测试与安全技能

Writes a single failing test that reproduces a bug after its root-cause analysis is complete, before any fix is written. TRIGGER when: a bug has a completed root-cause analysis and you need the failing reproduction test, writing a test that proves a bug exists, the second step of the bug-fixing pipeline. DO NOT TRIGGER when: still triaging or diagnosing the bug → opsmill-dev-analyzing-bugs; implementing the fix once the test exists → opsmill-dev-fixing-bugs; general feature test-first work → superpowers test-driven-development.

中文简介正在准备中。当前显示原文说明。

Mines a pull request's review threads for lessons that generalize beyond that PR, reconstructs each against the actual code before deciding, checks whether it is already codified, and routes the genuinely-new, durable ones into Infrahub's internal documentation — `dev/knowledge/`, `dev/guides/`, `dev/guidelines/`, the `AGENTS.md` files, and `.agents/rules/` — proposing edits first and applying only with the user's approval. TRIGGER when: the user wants to turn PR review feedback into durable conventions, guidelines, or rules; capture recurring reviewer comments as internal documentation; or check whether review lessons are reflected in the knowledge/guides/guidelines/AGENTS.md/rules layer. DO NOT TRIGGER when: sweeping a feature's changes for documentation coverage across all layers → use `audit-docs`; extracting knowledge from completed spec directories → `speckit-opsmill-extract`; only replying to or resolving review threads → normal git/gh flow.

中文简介正在准备中。当前显示原文说明。

Test pyramid decision matrix, coverage targets, when to write which test type, mock vs real dependency decisions, and test ROI analysis.

中文简介正在准备中。当前显示原文说明。

Find similar vulnerabilities across a codebase after discovering one instance. Uses pattern matching, AST search, Semgrep/CodeQL queries, and manual tracing to propagate findings. Adapted from Trail of Bits. Use after finding a bug to check if the same pattern exists elsewhere.

中文简介正在准备中。当前显示原文说明。

SOC2 Type II compliance - Trust Service Criteria, access controls, audit logging, change management, incident response, evidence collection

中文简介正在准备中。当前显示原文说明。

Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.

中文简介正在准备中。当前显示原文说明。

Screenshot comparison QA for frontend development. Takes a screenshot of the current implementation, scores it across multiple visual dimensions, and returns a structured PASS/REVISE/FAIL verdict with concrete fixes. Use when implementing UI from a design reference or verifying visual correctness.

中文简介正在准备中。当前显示原文说明。

Comprehensive verification system covering build, types, lint, tests, security, and diff review before a PR.

中文简介正在准备中。当前显示原文说明。

Test-driven development workflow with philosophy guide - plan → write tests → implement → validate

中文简介正在准备中。当前显示原文说明。

Typosquatting detection, install script analysis, dependency confusion prevention, and phantom dependency detection for npm/pip.

中文简介正在准备中。当前显示原文说明。

Abonelik fiyatlama stratejileri. 3-tier framework, price anchoring, charm pricing, regional pricing (18 ulke), introductory offers, win-back campaigns, churn prevention ve A/B testing methodology.

中文简介正在准备中。当前显示原文说明。

Verification loop for Spring Boot projects: build, static analysis, tests with coverage, security scans, and diff review before release or PR.

中文简介正在准备中。当前显示原文说明。

Test-driven development for Spring Boot using JUnit 5, Mockito, MockMvc, Testcontainers, and JaCoCo. Use when adding features, fixing bugs, or refactoring.

中文简介正在准备中。当前显示原文说明。

Comprehensive testing workflow - unit tests ∥ integration tests → E2E tests

中文简介正在准备中。当前显示原文说明。

Formal theorem proving with research, testing, and verification phases

中文简介正在准备中。当前显示原文说明。

Security audit workflow - OWASP Top 10, input validation, auth, secret detection, vulnerability scan

中文简介正在准备中。当前显示原文说明。

Payment provider abstraction, webhook security, subscription lifecycle, dunning flows, pricing models, invoicing, tax handling, and refund patterns for SaaS applications.

中文简介正在准备中。当前显示原文说明。

RevenueCat SDK entegrasyon pattern'leri. iOS (Swift), Android (Kotlin), React Native ve Flutter icin setup, offerings, entitlement checking, webhook integration, StoreKit 2 migration ve sandbox testing.

中文简介正在准备中。当前显示原文说明。

Python testing strategies using pytest, TDD methodology, fixtures, mocking, parametrization, and coverage requirements.

中文简介正在准备中。当前显示原文说明。

Use this skill when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features. Provides comprehensive security checklist and patterns.

中文简介正在准备中。当前显示原文说明。

Self-healing codebase system. Monitors runtime errors, test failures, and build breaks. Automatically diagnoses root cause, generates fix, validates fix, and applies if safe. Zero human intervention for routine failures.

中文简介正在准备中。当前显示原文说明。

Release preparation workflow - security audit → E2E tests → review → changelog → docs

中文简介正在准备中。当前显示原文说明。

Static Application Security Testing patterns, OWASP Top 10 checklist, language-specific vulnerability patterns, Semgrep rule writing guide, and CI/CD integration. Use when scanning code for security vulnerabilities or writing custom SAST rules.

中文简介正在准备中。当前显示原文说明。

Pre-launch verification across infrastructure, security, legal, payment, email, analytics, and performance. Day-1 monitoring, rollback plan, incident response skeleton, and post-launch week-1 checklist.

中文简介正在准备中。当前显示原文说明。