Testing & Security skills

端到端认证实现时使用。适用于注册 → 登录 → Token → 权限 → 前端守卫的全栈闭环。覆盖 NextAuth / Lucia / Supabase Auth / 自建 JWT。

The English summary is being prepared. Showing the original description.

评估系统性能 / 容量 / 压测时使用。适用于上线前性能基线、SLA 验证、容量规划、性能退化排查。融合 Google SRE Workbook、Brendan Gregg USE Method、k6/JMeter 实践。

The English summary is being prepared. Showing the original description.

无明确用例或需要发现未知未知时使用。适用于新功能首次测、复杂业务流程、Bug 修复后扩散探索。融合 James Bach SBTM、Elisabeth Hendrickson Heuristics、Tour-Based Testing。

The English summary is being prepared. Showing the original description.

单元测试实现时使用。覆盖 Jest / Vitest / pytest / JUnit 5 / Go testing。融合 AAA 模式 + 测试替身 + 参数化测试。

The English summary is being prepared. Showing the original description.

API 契约测试时使用。适用于消费者驱动契约测试（Pact）/ OpenAPI 验证（Dredd / Schemathesis）。融合 Pact + Schemathesis + 契约优先。

The English summary is being prepared. Showing the original description.

输出 OpenAPI 契约和 Mock 服务时使用。适用于 API 设计的最后一步、给前端/后端/QA 的交付。优先使用 OpenAPI 3.1 + Mock 数据覆盖所有路径 + 详细的下游交接清单。

The English summary is being prepared. Showing the original description.

A/B 测试设计与分析时使用。适用于产品实验、功能验证、转化率优化。融合假设驱动 + 样本量计算 + 置信度判断。

The English summary is being prepared. Showing the original description.

把自动化测试集成到 CI/CD 流水线时使用。适用于 GitHub Actions / GitLab CI 测试阶段配置、并行化、缓存、失败阻塞。

The English summary is being prepared. Showing the original description.

CI/CD 流水线设计与实现，覆盖 GitHub Actions / GitLab CI / Jenkins。标准阶段：lint → test → build → scan → deploy。关注流水线性能、安全门禁、环境隔离。

The English summary is being prepared. Showing the original description.

实现单元测试 / 集成测试 / 契约测试时使用。覆盖 JUnit 5 / Jest / Vitest / pytest / Go testing / RSpec / xUnit + Pact 契约测试 + Testcontainers。融合测试金字塔实现 + 双倍替身 + AAA 模式。

The English summary is being prepared. Showing the original description.

集成测试实现时使用。适用于 API 端到端测试 / 数据库集成 / 第三方 Mock。融合 Testcontainers + Supertest + WireMock。

The English summary is being prepared. Showing the original description.

E2E 测试实现时使用。适用于 Playwright / Cypress 关键用户旅程测试。融合 Page Object Model + 视觉回归 + 可访问性测试。

The English summary is being prepared. Showing the original description.

实现认证和鉴权时使用。覆盖 Spring Security / NestJS Guards / Django Auth / FastAPI Depends / Passport / Auth0 集成。融合 OAuth 2.1 + JWT + RBAC + 中间件实现。

The English summary is being prepared. Showing the original description.

Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.

The English summary is being prepared. Showing the original description.

Shell and session operations after an attack module already established command execution, a raw shell, webshell channel, container/runner shell, or remote session. This module does not own exploitation and should not pull SSH/WinRM/RDP authentication or vulnerability-to-shell chains out of Web/AD/Cloud/K8s/CI-CD/Service/Phishing. Use it to bootstrap a usable callback from existing command execution, stabilize Linux PTY, upgrade Windows sessions with ConPTY where applicable, manage listeners, recover fragile sessions, and exchange files for continued operations.

The English summary is being prepared. Showing the original description.

