Test design, vulnerability assessment, and quality assurance (13K skills)
Use when working with Semgrep — semgrep static application security testing (SAST). Covers code scanning, custom rule creation, CI integration, autofix capabilities, multi-language support, and vulnerability triage. Use when scanning source code for security vulnerabilities, creating custom detection rules, or integrating SAST into CI pipelines.
The English summary is being prepared. Showing the original description.
Use when working with Aqua — aqua Security platform analysis. Covers container runtime protection, image assurance policies, compliance frameworks, vulnerability management, workload protection, and registry scanning. Use when analyzing container security posture, reviewing image compliance, investigating runtime alerts, or auditing security policies.
The English summary is being prepared. Showing the original description.
Use when working with Snyk — snyk security scanning and vulnerability analysis. Covers dependency vulnerability scanning, container image scanning, IaC security scanning, code analysis, license compliance, and fix recommendations. Use when scanning for vulnerabilities, analyzing dependency risks, reviewing container security, or auditing IaC configurations.
The English summary is being prepared. Showing the original description.
Use when working with Tfsec — tfsec Terraform security scanning. Covers static analysis of Terraform code, custom rule creation, CI integration, severity filtering, module scanning, and remediation guidance. Use when scanning Terraform configurations for security issues, creating custom security rules, or integrating security checks into CI pipelines.
The English summary is being prepared. Showing the original description.
Use when working with Kubescape — kubescape Kubernetes security posture analysis. Covers NSA/CISA framework assessment, MITRE ATT&CK mapping, CIS Kubernetes benchmarks, workload scanning, RBAC analysis, and network policy evaluation. Use when assessing Kubernetes cluster security, evaluating compliance frameworks, or analyzing workload configurations.
The English summary is being prepared. Showing the original description.
Use when working with Trivy — trivy comprehensive security scanner. Covers container image scanning, filesystem scanning, Kubernetes cluster scanning, SBOM generation, secret detection, license scanning, and misconfiguration detection. Use when scanning containers for vulnerabilities, generating SBOMs, scanning K8s clusters, or detecting misconfigurations.
The English summary is being prepared. Showing the original description.
Use when working with Wiz — wiz cloud security posture management. Covers cloud security posture analysis, vulnerability prioritization, attack path analysis, compliance assessment, container security, and resource inventory. Use when assessing cloud security posture, investigating attack paths, prioritizing vulnerabilities, or auditing cloud compliance.
The English summary is being prepared. Showing the original description.
Use when working with Checkov — checkov infrastructure-as-code security scanning. Covers Terraform, CloudFormation, Kubernetes, and Dockerfile scanning, policy management, custom checks, compliance frameworks, and suppression management. Use when scanning IaC for security misconfigurations, evaluating compliance, managing custom policies, or reviewing scan results.
The English summary is being prepared. Showing the original description.
Use when working with Dependabot — dependabot and Renovate dependency update management. Covers vulnerability alerts, dependency update PRs, auto-merge configuration, version pinning, update scheduling, and security advisory tracking. Use when managing dependency updates, reviewing vulnerability alerts, configuring auto-merge policies, or auditing dependency health.
The English summary is being prepared. Showing the original description.
Use when working with Great Expectations — great Expectations data quality framework analysis. Covers expectation suite management, validation result review, data docs generation, checkpoint execution, datasource configuration, and batch analysis. Use when reviewing data quality results, managing expectation suites, investigating validation failures, or auditing data quality configurations.
The English summary is being prepared. Showing the original description.
Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.
The English summary is being prepared. Showing the original description.
Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders.
The English summary is being prepared. Showing the original description.
Autonomously improve a real artifact (code, training recipe, agent harness, data pipeline, prompt) against an objective and an evaluator, using Hypothesis Tree Refinement (HTR) from the Arbor paper. Use this whenever someone wants to iteratively optimize something over many experiments without overfitting — e.g. "get my model's eval score up", "improve this agent/harness", "tune this pipeline", "beat the baseline on this benchmark", "run a search over approaches and keep the best", "do an MLE-bench / Kaggle-style optimization", or any long-horizon "make this artifact better and don't just memorize the dev set" task. Trigger it even when the user doesn't say "Arbor" or "hypothesis tree" but describes repeated experiment-and-evaluate loops, branching exploration of competing ideas, or worries about a dev/test gap. Runs Claude itself as the coordinator with subagent executors in isolated git worktrees; for the standalone `arbor` CLI tool see references/arbor-upstream.md.
