Test design, vulnerability assessment, and quality assurance (13K skills)
Implement secure API design patterns including authentication, authorization, input validation, rate limiting, and protection against common API vulnerabilities
The English summary is being prepared. Showing the original description.
Automated end-to-end UI testing and verification on an Android Emulator using ADB.
The English summary is being prepared. Showing the original description.
You are an accessibility expert specializing in WCAG compliance, inclusive design, and assistive technology compatibility. Conduct audits, identify barriers, and provide remediation guidance.
The English summary is being prepared. Showing the original description.
Use for Nauthilus Redis client, Redis Cluster/Sentinel/topology behavior, Redis-backed token/session/flow/cache/bruteforce state, Lua Redis scripts, `NOSCRIPT` recovery, script upload/retry behavior, redismock tests, local cache coordination, and fail-closed runtime state changes.
The English summary is being prepared. Showing the original description.
Use for Nauthilus authentication and identity-provider work touching OIDC, OAuth2, SAML, MFA, TOTP, WebAuthn, recovery codes, LDAP-backed identity, browser login and consent flows, token/session/flow state, `private_key_jwt`, introspection, discovery metadata, endpoint-specific client authentication, and security-sensitive auth tests.
The English summary is being prepared. Showing the original description.
Use for Nauthilus Lua plugins, Lua callback tests, policy compiler and registry work, Lua environment and subject sources, Lua actions, hooks, backend scripts, policy facts, obligation targets, `server/lualib`, `server/lua-plugins.d`, `server/policy`, and JSON fixtures under `testdata/lua`.
The English summary is being prepared. Showing the original description.
Use when running the dev Grafana stack and/or the Playwright e2e suite against a *packaged* plugin zip (a release/RC artifact like `hydrolix-hydrolix-datasource-<ver>.zip`) rather than the working-tree `dist/`. Unpacks the package into a timestamped `dist_<timestamp>/dist` sandbox alongside copies of the compose artifacts, so the run is reproducible and the folder stays available to experiment with afterwards. Delegates stack bring-up to `stack-run` (frozen mode: read-only mount + `DEV=false` so the mage-watcher can't rebuild the packaged Go binary), verifies signature/version, runs the suite, and treats cleanup as optional — the sandbox is deleted only with the user's approval. Apply whenever the task is "test this plugin package / zip" or "run e2e against the built artifact".
The English summary is being prepared. Showing the original description.
Use when starting, stopping, or inspecting the dev stack for this Hydrolix Grafana datasource plugin — Grafana (with the plugin bind-mounted), ClickHouse, Keycloak (OAuth), and the on-demand playwright runner. Covers `docker compose up` semantics, the `dist/` prerequisite, serving plugin artifacts from an alternate folder (any path, live or frozen, via an ephemeral compose override), switching Grafana versions, hot-reload behaviour, delve attach, log streaming, OAuth/anonymous auth, and ClickHouse fixture access. Apply whenever a task needs the plugin running locally, needs to reset the stack, or needs to debug why Grafana won't come up.
The English summary is being prepared. Showing the original description.
Use when writing, running, or debugging Playwright e2e tests in this Hydrolix Grafana datasource plugin. Covers the docker-compose `playwright` service invocation, locator patterns for Grafana's react-select / Monaco editor / panel chrome, state-dependent interactions in QueryEditor, and timeout/retry expectations. Apply whenever a task touches `tests/*.spec.ts`, `tests/helpers.ts`, the `playwright` service in `docker-compose.yaml`, or the test results under `test-results/`.
The English summary is being prepared. Showing the original description.
Use when building this Hydrolix Grafana datasource plugin — frontend webpack bundle (`dist/module.js*`) or Go backend binary (`dist/gpx_plugin_*`). Covers the split between host-built frontend and container-built Go, when each needs an explicit rebuild, watch vs one-shot, and the verification chain (typecheck / lint / unit tests). Apply for any task that edits `src/**`, `pkg/**`, `Magefile.go`, `webpack.config.ts`, or that needs to confirm `dist/` matches the working tree before running e2e or the dev stack.
The English summary is being prepared. Showing the original description.
Review FriendlyBet quality, regression risk, test plans, release readiness, version bump discipline, scoring/locking correctness, provider fallback behavior, and dirty-worktree safety. Use before shipping app code, scoring changes, migrations, sports integrations, copy updates, PWA cache changes, or any risky user-facing flow.
The English summary is being prepared. Showing the original description.
Review FriendlyBet privacy, RLS security, auth, recovery codes, session storage, data minimization, public snapshots, share surfaces, legal/gambling wording, real-money risk, and compliance-sensitive product changes. Use when a task changes data access, user identity, public sharing, money-like language, security posture, or legal risk.
The English summary is being prepared. Showing the original description.
Plan or review FriendlyBet architecture, implementation, schema, data flows, scoring, provider integrations, static/PWA behavior, Supabase/RLS impact, migrations, automation, and technical sequencing. Use when a task asks how to build, refactor, generalize, integrate, test, or safely ship FriendlyBet code.
The English summary is being prepared. Showing the original description.
Scoring rubrics for all 5 pipeline layers (Vision, Architecture, IA, BE, FE). Use when auditing specs, running self-checks, or remediating ambiguity gaps.
The English summary is being prepared. Showing the original description.
Coordinate multi-layer security scanning and hardening across application, infrastructure, and compliance controls.
The English summary is being prepared. Showing the original description.
Execute per-layer adversarial audit/remediation loop, persist fixes metadata, and manage fresh-run advancement
The English summary is being prepared. Showing the original description.
Assess pipeline layer state, detect prerequisite blockers, classify audit status, and persist remediation plan
The English summary is being prepared. Showing the original description.
Methodology for writing complete, unambiguous IA, BE, and FE specification documents in the CFSA pipeline. Covers completeness testing, progressive section writing, cross-reference checking, and ambiguity gate application.
The English summary is being prepared. Showing the original description.
Layer-by-layer remediation loop using adversarial audits, targeted fixes, and fresh-run verification enforcement
The English summary is being prepared. Showing the original description.
Execute code-quality gates for a completed phase including tests, coverage, lint, types, build, CI/CD, staging, migrations, and spec coverage
The English summary is being prepared. Showing the original description.
Design and implement comprehensive testing strategies. Use when setting up tests, choosing test types, implementing TDD, or improving code quality. Covers unit tests, integration tests, E2E tests, test-driven development, and testing best practices.
The English summary is being prepared. Showing the original description.
Determine ambiguity audit scope, enumerate source documents from filesystem, and persist rubric file bindings
The English summary is being prepared. Showing the original description.
Structured methodology for adversarial thinking — generating attack scenarios, abuse cases, race conditions, and security edge cases against specs and implementations. Produces spec-level gap items, not code-level fixes.
The English summary is being prepared. Showing the original description.
Cascade approved evolution changes through downstream layers, assess impact, run consistency checks, and write evolution audit record
The English summary is being prepared. Showing the original description.