测试与安全技能

Resolve merge conflicts non-interactively, validate build and tests, and finalize conflict resolution

中文简介正在准备中。当前显示原文说明。

Assess or configure MotherDuck access control: roles (RBAC), share grants, table-, row-, and column-level security, masking, tenant isolation, residency, and Terraform governance.

中文简介正在准备中。当前显示原文说明。

Use when reviewing, debugging, or giving feedback on Go code in this repo (exercises/part2, website/tools, or any *.go file) or when asked for a "code review", "review this Go", "revisa este código Go", or "crítica de código". Reviews for correctness, idiomatic Go, error handling, resource cleanup, concurrency, performance, and security, and always ends with a test-thinking pass (what a test would catch). For exercises/part2, prefer the go-exercise-reviewer skill which knows the module-mode quirk; this skill covers general Go anywhere in the repo.

中文简介正在准备中。当前显示原文说明。

Use when asked to audit or harden security in this repo — e.g. "security audit", "auditoría de seguridad", "revisa la seguridad", "is this secure", "hardening", "vulnerabilities". Audits code, config, workflows, and secrets exposure. Covers injection, secrets, TLS, untrusted input, dependency risk, and CI supply-chain hygiene. Runs when the user asks about security, not just for code reviews.

中文简介正在准备中。当前显示原文说明。

Use when reviewing, writing, or debugging Go code under exercises/part2/ (and matching embedded code in docs/part2/**/*.mdx). Thinks hard about correctness, idiomatic Go, error handling, resource cleanup, concurrency, and — crucially — what the tests would catch: edge cases, races, leaks, timeouts, and port conflicts. Knows the repo's module-mode quirk (GO111MODULE=off) and which dirs carry go.mod.

中文简介正在准备中。当前显示原文说明。

Use whenever the user wants to find, shortlist, vet, or enrich US cybersecurity firms — pen-testing/red team, security audits, vCISO, SOC 2 readiness, incident response, managed SOC, IAM, cloud security, and AppSec. Triggers on "find me a pen-testing firm for our SOC 2 audit", "shortlist three vCISO services for our healthcare-tech startup", "we need an incident response retainer", or "pull contact info for these 8 security firm domains", even when described indirectly (we got breached, prepare us for the compliance audit, get us SOC 2 ready). Drives the ServiceGraph API (api.servicegraph.co) — a 100k+ US firm catalog filterable by industry, services, location, size, ratings. Skip in-house security hires, "how do I patch CVE-X" or "configure firewall Y" DIY questions, security-product reviews (CrowdStrike vs SentinelOne, etc.), generic security knowledge questions, consumer/personal security advice, non-US firms, individual freelancers and bug-bounty hunters.

中文简介正在准备中。当前显示原文说明。

Use whenever the user wants to find, shortlist, vet, or enrich US accounting and tax firms (CPA firms) — financial-statement audit, SOC 1/2 audit, corporate tax, bookkeeping for businesses, advisory/fractional CFO, M&A diligence, 409A valuations, R&D tax credits, IPO readiness, sales-and-use tax. Triggers on "find me a CPA firm for our delaware c-corp series A audit", "shortlist three audit firms with SaaS experience", "we need a tax advisor for our M&A", or "pull contact info for these 10 accounting firm domains", even when described indirectly (audit our books, fractional CFO support, file our 1120). Drives the ServiceGraph API (api.servicegraph.co) — a 100k+ US firm catalog filterable by industry, services, location, size, ratings. Skip personal/consumer tax preparation (1040, individual estate, retirement planning), in-house controller/CFO hires, "how do I file my taxes" DIY questions, accounting-software comparisons (QuickBooks vs Xero), non-US firms, individual freelance bookkeepers.

中文简介正在准备中。当前显示原文说明。

Prepare to contribute to an open source repo. Reads all contribution docs, checks eligibility, assesses the user's knowledge gaps, and fills them before coding starts. Use after finding an issue with oss-find-issue, or when starting work on any OSS repo. Not for installing dependencies or getting the build and tests running. Use oss-setup-dev-env for that.

中文简介正在准备中。当前显示原文说明。

Find actual code issues in a repo that aren't listed in GitHub issues. missing tests, inconsistent patterns, outdated dependencies, documentation gaps. Presents findings to the user for evaluation. Use when you want to make proactive contributions beyond existing issues, or when no good issues are available. Not for browsing the existing issue tracker. Use oss-find-issue for that.

