测试与安全技能

Technical due diligence for M&A, investment, or acquisition. Reads a target company's codebase and generates a comprehensive tech DD report with architecture assessment, tech debt quantification, scalability analysis, security posture, team capability inference, build system quality, test coverage, deployment maturity, and open source license risks. Outputs tech-dd-report.md formatted like a real investment memo with risk ratings, remediation costs, and go/no-go recommendation.

中文简介正在准备中。当前显示原文说明。

Use to run real static analysis over a diff or repo before shipping — Semgrep, CodeQL, secret scanning, dependency CVEs — and triage the findings into what must be fixed now versus noise. Trigger before a release or PR merge, during a security review, or when the user asks to scan the code for vulnerabilities.

中文简介正在准备中。当前显示原文说明。

Answers business questions about the user's own spreadsheet or data export (CSV, TSV, XLSX from a CRM, Shopify, Stripe, QuickBooks, ad platforms, HR or payroll systems) correctly and auditably. Profiles every file first (grain, duplicate keys, embedded Grand Total rows, text-stored numbers, mixed currencies, UTC timestamps, Excel serial dates, hidden rows), states the metric definition used, computes every number in SQL or pandas instead of mental math, checks joins for fan-out, reconciles to a known total, and returns the query, filters, row counts, and rows behind the answer. Use this whenever the user says "analyze this spreadsheet", "how many...", "what's the total in this export", "which customers...", "pivot this", "revenue by month", "top 10", "what's our churn/MRR/AOV", or asks any question about their data, CSV, or Excel file, even a quick one. Also use when they ask to change values in a data file.

中文简介正在准备中。当前显示原文说明。

Audits business spreadsheet models (.xlsx, .xlsm, or Google Sheets exported to .xlsx) for structural integrity errors and explains each fix -- budgets, forecasts, pricing models, commission calculators, FP&A packs, ops trackers, not only banking models. A bundled openpyxl script finds hardcoded numbers inside formulas, typed values pasted over formulas, inconsistent formulas across a row or column,

中文简介正在准备中。当前显示原文说明。

Analyze test coverage gaps and generate tests to improve coverage. Use when improving test coverage, finding untested code, or writing missing tests.

中文简介正在准备中。当前显示原文说明。

Plans security penetration tests for web applications. Analyzes codebase, API routes, auth implementation, and infrastructure config to generate comprehensive pentest plans. For authorized testing only.

中文简介正在准备中。当前显示原文说明。

Simulate a panel of your real prospects and buyers to pressure-test sales and marketing before it goes out — cold emails, pitch decks, landing pages, pricing pages, demo scripts, proposals. Each simulated prospect reacts in character, raises the objection they'd actually raise, and tells you whether they'd reply, book, or ghost. Use to de-risk outbound and messaging without burning real leads.

中文简介正在准备中。当前显示原文说明。

Take any claim and design + execute a complete research protocol to test it. Apply scientific method automatically: design study, gather data, run analysis, provide verdict with confidence level.

中文简介正在准备中。当前显示原文说明。

Uses Managed Agents' 14.5-hour runtime to audit an entire codebase overnight. Security, performance, accessibility, dependency issues. You wake up to a full report.

中文简介正在准备中。当前显示原文说明。

Uses Agent SDK to deploy 3 parallel agents for client onboarding -- workflow auditor, tech stack mapper, and strategy drafter. Real consulting workflow that produces a complete client assessment.

中文简介正在准备中。当前显示原文说明。

Audit a codebase for LLM calls that are really classifications in disguise, then produce a costed swap plan for a System One model. Use when asked to cut AI inference cost or latency, when scoping a performance engagement for a client, when reviewing an agent loop that feels slow, or when asked "where could we use Jev here". Produces a ranked table of candidates with measured latency and dollar deltas.

中文简介正在准备中。当前显示原文说明。

Cowork-style sweep of a folder of receipts, statements, and expense exports -- categorizes every transaction, matches receipts to statement lines, flags policy violations and anomalies, and outputs a clean expense report plus a findings memo.

中文简介正在准备中。当前显示原文说明。

Audit npm dependencies for security vulnerabilities, outdated packages, and unused dependencies. Use when checking for security issues, updating packages, or cleaning up dependencies.

