Testing & Security skills

App Store and Google Play submission automator with Fastlane, screenshot automation, metadata management, and TestFlight/internal testing. Activate on: app store submission, Fastlane, TestFlight, Google Play Console, screenshot automation, metadata management, app review, code signing, provisioning profiles. NOT for: CI/CD pipeline setup (use github-actions-pipeline-builder), app architecture (use react-native-architect), analytics (use mobile-analytics-crash-reporting-expert).

The English summary is being prepared. Showing the original description.

Audits an Articles of Agreement contract — the daemon-witnessed agreement every official Port Daddy agent signs covering registration, transcript reporting, tool-use gating, file claims, parley conduct, budget limits, and operator control — against the enforcement-beats-hope bar: a clause counts as safe only when it resolves to a concrete, daemon-observable mechanism with a defined denial shape, never a promise the agent might honor. Use when drafting a new agent's Articles, reviewing a compliance-level (C0-C6) claim, deciding whether a clause is genuinely enforced or merely documented, or auditing whether an agent's claimed identity can be trusted. NOT for securing the inbound event-to-spawn path (fleet-event-spawn-trust), designing the relay's transport PKI and signing keys (pd-relay-zero-trust), or tracking an agent's identity and reputation across its whole lifetime after it signs (agent-identity-continuity-reputation).

The English summary is being prepared. Showing the original description.

Plan or audit the cross-layer Harbor cooperative editor: Loro replicas for humans and agents, governed edit claims, salvage authority, and transport across shared, LAN, and remote harbors. Use when a change spans editor collaboration, identity, recovery, or transport contracts. For a single GPUI pane use gpui-rust-console; for motion use rust-gpui-motion; for a shader use gpui-shaders. NOT for non-collaborative screens, web editors, or generic Rust development.

The English summary is being prepared. Showing the original description.

Design and audit a pricing function for variable-cost agent labor. Choose among per-seat, metered, credits, hybrid, and outcome pricing; name buyer value and cost metrics separately; calculate a reproducible cost floor; require pre-commitment guardrails; and stress-test declared personas. Use for offline pricing-design evidence, not billing implementation or runtime control. NOT for production billing, payment collection, or runtime spend enforcement.

The English summary is being prepared. Showing the original description.

Audit a compliance-ladder design (C0-C6) and transcript-fidelity ladder (T0-T5) plus their adapter conformance fixtures — Codex, Claude Code, Cloudflare, Ollama/LM Studio, custom stdio/HTTP agents — for the two failure modes that make a C-badge or T-fidelity label a lie: the ladder disagreeing with itself across doc/schema/ui/probe surfaces, and a level being reachable by self-report because no daemon-witnessed negative probe actually tries to forge it. Use when designing or freezing a compliance ladder, wiring an adapter conformance probe suite, deciding whether a numeric C-badge or T-label is safe to ship, or investigating a self-attestation or observed-to-controlled bypass risk. NOT for auditing a cryptographic protocol or whitepaper for adversarial soundness (`redteam-review`), writing TLA+/formal invariants for a daemon monitor (`runtime-verification-for-agents`), or agent identity, successor linkage, and reputation across restarts (`agent-identity-continuity-reputation`).

The English summary is being prepared. Showing the original description.

Author a pull request an AI coding agent can actually get merged: a scoped, coherent diff; a Summary and Test Plan backed by real evidence; correct triage of required-and-blocking CI gates versus external/advisory checks (e.g. a Cloudflare Pages preview build); draft-while-WIP discipline; named fixup commits for real review findings; and a clean landing through a merge queue without force-pushing or bypassing branch protection. Use when opening, updating, triaging red CI on, or landing an agent-authored GitHub PR. NOT for this repo's internal release ceremony, actor embodiments, or contributor mirror-sync mechanics (use port-daddy-internal-dev), tracking backlog/issue lifecycle across a board (use agent-issue-tracker-workflow), or deciding what to build next / sequencing a roadmap (use legible-roadmap-with-sidequests).

