测试与安全技能

Execute the full end-to-end permission matrix against the live Uniffy app through the two Playwright MCP browsers: every sharing, access, denial, viewing, revocation, and request-access case on every content domain (notes, files, projects, tasks, calendar, chat, agents, automations, rooms), proven as the affected user. Covers the PostgreSQL-authoritative access behaviors: instant revocation in search and mentions, per-surface search authorization (spotlight, domain searches, filters, pagination), restricted chips, access requests, COMMENTER and role floors, expiry-aware grants, live org-default inheritance, group membership churn, delete and tag and bookmark revocation, attachment byte gating, and live no-reload pruning. Use when asked to run the permission matrix, matrix-test the permission system, do a full e2e sweep of sharing and access control, or validate a permissions PR end to end. Use `uniffy-e2e-flows` for a lighter single-domain permission loop and `uniffy-playwright` for one-off browser inspection. Skip for unit or integration tests, backend-only work, or when the dev stack is not running and the user has not asked to start it.

中文简介正在准备中。当前显示原文说明。

Create or refine GitHub issues in `uniffy-io/uniffy` using the project's title, template, dependency, project, and image-attachment conventions. Use when asked to create, open, file, draft, report, rename, or track a bug, feature, security issue, or performance issue in this repository, including requests that begin with `[BUG]`, `[FEATURE]`, `[SECURITY]`, or `[PERFORMANCE]`. Skip for pull requests, commit messages, implementation plans that do not need a tracking issue, other repositories, or general GitHub CLI questions.

中文简介正在准备中。当前显示原文说明。

Run disciplined end-to-end flows against the live Uniffy app through the project's Playwright MCP infrastructure. Covers authentication, content creation across domains, and the full permission and sharing model, including verification as a second user. Use when asked to test auth, login, permissions, sharing, access control, creation or CRUD, smoke-test the app, exercise each domain, or run a create-and-share flow. Use `uniffy-playwright` instead for a one-off browser inspection or single-bug reproduction. Skip for unit or integration tests, backend-only work, or when the dev stack is not running and the user has not asked to start it.

中文简介正在准备中。当前显示原文说明。

Run a disciplined review of the pending changes (uncommitted work plus the branch delta against main) across four dimensions: security, correctness, performance, and repo consistency. Fans out exploration subagents per dimension, then the main agent acts as judge: every finding is re-verified against the actual code before it is reported, and the result is saved to `.agents/local/reviews/` and replied verbatim. Use when asked to review the changes, review before a PR, check my work, audit this branch, or run a pre-merge review. Use `security-review` instead for a security-only pass, and `simplify` for quality-only cleanup with no bug hunting. Skip for reviewing a single function in conversation or code outside this repo.

中文简介正在准备中。当前显示原文说明。

Create a comprehensive Uniffy feature plan in `.agents/local/plans/` through deep codebase analysis, applicable rules, verified patterns, risks, tests, and executable validation steps. Use when the user asks to plan a feature or prepare implementation work without writing product code.

中文简介正在准备中。当前显示原文说明。

Audit the in-tree model catalog against each provider's live API (Anthropic, OpenAI, Google, OpenRouter, xAI) using the keys in .env. Surfaces new models the catalog is missing, catalog models a provider no longer returns, and price/context drift on the curated OpenRouter subset, so the catalog stays current. Works on both stacks (docker containers or host venv). Run periodically or when a provider ships new models / changes pricing.

中文简介正在准备中。当前显示原文说明。

Security review specialist for credential safety, OWASP vulnerabilities, JWT validation, and WebSocket security. Use proactively after implementing auth, encryption, credential handling, or workspace access code. Invoke before PRs touching security-sensitive files.

中文简介正在准备中。当前显示原文说明。

Build a self-contained UI prototype for design exploration. Creates an unauthed page in the real web app with stress-test mock data, exposes the dev server for preview, and runs visual audits at mobile and desktop viewports. Use when exploring layouts, information architecture, or interaction patterns before production implementation.

中文简介正在准备中。当前显示原文说明。

Build a UI prototype for design exploration. Creates a self-contained, unauthed page in the real web app with mock data, exposes it for preview, and runs visual audits. Use when exploring layouts, information architecture, or interaction patterns before committing to production implementation.

中文简介正在准备中。当前显示原文说明。

Test generation specialist for TDD compliance and coverage enforcement. Generates comprehensive tests following Vitest patterns for TypeScript and Go testing conventions. Use proactively during TDD phases, when implementing critical paths, or when coverage needs improvement.

