테스트·보안 스킬

Scan staged changes before a commit and commit history before a push for API keys, access tokens, and other common credentials. The guidance explains how to replace exposed values, move them to environment variables, and clean affected history.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking staged changes for credentials before committing
• Scanning commits for secrets before pushing
• Finding and cleaning commits that contain sensitive values

Use this skill to add, migrate, or review unit tests for TDesign Vue Next components, hooks, and utilities. It organizes component cases by public API behavior and guides running the target tests with Vitest, including issue regression checks.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Adding tests for a Vue component API
• Writing a regression test for an issue
• Reviewing hooks or utility tests

Use this skill to write or review Windows regression tests that protect observable behavior. It checks whether expectations are independent, fixtures are faithful, and each test covers a distinct risk, while preserving native proof and architecture guards.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing Windows regression tests
• Designing tests for observable behavior
• Checking fixture fidelity and independent expectations

Run repository builds, tests, and focused behavior checks on remote native Windows or WSL2 hosts through Crabbox. The workflow selects an appropriate provider, records the actual lease and run details, and cleans up task-created cloud leases.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Run Windows builds on a remote host
• Validate WSL gateway behavior on Windows
• Collect targeted Windows UI or node proof

Plan validation for changes to the OpenClaw Windows app and collect evidence from tests, UI behavior, local MCP, or the gateway as applicable. The skill helps record what was verified and clearly report blocked checks.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Plan checks for a Windows app change
• Collect UI or MCP evidence for a behavior
• Verify a new `winnode` command

Reproduce a publicly disclosed, already-fixed vulnerability in an isolated local lab. Compare vulnerable and patched behavior with controlled inputs, inspect the fix, and prepare evidence for security testing or a technical write-up.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reproduce a patched CVE in a local lab
• Compare vulnerable and fixed versions
• Review a security patch or plan a backport

Create local, defensive reproductions of public, already-patched vulnerabilities. Confirm patch status, model the disclosed failure with synthetic markers, and build an offline comparison harness and reproducibility guide for education or control testing.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Build a local reproduction guide for a patched CVE
• Compare vulnerable and patched behavior safely
• Create a control test for a disclosed incident

Audit Pilot Shell dependencies listed in `installer/upstreams.yaml` across npm, PyPI, Homebrew, and curl installers. Check stable releases, security advisories, and hash changes, then verify updates through installation and integration checks before recording them.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking whether upstream dependencies are current
• Reviewing dependency security advisories
• Verifying checksum changes for installers

Map a feature’s real data flows and trust boundaries, then identify realistic threats such as spoofing, data tampering, or privilege escalation. The skill helps teams choose and prioritize controls while design changes are still easier to make.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing threats while designing a feature
• Reviewing changes to authentication or data handling
• Preparing for a security review

Manage vulnerabilities from discovery through verified remediation. Triage scanner findings by real-world exposure and exploitability, set patch timelines, track fixes, handle outside disclosures, and report unresolved risk in terms leaders can act on.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Setting up or improving a vulnerability program
• Prioritizing and triaging scanner findings
• Setting patch deadlines based on exposure

Review a design or code change for security risks in authentication, permissions, data handling, secrets, and dependencies. Get findings grouped by severity, with an attack path, likely impact, release implications, and a specific fix.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review an architecture or pull request for security risks
• Set secure coding standards for a team
• Choose or tune security scanning tools

Plan how to protect stored information by classifying data, choosing encryption for specific threats, managing keys and application secrets, and limiting or deleting data. Use it to assess what a backup exposure could reveal or review a protection plan.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Design data protection for a system
• Check what an encryption claim actually protects
• Set up key or application secret management

Guide security incident response from declaration through containment, evidence preservation, investigation, recovery, and review. Use it to prepare a response plan or exercise, assess a suspected compromise, and coordinate communication when personal data may be involved.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Responding to a suspected security compromise
• Preparing an incident response plan or exercise
• Coordinating containment and evidence collection

Design and assess security monitoring that can surface an attack in progress. Decide which logs to retain, build detections around attacker behavior, reduce noisy alerts, define response steps, and verify that alerts reach someone who can act.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing security monitoring coverage
• Investigating why an incident went unnoticed
• Reducing noisy alerts while keeping useful signal

Design and review access so people and services have appropriate permissions. Use it to plan roles, audit accounts, reduce always-on admin rights, manage credentials, handle departures, and improve sign-in with single sign-on or multi-factor authentication.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing who can access each system
• Planning role based permissions
• Removing access during offboarding

Use this skill to make organizational security decisions, assess business exposure from technical choices, and set security program priorities. It helps define blocking findings, specify what would resolve them, and record who accepts a risk and for how long.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Setting security program priorities
• Assessing a security risk in a technical decision
• Deciding whether a finding should block a release

Reviews analysis code for known scientific error patterns across physics, earth science, biology, chemistry, social science, and bioprocessing. It reports structured findings such as unit mismatches or unsuitable statistical methods; a clean review does not prove the code is correct.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing scientific analysis code before sharing results
• Checking whether code handles units or geographic coordinates appropriately
• Auditing statistical tests and data reductions

Test and inspect local web applications with Playwright, a browser automation tool. Check frontend behavior, investigate UI issues, capture screenshots, and view browser logs using Python scripts, including a helper for managing local servers.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking whether a local app's frontend works
• Investigating unexpected UI behavior
• Capturing a browser screenshot for review

Use this skill before reporting work as complete, fixed, or passing. It guides the agent to run the relevant verification command, read its full output, and base status updates on the results, including when preparing commits or pull requests.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking tests before saying they pass
• Confirming a bug fix with a verification command
• Reviewing build output before creating a pull request

Run validation through Crabbox on Linux, macOS, Windows, or WSL2 using the configured provider. Track environment setup and results, including delegated Blacksmith Testbox runs, and report the actual provider and run ID.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Run tests in the configured Crabbox environment
• Validate a change on Windows or WSL2
• Prove a user-facing bug fix with an end-to-end run

Use this skill to structure Playwright end-to-end tests, configure browser projects and CI runs, and manage screenshots, videos, and traces. It also gives approaches for finding and reducing flaky tests, which pass inconsistently due to timing or race conditions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Structuring browser-based end-to-end tests
• Setting up Playwright projects and CI workflows
• Capturing screenshots, videos, and traces on failure

Apply test-driven development when adding features, fixing bugs, or refactoring. The workflow starts with user journeys and failing tests, then implementation and refactoring, using unit, integration, and Playwright end-to-end tests with a target of at least 80% coverage.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Writing tests before implementing a new feature
• Planning integration and end-to-end coverage for an API
• Refactoring code while keeping tests passing

Set clear pass or fail criteria for Claude Code tasks before implementation, then track capability and regression evaluations as changes are made. The framework supports code, model, and human grading and records reliability measures such as pass@k.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Defining success criteria before changing code
• Checking that new behavior works as expected
• Finding regressions after prompt or agent changes

Guide feature work, bug fixes, and refactoring with test-driven development: write tests first, implement until they pass, then refactor. It covers unit, integration, and Playwright end-to-end tests, with an 80% coverage target.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Start a feature by defining user journeys and tests
• Add tests before fixing a bug
• Plan unit, integration, and browser end-to-end coverage