Testing & Security skills

Run the project test suite using Polylith's poly test command

The English summary is being prepared. Showing the original description.

Run the E2E QA test suite against the live application using Playwright MCP and nREPL. Use when testing the app end-to-end.

The English summary is being prepared. Showing the original description.

Create a complete Grain domain service with schemas, read models, commands, queries, and tests

The English summary is being prepared. Showing the original description.

Implementer - fetches a GitHub issue, builds an implementation plan, then implements using TDD. Use when: implement, build this, code this, add this feature, TDD, test first, red green refactor, pick a task, next task, dev.

The English summary is being prepared. Showing the original description.

Build or iterate on Pulp's native Dawn-backed Three.js workflow using the real three.webgpu.js renderer, focused bridge tests, and native demo capture.

The English summary is being prepared. Showing the original description.

Decide whether a Pulp test earns its place — before writing it, when reviewing one, or when sweeping a subsystem for low-value, duplicated, or mis-routed tests. Applies a four-question authoring gate, a junk-pattern list, a retention bar, and an evidence template for any deletion, and routes kept tests to the right lane (required gate, pr-fast, slow, nightly). Handles "should I add a test for this", "is this test useful", "audit these tests", "reduce test time", "which tests can go", and "move toward functional tests".

The English summary is being prepared. Showing the original description.

Baseline, half-leading, and font-face resolution for Label and captured (browser-imported) text — the arithmetic that decides where a glyph lands and how wide the box must be, plus the measure-vs-paint divergences that make text clip or sit low without any test going red.

The English summary is being prepared. Showing the original description.

Maintain Pulp's installed design-time agent capability manifest and public-surface ledger. Use when adding, removing, renaming, or materially changing public audio, MIDI, signal, timebase, or sequence APIs; registering a new algorithm for generators; changing capability support or deprecation state; or repairing agent-capabilities freshness, schema, fingerprint, tombstone, or installed-SDK tests.

The English summary is being prepared. Showing the original description.

Load, run, and test VST3 / AU / CLAP / LV2 plugins from Pulp code. Use when working on `core/host/` (scanner, plugin_slot, signal_graph), when adding a new format backend, when wiring a plugin into a SignalGraph, or when writing an integration test that needs a real plug-in binary.

The English summary is being prepared. Showing the original description.

Configure, implement, and test Pulp's optional desktop Ableton Link tempo-sync adapter while preserving the developer-supplied SDK, licensing, realtime, latency-compensation, and no-install boundaries.

The English summary is being prepared. Showing the original description.

Keep a plugin/demo repo's screenshots in sync with its UX. When editor / UI / design-token code changes in an opted-in repo (one carrying .pulp/screenshots.toml), re-capture and refresh every place each shot is consumed — README images, web-demo Open Graph (og.png) images, and gallery thumbnails — consistently across the WAM and WCLAP demo sites. Two capture routes: native headless (render_to_png / pulp-screenshot, Skia) for README / native-editor shots, and live-web headless Chrome (playwright-core) for WAM/WCLAP demo OG + gallery images. Backfills demos missing OG images. This is a PORTING / consistency tool — it re-shoots a repo's OWN UI, it never clones another product's art.

The English summary is being prepared. Showing the original description.

Prepare an outside contribution to Pulp or Forge that a maintainer can land with minimal rework — routing (Core vs Forge), local build and test on a plain Mac, the checks that are worth running without Shipyard/Tart/VMs, and the handoff format. Use when contributing without write access or without the maintainer CI fleet.

The English summary is being prepared. Showing the original description.

Optimize and stress-test a logistics system end-to-end — chains route optimization, warehouse operations review, inventory demand forecasting, supply chain risk analysis, and peak-load testing. Use for delivery platforms, warehouse management systems, fleet routing, or supply chain software.

The English summary is being prepared. Showing the original description.

Full quality pass -- chains parallel UX + scalability audit, then QA verification, then consistency gate. Fixes everything it finds. Works with any stack.

The English summary is being prepared. Showing the original description.

Run a focused tech debt reduction sprint — inventories all technical debt (TODOs, outdated deps, missing tests, god objects), fixes code smells, removes dead code, then hardens with a review pass. Use when a codebase feels sluggish, before a major feature push, or on a regular maintenance cadence.

The English summary is being prepared. Showing the original description.

Build and ship features with security baked in — runs OWASP Top 10 pre-scan, builds and ships with /ship, validates with post-build security review, then penetration tests the result. Use when shipping auth flows, payment logic, API endpoints, admin panels, or any security-sensitive code.

The English summary is being prepared. Showing the original description.

Build a complete indie launch package for an app, tool, or library — product audit, positioning (one-liner, value props, objection answers), finished launch assets written to a launch/ directory (landing copy, App Store or Play Store or npm/directory listing text, Product Hunt draft.

The English summary is being prepared. Showing the original description.

Full-stack app pipeline — build, test, review, and deploy across one or ALL repos. Scans CLAUDE.md, MEMORY.md, TODOs, open PRs, and issues for shippable work. Supports 'ship all' for multi-repo. Use when: 'build and ship', 'ship it', 'ship all', 'deploy everything', 'full pipeline', 'what needs shipping', 'end to end'.

The English summary is being prepared. Showing the original description.

Audit your project's documentation health and identify gaps. Scans for README, changelog, API docs, ADRs, runbooks, onboarding guides, and diagrams. Triggers: you need a documentation audit, want to check doc coverage, find missing documentation, or assess documentation quality.

The English summary is being prepared. Showing the original description.

Run a full pre-launch quality gate before shipping — chains product review, growth audit, UX audit, security scan, and deployment preflight into a go/no-go launch decision. Stops on critical blockers. Use before v1 launch, beta release, major version rollout, or feature launch.

The English summary is being prepared. Showing the original description.

Review then build — chains architecture review into implementation. Accepts any spec format (ticket, PRD, engineering spec, feature description, screenshot) and autonomously reviews the design, resolves gaps, then implements with tests and a PR.

The English summary is being prepared. Showing the original description.

Run a complete mobile app pre-launch verification — chains performance audit, QA testing, OWASP mobile security review, App Store and Play Store compliance checks, and store listing optimization into a single launch-ready report. Use before submitting to TestFlight, App Store, or Google Play.

The English summary is being prepared. Showing the original description.

Audit a government or public services system for compliance, fraud risk, and security — chains benefits processing review, fraud detection analysis, regulatory compliance check (ADA, Section 508, FISMA, Privacy Act), and PII-focused security audit. Use for benefits platforms, eligibility engines, enrollment portals, or inter-agency data systems.

The English summary is being prepared. Showing the original description.

One-command PR gate that runs four passes over exactly the changed surface — code review (correctness then simplification), security (injection, authz, secrets, dependency diff), tests (run the suite and flag untested changed lines).

The English summary is being prepared. Showing the original description.