中文简介正在准备中。当前显示原文说明。

Review changes in samples/book-app-web for accessibility, responsive layout, tests/build validation, and small beginner-safe changes.

中文简介正在准备中。当前显示原文说明。

Use when reviewing a skillsaw PR. Dispatches 7 specialist reviewers (Architecture, Python Expert, Security & Supply Chain, QA Engineer, Technical Writer, Ecosystem, Slopinator) as parallel sub-agents by default, then synthesizes a single verdict. Use --serial for cheaper inline execution.

中文简介正在准备中。当前显示原文说明。

Audit skillsaw for release readiness — test new rules against real repositories, audit core architectural dimensions, independently verify proposed fixes, and ship improvements in clean, focused batches. Use before cutting a release.

中文简介正在准备中。当前显示原文说明。

Create a skillsaw rule plugin — a pip-installable Python package that adds custom lint rules to skillsaw. Walks through scaffolding the package, writing rules against the lint tree, testing, and publishing to PyPI. Use when a user wants to share skillsaw rules across repositories or publish them for others.

中文简介正在准备中。当前显示原文说明。

Maintain Node3D GitHub Actions, reusable CI patterns, install modes, matrices, native/GPU/platform limits, lint/test/build jobs, and validation semantics.

中文简介正在准备中。当前显示原文说明。

Audit or prepare Node3D packages for npm publishing: package metadata, exports/files, versions, lockfiles, npm pack, binary tags/assets, submodule/root release state, and readiness.

中文简介正在准备中。当前显示原文说明。

Add or maintain node:test, native-load/runtime, visual/offscreen, hardware-dependent, browser/WebGL/Three.js, and integration validation.

中文简介正在准备中。当前显示原文说明。

Runs BDD-compliant GIVEN-WHEN-THEN tests, validates naming compliance, and analyzes coverage. Use when running tests, checking BDD compliance, validating test patterns, or verifying that test names follow GIVEN-WHEN-THEN conventions. Make sure to use this skill whenever tests need to be executed — it validates naming compliance and catches convention violations that plain test runners miss.

中文简介正在准备中。当前显示原文说明。

Scaffolds new Fakt sample projects with correct structure, build scripts, and CI integration. Supports JVM, KMP, Android, multi-module, test-fixtures, and fake-publishing types. Use when creating a new sample project, adding a demo for a new feature, setting up a new test project, or scaffolding a demonstration project. Make sure to use this skill whenever a new sample directory needs to be created — it handles build scripts, CI integration, and settings.gradle.kts registration that are easy to miss manually.

中文简介正在准备中。当前显示原文说明。

Use when building a LIVE DEMO DASHBOARD for an EXISTING Vapi assistant or squad — a Vapi-branded web page that visualizes a call as it happens (streaming transcript, tool calls, optional assistant-request strip, optional web-call button, a custom panel per use case) and deploys to Railway. Triggers on "make a demo for this assistant", "demo dashboard", "showcase this agent", "live call visualization", "demo this to a customer/exec". NOT for creating, prompting, or testing voice agents — it points at an agent that already exists and already works, and it never edits the agent itself.

中文简介正在准备中。当前显示原文说明。

This skill should be used when the user asks to "write a test", "run tests", "add a test for", "test this function", "check test coverage", "run the test suite", or when writing pytest tests for StreamFlow features or bug fixes.

中文简介正在准备中。当前显示原文说明。

Use when the primary outcome is comparing documentation claims with implementation evidence, synchronizing docs from verified changes, or freshness review, including drift, missing coverage, stale claims, and post-change updates.

中文简介正在准备中。当前显示原文说明。

Reference guide for the Twelve-Factor App methodology — 15 principles (12 original + 3 modern extensions) for building portable, resilient, cloud-native applications. Use when evaluating application architecture, designing cloud-native services, reviewing codebases for methodology compliance, advising on configuration, scaling, observability, security, and deployment patterns. Incorporates the 2025 open-source community evolution and cloud-native reinterpretations of each factor.

中文简介正在准备中。当前显示原文说明。

Use when the user explicitly asks Rewrite Room to route documentation work, or when audit/sync/freshness, user-facing authoring, citation-driven writing, docs-to-skill conversion, and AI-instruction optimization overlap and exactly one workflow must be chosen.

中文简介正在准备中。当前显示原文说明。