Testing & Security skills

When the user wants to research, profile, or analyze competitors from their URLs. Also use when the user mentions 'competitor profile,' 'competitor research,' 'competitor analysis,' 'profile this competitor,' 'analyze competitor,' 'competitive intelligence,' 'competitor deep dive,' 'who are my competitors,' 'competitor landscape,' 'competitor dossier,' 'competitive audit,' or 'research these competitors.' Input is a list of competitor URLs. Output is structured competitor profile markdown files. For creating comparison/alternative pages from profiles, see competitors. For sales-specific battle cards, see sales-enablement.

The English summary is being prepared. Showing the original description.

Prepare a neutral brief for counsel or the security lead on a matter that needs their judgement.

The English summary is being prepared. Showing the original description.

Track compliance requirements and audit readiness. Trigger with "compliance", "audit prep", "SOC 2", "ISO 27001", "GDPR", "regulatory requirement", or when the user needs help tracking, preparing for, or documenting compliance activities.

The English summary is being prepared. Showing the original description.

Draft a narrow dependency upgrade pull request with evidence, code changes, tests, risk notes, and rollback instructions.

The English summary is being prepared. Showing the original description.

Set up dependency and security hygiene from repository evidence, with a clear scope, source list, risk queue, and approval line.

The English summary is being prepared. Showing the original description.

Use when an outsourced support vendor handles your customers: audit the queue, score the sample, calibrate the vendor, and lift capability with evidence.

The English summary is being prepared. Showing the original description.

Check cap-table records against signed source documents and report ownership, security, date, and total differences for expert review.

The English summary is being prepared. Showing the original description.

Performs security-focused differential review of code changes. Adapts analysis depth to codebase size, uses git blame for context, calculates blast radius by counting callers, checks test coverage of modified code, and generates a markdown report. Use when reviewing a PR, commit, or diff for security vulnerabilities, checking whether a change re-introduces a previously fixed bug, asking what else a change could break, or finding which modified code has no test covering it.

The English summary is being prepared. Showing the original description.

Conventions for using annotations in all tests using Jupiter

The English summary is being prepared. Showing the original description.

Conventions for dependency injection and mocking in Spring Boot in this project. Use this whenever writing, reviewing, or refactoring integration test classes (anything annotated @SpringBootTest, or under src/test that talks to a real Spring context), especially when deciding how to wire dependencies or mock collaborators. Also consult this before adding @Autowired, @MockBean, @MockitoBean, or field injection in any test class.

The English summary is being prepared. Showing the original description.

Conventions for dependency injection and mocking in Spring Boot integration tests in this project. Use this whenever writing, reviewing, or refactoring integration test classes (anything annotated @SpringBootTest, or under src/test that talks to a real Spring context), especially when deciding how to wire dependencies or mock collaborators. Also consult this before adding @Autowired, @MockBean, @MockitoBean, or field injection in any test class.

The English summary is being prepared. Showing the original description.

Conventions for using parallelization in all tests using Jupiter

The English summary is being prepared. Showing the original description.

Expert knowledge of bilateral social security agreements (trygdeavtaler) in melosys-api. Use when: (1) Understanding which countries have agreements with Norway, (2) Debugging Sakstyper.TRYGDEAVTALE processing, (3) Understanding lovvalgsbestemmelser for specific agreement countries, (4) Investigating TrygdeavtaleVedtakService and attestation generation, (5) Understanding differences between EU/EEA and bilateral agreement handling.

The English summary is being prepared. Showing the original description.

Expert knowledge of authentication and authorization patterns in melosys-api. Use when: (1) Understanding Azure AD/OIDC authentication, (2) Debugging Tilgangsmaskinen access control, (3) Understanding SubjectHandler and user context, (4) Configuring OAuth2 clients for service-to-service calls, (5) Understanding audit logging patterns.

The English summary is being prepared. Showing the original description.

Expert knowledge of EU/EEA social security coordination regulations in melosys-api. Use when: (1) Understanding EU Regulation 883/2004 and 987/2009 framework, (2) Understanding personal and material scope of coordination, (3) Understanding coordination principles (single legislation, lex loci laboris), (4) Understanding territorial scope (EU, EEA, Switzerland, UK), (5) Understanding the relationship between Sakstyper.EU_EOS and regulations, (6) Understanding how EESSI integrates with regulation procedures.

The English summary is being prepared. Showing the original description.

