Testing & Security skills

Use when writing, testing, or deploying a Prisma Composer app. Read the official Composer skill even if the project has no local copy.

The English summary is being prepared. Showing the original description.

The LAW a council SEAT is bound by — deliberation protocol, pact obligations, governance, and decision-ledger recording — the discipline half of a seat. Trigger when: - Holding a seat on a bound council (architect, lead-maintainer, process-auditor, or a summoned guest). - Depositing an independent assessment, routing a decision, or recording assent or a finding. - Auditing whether the council honored the pact, the delegation table, or the barring lifecycle. - Prompt contains: /council, council seat, deliberation protocol, pact, delegation table, decision ledger, barring, merge-consent.

The English summary is being prepared. Showing the original description.

Protocol for auditing API surface coherence and type safety. Trigger when: - Evaluating API designs, interface type safety, or design elegance. - Prompt contains: /api-audit, API surface, API coherence, type safety.

The English summary is being prepared. Showing the original description.

Normative sufficiency conditions for Initial Boundary Conditions (IBCs) and the SOP for the cheap-tier boundary refinement loop (/boundary). Trigger when: - Crafting, auditing, or refining a prompt/IBC destined for an expensive (architect-class) model or an autonomous worker dispatch. - Evaluating whether a task frame is sufficient to bound an agent walk. - Prompt contains: /boundary, IBC, initial boundary condition, boundary contract, sufficiency conditions, worker prompt, prompt refinement.

The English summary is being prepared. Showing the original description.

Phased risk-centric security assessment framework. Trigger when: - Auditing code for vulnerabilities, checking SQL injection, access control, or buffer overflows. - Prompt contains: /security-audit, security audit, taint analysis, threat model, vulnerability.

The English summary is being prepared. Showing the original description.

Trigger when auditing documentation, checking markdown link integrity, formatting tables, checking headers, or verifying absolute/relative paths.

The English summary is being prepared. Showing the original description.

Guidelines and strategies for constructing meaningful test suites, property-based tests, metamorphic relations, and fuzzing harnesses. Trigger when: - Designing verification bounds, writing tests, creating test invariants, or implementing validation gates. - Prompt contains: testing, test design, property-based testing, PBT, metamorphic testing, fuzzing, integration tests, E2E.

The English summary is being prepared. Showing the original description.

SOP for the automated refinement loop (/refine) workflow. Trigger when: - Exhaustively auditing and optimizing pre-existing codebase artifacts. - Applying iterative contraction mapping to reduce code entropy. - Prompt contains: /refine, refinement loop, contraction mapping, fixed-point sweep.

The English summary is being prepared. Showing the original description.

SOP for structured documentation lifecycle. Trigger when: - Designing, writing, reviewing, or auditing large-scale documentation structures. - Navigating phases: Audit, Plan, Draft, Review, Verify. - Prompt contains: /doc, doc workflow, audit, draft, review, verify, documentation debt.

The English summary is being prepared. Showing the original description.

Conditional discipline for projects hosted on a git forge (GitHub, GitLab, Forgejo, …): branch↔PR mapping, self-contained PR prose, review-on-forge, merge consent, and the forge audit. Trigger when: - Opening, updating, reviewing, or merging a pull/merge request. - A campaign's integration branch is ready to surface on a forge. - Auditing forge-side presence at merge-consent or campaign CLOSE. - Prompt contains: /forge, pull request, PR body, merge request, forge discipline, PR review, stacked PR.

The English summary is being prepared. Showing the original description.

SOP for locating, auditing, and importing production-tested reference patterns and peer-reviewed literature. Trigger when: - Designing or implementing non-trivial algorithms, system protocols, design patterns, or major library integrations. - Prompt contains: prior art, reference implementation, research patterns, standard implementation, arXiv, RFC.

The English summary is being prepared. Showing the original description.

SOP for auditing AI-generated code. Trigger when: - Reviewing, refactoring, or cleaning up AI-generated code to prevent regressions or hallucinated APIs. - Prompt contains: /ai-audit, code audit, AI cleanup, common flaws.

The English summary is being prepared. Showing the original description.

Idiomatic programming style, patterns, and conventions for Go (Golang) development. Trigger when: - Writing, refactoring, reviewing, or debugging Go code. - Files matching the pattern **/*.go (including go.mod, go.sum) are in the workspace or referenced. - Tasks involve: go fmt, go test, go build, go vet, golangci-lint. - Prompt contains keywords: go, golang, goroutine, channel, select, interface, err != nil, defer, panic, gofmt, struct.

The English summary is being prepared. Showing the original description.

