테스트·보안 스킬

Interview the user relentlessly about a plan or design until reaching shared understanding, resolving each branch of the decision tree. Use when user wants to stress-test a plan, get grilled on their design, or mentions "grill me".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Grilling session that challenges your plan against the existing domain model, sharpens terminology, and updates documentation (CONTEXT.md, ADRs) inline as decisions crystallise. Use when user wants to stress-test a plan against their project's language and documented decisions.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

BROWSER REVIEW QA SKILL — Use the built-in browser/headless browser (puppeteer-core) to open a browser-runnable Cocos preview, switch preview targets, capture screenshots, and compare them with reference images. USE FOR: screen-driven QA only when the user has already prepared a Browser Review environment that can run in the browser (`http://localhost:7456`, LoadingScene/preview host/preview target wiring ready). DO NOT USE FOR: current Cocos Editor window screenshots, Editor Preview capture, compile errors, or pure log analysis. If the Browser Review environment is not ready, stop and remind the user to prepare it first.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Agent context budget guard and artifact compression workflow. USE FOR: image-heavy QA, compare board review, screenshot batches, large keep/todo/task manifests, long notes handoff, and md/json diff summarization. Trigger this before reading or forwarding heavy artifacts when token growth is a risk.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

HTML -> UCUF (Cocos Creator UI) conversion skill. Use for turning a complete HTML source package with ui-design-tokens.json and colors_and_type.css into Cocos usable layout/skin/screen JSON, then validating with Plan5 final fidelity gates: stale-rule audit, rule guard, visual fidelity risk, runtime interaction smoke, Cocos Editor final gate, and 95% regression matrix.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Cross-Reference 進度掃描器 — 自動掃描 assets/scripts/**/*.ts 與 tests/*.ts，比對 cross-ref-code.md B-1 表格，產生進度差異報告。USE FOR: 進度掃描、cross-ref 更新。DO NOT USE FOR: 程式碼編輯、UI layout 調整。

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

BROWSER VFX ACCEPTANCE SKILL — Use built-in browser/headless browser to automatically verify Cocos VFX block effects and composed VFX recipes in BattleScene preview (`http://localhost:7456`, `previewMode=true`, `previewTarget=5`). USE FOR: VFX health audit, per-block smoke validation, combo recipe regression checks before merging `vfx-block-registry.ts` / `vfx-effects.json`. DO NOT USE FOR: Cocos Editor window screenshot capture, compile-error debugging, or pure log-only diagnosis without browser preview.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

EDITOR PREVIEW SCREENSHOT SKILL — Capture the current Cocos Creator Editor window to a PNG file and inspect exactly what is already visible inside the Editor. USE FOR: visual symptoms when the user already has the target screen open in Cocos Editor / Editor Preview. DO NOT USE FOR: browser-driven QA, automatic browser target switching, reference-image comparison pipelines, compile errors, or pure log analysis. If the user wants browser screenshots, remind them to prepare the Browser Review environment and use cocos-preview-qa instead.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Idiomatic Go - package and interface design, error wrapping, table-driven tests, generics, the modern standard library (slices/maps/cmp/errors.Join), current syntax, and logging discipline. Use when writing, reviewing, or refactoring any Go code, especially code drifting toward Java/Spring shapes (deep layer trees, generic repositories, heavy frameworks) - even if the user never says "idiomatic". Distilled from spf13/go-skills and adapted to this repo.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect and resolve naming collisions, overlapping intent triggers, and insufficient intent diversity across the skill library. Load when a new skill is created (called by universal-skill-creator), during improvement passes (called by improve-skills), or when the user asks to deconflict skills, check for naming collisions, audit trigger overlap, review intent coverage, find duplicate triggers, check skill names, or says "are any skills too similar", "which skills overlap", "deconflict the library", "check for confusing skill names", "intent audit".

