테스트·보안 스킬

Execute the full end-to-end permission matrix against the live Uniffy app through the two Playwright MCP browsers: every sharing, access, denial, viewing, revocation, and request-access case on every content domain (notes, files, projects, tasks, calendar, chat, agents, automations, rooms), proven as the affected user. Covers the PostgreSQL-authoritative access behaviors: instant revocation in search and mentions, per-surface search authorization (spotlight, domain searches, filters, pagination), restricted chips, access requests, COMMENTER and role floors, expiry-aware grants, live org-default inheritance, group membership churn, delete and tag and bookmark revocation, attachment byte gating, and live no-reload pruning. Use when asked to run the permission matrix, matrix-test the permission system, do a full e2e sweep of sharing and access control, or validate a permissions PR end to end. Use `uniffy-e2e-flows` for a lighter single-domain permission loop and `uniffy-playwright` for one-off browser inspection. Skip for unit or integration tests, backend-only work, or when the dev stack is not running and the user has not asked to start it.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Create or refine GitHub issues in `uniffy-io/uniffy` using the project's title, template, dependency, project, and image-attachment conventions. Use when asked to create, open, file, draft, report, rename, or track a bug, feature, security issue, or performance issue in this repository, including requests that begin with `[BUG]`, `[FEATURE]`, `[SECURITY]`, or `[PERFORMANCE]`. Skip for pull requests, commit messages, implementation plans that do not need a tracking issue, other repositories, or general GitHub CLI questions.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Run disciplined end-to-end flows against the live Uniffy app through the project's Playwright MCP infrastructure. Covers authentication, content creation across domains, and the full permission and sharing model, including verification as a second user. Use when asked to test auth, login, permissions, sharing, access control, creation or CRUD, smoke-test the app, exercise each domain, or run a create-and-share flow. Use `uniffy-playwright` instead for a one-off browser inspection or single-bug reproduction. Skip for unit or integration tests, backend-only work, or when the dev stack is not running and the user has not asked to start it.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Run a disciplined review of the pending changes (uncommitted work plus the branch delta against main) across four dimensions: security, correctness, performance, and repo consistency. Fans out exploration subagents per dimension, then the main agent acts as judge: every finding is re-verified against the actual code before it is reported, and the result is saved to `.agents/local/reviews/` and replied verbatim. Use when asked to review the changes, review before a PR, check my work, audit this branch, or run a pre-merge review. Use `security-review` instead for a security-only pass, and `simplify` for quality-only cleanup with no bug hunting. Skip for reviewing a single function in conversation or code outside this repo.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Create a comprehensive Uniffy feature plan in `.agents/local/plans/` through deep codebase analysis, applicable rules, verified patterns, risks, tests, and executable validation steps. Use when the user asks to plan a feature or prepare implementation work without writing product code.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Audit the in-tree model catalog against each provider's live API (Anthropic, OpenAI, Google, OpenRouter, xAI) using the keys in .env. Surfaces new models the catalog is missing, catalog models a provider no longer returns, and price/context drift on the curated OpenRouter subset, so the catalog stays current. Works on both stacks (docker containers or host venv). Run periodically or when a provider ships new models / changes pricing.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Security review specialist for credential safety, OWASP vulnerabilities, JWT validation, and WebSocket security. Use proactively after implementing auth, encryption, credential handling, or workspace access code. Invoke before PRs touching security-sensitive files.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Build a self-contained UI prototype for design exploration. Creates an unauthed page in the real web app with stress-test mock data, exposes the dev server for preview, and runs visual audits at mobile and desktop viewports. Use when exploring layouts, information architecture, or interaction patterns before production implementation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Build a UI prototype for design exploration. Creates a self-contained, unauthed page in the real web app with mock data, exposes it for preview, and runs visual audits. Use when exploring layouts, information architecture, or interaction patterns before committing to production implementation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Test generation specialist for TDD compliance and coverage enforcement. Generates comprehensive tests following Vitest patterns for TypeScript and Go testing conventions. Use proactively during TDD phases, when implementing critical paths, or when coverage needs improvement.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Review changes in samples/book-app-web for accessibility, responsive layout, tests/build validation, and small beginner-safe changes.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when reviewing a skillsaw PR. Dispatches 7 specialist reviewers (Architecture, Python Expert, Security & Supply Chain, QA Engineer, Technical Writer, Ecosystem, Slopinator) as parallel sub-agents by default, then synthesizes a single verdict. Use --serial for cheaper inline execution.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Audit skillsaw for release readiness — test new rules against real repositories, audit core architectural dimensions, independently verify proposed fixes, and ship improvements in clean, focused batches. Use before cutting a release.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Create a skillsaw rule plugin — a pip-installable Python package that adds custom lint rules to skillsaw. Walks through scaffolding the package, writing rules against the lint tree, testing, and publishing to PyPI. Use when a user wants to share skillsaw rules across repositories or publish them for others.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Maintain Node3D GitHub Actions, reusable CI patterns, install modes, matrices, native/GPU/platform limits, lint/test/build jobs, and validation semantics.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Audit or prepare Node3D packages for npm publishing: package metadata, exports/files, versions, lockfiles, npm pack, binary tags/assets, submodule/root release state, and readiness.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Add or maintain node:test, native-load/runtime, visual/offscreen, hardware-dependent, browser/WebGL/Three.js, and integration validation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Runs BDD-compliant GIVEN-WHEN-THEN tests, validates naming compliance, and analyzes coverage. Use when running tests, checking BDD compliance, validating test patterns, or verifying that test names follow GIVEN-WHEN-THEN conventions. Make sure to use this skill whenever tests need to be executed — it validates naming compliance and catches convention violations that plain test runners miss.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Scaffolds new Fakt sample projects with correct structure, build scripts, and CI integration. Supports JVM, KMP, Android, multi-module, test-fixtures, and fake-publishing types. Use when creating a new sample project, adding a demo for a new feature, setting up a new test project, or scaffolding a demonstration project. Make sure to use this skill whenever a new sample directory needs to be created — it handles build scripts, CI integration, and settings.gradle.kts registration that are easy to miss manually.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when building a LIVE DEMO DASHBOARD for an EXISTING Vapi assistant or squad — a Vapi-branded web page that visualizes a call as it happens (streaming transcript, tool calls, optional assistant-request strip, optional web-call button, a custom panel per use case) and deploys to Railway. Triggers on "make a demo for this assistant", "demo dashboard", "showcase this agent", "live call visualization", "demo this to a customer/exec". NOT for creating, prompting, or testing voice agents — it points at an agent that already exists and already works, and it never edits the agent itself.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

This skill should be used when the user asks to "write a test", "run tests", "add a test for", "test this function", "check test coverage", "run the test suite", or when writing pytest tests for StreamFlow features or bug fixes.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when the primary outcome is comparing documentation claims with implementation evidence, synchronizing docs from verified changes, or freshness review, including drift, missing coverage, stale claims, and post-change updates.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Reference guide for the Twelve-Factor App methodology — 15 principles (12 original + 3 modern extensions) for building portable, resilient, cloud-native applications. Use when evaluating application architecture, designing cloud-native services, reviewing codebases for methodology compliance, advising on configuration, scaling, observability, security, and deployment patterns. Incorporates the 2025 open-source community evolution and cloud-native reinterpretations of each factor.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when the user explicitly asks Rewrite Room to route documentation work, or when audit/sync/freshness, user-facing authoring, citation-driven writing, docs-to-skill conversion, and AI-instruction optimization overlap and exactly one workflow must be chosen.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.