, temp directories, and deciding whether to run targeted tests or builds.

The English summary is being prepared. Showing the original description.

Use when running a validated local Shipfox workflow change against a real trigger and inspecting its effects.

The English summary is being prepared. Showing the original description.

Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.

The English summary is being prepared. Showing the original description.

Practice test-driven development for new features and bug fixes.

The English summary is being prepared. Showing the original description.

Review a branch or PR for merge readiness and produce a QA report.

The English summary is being prepared. Showing the original description.

Behavior-first test guidance.

The English summary is being prepared. Showing the original description.

Use when Codex is already in the threat-modeling phase of a security scan, the user explicitly invokes $threat-model, or the user explicitly asks to create, update, or persist a repository threat model. Do not use as the primary trigger for full PR, commit, branch, patch, or repository scans.

The English summary is being prepared. Showing the original description.

Review a pull request, commit, branch diff, or working-tree patch for security vulnerabilities.

The English summary is being prepared. Showing the original description.