테스트·보안 스킬

Product-only Red Team audit of the FMT/IWE platform: source, manifests, setup/update paths, CI and release provenance, agent permissions and memory, hooks, runtime, roles, schedulers, Day Open/Close, and regression claims. Use before merging or publishing a release, after changes to updater/runtime/security behavior, or when verifying a reported platform defect. Excludes real consumer workspaces and personal customizations; use repository-owned code and synthetic disposable fixtures only.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Восстановление памяти агента из exocortex-бэкапа при переезде на новое устройство. Находит DS-strategy/exocortex/, показывает что будет восстановлено, спрашивает подтверждение, копирует memory/ + CLAUDE.md + AGENTS.md, финализирует /audit-installation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Аудит пользовательской инсталляции IWE. Запускает scripts/iwe-audit.sh + MCP healthcheck + smoke-test ритуала через sentinel-механику (контракт dry-run-contract.md), передаёт отчёт subagent'у в роли VR.R.002 Аудитор (context isolation) → verdict ✅/⚠️/❌ по 6 компонентам (Inventory, L1 drift, {{GOVERNANCE_REPO}}, L3 customizations, MCP, ритуал). Используй после restore из бэкапа, после update.sh, или при еженедельной сверке.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

ADI-cycle structured reasoning (Abduction-Deduction-Induction-Audit-Decide). Use for complex decisions when multiple hypotheses need to be considered.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Extract voice patterns from existing content (website, blog, social, sales-call transcripts) and codify into voice rules. Produces voice analysis + voice guidelines (rules per pattern + violation pattern + fix template). Writes to marketing/brand/brand-voice.md as the canonical voice rules every content skill reads. Triggers - "tone of voice", "brand voice", "voice guidelines", "TOV audit", "writing rules", "extract voice"

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when the user wants to create a new CLAUDE.md from scratch for a repository, bootstrap project memory for a new repo, set up a repo for Claude Code for the first time, or completely rewrite an existing CLAUDE.md deemed unsalvageable. Produces a lean, high-signal file under 80 lines (120 hard cap) by scanning the repo for mechanical content (stack, commands, structure) and interviewing the user for judgment content (WHY, gotchas, out-of-scope, approval gates, testing philosophy, external docs like Confluence pages). NOT for auditing or incrementally improving an existing CLAUDE.md — that is the claude-md-improver skill's role.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Multi-agent adversarial code review. Spawns three reviewer subagents (Auditor, Adversary, Pragmatist) on a single model, runs a cross-examination round, then deterministically synthesizes a single ranked report. Use this for non-trivial PRs, security-sensitive changes, refactors that touch many files, or any change where one perspective has obvious blind spots. Trigger phrases include "adverse review", "adversarial review", "multi-perspective review", "review my changes from multiple angles", "panel review". NOT suitable for trivial diffs (typos, dependency bumps, formatting).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Quality validation specialist covering functional, performance, and security testing to ensure production readiness through evidence-based testing.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Test engineer ensuring quality through unit, integration, and E2E testing strategies

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

SEOcrawler security vulnerability scanner and hardening specialist covering code analysis, dependency audits, and infrastructure review.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Resolve merge conflicts non-interactively, validate build and tests, and finalize conflict resolution