The English summary is being prepared. Showing the original description.

Designs and audits deterministic, authority-filtered partitions of trust-typed context for already admitted bodies or abstract continuation slots. Use when causal context, obligations, disclosure boundaries, vector-space identity, capacity, and omission proofs must survive partitioning. NOT for spawning or admitting agents, choosing worker count, retrieving arbitrary knowledge, writing successor prompts, or granting tools, leases, identity, or effect authority.

The English summary is being prepared. Showing the original description.

Safety-case design for always-on agents with episodic memory. Covers data hygiene, privacy and security risk surfaces, cost controls, scope, user dependency concerns, retention, incident containment, and responsible deployment evidence. It identifies hazards and asks for named controls, tests, owners, and residual uncertainty; it does not provide legal, clinical, youth-safety, or jurisdictional determinations. Activate on: "agent safety", "always-on agent privacy", "agent cost control", "persistent agent risks", "AI companion safety", "agent data hygiene", "runaway agent costs", "parasocial AI risk", "/always-on-agent-safety". NOT for: architecture design (use always-on-agent-architecture), input design (use always-on-agent-inputs), application brainstorming (use always-on-agent-applications), healthcare compliance specifically (use hipaa-compliance).

The English summary is being prepared. Showing the original description.

Cryptographic security for agentic systems — zero-trust agent networking, signed message envelopes (JWS/JWE), capability-based security (ocaps), Merkle tree audit trails, WASM sandboxing, and formal verification. Covers CLI dev tool security, mTLS between agents, permission boundaries (least privilege for AI agents), and supply chain security for skills/plugins. Activate on: "agent security", "zero trust agents", "secure agent communication", "capability-based security", "ocap", "signed messages between agents", "agent audit trail", "sandbox agent execution", "agent permissions", "mTLS agents", "cryptographic verification", "agent supply chain", "OWASP agentic", "prove agent did X", "tamper-proof agent logs". NOT for: application-level SAST scanning (use security-auditor), network firewall rules (use infrastructure), SOC2/HIPAA compliance (organizational), or prompt injection defense (use prompt-engineer).

The English summary is being prepared. Showing the original description.

Designs and audits closed, ordered, replay-safe message protocols between already admitted agent bodies. Use when a multi-agent exchange needs explicit epochs, audiences, per-sender sequencing, gathers, terminal fences, acknowledgements, and deterministic replay. NOT for selecting or spawning agents, granting identity or authority, choosing a runtime topology, general human facilitation, wire transport implementation, or deciding whether evidence is true.

The English summary is being prepared. Showing the original description.

Declare an agentic application's interaction disclosure, state, context, capabilities, and effect-control boundaries. Use for a reviewable design specification and static consistency audit before implementation. NOT for proving that controls are deployed or enforced, exposing private chain-of-thought, selecting a model/router, or designing a multi-agent protocol.

The English summary is being prepared. Showing the original description.

Design or audit an agent identity, credential, session, continuity, and reputation plan. Use when attributed outcomes must survive key rotation, restart, recovery, or review; when choosing Elo, TrueSkill, a contextual bandit, or an LLM judge; and when making Sybil, newcomer, calibration, collusion, and evidence limits explicit. Produces a supplied-plan consistency audit, never proof of observed delivery, cryptographic identity, or live enforcement. NOT for proving personhood, global Sybil resistance, or an unobserved delivery.

The English summary is being prepared. Showing the original description.

