Test design, vulnerability assessment, and quality assurance (13K skills)
Apply a structured QA perspective to code reviews. The skill guides reviewers to understand the full change and its context, then check correctness, security, performance, concurrency, compatibility, tests, and documentation before reporting actionable findings and positive practices.
Use this skill to add, migrate, or review unit tests for TDesign Vue Next components, hooks, and utilities. It organizes component cases by public API behavior and guides running the target tests with Vitest, including issue regression checks.
Use this skill to write or review Windows regression tests that protect observable behavior. It checks whether expectations are independent, fixtures are faithful, and each test covers a distinct risk, while preserving native proof and architecture guards.
Plan validation for changes to the OpenClaw Windows app and collect evidence from tests, UI behavior, local MCP, or the gateway as applicable. The skill helps record what was verified and clearly report blocked checks.
Run repository builds, tests, and focused behavior checks on remote native Windows or WSL2 hosts through Crabbox. The workflow selects an appropriate provider, records the actual lease and run details, and cleans up task-created cloud leases.
Reproduce a publicly disclosed, already-fixed vulnerability in an isolated local lab. Compare vulnerable and patched behavior with controlled inputs, inspect the fix, and prepare evidence for security testing or a technical write-up.
Create local, defensive reproductions of public, already-patched vulnerabilities. Confirm patch status, model the disclosed failure with synthetic markers, and build an offline comparison harness and reproducibility guide for education or control testing.
Audit Pilot Shell dependencies listed in `installer/upstreams.yaml` across npm, PyPI, Homebrew, and curl installers. Check stable releases, security advisories, and hash changes, then verify updates through installation and integration checks before recording them.
Map a feature’s real data flows and trust boundaries, then identify realistic threats such as spoofing, data tampering, or privilege escalation. The skill helps teams choose and prioritize controls while design changes are still easier to make.
Manage vulnerabilities from discovery through verified remediation. Triage scanner findings by real-world exposure and exploitability, set patch timelines, track fixes, handle outside disclosures, and report unresolved risk in terms leaders can act on.
Review a design or code change for security risks in authentication, permissions, data handling, secrets, and dependencies. Get findings grouped by severity, with an attack path, likely impact, release implications, and a specific fix.
Guide security incident response from declaration through containment, evidence preservation, investigation, recovery, and review. Use it to prepare a response plan or exercise, assess a suspected compromise, and coordinate communication when personal data may be involved.
Use this skill to make organizational security decisions, assess business exposure from technical choices, and set security program priorities. It helps define blocking findings, specify what would resolve them, and record who accepts a risk and for how long.
Design and assess security monitoring that can surface an attack in progress. Decide which logs to retain, build detections around attacker behavior, reduce noisy alerts, define response steps, and verify that alerts reach someone who can act.
Design and review access so people and services have appropriate permissions. Use it to plan roles, audit accounts, reduce always-on admin rights, manage credentials, handle departures, and improve sign-in with single sign-on or multi-factor authentication.
Plan how to protect stored information by classifying data, choosing encryption for specific threats, managing keys and application secrets, and limiting or deleting data. Use it to assess what a backup exposure could reveal or review a protection plan.
Reviews analysis code for known scientific error patterns across physics, earth science, biology, chemistry, social science, and bioprocessing. It reports structured findings such as unit mismatches or unsuitable statistical methods; a clean review does not prove the code is correct.
Use this skill before reporting work as complete, fixed, or passing. It guides the agent to run the relevant verification command, read its full output, and base status updates on the results, including when preparing commits or pull requests.
Test and inspect local web applications with Playwright, a browser automation tool. Check frontend behavior, investigate UI issues, capture screenshots, and view browser logs using Python scripts, including a helper for managing local servers.
Run validation through Crabbox on Linux, macOS, Windows, or WSL2 using the configured provider. Track environment setup and results, including delegated Blacksmith Testbox runs, and report the actual provider and run ID.
Apply test-driven development when adding features, fixing bugs, or refactoring. The workflow starts with user journeys and failing tests, then implementation and refactoring, using unit, integration, and Playwright end-to-end tests with a target of at least 80% coverage.
Set clear pass or fail criteria for Claude Code tasks before implementation, then track capability and regression evaluations as changes are made. The framework supports code, model, and human grading and records reliability measures such as pass@k.
Use this skill to structure Playwright end-to-end tests, configure browser projects and CI runs, and manage screenshots, videos, and traces. It also gives approaches for finding and reducing flaky tests, which pass inconsistently due to timing or race conditions.
Guide feature work, bug fixes, and refactoring with test-driven development: write tests first, implement until they pass, then refactor. It covers unit, integration, and Playwright end-to-end tests, with an 80% coverage target.