测试与安全技能

Web testing with Playwright, Vitest, k6. E2E/unit/integration/load/security/visual/a11y testing. Use for test automation, flakiness, Core Web Vitals, mobile gestures, cross-browser.

中文简介正在准备中。当前显示原文说明。

STRIDE + OWASP-based security audit with optional auto-fix. Scans code for vulnerabilities, categorizes by severity, and can iteratively fix findings using vc-autoresearch pattern.

中文简介正在准备中。当前显示原文说明。

5 expert personas debate proposed changes before implementation. Catches architectural, security, performance, and UX issues early. Use before major features or risky changes.

中文简介正在准备中。当前显示原文说明。

Use when a SPEC, INNOVATE, or VALIDATE (Layer 2) approach hinges on an unverified runtime/library/external mechanism: run a probe from the 8-family taxonomy and produce a VIABLE/NOT-VIABLE/INCONCLUSIVE VERDICT artifact.

中文简介正在准备中。当前显示原文说明。

Use when creating a test plan for a blast radius. Assigns all 4 tiers (fully-automated, hybrid, agent-probe, known-gap) with exact commands, what each proves, and gap resolution options.

中文简介正在准备中。当前显示原文说明。

Audit agent harness health: Claude/Codex agent parity, skill registry consistency, README.md sync, and protocol file wiring. Use when agents, skills, README.md, or development-protocol files move, split, or drift.

中文简介正在准备中。当前显示原文说明。

Generate comprehensive edge cases and test scenarios by decomposing features across 12 dimensions. Use before implementation or testing to catch issues early.

中文简介正在准备中。当前显示原文说明。

Audit active project plan files for staleness, completion, and routing truth. Use when cleaning up plans, reconciling active work, or archiving completed artifacts.

中文简介正在准备中。当前显示原文说明。

Audit project context routing, shared-skill discoverability, and Claude/Codex wiring. Use when context docs or skill surfaces move, split, or drift.

中文简介正在准备中。当前显示原文说明。

Optional design-improvement pass for when you have spare usage to drain. Finds the shallowest modules in the code the spec touches, researches a deeper design, and proposes refactors that shrink interfaces and hide decisions — behavior held constant, tests green before and after. Proposes §I/§V/§T edits, never silent rewrites. Triggers when the user says "deepen this", "improve the design", "this module feels shallow", "pull complexity down", "use spare budget on the codebase", or invokes /ck:deepen. Leans on the codebase-design skill's deep-module vocabulary when present.

中文简介正在准备中。当前显示原文说明。

Calibrated interrogation of a fuzzy idea before it becomes a spec. Asks one question at a time, recommends an answer, and lands each answer in §G (goal) or §C (constraints) — unknowns parked as `?` items, never guessed. The cheapest place to kill a bad idea is before §T exists. Triggers when the user has a vague idea, says "grill me", "stress-test this", "challenge my plan", "interview me before I spec", or invokes /ck:grill. Defers the actual write to the spec skill.

中文简介正在准备中。当前显示原文说明。

Bug → spec protocol. When a bug is found or a test fails, trace the cause, decide whether a new §V invariant would catch recurrence, append to §B. This is the one non-obvious thing SDD does that plan-then-execute doesn't. Triggers on test failure, bug report, post-mortem, or explicit user ask.

中文简介正在准备中。当前显示原文说明。

Read-only drift detector. Diffs SPEC.md against current code and reports violations grouped by severity. Writes nothing — suggests remedies via the spec or build skills but never invokes them. Triggers when the user asks to check drift, audit the spec, verify invariants, or ask whether code still matches the spec. Phrasings: "check drift", "audit the spec", "does the code still match §V", "check invariants", "spec vs code".

中文简介正在准备中。当前显示原文说明。

Use when adding a new messaging channel to Tel-Agent or changing an existing one — a transport under api/channels/, its official extension manifest, its settings card, tests, health and docs. Covers the file checklist, the two inbound shapes (dial-out and the public door), the credential and signature rules that are not negotiable, the declarative setup descriptor the generic card draws from, and the test shape every channel ships with.