Expert performance marketing guidance for paid acquisition, CRO, and growth optimization. Use when creating ad campaigns, writing ad copy, optimizing landing pages, setting up A/B tests, analyzing CAC/LTV, building attribution models, or planning retargeting strategies. Use for Google Ads, Meta Ads, LinkedIn Ads, conversion tracking, budget allocation, and funnel optimization.

The English summary is being prepared. Showing the original description.

Expert product discovery guidance for user research and problem validation. Use when conducting user interviews, validating problems, applying jobs-to-be-done framework, sizing opportunities, customer segmentation, competitive analysis, prototype testing, usability testing, designing surveys, or synthesizing research insights. Covers discovery sprints, continuous discovery, and research operations.

The English summary is being prepared. Showing the original description.

Expert product analytics strategist for SaaS and digital products. Use when designing product metrics frameworks, funnel analysis, cohort retention, feature adoption tracking, A/B testing, experimentation design, data instrumentation, or product dashboards. Covers AARRR, HEART, behavioral analytics, and impact measurement.

The English summary is being prepared. Showing the original description.

The Mileva Method (CRISP) — Phase 1: Clarify. Problem definition, eliciting, painkiller test, buy vs build, AI justification gate, Go/No-Go. Use at the start of any AI implementation project. Triggers on "clarify", "phase 1", "start discovery", "define the problem", "what problem are we solving", or at the beginning of a new client engagement.

The English summary is being prepared. Showing the original description.

The Mileva Method (CRISP) — Phase 5: Prove. Success validation against Phase R baseline metrics, test log review, and AI justification validation. Use after deployment. Triggers on "prove", "phase 5", "validate", "did it work", "success criteria", "measure results", or after go-live.

The English summary is being prepared. Showing the original description.

CRISP Execute — Sprint execution loop with change request management, security gates, product gates, and stakeholder reporting. Use after Phase S (Spec) is complete and crisp-state.json shows ready_for_execute: true. Triggers on "start sprint", "begin build", "execute", "sprint 1", "run sprints", or when handed off from crisp-orchestrator.

The English summary is being prepared. Showing the original description.

Map testable surfaces, audit existing tests for quality, and write test specifications that prevent AI shortcuts. Use when asked to "audit tests", "specify tests", "test architect", "map test coverage", or invoke /test-architect. Two modes — audit (evaluate existing tests against Beck's principles) and specify (write test specs for new code). Powered by Carmack × Beck quality-testing.md reference doc. Stack: Next.js App Router / TypeScript / Vitest / Cypress / tRPC / Prisma / Neon.

The English summary is being prepared. Showing the original description.

Perform a rigorous Carmack Council code review. Use when explicitly asked to review code, do a "council review", "carmack review", or invoke /council-review. Carmack's philosophy chairs a council of domain experts — Troy Hunt (security), Martin Fowler (refactoring), Kent C. Dodds (frontend), Matteo Collina (Node.js), Brandur Leach (Postgres), Vercel Performance, Simon Willison (LLM pipelines), Karri Saarinen (UI quality), Vitaly Friedman (UX quality), Kent Beck (test quality). Uses parallel subagents for deep, independent review. Produces prioritised P1/P2/P3 findings. Stack: Next.js App Router / React / TypeScript / tRPC / Prisma / Neon / Clerk.

The English summary is being prepared. Showing the original description.

Architect a feature with the Carmack Council before writing code. Use when explicitly asked to plan a feature, do a "council plan", "carmack plan", or invoke /council-plan. Carmack's philosophy chairs a council of domain experts — Troy Hunt (security), Martin Fowler (refactoring), Kent C. Dodds (frontend), Matteo Collina (Node.js), Brandur Leach (Postgres), Vercel Performance, Simon Willison (LLM pipeline), Karri Saarinen (UI quality), Vitaly Friedman (UX quality). Interactive feature discovery followed by parallel subagent dispatch. Produces a sequenced, attributed implementation plan with no code. Stack: Next.js App Router / React / TypeScript / tRPC / Prisma / Neon / Clerk.

The English summary is being prepared. Showing the original description.