Testing & Security skills

Determine ambiguity audit scope, enumerate source documents from filesystem, and persist rubric file bindings

The English summary is being prepared. Showing the original description.

Structured methodology for adversarial thinking — generating attack scenarios, abuse cases, race conditions, and security edge cases against specs and implementations. Produces spec-level gap items, not code-level fixes.

The English summary is being prepared. Showing the original description.

How to run and test the docs/index.html AGSL shader web gallery locally (static server, WebGL2-capable Chrome flags, CDP verification hooks).

The English summary is being prepared. Showing the original description.

Smart Kotlin unit testing with auto-detection, coverage analysis, and AI edge cases. Use when generating tests for biz/ layer classes, analyzing test coverage gaps, or discovering edge cases.

The English summary is being prepared. Showing the original description.

Use this skill for any Ionic Vue + Capacitor mobile work: Vue architecture, Composition API, TypeScript, state, env config, shared conventions. Required for every implementation task alongside mobile-testing.

The English summary is being prepared. Showing the original description.

Use this skill for all verification: unit, component, E2E, native, and release checks. Required alongside mobile-core for every implementation.

The English summary is being prepared. Showing the original description.

Interview the user relentlessly about a plan or design until reaching shared understanding, resolving each branch of the decision tree. Use when user wants to stress-test a plan, get grilled on their design, or mentions "grill me".

The English summary is being prepared. Showing the original description.

Use test-driven development for behavior-changing feature or fix work, and whenever the user mentions TDD, test-first, red-green-refactor, tracer bullets, integration tests, or public-interface behavior tests. Skip for docs-only, path-only rename, formatting-only, or purely mechanical chores unless explicitly requested.

The English summary is being prepared. Showing the original description.

Bun runtime, package manager, bundler, and test runner. Use when running scripts with bun, managing packages, serving HTTP with Bun.serve, querying databases with Bun.sql/bun:sqlite/Bun.redis, shell scripting with $, using S3/file I/O, writing tests with bun:test, bundling or compiling to executable, or using any Bun-specific API (spawn, glob, semver, FFI, workers, plugins, HTMLRewriter).

The English summary is being prepared. Showing the original description.

When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," or "SEO health check." For building pages at scale to target keywords, see programmatic-seo. For adding structured data, see schema-markup.

The English summary is being prepared. Showing the original description.

Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking screenshots, extracting data, testing web apps, or automating any browser task. Triggers include requests to "open a website", "fill out a form", "click a button", "take a screenshot", "scrape data from a page", "test this web app", "login to a site", "automate browser actions", or any task requiring programmatic web interaction.

The English summary is being prepared. Showing the original description.

Use when deploying or managing an app that uses Prisma Composer (`@prisma/composer`): wiring its services and Modules, running it locally, testing composed services, or standing up / tearing down an environment. Triggers on "prisma composer", "@prisma/composer", "prisma app", `prisma deploy`, `prisma dev`, `compute()`, `module()`, `contract()`, `service.load()`, `mockService`, `bootstrapService`.

The English summary is being prepared. Showing the original description.

Implement centralized audit logging and SIEM integration. Configure log retention and security monitoring. Use when implementing audit trail requirements.

The English summary is being prepared. Showing the original description.

Audit trail register: timestamp, user, module, record, action, field changed, old and new value, and the reason for the change. Use for change history and control evidence.

The English summary is being prepared. Showing the original description.

Use when an agent, harness, gateway, MCP workflow, or multi-step automation claims completion and the available traces, checkpoints, approvals, tool calls, or deployment records must be judged without

The English summary is being prepared. Showing the original description.

Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.

The English summary is being prepared. Showing the original description.

Reduce OpenClaw token usage and API costs through smart model routing, heartbeat optimization, budget tracking, and native 2026.2.15 features (session pruning, bootstrap size limits, cache TTL alignment). Use when token costs are high, API rate limits are being hit, or hosting multiple agents at scale. The 4 executable scripts (context_optimizer, model_router, heartbeat_optimizer, token_tracker) are local-only — no network requests, no subprocess calls, no system modifications. Reference files (PROVIDERS.md, config-patches.json) document optional multi-provider strategies that require external API keys and network access if you choose to use them. See SECURITY.md for full breakdown.

The English summary is being prepared. Showing the original description.

Reads invocation logs from eval_tracker and recommends which of the 50+ skills to prune or consolidate. Run monthly to keep the skill surface tight. Triggers: "audit skills", "prune skills", "which skills do I never use", "skill cleanup".

The English summary is being prepared. Showing the original description.

Structured build workflow: branch, delegate to coding agent, test, screenshot, and commit. Triggers on: "$devprocess", "build this properly", "use the coding agent workflow", or any feature/refactor/infrastructure change that is too large for a direct edit. NOT for: one-line fixes, doc edits, prompt tweaks, or simple config changes — do those directly.

The English summary is being prepared. Showing the original description.

Create and troubleshoot Ocana agents. Use when creating a new Ocana agent, refreshing/repairing management token auth, diagnosing `ocana_agent_create` failures, checking `gatewayReachable`, handling agents stuck in `provisioning`, debugging `226/NAMESPACE` or missing `/usr/bin/openclaw`, or testing lifecycle/reprovision flows for a newly created agent.

The English summary is being prepared. Showing the original description.

Multi-phase dialectical stress-test for HIGH-STAKES decisions only (architecture choices, irreversible product calls, strategic bets). Heavy-cost skill — do NOT use for routine questions, brainstorming, or simple tradeoffs. User must explicitly invoke or describe a decision they call "high-stakes", "irreversible", or "needs stress-testing". Triggers: "stress test this decision", "dialectic on", "challenge this thesis", "should I really".

The English summary is being prepared. Showing the original description.

Use when working with Cube Dev — cube.dev semantic layer management — monitor deployments, data models, pre-aggregations, query performance, and API health. Use when inspecting cube schemas, debugging slow queries, reviewing pre-aggregation builds, or auditing API usage.

The English summary is being prepared. Showing the original description.

Use when working with Cypress Deep — cypress end-to-end testing management and analysis. Covers test execution monitoring, dashboard integration, screenshot and video analysis, test report parsing, flaky test detection, and configuration auditing. Use when investigating test failures, reviewing Cypress Cloud results, or managing Cypress test suites.

The English summary is being prepared. Showing the original description.

Use when working with Cucumber — cucumber BDD testing management and analysis. Covers feature file organization, step definition mapping, scenario tagging, Gherkin syntax validation, test report parsing, and step reuse analysis. Use when managing Cucumber test suites, investigating BDD scenario failures, or reviewing feature file coverage.

The English summary is being prepared. Showing the original description.