Test design, vulnerability assessment, and quality assurance (13K skills)
Static application security testing (SAST) for changed source files — Vulnetix's built-in rule set plus optional Semgrep augmentation when `.semgrep` config is present. Use when reviewing a PR for code-level vulnerabilities, scanning a feature branch before merge, gating CI on critical findings, or running rule-specific checks for a known weakness class.
The English summary is being prepared. Showing the original description.
Dockerfile / Containerfile / compose analysis plus optional Trivy / Grype / Syft composition when those binaries are present. Use when reviewing a Dockerfile PR, gating `docker build`, building an image SBOM, evaluating base-image risk, or auditing a registry image for CVEs.
The English summary is being prepared. Showing the original description.
Dependency-conflict resolution when a `fix` version bump fails — diagnose the peer-dep tree, find a compatible safe version set, propose package-manager overrides (`overrides`/`resolutions`/`replace`/`[patch]`), fall back to safe-harbour inline patching. Use when an upgrade is blocked by transitive constraints, a peer-dep conflict surfaces, or you need to override a vulnerable transitive without bumping the parent.
The English summary is being prepared. Showing the original description.
Hardcoded-secret detection — AWS keys, GitHub PATs, Slack tokens, Stripe keys, generic high-entropy strings. Pre-commit (`--staged-only`), explicit paths, or full repo. Use when guarding `git commit`, auditing a repo for leaked credentials, validating no secrets entered the diff before push, or producing a rotation list for an exposed-secret incident.
The English summary is being prepared. Showing the original description.
Generate a runnable exploit-validation command (Nuclei template, Metasploit module hint, AI-assisted Python script, or curl-based PoC) against a user-specified authorised target. Use when validating that a fix actually closed the vulnerability path, confirming a patch deployed correctly, or producing a copy-pasteable test command for QA. The skill never executes — the user runs.
The English summary is being prepared. Showing the original description.
Typosquat and malicious-package detection across installed dependencies (or a single prospective addition) — cross-checks AI-malware family intelligence, package-name similarity to known popular packages, low maintainer-health signals. Use when auditing a freshly-onboarded repo, vetting a single suspicious package, gating CI on supply-chain risk, or investigating an incident.
The English summary is being prepared. Showing the original description.
Package license analysis — detect copyleft conflicts against a permissive policy, surface AGPL / SSPL / GPL contaminants, output SPDX SBOM with per-package license findings. Use when auditing a release for license compliance, vetting a new dependency's license, building an OSS-attribution document, or producing a customer-facing license disclosure.
The English summary is being prepared. Showing the original description.
End-of-life detection for runtimes (Node, Python, Java, Go, .NET) and key packages — surfaces past-EOL items, items reaching EOL within 90 days, and EOL base images for containers. Use when planning a runtime upgrade, auditing for unsupported versions, gating a deploy against EOL deps, or producing a remediation roadmap.
The English summary is being prepared. Showing the original description.
エンジニアとして手を動かす作業全般で必ず発火させる: コードを書く / テストを書く / リファクタ / バグ修正 / E2E spec 追加 / 既存仕様への小さな修正など、コードに触る作業すべて。「実装して」「テスト書いて」「リファクタして」「バグ直して」のような依頼を受けたとき、または基本設計が済んで実装フェーズに入るときに発火。基本作業は TDD（テスト先書き → 最小実装 → リファクタ → コミット）で進め、要件が大きければ適切な小ささに分割しつつサイクルを回す。発火しないのは要件定義 / 基本設計の対話中（まだ手を動かしていない時）だけ。
The English summary is being prepared. Showing the original description.
設計判断・ライブラリ選定・アーキ判断・実装アプローチが 2 つ以上ありえる場面で必ず発火させる、「複数案＋メリデメ＋推奨」を提示する横断スキル。「どっちがいい？」「これでいい？」「方針を相談したい」と聞かれたとき、ライブラリ選定・ディレクトリ構成・API 設計・テスト戦略のように選択肢が複数ある相談を受けたとき、要件定義 / 設計 / 実装の中で「複数アプローチがありそう」と感じたときに必ず使う。一案だけポンと出さない。
The English summary is being prepared. Showing the original description.
E2E テストの spec を書く・編集する・レビューする際に必ず発火させる。新しいシナリオの追加、既存 E2E テストの修正・デバッグ、E2E テストの書き方の相談、slice-tdd skill から E2E spec が必要と判断された場面で使う。触る範囲に対応するプロジェクトの E2E の流儀 (spec の書き方・構造・命名) を探して従わせる入口。E2E を実行する手順は扱わない (別スキルの責務)。
The English summary is being prepared. Showing the original description.
