Testing & Security skills

Test UI components the way users interact with them using Testing Library — query by role, text, and label instead of implementation details. Use when someone asks to "test React components", "Testing Library", "user-centric testing", "test accessibility", "test without implementation details", or "render and query components in tests". Covers React Testing Library, queries, user events, async testing, and accessibility assertions.

The English summary is being prepared. Showing the original description.

Assists with unit and integration testing using Vitest, a Vite-native test runner. Use when writing tests, configuring mocks, setting up coverage, or migrating from Jest. Trigger words: vitest, unit testing, test runner, vi.fn, vi.mock, test coverage, jest replacement.

The English summary is being prepared. Showing the original description.

Audit web pages and components for WCAG 2.2 accessibility compliance. Use when a user asks to check accessibility, find a11y issues, audit for WCAG compliance, fix screen reader problems, check color contrast, ensure keyboard navigation works, or prepare for accessibility regulations like the European Accessibility Act or ADA.

The English summary is being prepared. Showing the original description.

Scan code for security vulnerabilities, misconfigurations, and exposed secrets. Use when a user asks to audit security, find vulnerabilities, check for OWASP issues, scan for secrets, review dependencies for CVEs, detect SQL injection, find XSS vulnerabilities, or harden an application. Covers OWASP Top 10, dependency auditing, secrets detection, and generates fix recommendations with severity ratings.

The English summary is being prepared. Showing the original description.

Write and maintain end-to-end tests with Playwright. Use when someone asks to "add e2e tests", "test my web app", "set up Playwright", "write browser tests", "test login flow", "visual regression testing", "test across browsers", or "automate UI testing". Covers test setup, page objects, authentication, API mocking, visual comparisons, and CI integration.

The English summary is being prepared. Showing the original description.

Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.

The English summary is being prepared. Showing the original description.

Scan repository dependencies for known vulnerabilities using the GitHub MCP Server's Dependabot toolset and the GitHub Advisory Database. Use when asked to check dependency security, audit lockfiles, or verify packages before merging.

The English summary is being prepared. Showing the original description.

Web testing patterns and best practices using Playwright for automated testing

The English summary is being prepared. Showing the original description.

Map a codebase into feature-grouped flowcharts, identify duplicated concerns across features, and propose a unified architecture. Use when asked to "find the ideal path," unify duplicated systems, or audit architecture before a refactor. Emits a proposed unified flowchart plus per-system /make-plan prompts.

The English summary is being prepared. Showing the original description.

Remove AI-generated code smells (slop) from branch changes or an explicit file list. Locks behavior with regression tests FIRST, then runs categorized cleanup via parallel `deep` agents in batches of 5, then verifies with quality gates. Covers 10 slop categories including performance equivalences, excessive complexity (object annotations, if/elif variant chains), and oversized modules (250+ pure LOC with mandatory modular refactoring). MUST USE when the user asks to "remove slop", "clean AI code", "deslop", "clean up AI-generated code", "remove AI slop", or wants to clean up AI-generated patterns from recent changes. Triggers - "remove ai slops", "clean ai code", "deslop", "cleanup AI generated", "remove AI slop", "clean up AI-generated code", "strip slop", "ai-slop cleanup".

The English summary is being prepared. Showing the original description.

Post-implementation review orchestrator. Launches 5 parallel background sub-agents: Oracle (goal/constraint verification), Oracle (code quality), Oracle (security), unspecified-high (hands-on QA execution), unspecified-high (context mining from GitHub/git/Slack/Notion). All must pass for review to pass. MUST USE after completing any significant implementation work. Triggers: 'review work', 'review my work', 'review changes', 'QA my work', 'verify implementation', 'check my work', 'validate changes', 'post-implementation review'.

The English summary is being prepared. Showing the original description.

Verify a completed implementation against the plan in .unikit/code/plans/. Checks that every task was implemented, nothing was forgotten, the code compiles, the recorded test run still matches the code, and {{engine_name}} conventions are followed. Use after /unikit-implement completes, or when the user says "verify", "check the work", "did we miss anything". For code review use /unikit-review instead.

The English summary is being prepared. Showing the original description.

Customize how a built-in unikit skill behaves in this specific project by writing workflow overrides into its skill-context file. These are per-skill workflow rules (e.g. "/unikit-review should also flag TODO comments", "/unikit-implement should run tests after each task"), not coding conventions. Use when the user wants to change, customize, or override how a particular unikit skill works in this project — "customize the review skill", "make /unikit-fix always add logging here", "the implement skill should do X differently", "add a skill rule for /unikit-commit". Use "validate" to find stale overrides against updated base skills. For a general coding convention (not tied to one skill) use /unikit-rules; to derive rules from past mistakes use /unikit-evolve.

