Test design, vulnerability assessment, and quality assurance (13K skills)
アプリのテストはすべてこのスキルを使う。開発中のTDD（テストファースト）から、 ユーザー目線のE2E・受入テスト、インフラ/デプロイ検証、リリース前の網羅テストまでを1つに統合。 「テストを書いて」「テストして」「動作確認して」「TDDで進めて」「カバレッジを確認」 「E2Eテスト」「リリース前にちゃんとテストしたい」「本番で動くか確認」「回帰テスト」 などの文脈で必ず使用する。§0「適用段階」に従い、たたき台〜v1 では「壊れたら困る順」の最小テスト、 固定化段階(v1 到達後のブラッシュアップ)ではユーザーがテストと明示しなくてもTDDサイクルを適用する。 セキュリティ・コスト・パフォーマンスの監査は Skill launch-security を併用する。
The English summary is being prepared. Showing the original description.
社内向け業務アプリを「業務に必要な機能一式を盛り込んだ初回リリースを最短で出し、そこから育てる」MVPファーストで開発するための思考法・進行ルール。依頼者が非エンジニアである前提の会話プロトコル、1画面1目的のUI原則、決めること/決めなくていいことの仕分け、社内アプリの必要最低限セキュリティライン、残課題の管理方法を定める。「とりあえず形にして」「まず動くものを」「MVPで」「さっと使えるものを」「社内ツールを早く」「非エンジニアに見せたい」などの依頼で必ず使用する。新規アプリの要件定義ステージ開始時に app-excellence とセットでロードする。
The English summary is being prepared. Showing the original description.
アプリの本番品質を保証する統合スキル。セキュリティ監査・例外/エラー処理設計・攻撃別対処・ サーバーコスト最適化・パフォーマンス最適化を1つのゲートで検査する。 「セキュリティチェックして」「リリースしていい？」「本番公開前の確認」「脆弱性診断」「監査して」 「エラー処理を設計して」「例外処理を入れて」「攻撃対策」「レート制限」「コストを抑えたい」 「無料枠に収めたい」「パフォーマンス改善」「重い」などの文脈で必ず使用する。 また、認証・ユーザー入力・API・決済・機密データを扱うコードを書いた直後、およびデプロイ前には ユーザーが明示しなくても本スキルの該当セクションを適用する。 デプロイ手順自体は Skill cloudflare-secure-deploy、認証実装は Skill better-auth-google-gate、 LLMコストは Skill llm-api-integration / llm-cost-simulator を併用する。
The English summary is being prepared. Showing the original description.
Cloudflare Durable Objects の実装とレビューに使用する。チャットルーム、マルチプレイ、予約システムなどの状態を持つ協調処理、RPC methods、SQLite storage、alarms、WebSockets、Workers統合、wrangler設定、Vitestでのテストを扱う。事前学習の知識より最新のCloudflare docsの取得を優先する。
The English summary is being prepared. Showing the original description.
Cloudflare WorkersのCI(自動検査)とCD(自動デプロイ)を、Workers Buildsまたは外部CI/CDから案件に合う1経路だけ選び、無料枠に収まる最小構成で構築・運用するためのスキル。 「CIを入れて」「CDを組んで」「自動デプロイしたい」「GitHub Actions」「ワークフロー」「テストを自動で回したい」 「マージしたら勝手に公開されるようにして」「デプロイを自動化して」「CIが落ちた」「Actionsが失敗する」 「デプロイの手作業をなくしたい」「Cloudflareの設定が分からない」「非エンジニア向け手順を作って」などの文脈で必ず使用する。 デプロイ先が Cloudflare Workers の場合は Skill cloudflare-secure-deploy を併用する(D1マイグレーションの扱いが最重要)。ブランチ・PR・タグの規約は Skill solo-git-flow に従う。手動デプロイを繰り返している状況を見つけたら、依頼されていなくても このスキルの §0 を読んで導入可否を判断すること。
The English summary is being prepared. Showing the original description.
Stress-test plans before committing by imagining they've already failed. Three modes. Diagnostic mode runs a full pre-mortem session — vivid failure scene-setting, six failure categories, the monkey test, and concrete plan adjustments. Review mode checks previous findings monthly for changed probabilities and new failure modes. Alert Triggers mode defines and monitors early warning signals across four trigger categories. Use before any major commitment — strategy, investment, product launch, partnership — or regularly to keep assumptions honest. The planning fallacy is real. The spreadsheet looked great so everyone stopped thinking. This is the antidote. Based on practice by Eterdis (eterdis.com).
The English summary is being prepared. Showing the original description.
Strategy cascade based on Roger Martin and A.G. Lafley's Playing to Win framework. Five interconnected choices that define a real strategy — not a vision statement, not a list of priorities, not a strategic plan that's really just a budget with adjectives. Runs in three modes — Diagnostic for building or rebuilding the full cascade, Review for pressure-testing an existing one, and Alert Triggers for defining the tripwires that tell you the cascade is breaking. Updates company-context.md after every run. Triggers on questions about strategy, strategic choices, winning aspiration, where to play, how to win, competitive strategy, or when someone says "we need a strategy" and means it. Based on practice by Eterdis (eterdis.com).