E2E テストを実行する手順に沿って E2E を動かす際に発火させる。実行環境のセットアップ、実行コマンド、CI 統合、実行が失敗したときの対処など、E2E を「動かす」場面で使う。触る範囲に対応するプロジェクトの実行手順を探して従わせる入口。E2E spec を書く・レビューするのとは別の責務 (spec の書き方は扱わない)。
The English summary is being prepared. Showing the original description.
Weekly read-only repository audit. Grades one rotating rubric from .claude/audit-rubrics/, files between zero and five GitHub issues for what it finds, and changes no files. Use when the user asks to audit the repo, or when the audit-weekly workflow invokes it. It never edits, commits, branches, or opens pull requests.
The English summary is being prepared. Showing the original description.
Playwright workflows for deterministic third-party responses using page.route().
The English summary is being prepared. Showing the original description.
Playwright workflows for authenticated browser state reuse through storageState and setup projects.
The English summary is being prepared. Showing the original description.
Diagnostic Playwright workflows for flaky or failing tests, including trace analysis, UI mode, and state isolation.
The English summary is being prepared. Showing the original description.
Conducts rigorous authoring and review of Playwright E2E tests. Enforces accessibility-first locators, web-first assertions, strict isolation, and DAMP architecture. Use when generating, refactoring, or reviewing any Playwright test code.
The English summary is being prepared. Showing the original description.
脅威と攻撃面を洗い出し、最小権限と安全な失敗で守るための判断軸。認証/認可、入力検証、秘密情報管理、監査ログ等の設計・実装・レビューで使う。
The English summary is being prepared. Showing the original description.
Agent Browser（Headlessブラウザ自動化CLI）を使ったUI検証・E2Eテスト・スクリーンショット取得の判断軸。アクセシビリティツリーベースの要素選択を優先し、壊れにくいテスト設計を目指す。
The English summary is being prepared. Showing the original description.
テストピラミッド・テスト設計・品質戦略を整理する判断軸。テストの粒度・スコープ・優先順位に迷ったときに使う。TDDの具体的な実装手順は developer-specialist と併用する。
The English summary is being prepared. Showing the original description.
ego-browser (ego-lite) is a Chromium-based browser that gives AI agents a CLI-accessible Node.js runtime for driving a real browser. Use this skill whenever the user needs to interact with a website opening pages, filling forms, clicking buttons, taking screenshots, extracting page data, testing web apps, logging into sites, automating browser operations, or any other browser automation task. Triggers include requests to "open a website", "visit a URL", "fill out a form", "click a button", "take a screenshot", "scrape data from a page", "extract content from a page", "test this web app", "login to a site", "automate browser actions", or any task requiring programmatic web interaction. Also used for exploratory testing, dogfooding, QA, bug hunting, or reviewing app quality. Prefer ego-browser over any built-in browser automation, web fetch, or other web tools.
The English summary is being prepared. Showing the original description.
Use when reviewing local staged or unstaged implementation changes for a .plans/ROADMAP.md item in this repository. Performs a static-only code review without running tests, linters, builds, formatters, or app commands; checks roadmap alignment, .plans/DEVIATIONS.md quality, TypeScript/API boundary design, and React implementation quality.
The English summary is being prepared. Showing the original description.
Run test checks for VK.
The English summary is being prepared. Showing the original description.
Reconstructed reference notes on US NRC software assurance guidance for digital computer software in nuclear power plant safety systems, built from seven public-domain sources (Regulatory Guide 1.168 Revision 2, July 2013; Regulatory Guides 1.169, 1.170, 1.171, 1.172, and 1.173 Revision 1, July 2013; NUREG-0800 Branch Technical Position 7-14 Revision 6, August 2016; pinned 2026-10-12). Use for software life cycle process questions, software requirements specifications, software configuration management plans, verification and validation with reviews and audits, test documentation and unit testing, and what NRC staff examine in a BTP 7-14 software review of plans, implementation, and design outputs. SCOPE LIMITS: NRC Regulatory Guides and the BTP 7-14 staff review position only; the endorsed IEEE standards (IEEE Std 603-1991, 7-4.3.2-2003, 828-2005, 829-2008, 830-1998, 1008-1987, 1012-2004, 1028-2008, 1074-2006), IEC 60880, IEC 61513, IEC 62138, and IAEA guides are cited by designation and edition only, with no standard text; RG 1.152 Rev 4, BTP 7-18, BTP 7-19, other SRP Chapter 7 sections, and NUREG/CR contractor reports are outside the pack; reflects the pinned 2013 and 2016 editions, not later agency actions; synthesized reference notes, not legal or licensing advice and not a substitute for the source documents. LICENCE: Public Domain (US Government work, 17 U.S.C. § 105).
The English summary is being prepared. Showing the original description.