Test design, vulnerability assessment, and quality assurance (13K skills)
Audit mental health crisis monitoring systems for risk signal detection accuracy, escalation protocol completeness, safety planning integration, crisis team coordination, and ethical guardrail enforcement..
The English summary is being prepared. Showing the original description.
Run a full Section 508 + WCAG 2.2 Level AA accessibility audit on a federal / .gov / public-sector website or ICT product. Triggers: "Section 508", "508 audit", "WCAG", "VPAT", "ACR".
The English summary is being prepared. Showing the original description.
Analyze compliance operations for regulatory change tracking, control mapping, policy management, audit readiness, and training compliance. Triggers: 'audit compliance program', 'assess GRC platform', 'review regulatory change management', 'check control framework'.
The English summary is being prepared. Showing the original description.
Validate OpenClaw release candidates through OCM using the built OpenClaw artifact, a broad reusable scenario matrix, copied existing-user state, clean new-user state, concise pass/fail reporting, and focused failure notes. Use when asked to test OpenClaw origin/main, release readiness, upgrade behavior, plugins, services, channels, doctor recovery, packaging, or broad release risk.
The English summary is being prepared. Showing the original description.
Use OpenClaw Manager (OCM) safely and correctly for OpenClaw environment lifecycle work, runtime installation/builds, release-shaped local builds, upgrades, migration/adoption, cloning existing user state, service supervision, gateway logs, dev worktrees, plugin testing, model/provider smoke tests, TUI/dashboard checks, cleanup, and concise reporting. Use whenever Codex is asked to use OCM, manage OpenClaw envs/runtimes/services, test OpenClaw with OCM, reproduce existing-user or new-user flows, or avoid breaking user state while working with OpenClaw.
The English summary is being prepared. Showing the original description.
Review custom components and layouts against shadcn design patterns, visual style conventions (Vega, Nova, Maia, Lyra, Mira), composition rules, design token usage, and Radix/Base UI composition patterns. Use PROACTIVELY after writing or modifying any custom UI component, page layout, or variant of a shadcn component. Use when the user says "review this component", "check my spacing", "does this follow shadcn patterns", "audit this layout", "is this shadcn-idiomatic", or shares a component for feedback. Catches spacing drift, hardcoded colors, missing data-slot attributes, inconsistent theme application, and composition anti-patterns that shipping-fast-with-AI tools often miss.
The English summary is being prepared. Showing the original description.
Full website SEO audit with parallel subagent delegation. Crawls up to 500 pages, detects business type, delegates to up to 7 specialists, generates health score. Enhanced with live Ahrefs (DR, backlinks, traffic) and GSC (indexing, top pages) data when MCPs are available. Use when user says "audit", "full SEO check", "analyze my site", or "website health check".
The English summary is being prepared. Showing the original description.
Flagship comprehensive SEO audit combining Ahrefs and GSC data in sequential waves with checkpoint saves. Use when user says "site audit pro", "full audit", "comprehensive audit", "audit with live data", "deep audit", "pro audit", "complete SEO audit", "run a full site audit", or "audit everything for this domain". Requires domain param. Optional: site param for GSC overlay.
The English summary is being prepared. Showing the original description.
Standalone E-E-A-T scoring rubric for a URL or content draft. Scores Experience, Expertise, Authoritativeness, and Trust 0-5 each using concrete detectable signals, framed per Google's creating-helpful-content doc. Use when user says "E-E-A-T", "EEAT", "experience expertise", "trust signals", or "author authority".
The English summary is being prepared. Showing the original description.
Run a Lighthouse audit against any URL via the local Lighthouse CLI or the PageSpeed Insights API fallback, parse category scores and failed audits, and map every failed audit ID to its official Chrome docs page plus a one-line fix. Use when user says "lighthouse", "lighthouse audit", "run lighthouse", "lighthouse score", or "pagespeed".
The English summary is being prepared. Showing the original description.