The English summary is being prepared. Showing the original description.
VRIO resource analysis combined with Dynamic Capabilities assessment. Use this skill to identify real competitive advantages (Barney VRIO framework), then test whether the organisation can sense new opportunities, seize them, and transform itself to stay ahead (Teece dynamic capabilities). Runs in three modes — full diagnostic for deep first-use sessions, review mode for quick re-assessment, and alert triggers for defining early-warning signals. Updates company-context.md after every run. Triggers on questions about competitive advantage, defensibility, resource assessment, why competitors are gaining ground, organisational agility, or whether advantages will hold. Based on practice by Eterdis (eterdis.com).
The English summary is being prepared. Showing the original description.
このリポジトリでワークツリーを作成・利用・片付けるときの手順。git wt でブランチ用のワークツリーを作るとき、ワークツリーでサービス起動・DB操作・テストを行うとき、作業が終わってワークツリーを削除するときに使う。
The English summary is being prepared. Showing the original description.
Research and stress-test open-source project names, from collision checks to launch-ready decisions. Use when the user asks to name or rename a project, compare candidate names, screen GitHub or package namespace risk, verify language or mythology claims, or improve SEO/GEO clarity. Perform live web and registry research, separate brand from category descriptor, classify collisions, and return one evidence-backed recommendation.
The English summary is being prepared. Showing the original description.
Use before feature, bugfix, or refactor implementation when behavior can be tested; enforces Red-Green-Refactor discipline.
The English summary is being prepared. Showing the original description.
Use for security review, audit, hardening, compliance, DevSecOps, network, infrastructure, or application security with focused references.
The English summary is being prepared. Showing the original description.
Deploy and use the Exasol Text AI Extension (TXAIE) with notebook-connector. Covers `deploy_license`, `initialize_text_ai_extension`, the `PYTHON3_TXAIE` language container, the Extraction API classes `StandardExtractor`, `NamedEntityExtractor`, `TopicClassifierExtractor`, `PipelineExtractor`, and `BranchExtractor`, named-entity, zero-shot classification, and feature extraction runs, default-model installation, and result-table querying such as `TXAIE_AUDIT_LOG`.
The English summary is being prepared. Showing the original description.
Browse the web for any task — research topics, read articles, interact with web apps, fill forms, take screenshots, extract data, and test web pages. Use whenever a browser would be useful, not just when the user explicitly asks.
The English summary is being prepared. Showing the original description.
X (Twitter) integration for NanoClaw. Post tweets, like, reply, retweet, and quote. Use for setup, testing, or troubleshooting X functionality. Triggers on "setup x", "x integration", "twitter", "post tweet", "tweet".
The English summary is being prepared. Showing the original description.
Browse the web for any task — research topics, read articles, interact with web apps, fill forms, take screenshots, extract data, and test web pages. Use whenever a browser would be useful, not just when the user explicitly asks.
The English summary is being prepared. Showing the original description.
X (Twitter) integration for NanoClaw. Post tweets, like, reply, retweet, and quote. Use for setup, testing, or troubleshooting X functionality. Triggers on "setup x", "x integration", "twitter", "post tweet", "tweet".
The English summary is being prepared. Showing the original description.
Audit a composer output against four hard checks before delivery — cite integrity, voice rules, word count, schema validity. Always invoked after the polisher (English) or humanizer-* (Arabic / Hebrew). Emits a VerificationReport Pydantic object; orchestrator branches on `overall_passed`. Target ≥0.9 score per run. Triggers automatically as the final composer sub-agent; not user-facing.
The English summary is being prepared. Showing the original description.
Standardized bug fix workflow using TDD (Red-Green-Refactor). Use when fixing bugs, resolving issues, or when the user invokes /bugfix. Ensures root cause analysis, failing test first, then minimal fix.
The English summary is being prepared. Showing the original description.
Analyze PermissionRequest decision logs and improve auto-approve configuration across all layers. Covers settings.json patterns, static rule engine, LLM evaluator prompt, and tests. Use when asked to "update auto-approve", "improve permissions", "reduce unnecessary asks", or "optimize permission rules".
The English summary is being prepared. Showing the original description.
Execute a pre-existing plan file by implementing tasks sequentially with test verification after each step. Use when plan/tasks are already decomposed and ready for implementation.
The English summary is being prepared. Showing the original description.
Design test viewpoints and test cases from code changes using ISO 25010. Use when writing test plans for plan.md, reviewing PR test coverage, or when asked to 'テスト設計', 'テスト観点洗い出し', 'design test cases'. Do NOT use for writing test code or TDD workflows (use /bugfix).
The English summary is being prepared. Showing the original description.
Validate logical consistency of decisions and claims through context forking. Use proactively when judgment validity is unclear, but prefer direct tools (Read, Bash) for simple verifications like file contents or test results.
The English summary is being prepared. Showing the original description.
Comprehensive documentation audit and refresh. Checks code-documentation drift, generates prioritized report, then updates with approval. Use for: 'ドキュメント監査', 'docs audit', 'ドキュメント棚卸し', 'README全体見直し', 'documentation health check'.
The English summary is being prepared. Showing the original description.