Testing & Security skills

Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a codebase or path, enumerate threats/abuse paths, or perform AppSec threat modeling. Do not trigger for general architecture summaries, code review, or non-security design work.

The English summary is being prepared. Showing the original description.

Produce a single consolidated hardening report for the DSH node. Runs audit.sh, dome-check.sh, and machine-probe.py, parses their outputs, and writes one markdown file listing every passing check, every failure with a specific remediation command, and a top-line verdict (ALL GREEN / N ISSUES). Non-destructive — reads only, no auto-fix.

The English summary is being prepared. Showing the original description.

Comprehensive testing strategies including unit tests, integration tests, E2E tests, property-based testing, visual regression, and test automation. Use when writing tests, setting up testing frameworks, or designing test coverage strategies.

The English summary is being prepared. Showing the original description.

Use when the task requires automating a real browser from the terminal (navigation, form filling, snapshots, screenshots, data extraction, UI-flow debugging) via `playwright-cli` or the bundled wrapper script.

The English summary is being prepared. Showing the original description.

Check your work with a verification subagent. Spawns a verifier that reviews diffs, runs builds and tests, and evaluates correctness. Use when asked to "check work", "verify changes", "self-verify", "/check", "/verify", "/check-work", or "/self-verify".

The English summary is being prepared. Showing the original description.

Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.

The English summary is being prepared. Showing the original description.

Apply the full DSH sovereign lockdown: kill known phone-home daemons (Google, Zoom, CodeWhisperer), pin DNS to dnscrypt-proxy, enable firewall + stealth, install a pf anchor blocking telemetry endpoints, and permanently remove unauthorized LaunchAgents. Verifies with audit.sh + dome-check.sh and surfaces any remaining gaps.

The English summary is being prepared. Showing the original description.

Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.

The English summary is being prepared. Showing the original description.

Tell the user (or an agent) exactly what machine they are on — chip, cores, RAM, NPU TOPS, memory bandwidth, security posture, DSH tier, and the right Ollama model to pull. Refreshes the canonical profile at agents/core/.mesh/machine.json on every call. Reads the result via agents.core.machine — zero re-probing in application code.

The English summary is being prepared. Showing the original description.

Review docs/prose for Writing Guidelines compliance. Use when asked to "review my docs", "check writing style", "audit prose", "review docs voice and tone", or "check this page against the writing handbook".

The English summary is being prepared. Showing the original description.

Visually QA a web application by launching it in Cursor's built-in browser, taking screenshots, checking console errors, and auditing network requests. Use after making UI changes to verify they look correct.

The English summary is being prepared. Showing the original description.

Test-driven development. Use when the user wants to build features or fix bugs test-first, mentions "red-green-refactor", or wants integration tests.

The English summary is being prepared. Showing the original description.

Analyze existing code and write comprehensive unit and integration tests for it. Detects the test framework, identifies untested code paths, and generates tests with proper mocking, edge cases, and assertions. Use when the user asks to add tests, improve coverage, or test a specific module.

The English summary is being prepared. Showing the original description.

Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.

The English summary is being prepared. Showing the original description.

Interactive QA session where user reports bugs or issues conversationally, and the agent files GitHub issues. Explores the codebase in the background for context and domain language. Use when user wants to report bugs, do QA, file issues conversationally, or mentions "QA session".

The English summary is being prepared. Showing the original description.

Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.

The English summary is being prepared. Showing the original description.

Execute a user flow step-by-step in Cursor's built-in browser while documenting each action, then emit a Playwright test that replays the same flow using stable selectors derived from the accessibility tree.

The English summary is being prepared. Showing the original description.

Open the app in Cursor's browser at multiple viewport sizes, screenshot each, and report any layout breakage.

The English summary is being prepared. Showing the original description.

Security code review for vulnerabilities. Use when asked to "security review", "find vulnerabilities", "check for security issues", "audit security", "OWASP review", or review code for injection, XSS, authentication, authorization, cryptography issues. Provides systematic review with confidence-based reporting.

The English summary is being prepared. Showing the original description.

Set up Husky pre-commit hooks with lint-staged (Prettier), type checking, and tests in the current repo. Use when user wants to add pre-commit hooks, set up Husky, configure lint-staged, or add commit-time formatting/typechecking/testing.

The English summary is being prepared. Showing the original description.

Scan agent skills for security issues. Use when asked to "scan a skill", "audit a skill", "review skill security", "check skill for injection", "validate SKILL.md", or assess whether an agent skill is safe to install. Checks for prompt injection, malicious scripts, excessive permissions, secret exposure, and supply chain risks.

The English summary is being prepared. Showing the original description.

Audit technical SEO — meta tags, structured data, Open Graph, sitemaps, robots.txt, performance, and accessibility signals.

The English summary is being prepared. Showing the original description.

When the user keeps asking for the same check to run (lint, tests, type-check), suggest a Cursor hook to automate it.

The English summary is being prepared. Showing the original description.

Set up a GitHub Actions CI/CD pipeline with linting, testing, type-checking, and deployment steps.

The English summary is being prepared. Showing the original description.