The English summary is being prepared. Showing the original description.
Understand anti-reversing, obfuscation, and protection techniques encountered during software analysis. Use this skill when analyzing malware evasion techniques, when implementing anti-debugging protections for CTF challenges, when reverse engineering packed binaries, or when building security research tools that need to detect virtualized environments.
The English summary is being prepared. Showing the original description.
Plan, execute, and document validation, verification, and transfer of analytical procedures under the governing framework - ICH Q2(R2) and Q14, USP <1220>/<1225>/<1226>, ICH M10 bioanalytical, CLSI EP, or ISO/IEC 17025. Use for HPLC, LC-MS/MS, GC, CE, ICP-MS, dissolution, qNMR, qPCR, NIR, and ligand binding or cell-based assays whenever the question is whether a procedure is fit for its intended purpose. Triggers include "method validation", "analytical method validation", "AMV", "validation protocol", "acceptance criteria", "linearity", "reportable range", "accuracy and precision", "repeatability", "intermediate precision", "recovery", "LOD", "LOQ", "detection limit", "quantitation limit", "specificity", "robustness", "method transfer", "method comparison", "Deming", "Passing-Bablok", "Bland-Altman", "equivalence testing", "OOS investigation", "ICH Q2", "Q2(R2)", "Q14", "USP 1225", "ICH M10", "incurred sample reanalysis", "ISR", "CLSI EP", and any request to show that an assay works.
The English summary is being prepared. Showing the original description.
Build production Apache Airflow DAGs with best practices for operators, sensors, testing, and deployment. Use when creating data pipelines, orchestrating workflows, or scheduling batch jobs.
The English summary is being prepared. Showing the original description.
Regression testing strategies for AI-assisted development. Sandbox-mode API testing without database dependencies, automated bug-check workflows, and patterns to catch AI blind spots where the same model writes and reviews code.
The English summary is being prepared. Showing the original description.
Browse the web for any task — research topics, read articles, interact with web apps, fill forms, take screenshots, extract data, and test web pages. Use whenever a browser would be useful, not just when the user explicitly asks.
The English summary is being prepared. Showing the original description.
Use when doing ANY task involving Supabase. Triggers: Supabase products (Database, Auth, Edge Functions, Realtime, Storage, Vectors, Cron, Queues); client libraries and SSR integrations (supabase-js, @supabase/ssr) in Next.js, React, SvelteKit, Astro, Remix; auth issues (login, logout, sessions, JWT, cookies, getSession, getUser, getClaims, RLS); Supabase CLI or MCP server; schema changes, migrations, declarative schemas, security audits, Postgres extensions (pg_graphql, pg_cron, pg_vector); debugging and troubleshooting errors or unexpected behavior on Supabase projects (HTTP errors, Postgres errors, RLS surprises, permission denied, schema cache issues, timeouts, Edge Function crashes, Realtime drops, Storage failures) and reading or querying logs (Logs Explorer, ClickHouse).
The English summary is being prepared. Showing the original description.
RED-GREEN-REFACTOR for process documentation - baseline without skill, write addressing failures, iterate closing loopholes
The English summary is being prepared. Showing the original description.
Implement WCAG 2.2 compliant interfaces with mobile accessibility, inclusive design patterns, and assistive technology support. Use when auditing accessibility, implementing ARIA patterns, building for screen readers, or ensuring inclusive user experiences.
The English summary is being prepared. Showing the original description.
Never test mock behavior. Never add test-only methods to production classes. Understand dependencies before mocking.
The English summary is being prepared. Showing the original description.
Review docs/prose for Writing Guidelines compliance. Use when asked to "review my docs", "check writing style", "audit prose", "review docs voice and tone", or "check this page against the writing handbook".
The English summary is being prepared. Showing the original description.
Playwright automation, Chrome DevTools debugging, and browser interaction testing. Use for E2E/unit tests, capturing screenshots, inspecting network/console logs, or validating user flows in web applications.
The English summary is being prepared. Showing the original description.