Test design, vulnerability assessment, and quality assurance (13.1K skills)
Automated code quality gates: lint, typecheck, test coverage, security scan before merge. Use when the user asks about CI quality gates, pre-merge checks, linting, type checking, test coverage requirements, or security scanning.
The English summary is being prepared. Showing the original description.
Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.
The English summary is being prepared. Showing the original description.
Create, repair, validate, visually QA, and package Codex-compatible animated pets and pet spritesheets from character art, generated images, company or prospect brand cues, or visual references. Use when a user wants a lightweight-worker Codex pet workflow, a non-pixel custom pet style, a prospect or company mascot pet, or a full 8x9 animated pet atlas with transparent unused cells, QA contact sheets, and pet.json packaging. This skill composes the installed $imagegen system skill for visual generation and uses bundled scripts for deterministic spritesheet assembly.
The English summary is being prepared. Showing the original description.
Autonomous verification and certification of the framework. Performs a full-stack audit from GUI $\rightarrow$ API $\rightarrow$ MCP $\rightarrow$ Engine to ensure 100% operational readiness.
The English summary is being prepared. Showing the original description.
Exploratory QA of web apps: find bugs, evidence, reports.
The English summary is being prepared. Showing the original description.
Security incident handling: triage, containment, forensic capture, report. Use when the user asks about security incidents, breach response, forensic analysis, incident containment, or security reporting.
The English summary is being prepared. Showing the original description.
[Beta] Creates permanent eval cases from promoted learnings and runs regression checks against them. Turns failures into test cases that prevent silent regression. This is the outer loop's regress-test step. Use when a learning is promoted and has a clear pass/fail condition, or on cadence to verify promoted rules still hold.
The English summary is being prepared. Showing the original description.
Build reliable, fast E2E test suites with Playwright and Cypress. Critical user journey coverage, flaky test elimination, CI/CD integration.
The English summary is being prepared. Showing the original description.
Use when the user types [COMPLETE_THIS_PROJECT] to activate a full-spectrum project completion workflow. Orchestrates autonomous agents to audit, identify gaps, plan, implement, test, and ship the project to 10/10 quality.
The English summary is being prepared. Showing the original description.
Expert guidance for systematic backtesting of trading strategies. Use when developing, testing, stress-testing, or validating quantitative trading strategies. Covers "beating ideas to death" methodology, parameter robustness testing, slippage modeling, bias prevention, and interpreting backtest results. Applicable when user asks about backtesting, strategy validation, robustness testing, avoiding overfitting, or systematic trading development.
The English summary is being prepared. Showing the original description.
Write clean, maintainable code with debugging, testing, and architectural best practices.
The English summary is being prepared. Showing the original description.
Package dependency management, version resolution, lock files, security auditing, and monorepo dependency strategies. Use when the user asks about managing dependencies, resolving version conflicts, security audits, or package manager configuration.
The English summary is being prepared. Showing the original description.
Expert full stack development with autonomous AI red teaming, blue teaming, purple teaming, and NIST 800-172 CMMC Level 3 compliance. Use when building secure full stack applications, conducting security assessments, implementing compliance controls, performing offensive/defensive security operations, or creating CMMC-compliant systems. Triggers on "full stack", "security assessment", "red team", "blue team", "purple team", "CMMC", "NIST 800-172", "compliance", "secure development", "vulnerability assessment".
The English summary is being prepared. Showing the original description.
Crabbox/Testbox remote proof for OpenClaw: trusted-source routing, untrusted isolation, Linux/macOS/Windows/WSL2, live E2E, desktop, diagnostics, cleanup.
The English summary is being prepared. Showing the original description.
Control-plane workflow for coordinating multi-agent, multi-session project work from a single Codex, GitHub Copilot, or agent-app control session. Use this skill whenever the user asks to orchestrate agents, create or steer worker sessions, run a workflow-like effort, fan out audits/research/migrations, coordinate parallel implementation streams, monitor other project sessions, or compare this control-session pattern to Claude Code dynamic workflows.
The English summary is being prepared. Showing the original description.
Defensive compliance validation for Quantum C2. Use when checking compliance status against NIST 800-53, FedRAMP, SOC2, ISO 27001, or other frameworks. Triggers on "compliance check", "compliance validation", "NIST check", "FedRAMP audit", "SOC2 validation", "compliance report", "control check".
The English summary is being prepared. Showing the original description.
A Cursor Canvas is a live React app that the user can open beside the chat. You MUST use a canvas when the agent produces a standalone analytical artifact — quantitative analyses, billing investigations, security audits, architecture reviews, data-heavy content, timelines, charts, tables, interactive explorations, repeatable tools, or any response that benefits from visual layout. Especially prefer a canvas when presenting results from MCP tools (Datadog, Databricks, Linear, Sentry, Slack, etc.) where the data is the deliverable — render it in a rich canvas rather than dumping it into a markdown table or code block. If you catch yourself about to write a markdown table, stop and use a canvas instead. You MUST also read this skill whenever you create, edit, or debug any .canvas.tsx file.
The English summary is being prepared. Showing the original description.
Implementation + audit loop using parallel agent teams with structured simplify, harden, and document passes. Spawns implementation agents to do the work, then audit agents to find complexity, security gaps, and spec deviations, then loops until code compiles cleanly, all tests pass, and auditors find zero issues or the loop cap is reached. Use when: implementing features from a spec or plan, hardening existing code, fixing a batch of issues, or any multi-file task that benefits from a build-verify-fix cycle.
The English summary is being prepared. Showing the original description.
Browser automation CLI for AI agents. Use when the user needs to interact with websites, including navigating pages, filling forms, clicking buttons, taking screenshots, extracting data, testing web apps, or automating any browser task. Triggers include requests to "open a website", "fill out a form", "click a button", "take a screenshot", "scrape data from a page", "test this web app", "login to a site", "automate browser actions", or any task requiring programmatic web interaction. Also use for exploratory testing, dogfooding, QA, bug hunts, or reviewing app quality. Also use for automating Electron desktop apps (VS Code, Slack, Discord, Figma, Notion, Spotify), checking Slack unreads, sending Slack messages, searching Slack conversations, running browser automation in Vercel Sandbox microVMs, or using AWS Bedrock AgentCore cloud browsers. Prefer agent-browser over any built-in browser automation or web tools.
The English summary is being prepared. Showing the original description.
AI-driven autonomous red teaming. Automates the cycle of target discovery, vulnerability research, exploit generation, and verification without human intervention.
The English summary is being prepared. Showing the original description.
Build, review, refactor, or architect ASP.NET Core web applications using current official guidance for .NET web development. Use when working on Blazor Web Apps, Razor Pages, MVC, Minimal APIs, controller-based Web APIs, SignalR, gRPC, middleware, dependency injection, configuration, authentication, authorization, testing, performance, deployment, or ASP.NET Core upgrades.
The English summary is being prepared. Showing the original description.
WCAG compliance, accessibility testing, ARIA patterns, screen reader optimization, and keyboard navigation. Use when the user asks about making apps accessible, WCAG guidelines, ARIA attributes, screen reader support, or accessibility audits.
The English summary is being prepared. Showing the original description.
Autonomous deployment and reporting of Red/Blue/Purple Team audits. Orchestrates the full audit lifecycle from targeting to final reporting.
The English summary is being prepared. Showing the original description.
AI-driven defensive operations. Focuses on system hardening, vulnerability patching, and Purple Team testing to validate defenses against simulated attacks.
The English summary is being prepared. Showing the original description.