测试与安全技能

Run the weak-agent adversarial test harness against docx-cli. Spawns weak exercise agents (Haiku by default, Sonnet to probe, or a local agent harness's pre-produced runs) to perform real document tasks over six scenarios — five editing (MNDA form-fill + font fidelity, invoice table-edit/restructure + logo replace, résumé styling, contract redlining + commenting, contract finalize via accept/reject + comment reply/resolve) and one authoring (T. S. Eliot poetry journal: multi-column, verse, footnotes, links, figure) — renders every result with Word, has opus judge them against ground-truth rubrics, measures each exercise's tool economy, token cost, wall-clock, and correctness (from transcripts for Claude, the exercise.json ledger for the local harness), and synthesizes a prioritized ergonomics report. Use when the user says 'adversarial review', 'test docx-cli with weak agents', 'run the haiku harness', 'weak agent test', or wants to re-run yesterday's adversarial process.

中文简介正在准备中。当前显示原文说明。

Review code for security vulnerabilities. Use when the user says 'security review', 'security audit', 'check for vulnerabilities', 'pentest the code', 'OWASP check', or any variation of wanting a security assessment.

中文简介正在准备中。当前显示原文说明。

Perform a broad, authorized security audit across application, infrastructure, identity, dependencies, and operations. Use when the user needs a scoped security posture review; use the SAST, DAST, dependency-scanning, or threat-modeling skill when the request is limited to one specialist activity.

中文简介正在准备中。当前显示原文说明。

Analyze source code for security vulnerabilities using static analysis tools, custom rules, and CI-integrated scanning pipelines. Use when the user requests static application security testing or provides relevant inputs for this workflow.

中文简介正在准备中。当前显示原文说明。

Perform dynamic security testing against running web applications and APIs to discover vulnerabilities through active probing and fuzzing. Use when the user requests dynamic application security testing or provides relevant inputs for this workflow.

中文简介正在准备中。当前显示原文说明。

Conduct structured threat modeling for software systems using established methodologies to identify, prioritize, and mitigate security threats before they are exploited. Use when the user requests threat modeling or provides relevant inputs for this workflow.

中文简介正在准备中。当前显示原文说明。

Audit web interfaces against WCAG 2.1 AA/AAA standards, identify violations, and produce actionable remediation reports with code fixes. Use when the user requests accessibility testing or provides relevant inputs for this workflow.

中文简介正在准备中。当前显示原文说明。

Scan project dependencies for known vulnerabilities, generate software bills of materials, and enforce license compliance across the software supply chain. Use when the user requests dependency scanning or provides relevant inputs for this workflow.

中文简介正在准备中。当前显示原文说明。

Threat-model and harden AI agents, RAG systems, assistants, and tool-using workflows against direct, indirect, stored, cross-agent, and multimodal prompt injection. Use when reviewing an agent architecture, isolating untrusted content, constraining tools and egress, protecting secrets, adding injection-focused tests, investigating a suspected injection incident, or documenting residual prompt-injection risk.

中文简介正在准备中。当前显示原文说明。

Generate, execute, and analyze tests for codebases, covering unit, integration, and end-to-end testing with coverage reporting. Use when the user requests testing or provides relevant inputs for this workflow.

中文简介正在准备中。当前显示原文说明。

Plan, execute, document, and retest authorized security assessments of AI agents and multi-agent workflows using safe adversarial cases, synthetic identities, canaries, and evidence-based findings. Use when defining red-team rules of engagement, assessing prompt injection or excessive agency, testing tool and identity boundaries, evaluating memory or cross-agent attacks, scoring a campaign, or verifying remediation in an approved environment.

中文简介正在准备中。当前显示原文说明。

Design and verify auditable human oversight, approval gates, escalation paths, and safe state transitions for AI agent workflows. Use when deciding which agent actions require review, adding approve/reject or dual-control flows, preventing unauthorized autonomous effects, creating decision records, reducing rubber-stamping, or recovering safely from rejected, expired, or failed actions.