Audit markdown files for SEO before publishing. Checks heading structure, meta description, keyword density, content length, link quality, image alt text, and frontmatter completeness. Use when user says "markdown audit", "check my markdown", "SEO check markdown", or "audit this post".
The English summary is being prepared. Showing the original description.
Reviews CLAP plugin implementations for spec compliance, thread safety, and correctness. Use when the user asks to review a CLAP plugin, audit a CLAP extension, or check whether their process() callback follows the CLAP threading model. Trigger on phrases like "review my CLAP plugin", "check CLAP extension", "is my CLAP process() safe", "audit my clap_plugin_t", or when you see clap_plugin_t, clap_process_t, or CLAP extension structs in the code.
The English summary is being prepared. Showing the original description.
Reviews AudioUnit v2/v3 plugin implementations for spec compliance, thread safety, and correctness. Use when the user asks to review an AudioUnit plugin, check an AUv3 app extension, audit property or parameter handling, or asks "is my AUComponent thread-safe?" or "why does my AU crash in Logic?". Trigger on phrases like "review my AudioUnit", "check my AUv3", "is my render block safe?", or when you see AURenderCallback, internalRenderBlock, kAudioUnitProperty_*, or AUAudioUnit in the code.
The English summary is being prepared. Showing the original description.
Reviews YUP audio plugin code for YUP-specific correctness issues: AudioProcessor lifecycle, AudioParameterBuilder and AudioParameterHandle usage, editor gestures, AudioBusLayout handling, CLAP/VST3 wrapper contracts, state recall, and MIDI safety. Use when the user asks to review a YUP plugin, check a processBlock, audit parameter smoothing, or asks "is this YUP code safe?". Trigger when you see yup::AudioProcessor, yup_audio_plugin, AudioParameterBuilder, AudioParameterHandle, AudioProcessorEditor, or createPluginProcessor in the code.
The English summary is being prepared. Showing the original description.
Reviews VST3 plugin implementations for spec compliance, host compatibility, and correctness. Use when the user asks to review a VST3 plugin, check bus arrangements, audit parameter handling, or verify their process() callback is safe. Trigger on phrases like "review my VST3 plugin", "check VST3 bus arrangement", "is my VST3 process safe", "audit my IAudioProcessor", or when you see IComponent, IAudioProcessor, IEditController, ProcessData, or Vst:: namespaced types in the code.
The English summary is being prepared. Showing the original description.
Reviews JUCE audio plugin code for JUCE-specific correctness issues: thread safety, APVTS parameter patterns, MessageManager usage, ValueTree, and MIDI handling. Use when the user asks to review a JUCE plugin, check a processBlock, audit parameter handling, or asks "is this JUCE code safe?". Trigger on phrases like "review my JUCE plugin", "check my AudioProcessor", "is this APVTS usage correct?", or when you see AudioProcessor, AudioProcessorEditor, or AudioProcessorValueTreeState in the code.
The English summary is being prepared. Showing the original description.
Audit an existing Lamport-style hierarchical mathematical proof forward for validity and whether its hierarchy, scope, dependencies, side conditions, and proof constructs discharge the stated theorem. Use when the central question concerns a top-down proof with numbered levels, subproofs, ASSUME/PROVE, SUFFICES, PICK, CASE, DEFINE, Q.E.D., or prose equivalents. For an ordinary proof that first needs source-preserving hierarchy, use convert-lamport; for conclusion-first AND/OR obligation reconstruction, use reverse-lamport. Do not use to generate or replace a proof, or to audit Lean, Coq, Isabelle, or other proof-assistant source.
The English summary is being prepared. Showing the original description.
Convert an existing prose, flat, or loosely organized mathematical proof into a source-mapped Lamport-style hierarchy without repairing or completing its mathematics. Use when a submitted proof needs a traceable hierarchical rendering before a forward Lamport audit or for clearer presentation. Do not use to invent a proof, certify validity, or restructure an already hierarchical proof merely to audit it.
The English summary is being prepared. Showing the original description.
