Testing & Security skills

Use this skill when an incident or a serious near miss is closed and the team must learn from it, or an auditor asks for lessons learned, and someone says "run the post-mortem", "post-incident review", "lessons learned", "retro on the outage", "blameless review", "root cause of the incident" or "what do we change after this breach". Builds the timeline from records before the meeting, runs a blameless discussion, finds the contributing factors, and turns them into a few owned, dated actions linked to updates of the risk register, controls, playbooks and supplier records, then writes the review and an action tracker.

The English summary is being prepared. Showing the original description.

Use this skill when a company with a security applicability statement extends its management system to privacy or to AI, and asks "extend our SoA for privacy", "which privacy controls apply to a processor", "AI controls applicability", "SoA for our AI management system", "are we controller or processor for this" or "do the AI development controls apply if we only use a model". Settles the company's role per processing activity and per AI system, decides applicability of the additional controls from those roles and the risk or impact assessments, and writes an extension to the applicability statement plus role and scope notes.

The English summary is being prepared. Showing the original description.

Use this skill when an incident may have to be reported to an authority, customers or affected people, and the team asks "do we have to notify", "72 hours", "24 hour early warning", "is this a notifiable breach", "major incident report", "who do we tell and by when", "draft the breach notification" or "do we tell the customers". Fixes the facts and the awareness time, tests each regime and contract that may apply, builds one table of recipients and deadlines with the earliest first, drafts each notification for review, and records the reasoning for every decision not to notify.

The English summary is being prepared. Showing the original description.

Use this skill when a risk owner wants to accept a residual risk instead of treating it further, or when someone asks "write a risk acceptance", "we want to accept this risk", "risk exception form", "document the risk acceptance for the auditor", "security exception for this system", "can we sign off this risk" or "management accepted the risk, how do we record it". Drafts a one-page decision record per risk: the risk and its score, the options considered with cost, why acceptance is reasonable, compensating measures with evidence, conditions, expiry and the triggers that reopen it, with a signature block for the person who holds the authority.

The English summary is being prepared. Showing the original description.

Use this skill when a company needs a written risk assessment method before it builds or rescores a register, or when the current method produces registers where everything scores 3. Triggers: "write our risk methodology", "define likelihood and impact scales", "what is our risk appetite", "risk acceptance criteria", "who can accept a risk", "our auditor says the method is not repeatable", "risk matrix for our ISMS". Drafts a short method with likelihood and impact anchors in the company's own money, hours and records, a scoring rule, an acceptance threshold with an authority ladder, reassessment triggers, and a calibration test on five sample risks.

The English summary is being prepared. Showing the original description.

Use this skill when a team needs its first information security risk register, or has one that is a copied catalogue nobody owns, and asks "build our risk register", "draft a risk assessment", "what are our top risks", "risk register from scratch", "our auditor wants a risk assessment" or "turn our incidents and findings into risks". Drafts 20 to 40 company-specific risk scenarios from the material the agent can reach, scores them against an agreed method, proposes owners and treatments, and writes a CSV register plus a notes file of assumptions and questions for owners.

The English summary is being prepared. Showing the original description.

Use this skill when an existing risk register needs a check before an audit, a management review or a new owner takes it over, or when someone asks "clean up our risk register", "is our risk register any good", "review the risk register before the audit", "our risks have not been updated", "find duplicate risks", "who owns these risks" or "the scores look wrong". Reads the register read-only and finds stale, duplicated, unowned, orphaned and mis-scored entries, risks missing given the company's own incidents and findings, and expired acceptances, then writes a findings file with a proposed fix per line for the owners to decide.

The English summary is being prepared. Showing the original description.

Use this skill when the risk register and the statement of applicability were written separately and may not agree, and the team asks "do our risks link to our controls", "traceability between risk treatment and the SoA", "why is this control applicable", "the auditor could not trace a risk to a control", "check our risk treatment plan against the SoA" or "orphan controls". Checks in both directions that every treated risk points to controls and actions, and every applicable control traces back to a risk or obligation, then writes a traceability matrix and a list of orphans and contradictions with proposed fixes.

The English summary is being prepared. Showing the original description.

Use this skill when a risk register has treatment decisions but no plan anyone can execute, or when someone asks "write the risk treatment plan", "turn the risk register into actions", "what do we do about our high risks", "treatment plan for the auditor", "budget the security roadmap from the risks" or "our treatment plan is just a list of controls". Turns each reduce, avoid or transfer decision into dated actions with an owner, budget, dependency and the record that will prove it was done, states the expected residual score and why, and adds interim measures for risks that stay high while the work runs. Writes a CSV plan and a short notes file.

The English summary is being prepared. Showing the original description.

Use this skill when process owners, engineers or executives will be interviewed in an external or internal audit and need to be ready, or when someone asks "prepare the team for the auditor interviews", "what will the auditor ask our CTO", "interview briefing for the audit", "how should people answer the auditor", "mock audit interviews" or "our engineers are nervous about the audit". Builds a one-page brief per role: what the auditor is likely to ask, the records that person should be able to open, the honest way to answer what they do not know, and a short mock interview, plus an interview schedule with the evidence each session needs.

The English summary is being prepared. Showing the original description.