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Assess or configure MotherDuck access control: roles (RBAC), share grants, table-, row-, and column-level security, masking, tenant isolation, residency, and Terraform governance.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when reviewing, writing, or debugging Go code under exercises/part2/ (and matching embedded code in docs/part2/**/*.mdx). Thinks hard about correctness, idiomatic Go, error handling, resource cleanup, concurrency, and — crucially — what the tests would catch: edge cases, races, leaks, timeouts, and port conflicts. Knows the repo's module-mode quirk (GO111MODULE=off) and which dirs carry go.mod.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when reviewing, debugging, or giving feedback on Go code in this repo (exercises/part2, website/tools, or any *.go file) or when asked for a "code review", "review this Go", "revisa este código Go", or "crítica de código". Reviews for correctness, idiomatic Go, error handling, resource cleanup, concurrency, performance, and security, and always ends with a test-thinking pass (what a test would catch). For exercises/part2, prefer the go-exercise-reviewer skill which knows the module-mode quirk; this skill covers general Go anywhere in the repo.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use when asked to audit or harden security in this repo — e.g. "security audit", "auditoría de seguridad", "revisa la seguridad", "is this secure", "hardening", "vulnerabilities". Audits code, config, workflows, and secrets exposure. Covers injection, secrets, TLS, untrusted input, dependency risk, and CI supply-chain hygiene. Runs when the user asks about security, not just for code reviews.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use whenever the user wants to find, shortlist, vet, or enrich US cybersecurity firms — pen-testing/red team, security audits, vCISO, SOC 2 readiness, incident response, managed SOC, IAM, cloud security, and AppSec. Triggers on "find me a pen-testing firm for our SOC 2 audit", "shortlist three vCISO services for our healthcare-tech startup", "we need an incident response retainer", or "pull contact info for these 8 security firm domains", even when described indirectly (we got breached, prepare us for the compliance audit, get us SOC 2 ready). Drives the ServiceGraph API (api.servicegraph.co) — a 100k+ US firm catalog filterable by industry, services, location, size, ratings. Skip in-house security hires, "how do I patch CVE-X" or "configure firewall Y" DIY questions, security-product reviews (CrowdStrike vs SentinelOne, etc.), generic security knowledge questions, consumer/personal security advice, non-US firms, individual freelancers and bug-bounty hunters.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use whenever the user wants to find, shortlist, vet, or enrich US accounting and tax firms (CPA firms) — financial-statement audit, SOC 1/2 audit, corporate tax, bookkeeping for businesses, advisory/fractional CFO, M&A diligence, 409A valuations, R&D tax credits, IPO readiness, sales-and-use tax. Triggers on "find me a CPA firm for our delaware c-corp series A audit", "shortlist three audit firms with SaaS experience", "we need a tax advisor for our M&A", or "pull contact info for these 10 accounting firm domains", even when described indirectly (audit our books, fractional CFO support, file our 1120). Drives the ServiceGraph API (api.servicegraph.co) — a 100k+ US firm catalog filterable by industry, services, location, size, ratings. Skip personal/consumer tax preparation (1040, individual estate, retirement planning), in-house controller/CFO hires, "how do I file my taxes" DIY questions, accounting-software comparisons (QuickBooks vs Xero), non-US firms, individual freelance bookkeepers.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Write tests for untested OSS code as a standalone contribution. Identifies coverage gaps, studies the repo's test conventions, and guides the user through writing tests that match existing patterns. Use when contributing tests to an open source repo, looking for a low-risk first contribution, or improving test coverage. Not for writing tests alongside a bug fix — use oss-contribute for that.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Submit a pull request following the repo's contribution guidelines. Reviews the diff, checks for common rejection reasons, and helps the user write their own PR description. The LLM reviews. the user writes. Use when implementation is complete and tests pass. Not for responding to review comments after the PR is open. Use oss-post-pr for that.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Set up a complete development environment for an unfamiliar OSS repo. Handles dependency installation, building, running tests, and configuring dev tooling. Use when cloning a new OSS repo and setting up for development, when the repo's setup instructions don't work, or when you need to debug environment issues. Not for setting up your own project — this is for getting someone else's repo running.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Research an issue deeply and present all context to the user. but the user writes the code. The LLM investigates code paths, finds relevant files, explains patterns, and identifies constraints. The user thinks through the approach and implements it. Use when ready to start working on an issue after oss-prep-to-contribute. Not for writing tests or documentation as a standalone contribution. Use oss-write-tests or oss-write-docs for those.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Find actual code issues in a repo that aren't listed in GitHub issues. missing tests, inconsistent patterns, outdated dependencies, documentation gaps. Presents findings to the user for evaluation. Use when you want to make proactive contributions beyond existing issues, or when no good issues are available. Not for browsing the existing issue tracker. Use oss-find-issue for that.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Prepare to contribute to an open source repo. Reads all contribution docs, checks eligibility, assesses the user's knowledge gaps, and fills them before coding starts. Use after finding an issue with oss-find-issue, or when starting work on any OSS repo. Not for installing dependencies or getting the build and tests running. Use oss-setup-dev-env for that.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Maintain the opt-in encrypted Documents API, immutable account ownership, SQLite ciphertext storage, chunk transactions, recipient key envelopes, configuration parser, and TLS/browser cryptographic tests. The separately maintained React application has its own integration skill.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.