The English summary is being prepared. Showing the original description.

A test skill from an extension (v2)

The English summary is being prepared. Showing the original description.

A test skill from an extension

The English summary is being prepared. Showing the original description.

Perform a code review on {{engine_name}} {{engine_code_language}} code. Checks for bugs, security issues, performance problems, and best practices against the project's coding rules, design principles, and framework-specific conventions. Supports four modes — staged changes, a pull request, a commit range, or individual files. Use when the user says "review code", "check my code", "code review", "review PR", "review staged changes", "review these commits", or "is this code okay". Optional +check flag validates findings via a fresh-context subagent.

The English summary is being prepared. Showing the original description.

Navigator and help guide for the UniKit framework — use when the user is unsure what to do next, where to start, or which unikit skill fits their situation. It diagnoses intent and points to the right skill or pipeline: starting a project, writing code, testing, planning, the spec-driven code workflow, authoring or detailing game design, finding a new mechanic, or deciding what game to build. Trigger on questions like "what do I do next", "where do I start", "how do I start coding", "how do I test my code", "how do I create the game design", "how do I detail a system", "how do I find a new mechanic", "which unikit skill should I use", "how does the code pipeline relate to game design", "I'm lost in unikit", "help me with unikit". Read-only — it explains and points to the right command, it never edits project files. For technical code research use /unikit-explore; for game-design research use /unikit-gd-explore; to initialize the framework use /unikit.

The English summary is being prepared. Showing the original description.

Fix a specific bug or problem in a {{engine_name}} project. Supports two modes — immediate fix or plan-first. Without arguments executes existing .unikit/code/FIX_PLAN.md. Checks {{engine_name}} compilation, suggests test coverage, and creates self-improvement patches. Use when user says "fix bug", "debug this", "something is broken", "fix the tests", "fix the errors in the tests", "read the errors in the {{engine_name}} console logs and fix the problems", or pastes an error message or {{engine_name}} console log. Also trigger when user shares a NullReferenceException, MissingReferenceException, compilation error, or any {{engine_name}}-specific error.

The English summary is being prepared. Showing the original description.

Curate .unikit/MCP-RECHECK-NOTES.md — the project's log of findings about the configured engine MCP server. Four jobs: re-stamp (the server moved, so every entry is suspect), replay (reproduce a `replay: safe` finding inside a disposable sandbox to see whether it still holds), retire (offer to drop what was fixed or went upstream), and upstream (print a ready diff for the packaged INDEX.md). Use for "audit the MCP notes", "are these findings still true", "recheck the MCP traps", "clean up MCP-RECHECK-NOTES", "the server was updated — revisit the notes". Replaying mutates a live editor, so it starts by telling you how to prepare it — save your scene, open an empty one — and asks once before touching anything. Everything it creates lives under a single UNIKIT_AUDIT_<runid> prefix, is deleted in one action, and the scene is never saved. To record a NEW finding use /unikit-mcp-trap instead.

The English summary is being prepared. Showing the original description.

Dell ファームウェアダウンロード。Playwright で dl.dell.com から BIN を取得し firmimg.d7 を抽出する。

The English summary is being prepared. Showing the original description.

Playwright セットアップ・利用ガイド。headless Chromium によるブラウザ自動化の共通パターン。

The English summary is being prepared. Showing the original description.

Use Tanso, an AI Search CLI for exploring Chinese internet signals. Use when the user asks to search Chinese web sources, Zhihu, Zhihu hotlists, Bocha, Volcengine Ark, Chinese internet topics, source-backed briefs, contradiction checks, counterintuitive topic discovery, popular answers, live provider testing, or current Chinese web signals.

The English summary is being prepared. Showing the original description.

Review a drafted support response for quality, accuracy, tone, and completeness before sending.

The English summary is being prepared. Showing the original description.

Drive Chromium from standard Playwright APIs with a real-device fingerprint applied in the kernel, one persistent isolated profile per identity, and a per-profile proxy whose exit IP sets timezone and WebRTC - JavaScript (npm 'anti-detect-browser') or Python (PyPI 'antibrow'). Use when sessions must stay logged in across runs and stay separate, when a scraper or agent is blocked by an incoherent headless fingerprint, when checking ads or pricing from another region, when a page must be reached as a phone rather than a desktop, when automation mints a profile per task, when running several of your own accounts from one machine, or when testing how your own bot detection scores a real device. Also for 'antibrow', 'fingerprint browser', 'multi-account browser', '防关联', '多账号', '安卓模拟', 'Android profile', 'mobile fingerprint', 'temporary profile', 'CreepJS', 'residential proxy', 'browser-use', 'crawl4ai'. MCP control is browser-mcp-agent; isolation is multi-account-isolation.

The English summary is being prepared. Showing the original description.