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Design, build, validate, and ship cross-platform agent skills. Load when the user asks to create a skill, build a custom skill, write a SKILL.md, package a workflow as reusable agent capability, improve or audit a skill, publish a skill, or build a planned skill suite.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Prepare safe production launches — pre-launch checklist, monitoring, staged rollout, and rollback. Load when deploying to production, releasing a major change, opening beta access, or the user asks for a launch checklist, go-live plan, rollout strategy, or rollback plan. Not for local-only prototypes. Pairs with ci-cd-and-automation and app-security-hardening.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Content sanitization and hidden-content detection for agent skill security. Scans markdown, HTML, and text for visually hidden but agent-readable attacks: CSS-hidden text (display:none, color:white, font-size:0, opacity:0), HTML comments with instructions, collapsible details sections, zero-width unicode, homoglyphs, misleading links, and inline HTML in markdown. Enforces mandatory sanitization before external content enters agent context. Load as part of the secure-* sequence during any repo scan or skill audit. Also load for sanitize content, check hidden text, scan markdown attacks, strip HTML, detect invisible instructions, check zero-width chars. Core principle: visibility does not equal influence — hidden content is more dangerous than visible content because agents process it but humans cannot see it.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Security checks for repository ingestion — scans repos for poisoned examples, dependency and supply-chain attacks, file/path traversal, format-based attacks, and enforces quarantine-before-commit. Load as part of the secure-* skill sequence whenever an agent reads, ingests, or learns from a GitHub repository. Also load when the user asks to check a repo for poisoned code, scan dependencies, verify supply chain safety, check for path traversal, scan repo files for attacks, or audit a repo before ingestion. Covers Issues 3, 4, 7, 8 from the agent security threat model: poisoned training data, dependency attacks, file/path attacks, and format-based attacks.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Runtime security for agent skills — prevents state corruption, skill overwrite attacks, denial of service, and enforces provenance tracking and no-go repo management. Load as part of the secure-* skill sequence whenever an agent processes external content or writes to the skill store. Also load when the user asks to check for state corruption, prevent skill overwrite, manage no-go repos, check provenance, audit runtime security, detect DoS patterns, or protect the skill store. Covers Issues 6, 9, 10 from the agent security threat model: instruction hierarchy enforcement, state corruption and skill overwrite, and denial of service prevention.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Ground framework-specific implementation in official documentation — detect stack versions, fetch authoritative docs, implement cited patterns, cite sources. Load when building with a library or framework where API correctness matters, when the user wants verified or documented code, or before writing framework code from memory. Also triggers on "source driven development", "cite the docs", "check official documentation", "verify against docs", "don't hallucinate APIs". Not for pure logic or renames. Pairs with feature-spec and test-driven-development.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Hard readiness gate before implementation begins — cross-checks the constitution, feature spec, plan, and tasks for consistency, traceability, and unresolved ambiguity. Returns PASS or FAIL with specific findings. Load when the spec-driven-development orchestrator routes /analyze, when the user asks to cross-check spec vs plan, audit traceability, verify spec readiness, gate-check before implementation, or says "is this spec implementation-ready", "trace requirements to tasks", "/analyze", "spec sanity check", "spec readiness gate", "spec consistency check". Output: docs/reviews/YYYY-MM-DD-<slug>-spec-crosscheck.md.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Apply the Red-Green-Refactor cycle to software development. Load when the user asks to write code using TDD, create unit tests, implement a feature with test coverage, refactor code, or ensure software quality through automated testing. Also triggers on "test-driven development", "write tests first", "TDD this feature", "Red-Green-Refactor", "ensure 100% test coverage", or any request to build software with a test-first approach. Supports unit, integration, and end-to-end testing strategies.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Audit the project's technical health and identify "high-interest" debt. Load when the user asks to check code quality, find TODOs, assess project health, or prepare for a refactoring sprint. Also triggers on "technical debt audit", "where is the code messy", "assess project health", "find my hacks", or "identify tech debt". Essential for maintaining velocity in growing projects.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Run a fast, read-only health check across all skills in the library and produce a structured quality report — without modifying anything. Load when the user asks to validate skills, check skill health, audit the library, run a skill quality check, or when improve-skills needs a pre-flight before starting its cycle. Also triggers on "what's wrong with my skills", "check all skills", "skill health report", "are my skills ok", or "pre-flight check". Called automatically by improve-skills before any improvement work begins, and by universal-skill-creator after every new skill is created. Never modifies any file — only reads and reports.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Orchestrator for the pre-decision business-idea lifecycle — generate ideas, model them, evaluate them, validate them with customers, and only then hand off to product-soul / brainstorming. Routes through `idea-generation`, `business-modeling`, `idea-evaluation`, and `customer-discovery`. Load when the user asks to explore business ideas, find a startup idea, evaluate a venture, validate an idea, says "what business should I start", "should I build this", "is this a good business", "I have a startup idea", "evaluate this venture", "model this business", "validate this idea", "Mom Test this", "Lean Canvas this", "Business Model Canvas", "Value Proposition Canvas", "go/no-go on this idea". Pre-decision suite — once one idea is committed, hands off to `product-soul`. Does NOT design features (use `brainstorming`) or audit built products (use `reality-check`).

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Security audit orchestrator for agent skills — scans for prompt injection, data exfiltration, credential theft, supply chain risks, and instruction hierarchy violations before any skill is installed, created, improved, or read from a GitHub repo. Load when creating skills from external sources, when improve-skills reads from GitHub repos, when research-skill fetches community SKILL.md files, when a user installs a third-party skill, or when the user asks to audit skill security, scan for injection, check if a skill is safe, scan all skills, or run a security sweep. Orchestrates all secure-* skills in sequence. Content is SAFE only if ALL secure-* skills return SAFE. 36% of community skills contain flaws (Snyk ToxicSkills 2026). This skill is the first line of defense.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Measure, profile, and fix performance bottlenecks — Core Web Vitals, backend latency, bundle size, and database queries. Load when performance requirements exist, users report slowness, profiling reveals bottlenecks, or the user asks to optimize load time, LCP, INP, CLS, or response time. Not for premature optimization without evidence. Pairs with browser-testing-with-devtools and ci-cd-and-automation for regression guards.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Apply one logical code change with mandatory impact mapping, git snapshot, verification, and automatic revert on failure. Load when the user asks for a safe edit, verified change, one change at a time with rollback, or codespine-style edit loop. Also triggers on "safe change", "edit with verification", "don't break the build", "revert if tests fail", or any non-trivial code edit where blast radius matters. Always runs dependency-mapping first. Pairs with incremental-implementation for multi-slice work; this skill is one atomic verify cycle per invocation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.