Use this skill when an external audit, attestation examination or assessment is coming and the team wants populations and evidence ready for the samples the auditor will pull, or asks "prepare for audit sampling", "what samples will the auditor ask for", "get our populations ready", "the auditor wants a list of all changes in the period", "evidence for the leavers sample", "Type II sample prep" or "how do we prove completeness of the population". Lists the populations an auditor is likely to sample, builds each from the system of record with the query that produced it, checks completeness and the evidence behind a dry-run sample, and writes a readiness file per population plus a list of gaps to fix before fieldwork.

The English summary is being prepared. Showing the original description.

Use this skill when a restore test is due, an auditor or customer asks for proof that backups can be recovered, or someone says "plan a restore test", "prove we can recover in time", "our backups succeed but we never restored", "test our RTO and RPO", "write up the disaster recovery test" or "document the backup restore for the audit". Picks what to restore, writes a test plan with success criteria set before the test, records timings against the recovery objectives, and produces a signed-off test record with the issues found and their owners.

The English summary is being prepared. Showing the original description.

Use this skill when an auditor will test change management, or the team wants to know before they do, and asks "sample our production changes", "check our PR approvals", "do we have segregation of duties on deploys", "test change management before the audit", "were emergency changes approved" or "can a developer push to production alone". Builds the change population from what actually reached production, reconciles it with tickets and pull requests, draws a recorded sample, tests approval, testing, segregation and emergency attributes, and writes the results and the exceptions as facts.

The English summary is being prepared. Showing the original description.

Use this skill when controls have no clear owner, or "security" owns everything, and the team asks "who owns each control", "build a RACI for our controls", "assign control owners", "nobody knows who runs the access review", "set a review cadence per control" or "the auditor asked who is accountable". Assigns one accountable role and the operators to every applicable control, checks workload and segregation of duties, sets a review cadence from how each control runs, and writes a RACI table plus a one-page brief per owner role.

The English summary is being prepared. Showing the original description.

Use this skill when a customer or prospect has sent a security questionnaire, due diligence form or vendor assessment and someone asks "answer this security questionnaire", "fill in the customer's vendor assessment", "draft answers from our policies", "we have 300 questions due Friday", "reuse our previous questionnaire answers" or "which answers can we not back up". Drafts every answer from the company's own documents with a source and a confidence level, flags answers without evidence and answers that create commitments, checks consistency with past answers, and writes an answer sheet plus a list of items for owners to confirm.

The English summary is being prepared. Showing the original description.

Premium brand-kit image generation skill for creating high-end brand-guidelines boards, logo systems, identity decks, and visual-world presentations. Trained for minimalist, cinematic, editorial, dark-tech, luxury, cultural, security, gaming, developer-tool, and consumer-app brand systems. Optimized for intentional logo concepting, refined composition, sparse typography, strong symbolic meaning, premium mockups, art-directed imagery, and flexible grid layouts.

The English summary is being prepared. Showing the original description.

Analyze a repository to generate recommended Claude Code settings.json permissions. Use when setting up a new project, auditing existing settings, or determining which read-only bash commands to allow. Detects tech stack, build tools, and monorepo structure.

The English summary is being prepared. Showing the original description.

Audits project dependencies across language ecosystems for known vulnerabilities, license conflicts, transitive risks, and outdated packages, and plans safe upgrades. Use before a release, when adding dependencies, or during a security or license compliance review.

The English summary is being prepared. Showing the original description.

Helm chart development agent skill and plugin for Claude Code, Codex, Gemini CLI, Cursor, OpenClaw — chart scaffolding, values design, template patterns, dependency management, security hardening, and chart testing. Use when: user wants to create or improve Helm charts, design values.yaml files, implement template helpers, audit chart security (RBAC, network policies, pod security), manage subcharts, or run helm lint/test.

The English summary is being prepared. Showing the original description.

Comprehensive guide for configuring and managing GitHub Dependabot. Use this skill when users ask about creating or optimizing dependabot.yml files, managing Dependabot pull requests, configuring dependency update strategies, setting up grouped updates, monorepo patterns, multi-ecosystem groups, security update configuration, auto-triage rules, or any GitHub Advanced Security (GHAS) supply chain security topic related to Dependabot. For pre-commit dependency vulnerability scanning in AI coding agents via the GitHub MCP Server, this skill references the Advanced Security plugin (`advanced-security@copilot-plugins`). Use this skill when an agent needs to scan dependencies for known vulnerabilities before committing.

The English summary is being prepared. Showing the original description.

Scaffolds an xUnit integration test project for validating Oracle-to-PostgreSQL database migration behavior in .NET solutions. Creates the test project, transaction-rollback base class, and seed data manager. Use once per project before writing Oracle-to-PostgreSQL migration integration tests.

The English summary is being prepared. Showing the original description.

Audits SwiftUI performance: rendering, scrolling, CPU and memory, unnecessary view updates, body re-evaluations, and layout thrashing, with Instruments guidance when code review is inconclusive. Use when a SwiftUI screen stutters, scrolls poorly, or uses too much CPU.

The English summary is being prepared. Showing the original description.

Audits Python + BigQuery pipelines for cost safety, idempotency, and production readiness. Returns a structured report with exact patch locations. Use before deploying or after a cost spike in a Python pipeline that queries BigQuery.

The English summary is being prepared. Showing the original description.

Creates an integration testing plan for .NET data access artifacts during Oracle-to-PostgreSQL database migrations. Analyzes a single project to identify repositories, DAOs, and service layers that interact with the database, then produces a structured testing plan. Use when planning integration test coverage for a migrated project, identifying which data access methods need tests, or preparing for Oracle-to-PostgreSQL migration validation.

The English summary is being prepared. Showing the original description.