Test design, vulnerability assessment, and quality assurance (13K skills)
[Code Quality] Use when a workflow step or the user asks for security audits: OWASP, secrets, supply chain, infrastructure, CI/CD and AI-agent risks.
The English summary is being prepared. Showing the original description.
[Git] Use when asked to create, open, finish, update or mark ready a pull request. Runs in the main session with risk-based test/review choices and automatic checks for routine CI repairs: branch, commit, open PR, CI to green.
The English summary is being prepared. Showing the original description.
[Workflow] Write and verify spec-traced integration tests, or diagnose and fix failing suites to repeatable green. --mode={write|green}.
The English summary is being prepared. Showing the original description.
[Documentation] Use when a workflow step or the user asks for documentation sync after code/spec/test changes (--mode=update), or explicit reference-doc initialization and reconciliation (--mode=init).
The English summary is being prepared. Showing the original description.
[Testing] Use when initializing, writing, reviewing or verifying performance/load/soak/capacity tests. --mode=verify --fix-loop (or --mode=green) diagnoses, fixes and remeasures with performance-review. Static bottleneck audits use performance-review.
The English summary is being prepared. Showing the original description.
[Testing] Automate browser interactions, test web pages, and work with Playwright tests.
The English summary is being prepared. Showing the original description.
[Testing] Use when a workflow step or the user asks for runtime review of a UI, API, CLI or service against intended behavior. --rounds=0 reports only; --rounds=N bounds repairs.
The English summary is being prepared. Showing the original description.
[Testing] Use when generating a demo video from E2E screenshots for current changes, a commit, pull request or named user journey, covering every relevant case.
The English summary is being prepared. Showing the original description.
[Architecture] Use when a workflow step or the user asks for architecture design, compliance review, scalability grading or whole-project audit via --mode={design|review|scalability|full}.
The English summary is being prepared. Showing the original description.
Use when reverse engineering binaries, firmware, mobile apps, JavaScript/Electron apps, .NET assemblies, network protocols, or malware samples; when decompiling, deobfuscating, unpacking, debugging, or hooking shipped artifacts; when solving CTF challenges (pwn, crypto, forensics, web); when a conclusion needs evidence from a shipped artifact rather than available source; or when routing authorized pentest and security-analysis work. Do not use for ordinary review of source code you already have.
The English summary is being prepared. Showing the original description.
Use when testing whether the jevaluate rubric and instructions lead graders to the right answers: after a rubric or instruction change, before freezing a rubric, before publishing ratings, or when a grader's calls look wrong.
The English summary is being prepared. Showing the original description.
Use to iterate a change until tests/quality checks pass — bounded run→revise→re-run gated by a numeric threshold, then a judge confirms. Triggers 'iterate to green', 'keep fixing until tests pass'.
The English summary is being prepared. Showing the original description.
Use BEFORE writing any test — enumerate cases per behavior (happy / boundary / error / abuse), prioritize by likelihood × impact, cross-check via subagent — even if the user just says 'add tests'.
The English summary is being prepared. Showing the original description.
Use when applying security best practices — authentication, authorization, CSRF protection, input sanitization, rate limiting, or secure coding — stack-agnostic.
The English summary is being prepared. Showing the original description.
Use when hardening a Linux host you operate — SSH posture, a default-deny firewall baseline, and unattended security upgrades, each verified on the box rather than assumed from a config file.
The English summary is being prepared. Showing the original description.
Implementing a feature, fixing a bug, refactoring — failing test first, then the code. For a WRONG test, `testing-anti-patterns` wins.
The English summary is being prepared. Showing the original description.
Use when reviewing, auditing, or optimizing skills — validates against the 7 Skill Killers checklist and produces fix recommendations.
The English summary is being prepared. Showing the original description.
Use when optimizing test suite performance — database setup, seeder optimization, parallel testing, CI pipeline efficiency, or RefreshDatabase alternatives.
The English summary is being prepared. Showing the original description.
Deep multi-pass codebase audit — orchestrates project-analysis-core plus the framework-specific project-analysis-*; explicit request only. Single-pass scan → project-analyzer.
The English summary is being prepared. Showing the original description.
BEFORE writing/changing tests, mocks, or test-only methods on production classes — mocking-the-mock, production pollution, overfit assertions; for order, `test-driven-development` wins.
The English summary is being prepared. Showing the original description.
Use when the user wants a security-maturity scorecard / posture assessment of a module — category ratings with evidence, not a vulnerability hunt. Also on 'wie sicher ist dieses Modul aufgestellt?'
The English summary is being prepared. Showing the original description.
Use to run a depth-bounded self-correction loop (attempt → critic verdict → re-attempt) as a tunable test-time compute knob — a do-and-judge specialisation, default off, capability-gated.
The English summary is being prepared. Showing the original description.
Single-pass tech-stack detection with an agents/evidence/analysis/ write-up; explicit request only. Deep multi-pass audit → universal-project-analysis. Raw primitives → project-analysis-core.
The English summary is being prepared. Showing the original description.
Security audit — vulnerability scan, pentest review, attack-surface sweep; explicit request only, not regular feature work. Pre-implementation threat pass → threat-modeling.
The English summary is being prepared. Showing the original description.