Testing & Security skills

Use when implementation is complete, all tests pass, and you need to decide how to integrate the work

The English summary is being prepared. Showing the original description.

Use when implementation is complete, all tests pass, and you need to decide how to integrate the work - guides completion of development work by presenting structured options for merge, PR, or cleanup

The English summary is being prepared. Showing the original description.

Grill the user relentlessly about a plan, decision, or idea. Use when the user wants to stress-test their thinking, or uses any 'grill' trigger phrases.

The English summary is being prepared. Showing the original description.

Use when adding, auditing, pruning, archiving, restoring, or reviewing Agent Notes in deepseek-harness; checks every new note for superseded active records, classifies implemented notes by future decision value, deletes rejected notes that no longer prevent a tempting fallacy, and applies the frozen archived/{kind} triplet and manifest rules.

The English summary is being prepared. Showing the original description.

Use before pushing, force-pushing, marking ready for review, or claiming checks pass on a deepseek-harness branch, and immediately after gh stack sync publishes rewritten branches, to select the smallest tests and checks that cover the outgoing or just-published diff without reflexively running the full repository suite.

The English summary is being prepared. Showing the original description.

Use when work produces a deliverable, factual claim, dataset, code change, decision, publication, deployment, automation, or irreversible action whose failure would matter; when the user asks for a quality gate, acceptance criteria, QA, completeness, validation, audit, evidence, preflight, release readiness, or a definition of done; or before claiming completion on medium- or high-risk work. Automatically decide whether a formal gate is warranted, derive task-specific pass/fail criteria, gather evidence, and block unsupported completion. Make sure to use this skill even when the user does not say "quality gate" if consequential work needs acceptance criteria or completion evidence. Skip formal gating for trivial, reversible, low-impact requests.

The English summary is being prepared. Showing the original description.

Add tree-sitter language support to codegraph end-to-end — wire the grammar + extractor, write tests, then benchmark extraction quality and retrieval value on 3 popular real-world repos. Use when the user runs /add-lang <language> or asks to add/support a new language (e.g. Lua, Elixir, Zig, OCaml) in codegraph.

The English summary is being prepared. Showing the original description.

Phase 4 Turn 2 of disease-market-sizing-orchestration (A6' upgrade). Audits compose output via Cite-or-Block strict — every anchor must reverse-resolve to an actual file in sources/, every fact claim must have an anchor. Returns verdict (ok/blocked) + violations list. Use AFTER cite-bound-content-generator (Turn 1), BEFORE report-bundle-builder (phase 5).

The English summary is being prepared. Showing the original description.

Benchmark CodeGraph retrieval quality on a real codebase by comparing agent behavior with vs without CodeGraph. Use when the user runs /agent-eval or asks to test, benchmark, audit, or validate a codegraph version (the local dev build or a published npm version) against a language's repo.

The English summary is being prepared. Showing the original description.

Cross-disease market sizing entry skill. Triggered by user one-liner like "做 X 市场调研" or "Run market sizing for X". Auto-runs 5 phase pipeline: contract → stratify → recall → compose-audit → bundle. Hard-gates on Cite-or-Block: every fact claim must carry citation anchor verifiable against sources/. Resumable mid-run.

The English summary is being prepared. Showing the original description.

Use when the user wants to design, redesign, shape, critique, audit, polish, clarify, distill, harden, optimize, adapt, animate, colorize, extract, or otherwise improve a frontend interface. Covers websites, landing pages, dashboards, product UI, app shells, components, forms, settings, onboarding, and empty states. Handles UX review, visual hierarchy, information architecture, cognitive load, accessibility, performance, responsive behavior, theming, anti-patterns, typography, fonts, spacing, layout, alignment, color, motion, micro-interactions, UX copy, error states, edge cases, i18n, and reusable design systems or tokens. Also use for bland designs that need to become bolder or more delightful, loud designs that should become quieter, live browser iteration on UI elements, or ambitious visual effects that should feel technically extraordinary. Not for backend-only or non-UI tasks.

The English summary is being prepared. Showing the original description.

All animation knowledge for HyperFrames — atomic motion rules, multi-phase scene blueprints, scene transitions, broader motion-design techniques, AND the seven runtime adapters (GSAP default, plus Lottie, Three.js, Anime.js, CSS keyframes, Web Animations API, TypeGPU). Use for any motion or animation task: pick 2-4 rules and compose, or load a blueprint, or look up runtime-specific API (e.g. GSAP eases / Lottie player / Three.js mixer). Also covers auditing an existing composition's choreography (animation map) and 24 named text-animation effects. HyperFrames-native: single paused timeline, seek-safe, deterministic.

The English summary is being prepared. Showing the original description.

Design, review, and diagnose tests and fixtures that can fail nondeterministically under CI concurrency, shared host resources, clocks, process-global state, subprocesses, network listeners, or asynchronous teardown. Use when adding or changing tests with those risks, investigating flaky CI, or reviewing test isolation; use pre-push-checks separately to select outgoing commands.

The English summary is being prepared. Showing the original description.

Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.

The English summary is being prepared. Showing the original description.

Manage Agent Skills across Codex, Claude Code, local/global/project roots, Skill Hubs, GitHub, skills.sh, and managed plugin caches. Use when searching, installing, updating, upgrading, syncing, merging, auditing, deduplicating, cleaning, packaging, publishing, validating, resolving upstream sources, choosing runtime or scope, or working with skill-upgrade, check_upstreams.ps1, Claude Code plugins, skills-lock.json, or skill-upstreams.json. Do not use for ordinary software-package upgrades or non-skill file cleanup.

The English summary is being prepared. Showing the original description.

Assess AWS, Azure, and GCP controls for IAM escalation and cloud service exposure.

The English summary is being prepared. Showing the original description.

Test Docker and Kubernetes security controls for RBAC abuse, breakout, and secret exposure.

The English summary is being prepared. Showing the original description.

Test egress and DLP controls using synthetic canary data across authorized exfiltration channels.

The English summary is being prepared. Showing the original description.

Test APIs against OWASP API Security Top 10 including discovery, auth abuse, and protocol-specific checks.

The English summary is being prepared. Showing the original description.

Actively enumerate in-scope hosts and services, then produce normalized network mapping artifacts.

The English summary is being prepared. Showing the original description.

Assess lateral movement and pivot paths across authorized internal trust boundaries.

The English summary is being prepared. Showing the original description.

Test authentication and session management controls for bypass and account takeover scenarios.

The English summary is being prepared. Showing the original description.

Plan and orchestrate authorized Nmap host discovery, port and service enumeration, NSE profiling, and reporting artifacts for in-scope targets.

The English summary is being prepared. Showing the original description.

Perform passive reconnaissance and leak intelligence collection with no direct contact to target systems.

The English summary is being prepared. Showing the original description.