Expert knowledge of testing patterns and strategies in melosys-api. Use when: (1) Writing unit tests with JUnit 5 or Kotest, (2) Setting up integration tests with Testcontainers, (3) Understanding the test base classes and hierarchy, (4) Using ArchUnit for architecture tests, (5) Configuring embedded Kafka for testing, (6) Understanding mock patterns and test utilities, (7) Creating test data with the forTest DSL.

The English summary is being prepared. Showing the original description.

Expert knowledge of Kafka event streaming patterns in melosys-api. Use when: (1) Understanding Kafka producers and consumers, (2) Debugging Kafka message processing issues, (3) Understanding topic configuration and message schemas, (4) Investigating SkippableKafkaErrorHandler and error handling, (5) Understanding Aiven Kafka setup and security configuration.

The English summary is being prepared. Showing the original description.

Drive Keel agent test-first or evidence-first execution for a selected OpenSpec task. Use when a task needs software tests, hardware testbench, assertions, lint, new behavior proof, regression coverage, or red/green evidence before implementation.

The English summary is being prepared. Showing the original description.

Use when adding or repairing Spark regression tests for asynchronous ownership, cancellation, persistence, restart recovery, or cross-surface projections. Not a coverage campaign, performance benchmark, source-text policy check, or full delivery review.

The English summary is being prepared. Showing the original description.

Use when a running Spark or DSH web service needs real-browser verification — page load, client-plugin boot errors, console errors, failed requests, or onboarding/dialog rendering — with the repository's own Playwright chromium.

The English summary is being prepared. Showing the original description.

このブランチ、またはこのセッションで書いた差分の全体を読み直し、用語の揺れ・古いまま残ったコメント・追従し損ねた実装 (呼び出し元・対になる箇所・テスト・文書) を探して、裏の取れたものを直す。「差分全体を見直して」「用語の揺れや更新漏れが無いか見て」「refresh-on-session」「/refresh-on-session」で発火。バグ探しは code-review、ディレクトリの文書と実体の一括照合は claude-md-refresh、issue 本文の書き戻しは issue-writeback の担当。

The English summary is being prepared. Showing the original description.

Writes and cleans up messages and docs for their channel and reader (email, Slack, a text, release notes, store pages, READMEs, Claude Docs) in a plain voice that never moves a fact. Trigger to write, rewrite, shorten, line-edit, retell or change the tone of any message, even a two-line text; to strip dashes or AI tells; to fix UI wording (a dialog, button or error); to score text without rewriting; to plan release comms; to write a store page, launch post or listing title, blurb and tags; to write in a voice or learn one; or say /rw-commscribe (draft, reshape, humanize, audit, retell, formats, cadence, voice, docs). It never sends. A skill's own files (SKILL.md, references) are skillwright's; brand voice and layout brandscribe's; sourced write-ups researchscribe's.

The English summary is being prepared. Showing the original description.

Keeps brand definitions, several side by side, and turns one into a Claude Design System, DESIGN.md, VOICE.md or guide. Trigger to define a brand, palette, type or voice; turn a style guide or site into tokens; make, connect or sync a design system; audit for brand drift (off-palette colours, old names); pass or fail a page against a brand, or apply one to a README or generated output; critique or check a built UI, or a built site (dist/) for UI problems before it ships (hierarchy, spacing, states, generic look); or say /rw-brandscribe (setup, build, export, sync, audit, gate, ui). Microcopy and messages are commscribe's; React libraries design-sync's; charts dataviz's; canon lorescribe's; a pre-build brief, fit across widths and themes, and game UI uismith's; no logos.

The English summary is being prepared. Showing the original description.

Transcribes local audio and video to txt, srt, vtt and json with timestamps using whisper.cpp, and proves which backend ran. Trigger to transcribe, caption or subtitle a recording, meeting, podcast or video locally; to pick a Whisper model for this GPU or estimate a batch; when a transcript is empty, cut short or repeating; when Whisper ran on the CPU or a pasted log must prove the GPU ran; when it shares the GPU with LM Studio or ComfyUI; or say /rw-whisperrunner (audit, check, plan, run, status, refresh). Never a cloud API or a download. Voice-overs are comfyrunner's; clips and burned-in captions obsrunner's; game audio soundsmith's; summarising transcripts lmstudiorunner's.

The English summary is being prepared. Showing the original description.