Testing & Security skills

Audits WordPress plugin or theme PHP code for the most common security mistakes — missing nonce checks, capability checks, input sanitization, output escaping, unslashing, SQL preparation, AJAX nopriv exposure, file/path traversal, and unsafe redirects. Use when reviewing pull requests, before releasing a plugin, when the user asks "is this secure", or when handling code that touches $_GET / $_POST / $_REQUEST / $_COOKIE / $_FILES / $_SERVER, admin-ajax / admin-post, REST endpoints, options, user meta, custom DB queries, or file uploads.

The English summary is being prepared. Showing the original description.

Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.

The English summary is being prepared. Showing the original description.

Manage the NV oOS Pro Toolkit Security Operations system — audit events, security training, maintenance windows, and incident records. Covers the full security ops lifecycle: audit logging, incident detection/response, maintenance scheduling, and compliance training tracking. Use when working with security audit trails, investigating incidents, scheduling maintenance windows, managing security training programs, or troubleshooting security operations data.

The English summary is being prepared. Showing the original description.

Generate production-quality Excalidraw architecture diagrams from natural language. Visual structure maps to conceptual structure — fan-out for one-to-many, timelines for sequences, convergence for aggregation. Includes self-validation via Playwright render review.

The English summary is being prepared. Showing the original description.

Autonomous AI security pen testing. Executes real exploits against web applications to find SQL injection, XSS, SSRF, authentication flaws, and IDOR vulnerabilities. Reports only confirmed, reproducible findings — no false positives.

The English summary is being prepared. Showing the original description.

Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, update or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.

The English summary is being prepared. Showing the original description.

Generate or audit an `/llms.txt` file at the site root that makes the site legible to LLMs and AI answer engines at inference time, following the llms.txt proposal (Jeremy Howard, 2024). Use this skill whenever the user asks to "build llms.txt", "create llms.txt", "generate llms.txt", "audit llms.txt", "make my site LLM-friendly", "expose the site to AI assistants", "let ChatGPT / Claude / Perplexity cite my site", "add an AI assistants index", or asks about `.md` companion pages for LLM consumption. Output is a valid `llms.txt` file (or an audit) plus optional `.md` companion page generation for top pages.

The English summary is being prepared. Showing the original description.

Audit on-page SEO and GEO (generative engine optimization) signals across the site — title tags, meta descriptions, H1/H2/H3 hierarchy, canonical tags, Open Graph, structured data, content length, internal link density, and AI-citation readiness. Use this skill whenever the user asks to "audit SEO", "check metadata", "review titles and descriptions", "check heading structure", "run an SEO audit", "GEO audit", "check schema markup", "find SEO issues", or review any on-page signal affecting organic or AI-search visibility. Output is a prioritized issue list with per-page findings and fixes.

The English summary is being prepared. Showing the original description.

Audit an existing sitemap.xml / robots.txt or generate new ones following sitemaps.org protocol and Google Search Central guidance, with a growth-first default that allows every crawler including AI search and AI training bots. Use this skill whenever the user asks to "build a sitemap", "generate sitemap.xml", "audit the sitemap", "refresh sitemap", "write robots.txt", "check robots", "allow AI crawlers", "block AI crawlers", "fix crawl budget", "submit to Google", or any other discovery / indexing configuration task. Output is a valid sitemap.xml (or sitemap index) and/or robots.txt, plus a written audit when auditing.

The English summary is being prepared. Showing the original description.

Classify incoming issues into the live GitHub label queue, reproduce where cheap, and write an auditable QUEUE.md snapshot. Use when triaging a backlog, running the scheduled triage routine, or deciding what the factory should pick up next.

The English summary is being prepared. Showing the original description.

Verify an open factory PR before human review - re-runs gates, checks the test proves the fix, checks scope and test tampering. Use when reviewing a factory PR, running the PR review routine, or asked to independently check a change.

The English summary is being prepared. Showing the original description.

Independently verify a factory pull request, including fail-closed gates, negative test proof, scope, and load-bearing review.

The English summary is being prepared. Showing the original description.

Scheduled health sweep that closes the factory loop - reads CI failures, recent commits, dependency and security advisories, and live queue labels, then files issues and writes an immutable run record. Use for the nightly or weekly monitor routine.

The English summary is being prepared. Showing the original description.

Inspect factory health, stale work, CI, security advisories, and recent run evidence without implementing fixes.

The English summary is being prepared. Showing the original description.

Classify GitHub issues into the factory's live label queue and write an auditable snapshot. Use for backlog triage or a scheduled triage run.

The English summary is being prepared. Showing the original description.

Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders.

The English summary is being prepared. Showing the original description.

Generates production-grade Appium mobile automation scripts for Android and iOS in Java, Python, or JavaScript. Supports real device and emulator testing locally and on TestMu AI cloud with 100+ real

The English summary is being prepared. Showing the original description.

Asset and IT register: serial, model, condition, assignee, location, purchase value, warranty expiry and return date, as CSV, SQL, JSON Schema or Notion on request. Use for asset audits.

The English summary is being prepared. Showing the original description.

Companion to atlas-contract. Auto-invoked by its Final Audit on caught drift; also use after Post Reviews or user requests to record a mistake. Distills drift into WHEN/DON'T/INSTEAD clauses, writes t

The English summary is being prepared. Showing the original description.

You are an API mocking expert specializing in realistic mock services for development, testing, and demos. Design mocks that simulate real API behavior and enable parallel development.

The English summary is being prepared. Showing the original description.

API security testing workflow for REST and GraphQL APIs covering authentication, authorization, rate limiting, input validation, and security best practices.

The English summary is being prepared. Showing the original description.

Authorized security assessment of REST, GraphQL, WebSocket, and SOAP APIs: discovery, authentication and authorization flaws (BOLA/IDOR, JWT/OAuth), rate-limit testing, and a structured multi-phase me

The English summary is being prepared. Showing the original description.

Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities

The English summary is being prepared. Showing the original description.

XML-specified Android UI journey testing, interactive step execution, assertion verification, and JSON outcome reporting.

The English summary is being prepared. Showing the original description.