中文简介正在准备中。当前显示原文说明。

Point Cowork at a folder of medical bills and insurance EOBs -- matches every bill to its explanation of benefits, catches duplicate charges, balance-billing, and bills that ignore your insurance, then drafts the dispute letters and phone scripts. Most medical bills contain errors; this finds them.

中文简介正在准备中。当前显示原文说明。

Argues the strongest honest case against a decision, plan, belief, hire, pricing move, strategy, or piece of work the user is leaning toward. Steelmans the other side, ranks at most three objections by consequence, runs a short pre-mortem, credits what the user got right, and ends with what would have to be true for their choice to work. Calibrated and collegial, never combative; says plainly when the position is strong. Use whenever the user says "play devil's advocate", "argue the other side", "poke holes in this", "what am I missing", "am I making a mistake", "talk me out of it", "stress-test this idea", "tell me why this is a bad idea", or asks for pushback on something they have mostly decided. Supports gentle, standard, and hard intensity. Not for interrogating requirements before a build (grill-the-brief) or staging a multi-persona debate (debate-simulator).

中文简介正在准备中。当前显示原文说明。

Analyze spending patterns and find savings. 50/30/20 rule, subscription audit, debt payoff strategies, emergency fund roadmap.

中文简介正在准备中。当前显示原文说明。

Use to actually verify a web change in a real browser instead of assuming it works — click through a flow, catch console errors, check a form submits, confirm a fix on the page. Trigger when a UI change needs proof, a bug only reproduces in the browser, or the user asks to test, check, or screenshot the running app.

中文简介正在准备中。当前显示原文说明。

Writes, explains, debugs, and optimizes BI calculations - Power BI / Fabric DAX measures and calculated columns, Tableau calculated fields (FIXED/INCLUDE/EXCLUDE LOD expressions, table calculations), and Looker LookML measures, dimensions, and derived tables. Use it whenever the request involves DAX, CALCULATE, a Power BI measure, a Tableau calc or LOD, LookML, or a business metric such as YoY, YTD, rolling 12 months, running total, percent of total, distinct customers, ranking, new vs returning customers, closing balances, or basket analysis. Use it especially when someone says a measure "shows the wrong total", "is blank", "ignores my slicer/filter", "repeats the same value on every row", or "is slow" - those are filter context, context transition, LOD order-of-operations, or fanout bugs this skill is built to diagnose. Produces the formula, the context it evaluates in, and a hand-checkable test with expected numbers.

中文简介正在准备中。当前显示原文说明。

Assesses how ready a business is for AI adoption across six dimensions. Evaluates data maturity, tech stack, team skills, process documentation, budget, and culture. Generates a comprehensive ai-readiness-report.md with scores, gap analysis, and recommended starting points. Aligned with OneWave AI's audit methodology.

中文简介正在准备中。当前显示原文说明。

Audit websites for accessibility issues and WCAG compliance. Use when checking accessibility, fixing a11y issues, or ensuring WCAG compliance.

中文简介正在准备中。当前显示原文说明。

Use to test whether an AI agent, prompt, or skill actually works before or after it ships — build a small eval set, score runs, and catch regressions when the prompt or model changes. Trigger when the user asks whether a prompt is good, wants to compare models or versions, sees inconsistent agent output, or is about to put an agent in front of customers.

中文简介正在准备中。当前显示原文说明。

Deploy a 2-layer parallel agent hierarchy for large, parallelizable work — big refactors, multi-file migrations, codebase-wide audits, bulk generation. A top-tier commander (Fable or Opus) orchestrates the swarms; the user picks a power level (Max Power / Heavy / Balanced / Economy) that sets the Opus/Sonnet/Haiku model mix per layer. Layer 1 is 3-50+ specialist agents, each with its own full context window; Layer 2 is 2+ sub-agents per member. Includes git safety, tiered sizing, a pre-deploy gate, phantom-completion checks, and multi-wave follow-up.

中文简介正在准备中。当前显示原文说明。

Audits a codebase or business process for regulatory compliance across GDPR, HIPAA, SOC2, CCPA, and PCI-DSS. Scans for PII handling, data retention, encryption, access controls, audit logging, consent management, and data transfer issues. Generates a structured compliance report with findings, gap analysis, remediation steps, and evidence requirements.

中文简介正在准备中。当前显示原文说明。

Security review checklist for construction software systems. Use when building integrations, APIs, data pipelines, or dashboards for construction projects.

中文简介正在准备中。当前显示原文说明。