Durable categorized record-keeping for any predicate-enabled walk. Trigger when: - Classifying a step's output for recording (decision, finding, debt, feedback). - Promoting a scratch artifact to the ledger, to repo/docs, or to a category home (.ledger/tech-debt/, .ledger/process-feedback/). - Auditing whether a draft is structurally ready for its destination. - Running a zero-context sensibility read before committing to promotion. - Recording a known limitation as a tech-debt entry (not prose in the log). - Recording a friction, miss, improvement, or process amendment. - Prompt contains: /record, record-keeping, promote, ledger note, zettelkasten, scratch-to-ledger, zero-context read, over-strip, classification trigger, tech-debt, process-feedback, amendment.

The English summary is being prepared. Showing the original description.

Propose the test(s) FIRST and get a human to sign off on the behaviour before writing the code — the test analog of /schema-review and /ui-proposal. For hand-written LOGIC in packages/* (apps opt-in, pocs exempt). Renders the proposed failing test as a reviewable contract, holds for lgtm/approve, then you write the code to make it green. Use when an agent is about to implement packages/* logic, or when asked to "write the test first", "TDD this", "agree on the test", run /test-review.

The English summary is being prepared. Showing the original description.

How to actually run every kind of test in nuxt-crouton (unit/e2e/typecheck/lint, verified commands) plus the HONEST coverage picture — which packages have real tests vs zero, the dormant skipped/todo cases behind three mocking walls, and what CI truly gates vs what CLAUDE.md claims. Use when asked "how do I run the tests", "is X covered by tests", "what does CI actually check", "why is this suite skipped", "where do I add a test", or before trusting a green build as evidence that something works.

The English summary is being prepared. Showing the original description.

Code Review Assistant. Reviews uncommitted changes or recent commits for pattern violations, security issues, and bugs. Optimized for solo dev moving fast. Use when reviewing code before or after committing.

The English summary is being prepared. Showing the original description.

The catalog of every config-as-data surface in nuxt-crouton — which file controls what, who actually reads it, its drift hazards, and how to change it safely. Use when asking "where is X configured", "who reads this file", "what happens if I edit harness.config.mjs / routing.json / digests.yml / labels.yml / a deploy.config.json / an e2e.manifest.json", when a setting change had no effect (silent no-op), when adding a new config surface, or when a gen-*.mjs --check fails. Trigger phrases: "where do I configure", "what reads this config", "config drift", "the setting didn't do anything", "stale generated doc", "add a new config-as-data surface".

The English summary is being prepared. Showing the original description.

Adversarially probe this monorepo for security flaws at the right depth. Steers the red-team subagent — picks quick/standard/deep from the request, spawns it (fanning out for a wide deep sweep), collates findings into a dated report, and files security/sec:* issues for confirmed high/critical findings. Use when asked to "red-team", "try to hack this", "find security holes", "pentest this package/app", or as the brain behind the CI + daily security runs.

The English summary is being prepared. Showing the original description.

Accessibility review for Vue surfaces — the code-cleaning analog of /code-review and /simplify, pointed at WCAG/ARIA. Reviews just your diff (or a package/file), rates findings by severity, and either comments inline on the PR (--comment) or applies the safe fixes for you (--fix). Steers the depth-aware `a11y` subagent. Use when asked to "check accessibility", "a11y this", "audit ARIA/keyboard", or run /a11y.

The English summary is being prepared. Showing the original description.

Run the Playwright fixture smoke harness to prove a real generated crouton app still boots, authenticates, and does CRUD after a dependency bump or package change. Use when asked to "smoke test", "run e2e", "verify against a fixture", or to check that a packages/ change doesn't break consuming apps.

The English summary is being prepared. Showing the original description.

Run the "get dependencies current" flow for this monorepo — sweep for available updates, triage into safe / deliberate / wait buckets, bump the pnpm catalog, and prove it with the typecheck + e2e gate. Use when asked to "update dependencies", "are we on the latest", "do the quarterly sweep", "bump deps", or when the recurring sweep ticket comes due. We run NO update bot on purpose (#141) — this skill IS the update process.

The English summary is being prepared. Showing the original description.

The crouton-conformance gate — the SECOND acceptance axis of graduation (the first is the experience side-by-side, /graduate stage C1). Checks a graduated app is a REAL crouton app — CLI-scaffolded, real collections, consumes the correct packages without reinventing them — by composing the existing probes (frontend-review, a11y, e2e-smoke, typecheck) plus crouton-structural checks, then renders a required, signed-off checklist on the graduation PR. Use at /graduate stage C2, or when asked "is this app crouton-native", "run the conformance gate", "check graduation conformance".

The English summary is being prepared. Showing the original description.

Audit packages for documentation completeness, detect drift between code and docs, and maintain documentation quality across the monorepo. Use when checking package docs, running audits, or reviewing documentation health.

The English summary is being prepared. Showing the original description.