中文简介正在准备中。当前显示原文说明。

Write tests for untested OSS code as a standalone contribution. Identifies coverage gaps, studies the repo's test conventions, and guides the user through writing tests that match existing patterns. Use when contributing tests to an open source repo, looking for a low-risk first contribution, or improving test coverage. Not for writing tests alongside a bug fix — use oss-contribute for that.

中文简介正在准备中。当前显示原文说明。

Submit a pull request following the repo's contribution guidelines. Reviews the diff, checks for common rejection reasons, and helps the user write their own PR description. The LLM reviews. the user writes. Use when implementation is complete and tests pass. Not for responding to review comments after the PR is open. Use oss-post-pr for that.

中文简介正在准备中。当前显示原文说明。

Set up a complete development environment for an unfamiliar OSS repo. Handles dependency installation, building, running tests, and configuring dev tooling. Use when cloning a new OSS repo and setting up for development, when the repo's setup instructions don't work, or when you need to debug environment issues. Not for setting up your own project — this is for getting someone else's repo running.

中文简介正在准备中。当前显示原文说明。

Research an issue deeply and present all context to the user. but the user writes the code. The LLM investigates code paths, finds relevant files, explains patterns, and identifies constraints. The user thinks through the approach and implements it. Use when ready to start working on an issue after oss-prep-to-contribute. Not for writing tests or documentation as a standalone contribution. Use oss-write-tests or oss-write-docs for those.

中文简介正在准备中。当前显示原文说明。

Maintain the opt-in encrypted Documents API, immutable account ownership, SQLite ciphertext storage, chunk transactions, recipient key envelopes, configuration parser, and TLS/browser cryptographic tests. The separately maintained React application has its own integration skill.

中文简介正在准备中。当前显示原文说明。

Maintain required external authorization decisions, gatekeeper and validator hooks, the HTTP JSON plugin, reusable parsers, and protected-request E2E coverage. Excludes credential authentication and claims enrichment.

中文简介正在准备中。当前显示原文说明。

Maintain authorization ACL rules, typed custom claim fields, their reusable parser, policy integration, and signed-token or authenticated-user E2E coverage.

中文简介正在准备中。当前显示原文说明。

Maintain the pure-Go SQLite single-use ticket identity provider, public parser, trusted issuance API, HTTP login capability, cookie and realm binding, portal signing, and TLS consumer tests. Excludes OAuth/SAML protocols and anonymous ticket issuance services.

中文简介正在准备中。当前显示原文说明。

Scope AuthCrunch validation to changed behavior and affected consumers, require corresponding Go and E2E coverage, remediate diagnostics, and maintain pinned tested reports and CI gates.

中文简介正在准备中。当前显示原文说明。

Maintain the pure-Go SQLite notification outbox, public parser, runtime messaging-provider injection, worker leases, bounded SMTP delivery, and registration notification E2E tests. Excludes registration enrollment state.

中文简介正在准备中。当前显示原文说明。

Maintain the pure-Go SQLite password identity store, reusable parser, immutable account evidence, idempotent enrollment, portal injection, and login E2E tests. Excludes local JSON database internals and MFA/profile feature implementation.

中文简介正在准备中。当前显示原文说明。

Create or revise repo-local skills connected by actionable routing statements from AGENTS.md through broad and increasingly specialized skills. Use when documenting AuthCrunch engineering knowledge, adding or routing a skill, reorganizing the skill hierarchy, or auditing that every skill is reachable and useful to contributors.

中文简介正在准备中。当前显示原文说明。

Maintain upstream SAML identity-provider authentication, request/response browser binding, ACS and assertion validation, pinned signing certificates, and signed TLS/browser tests.

中文简介正在准备中。当前显示原文说明。

Maintain upstream OAuth identity-provider directive parsers, shared configuration dispatch, injectable OAuth login storage, OAuth/OIDC discovery, GitHub identity claims, JWKS and static public PEM verification, EdDSA/Ed25519 token validation, key refresh, and real portal OAuth E2E tests. Excludes portal signing-key publication and gatekeeper-owned direct OAuth sessions.

中文简介正在准备中。当前显示原文说明。

Maintain AuthCrunch authentication event attribution, logging skip rules, the reusable directive parser, immutable Zap filters, root logger wiring, and TLS log-output tests. Excludes host-specific access-log configuration and changes to authentication decisions.

中文简介正在准备中。当前显示原文说明。