Test design, vulnerability assessment, and quality assurance (13K skills)
Review whether every page provides an accessible privacy policy link, especially in the footer. Check that the policy explains data collection, use, sharing, retention periods, contact details, and user rights, and identify missing information.
Review form fields for code that blocks pasting, then remove those restrictions. The skill helps check password manager use, keyboard interactions, and accessibility so people can paste passwords and other long values into inputs.
Review HTTP response headers and restrict browser features an application does not need, such as camera, microphone, and location access. Guide Permissions-Policy settings that limit what attackers could use if the site is compromised.
Audit account settings, privacy pages, and API routes for a complete data deletion flow. Check browser storage cleanup, server deletion requests, and user confirmation, then identify missing pieces and guide implementation.
Review website animations against users’ reduced motion preferences, a setting that requests less movement. Check flashing content, scrolling effects, alternative transitions, pause controls, and advance warnings, and identify changes needed in rendered pages and interactive states.
Review password fields for security and ease of use. Check autocomplete settings, accessible visibility controls, strength indicators, and password manager support, then verify relevant browser and HTTP behavior in an environment resembling production.
Review mobile and tablet pages in portrait and landscape. Identify orientation locks, blocking rotation messages, and hidden controls, then suggest responsive layout changes so essential content and actions remain usable in both orientations.
Review HTML and JSX links that open new tabs, identify missing rel attributes, and add protective values. The skill also explains how these values prevent changes to the original tab and control referral information.
Review HTML lists for incorrect child elements and nesting, then identify fixes that help screen readers, tools that read page content aloud, announce item counts and positions accurately.
Review how tests use mocks, substitutes for external services or resources. Identify excessive mocking and missing cleanup, suggest more realistic tests, and check whether automated checks consistently catch problems and prevent regressions.
Evaluate whether tests catch defects in business logic, calculations, or state machines. Using Stryker, the skill introduces small code changes, reviews which changes escape detection, and helps strengthen tests where important behavior is insufficiently checked.
Compare button and link text with accessible names, the names assistive technology uses for controls. Identify mismatches and suggest ARIA label changes so people using voice control can refer to the words they see.
Review links embedded in body text to check whether readers can recognize them without relying on color alone. Identify CSS issues with underlines, color contrast, and hover or keyboard focus states, then suggest specific fixes.
Review mobile test coverage across real devices and simulated screen sizes. Find gaps in automated checks and CI, the workflow that runs project checks, and add Playwright tests for key mobile user flows.
Check HTML for meta refresh redirects that can interrupt reading and confuse users. Suggest server-side redirects or clear links users choose themselves, with guidance for checking the resulting behavior using accessibility tools or assistive technology.
Check the HTML delivered to browsers for broken internal, external, anchor, and email links. Locate errors and unintended redirects, suggest URL updates or replacements, and help introduce automated checks and ongoing monitoring.
Review a page to ensure it has exactly one main landmark, the region identifying its primary content. Find missing or duplicate main regions and get corrections that give assistive technology users a clear navigation target.
Find resources loaded over unencrypted HTTP within HTTPS pages, a problem called mixed content. Review resource URLs and security headers, then guide HTTPS replacements and automatic request upgrades to address blocked or insecure resources.
Review page source, browser JavaScript, and Git history for exposed API keys, passwords, and tokens. Identify potential leaks and guide fixes, including moving secrets to the server, replacing compromised credentials, and adding checks before commits.
Review form fields to ensure each has a properly connected label. Identify placeholder-only names and missing group headings, then guide markup fixes that help screen readers identify inputs and make labels clickable.
Check form fields for duplicate labels that may confuse screen readers or voice control. Identify affected inputs and suggest consolidating labels or using aria-labelledby, an attribute that connects a field to multiple pieces of naming text.
Check that HTTP requests redirect to HTTPS with a permanent 301 response while preserving the page path and query parameters. Review server or CDN settings, verify response headers, and explain how HSTS helps returning visitors avoid HTTP requests.
Identify and test critical workflows where APIs, services, databases, and interface components work together. Review normal behavior, important failures, and CI checks to find gaps that isolated unit tests can miss and keep those interactions continuously verified.
Review page language attributes so HTML and XML readers receive consistent language information. Check matching lang and xml:lang values, validate language codes, and recommend keeping both attributes for XHTML or removing the unnecessary XML attribute from standard HTML5.