中文简介正在准备中。当前显示原文说明。

Verify claims, quotations, citations and references against live primary sources, and produce a reproducible audit record instead of an assertion. Use when asked to: check whether a quotation, verse, statistic, date, attribution or citation is accurate; verify references before publishing a report, thesis, article, slide deck or legal filing; confirm a text against an authoritative database; cross-check a claim across independent sources; build a citation register or verification appendix; find out whether two datasets agree; detect a misattributed or fabricated quotation; or audit a document's existing citations. Source-agnostic by design, with working providers for REST/JSON APIs, scraped HTML, bulk corpora, bibliographic catalogues (OpenLibrary), DOI resolution (Crossref) and reference works (Wikipedia) -- including scriptural tiers (Qur'an.com, sunnah.com and an independent hadith corpus) with full diacritic handling for Arabic, Hebrew, Greek and any script with optional marks. Covers content-addressed matching when sources disagree on numbering, graded match verdicts, byte-level integrity checks, published-string verification, and a catalogue of silent failure modes (identifier divergence, mojibake, scraper blocking, false-positive keyword rules, missing glyphs, unreliable PDF text layers).

中文简介正在准备中。当前显示原文说明。

Use when checking the overall health of a skills library. Run doctor, validate, check for stale skills, and verify generated docs are in sync.

中文简介正在准备中。当前显示原文说明。

Fast path for a minimal CloudBase Web + database demo (最小前后端 / 最小可用 fullstack / Lovable-like BaaS). Defaults to @cloudbase/js-sdk client CRUD (NoSQL app.database / PG app.rdb), MCP-only schema, preview-first, and forbids cloud functions unless secrets, cron/background jobs, or logic that security rules/RLS cannot express. Use for 搭一套 demo、留言板、Todo、Notes、Kanban, or when users say 带云函数+云数据库 but only need CRUD. NOT for production multi-service backends, CloudRun, WeChat Mini Programs, or tasks that truly need server secrets.

中文简介正在准备中。当前显示原文说明。

Use when auditing repository documentation for drift, stale statements, broken references, or README mismatches, especially across published docs under `doc/` and key entry surfaces such as `README.md` (English default), `README.zh-CN.md`, `mcp/README.md`, and `mcp/README.zh-CN.md` during periodic maintenance or before preparing corrective PRs.

中文简介正在准备中。当前显示原文说明。

Perform a full codebase review, categorize findings by severity, file GitHub issues, then fix each issue in an isolated git worktree and submit PRs. Use this skill when the user asks to audit the codebase, do a comprehensive code review, find and fix security/quality/reliability issues, or run a proactive health check across the entire repository.

中文简介正在准备中。当前显示原文说明。

Design, improve, and evaluate reusable agent skills with high-quality SKILL.md files, precise trigger descriptions, progressive disclosure, and testable behavior. This skill should be used when users ask to create a new skill, rewrite or review an existing skill, audit a skill collection such as `config/source/skills` for redundancy or overlap, improve skill trigger quality, organize skill references, or evaluate whether a skill should trigger and behave correctly.

中文简介正在准备中。当前显示原文说明。

Code learning and audit framework. Analyze any codebase — new, legacy, or AI-generated — and produce educational explanations or architectural audits. Use when the user wants to understand WHAT and WHY behind any code, not just accept it.

中文简介正在准备中。当前显示原文说明。

Audit an agent's harness against the four rings: containment, guides, sensors, permissions. Use when the user asks whether their agent setup is safe, wants a review of sandboxing / permissions / hooks / AGENTS.md guardrails, or asks what a bad session could break. Read-only: reports the blast radius and a hardening list, changes nothing. Do NOT use for context layout (context-audit) or cost routing (gate-check).

中文简介正在准备中。当前显示原文说明。

Find the decisions in a pipeline that do not need the expensive model and propose the gate for each: a rule, a classic classifier, or a small model, with fail-closed routing. Use when the user asks to cut model costs or latency, says the big model handles everything, or wants a triage / routing / filter layer in front of an agent. Analysis plus an optional baseline scaffold. Do NOT use for auditing context layout (context-audit) or for building eval suites (evals-bootstrap).

中文简介正在准备中。当前显示原文说明。

Turn a vague task into a testable definition of done and generate an executable goal-test script for it, optionally with a bounded retry loop around a headless agent. Use when the user wants to run an agent in a loop, asks how to know when an agent task is finished, or says a goal like "improve X" needs to become checkable. Do NOT use for building eval suites over many cases — that is evals-bootstrap.

中文简介正在准备中。当前显示原文说明。