Verify every visual-evidence artifact (screenshot/GIF/recording) attached to a PR carries a provenance manifest binding it to real daemon-backed truth — daemon port, run id, transcript head hash, agent node id, commit, and an honest real/fixture/mock source label — and that operator-control-panel PRs cover the required set of proof states. Use when gating a PR's proof artifacts before merge, auditing whether a "LIVE" visual claim is backed by a real daemon run versus a reused or fixture-backed mock, or defining the required state-coverage set for a control-panel change. NOT for the capture technique itself — headless Playwright, `screencapture -x -l`, non-interruptive capture (use port-daddy-agent-skill's visual-evidence doctrine), designing the receipt body schema an artifact attaches to (use agent-work-receipt-designer), or the broader dogfood/Potemkin product-quality bar (use multi-agent-authoring-product-bar).

The English summary is being prepared. Showing the original description.

Audit an existing Coval evaluation setup for coverage, misleading scores, missing evidence, judge validation and execution risk. Read-only; use when inheriting an eval or deciding whether its results support a release decision.

The English summary is being prepared. Showing the original description.

Import datasets from HuggingFace and convert them to Coval test sets. Use when the user wants to create test cases from HuggingFace dataset or repository.

The English summary is being prepared. Showing the original description.

Configure an AI agent to send OpenTelemetry traces to Coval. Use when a user wants to add Coval tracing, instrument an agent for simulations or conversation monitoring, make traces show up in Coval, handle SIP/PSTN/WebSocket trace correlation, or replace the one-command wizard with a security-reviewable manual setup.

The English summary is being prepared. Showing the original description.

End-to-end Coval accent testing workflow. Creates one persona per accent (each using a distinct accent voice and mirroring your Standard Customer behavior), launches one run per accent against the same voice agent + test set + metrics, polls for completion, builds a per-persona comparison table from the results, and creates the saved multi-run report (grouped by Persona) via the public API. Use when a user wants to follow the Testing Across Accents cookbook (https://docs.coval.dev/guides/testing-across-accents) without doing each step by hand.

The English summary is being prepared. Showing the original description.

Execute a bounded Coval evaluation on explicit test cases, then audit conversation, recording and metric evidence. Use when the user requests a run; does not automatically rerun, tune an agent or schedule evaluations.

The English summary is being prepared. Showing the original description.

Analyze a Coval adversarial / red-team testing report and turn it into an agent-hardening plan. Use when a user provides a Coval report URL, report export, run IDs, screenshots, or a per-scenario scorecard from an adversarial sweep and wants evidence-backed next steps such as prompt/guardrail changes, refusal hardening, verification fixes, escalation routing, or expanded attack coverage.

The English summary is being prepared. Showing the original description.

Analyze a Coval accent testing report from runs across different speaker accents. Use when a user provides a Coval report URL, report export, run IDs, screenshots, or metric summary and wants evidence-backed next steps such as prompt changes, STT/confirmation adjustments, accent-robust routing, or expanded accent coverage.

The English summary is being prepared. Showing the original description.

Select and configure a Coval metric for a concrete product criterion, choosing transcript, audio, trace or deterministic evidence and testing the result. Use for metric creation or scoring design, not for final human calibration.

The English summary is being prepared. Showing the original description.

Validate one Coval judge against independent human labels, with grouped development/test separation, class-specific errors and uncertainty. Use for trust claims or calibration; without real labels, prepare review rather than inventing ground truth.

The English summary is being prepared. Showing the original description.

Turn a large dataset (an existing oversized Coval test set, an export of past conversations, or a CSV/JSON of cases) into a small, high-signal Coval test set by removing duplicates, identifying unique scenarios, and selecting a representative, failure-weighted subset — then bulk-loading it with no row cap. Use when the user says "I have thousands of cases", "dedupe my test set", "my test set is too big", "turn this dataset into a test set", "pick representative scenarios", or "my CSV import only kept 10 / uploaded everything".

The English summary is being prepared. Showing the original description.

Migrate configuration from Bluejay voice AI testing platform to Coval. Use when customer says "migrate from bluejay", "bluejay migration", "import bluejay config", or needs to transfer agents, simulations, metrics, and schedules from Bluejay to Coval.

The English summary is being prepared. Showing the original description.