中文简介正在准备中。当前显示原文说明。

Audit agent skills, plugins, prompts, manifests, scripts, dependencies, and bundled assets for provenance, prompt-injection, permission, execution, exfiltration, persistence, and update risk. Use when evaluating a third-party skill before installing, enabling, updating, publishing, or distributing it; reviewing an untrusted SKILL.md, agent configuration, MCP integration, archive, or repository; comparing a package with a known-good version; or investigating unexpected tool, network, credential, or filesystem behavior.

中文简介正在准备中。当前显示原文说明。

Use when starting any conversation involving bundle-plugins — blueprinting, scaffolding, authoring, auditing, testing, optimizing, or releasing. Also use when feeling unsure which bundles-forge skill applies

中文简介正在准备中。当前显示原文说明。

Use when optimizing a bundle-plugin or single skill — improving descriptions, reducing tokens, fixing audit findings, restructuring workflows, adding skills to fill gaps, or iterating on user feedback

中文简介正在准备中。当前显示原文说明。

Use when reviewing a bundle-plugin for structural issues, version drift, skill quality, workflow integration, or security risks — before releasing, after changes, or after adding skills. Auto-detects scope (full project vs skill vs workflow)

中文简介正在准备中。当前显示原文说明。

Use when testing a bundle-plugin locally before release — generating dev-marketplace environments, verifying component discovery, running hook smoke tests, and validating cross-platform readiness

中文简介正在准备中。当前显示原文说明。

Interview the user relentlessly about a plan or design until reaching shared understanding, resolving each branch of the decision tree. Use when user wants to stress-test a plan, get grilled on their design, or mentions "grill me".

中文简介正在准备中。当前显示原文说明。

Test-driven development with red-green-refactor loop. Use when user wants to build features or fix bugs using TDD, mentions "red-green-refactor", wants integration tests, or asks for test-first development.

中文简介正在准备中。当前显示原文说明。

Think and work like an expert Materials Scientist. Use when a task calls for Materials Scientist judgment. Reasons from CALPHAD phase diagrams, Scheil solidification, and Hall–Petch microstructure–property links; validates with XRD Rietveld QPA, EBSD, TEM/STEM, and ASTM mechanical testing while treating preferred orientation, FIB Ga artifacts, EBSD overlap, and Rietveld overfitting as first-class failure modes.

中文简介正在准备中。当前显示原文说明。

Think and work like an expert Mechanical Engineer. Use when a task calls for Mechanical Engineer judgment. Reasons from equilibrium, failure physics, and code-backed allowables; designs through requirements, GD&T, DFMEA, and hand/FEA/test validation with explicit governing failure modes.

中文简介正在准备中。当前显示原文说明。

Think and work like an expert Medical Physicist. Use when a task calls for Medical Physicist judgment. Reasons from CTDIvol/SSDE, HU accuracy, ACR/MQSA QA, TG-126 PET/CT, TG-18/TG-270 displays, and NCRP 147 shielding across CT, MRI, mammography, NM/PET, and therapy QA while treating phantom-mismatch dose claims, SUV normalization drift, display washout, and post-upgrade MEE gaps as first-class failure modes.

中文简介正在准备中。当前显示原文说明。

Think and work like an expert Mining Geologist. Use when a task calls for Mining Geologist judgment. Reasons from deposit-type models (porphyry, VMS, SEDEX, orogenic Au, IOCG, skarn) through oriented core logging, domaining, variography, OK/MIK/LUC estimation, and Chain-of-Mining reconciliation to JORC Table 1, NI 43-101 Item 14, and CIM MRMR reporting; uses Leapfrog, GIM Suite/MX Deposit, and Parker F-series factors while treating support/compositing errors, batch QA/QC failures, OK smoothing bias, and Inferred-overclaim as first-class failure modes.

中文简介正在准备中。当前显示原文说明。

Think and work like an expert Hydrogeologist. Use when a task calls for Hydrogeologist judgment. Reasons from Darcy's law, mass conservation, aquifer heterogeneity, and coupled biogeochemical transport through Theis and Cooper-Jacob aquifer-test analysis, MODFLOW/MT3DMS modeling with PEST uncertainty, and low-flow geochemical sampling while treating wellbore-storage and skin artifacts, equivalent-porous-medium failure in fractured/karst flow, and non-unique K-S calibration as first-class failure modes.

中文简介正在准备中。当前显示原文说明。