Audit an existing mathematical, logical, algorithmic, or technical proof from its stated conclusion backward as a bounded AND/OR graph of exact obligations. Use to reconstruct conclusion dependencies, determine whether a proof-supplied route establishes the conclusion, or expose hidden assumptions, unmet side conditions, cycles, overly strong steps, or silent route switches. For a source-mapped Lamport rendering use convert-lamport, and for forward hierarchy, construct, and scope conformance use forward-lamport before this skill. This does not decide full theorem-level entailment by searching for a different proof; do not turn the audit into a linear reversed proof, exhaustive proof search, or replacement proof.
The English summary is being prepared. Showing the original description.
测试环境自动准备 Skill。在执行任何测试之前，自动检查并准备完整的测试环境：服务健康检查、自动启动后端、数据库就绪、测试账号创建、依赖验证。确保后续测试在稳定环境中执行。触发词：「准备测试环境」「环境预检」「初始化测试环境」「测试前准备」。也被 role-测试工程师 Step 0 和 fixer Step A0/B0 自动调用。
The English summary is being prepared. Showing the original description.
Guideline for designing, implementing, and verifying secure TypeScript and JavaScript applications following OWASP Top 10 best practices. Use when the user wants to: (1) review TypeScript or JavaScript code for security vulnerabilities, (2) design a secure Node.js, Deno, or browser application architecture, (3) implement security features (authentication, authorization, cryptography, input validation), (4) audit npm/yarn/pnpm dependencies for known vulnerabilities, (5) create security checklists or verification plans, (6) fix security bugs or harden existing TypeScript or JavaScript code, (7) set up security testing and static analysis (ESLint security plugins, Semgrep, Snyk), or (8) handle any TypeScript/JavaScript security concern including injection prevention, prototype pollution, XSS protection, SSRF prevention, secrets management, and secure deployment.
The English summary is being prepared. Showing the original description.
Write, review, and optionally test Bash and Zsh shell scripts following project coding standards. Use for ANY shell scripting task: (1) creating a new Bash or Zsh script, (2) editing, fixing, or reviewing an existing .sh, .bash, or .zsh file, (3) adding error handling, dependency checks, or cleanup traps to shell scripts, (4) implementing API integration or file processing in shell, (5) writing or fixing ShellSpec tests (spec/*_spec.sh), or (6) deciding whether a script should be written in Bash or Zsh. Defaults to Bash; Zsh-specific guidance lives in a reference file that is loaded only when writing Zsh.
The English summary is being prepared. Showing the original description.
Guideline for designing, implementing, and verifying secure APIs following OWASP API Security Top 10 (2023) best practices. Use when the user wants to: (1) review API code or design for security vulnerabilities, (2) design a secure REST, GraphQL, or gRPC API architecture, (3) implement API authentication and authorization (OAuth2, JWT, API keys, mTLS), (4) configure rate limiting, input validation, or CORS, (5) audit API endpoints for BOLA, BFLA, or mass assignment vulnerabilities, (6) create API security checklists or verification plans, (7) fix API security bugs or harden existing APIs, (8) set up API security testing (OWASP ZAP, Schemathesis, Burp Suite), or (9) handle any API security concern including SSRF prevention, resource consumption limits, business flow protection, API inventory management, and secure third-party API consumption.
The English summary is being prepared. Showing the original description.
Create high-quality, secure, and performance-optimized Containerfiles (Dockerfiles) following best practices for multi-architecture builds, OpenShift/Kubernetes compatibility, and BuildKit cache optimization. Use when the user wants to: (1) create a new Containerfile or Dockerfile for any project (Python, Rust, Go, Node.js, .NET, or any language), (2) containerize an application with multi-stage builds, (3) optimize an existing Containerfile for security, performance, or image size, (4) review or improve container image build practices, (5) set up BuildKit cache mounts for package managers, (6) create OpenShift-compatible container images with non-root users and arbitrary UID support, (7) write a .dockerignore file, or (8) apply OCI LABEL standards.
The English summary is being prepared. Showing the original description.