Test design, vulnerability assessment, and quality assurance (13K skills)
Run validation through Crabbox on Linux, macOS, Windows, or WSL2 using the configured provider. Track environment setup and results, including delegated Blacksmith Testbox runs, and report the actual provider and run ID.
Set clear pass or fail criteria for Claude Code tasks before implementation, then track capability and regression evaluations as changes are made. The framework supports code, model, and human grading and records reliability measures such as pass@k.
Apply test-driven development when adding features, fixing bugs, or refactoring. The workflow starts with user journeys and failing tests, then implementation and refactoring, using unit, integration, and Playwright end-to-end tests with a target of at least 80% coverage.
Review application code for common security risks when adding authentication, handling user input or secrets, building API endpoints, or implementing payments. It provides practical checks for access control, injection, data exposure, dependencies, and related protections.
Guide feature work, bug fixes, and refactoring with test-driven development: write tests first, implement until they pass, then refactor. It covers unit, integration, and Playwright end-to-end tests, with an 80% coverage target.
Review code that handles authentication, user input, secrets, API endpoints, payments, or sensitive data. Checklists and implementation examples cover validation, access control, injection, cross-site scripting, request forgery, rate limits, sensitive logging, dependencies, and deployment preparation.
Use this skill to structure Playwright end-to-end tests, configure browser projects and CI runs, and manage screenshots, videos, and traces. It also gives approaches for finding and reducing flaky tests, which pass inconsistently due to timing or race conditions.
Review Django security practices for authentication, permissions, production settings, CSRF and XSS defenses, safe database queries, file uploads, API throttling, and security headers. It provides configuration and code examples for common application risks.
Use this skill after substantial code changes or before creating a pull request. It guides a staged review of build, types, lint, tests, security checks, and diffs, then produces a report showing results and issues to fix.
Check application code for common security risks while adding authentication, processing user input or secrets, creating API endpoints, or building payment features. Its checklist covers validation, access control, injection, cross-site attacks, data exposure, rate limits, and deployment readiness.
Use AgentShield to inspect Claude Code configuration for exposed secrets, overly broad permissions, unsafe MCP servers, hook command injection, and prompt injection risks. The skill explains scan options, report formats, safe automatic fixes, and CI integration.
Use this framework to define expected behavior before a Claude Code implementation, test capabilities and regressions, and report outcomes. It outlines code, model, and human graders, along with pass@k and pass^k measures for agent reliability.
Follow a test-driven workflow for new features, bug fixes, and refactoring: write tests first, implement only what makes them pass, then refactor and review coverage. It covers unit, integration, and Playwright end-to-end tests, with an 80% coverage target and examples for isolating external services.
Run a structured verification cycle for Spring Boot projects before pull requests, major changes, or deployment. It covers builds, static analysis, tests and coverage, security scans, and a final diff review, with a report of readiness and issues to fix.
Use this skill to review security controls in Java Spring Boot services. It covers authentication and authorization, input validation, SQL injection prevention, CSRF, secret management, security headers, CORS, rate limiting, dependency checks, and sensitive logging.
Check a Django project before a pull request or deployment. The workflow covers code quality, database migrations, tests and coverage, security, configuration, static assets, and a final diff review, with findings collected in a verification report.
Use this skill to develop Spring Boot services through test-driven development. It guides you in writing unit, web, integration, and persistence tests with JUnit 5, Mockito, MockMvc, and Testcontainers, then checking coverage with JaCoCo.
Build and maintain Playwright end-to-end tests with examples for page objects, test organization, browser and mobile projects, CI integration, and failure artifacts such as screenshots, videos, and traces. Includes approaches for finding and handling flaky tests.
Use idiomatic Go testing patterns with a test-driven workflow, table-driven tests, subtests, mocks, and HTTP or database checks. The examples also cover benchmarks, fuzzing, race detection, and coverage to help assess correctness and performance.
Build a Django test suite with a test-driven development workflow. The skill covers pytest-django setup, reusable test data with factory_boy, model and view checks, Django REST Framework API tests, mocking external services, integration tests, and coverage reports.
Build and organize Python tests with pytest, from the red-green-refactor TDD cycle to reusable fixtures, mocks, parametrized cases, and async checks. The skill also covers test selection, temporary files, exception testing, and measuring coverage so teams can assess important code paths.
Apply Go testing practices with a test-first workflow. The guide covers table-driven and subtests, benchmarks, fuzz testing for varied inputs, HTTP handler checks, mocks, and coverage so tests can check behavior and performance.
Structure evaluations for Claude Code tasks by defining success criteria before implementation, checking new capabilities and regressions, and recording results. It describes code-based, model-based, and human graders, plus pass@k and pass^k reliability measures.
Plan and write Python tests with pytest, from test-driven development to reusable fixtures, mocks, parameterized cases, async tests, and coverage reports. It provides patterns for checking errors, side effects, APIs, and databases, and for organizing test suites that are readable and maintainable.