测试与安全技能

实现认证和鉴权时使用。覆盖 Spring Security / NestJS Guards / Django Auth / FastAPI Depends / Passport / Auth0 集成。融合 OAuth 2.1 + JWT + RBAC + 中间件实现。

中文简介正在准备中。当前显示原文说明。

A/B 测试设计与分析时使用。适用于产品实验、功能验证、转化率优化。融合假设驱动 + 样本量计算 + 置信度判断。

中文简介正在准备中。当前显示原文说明。

CI/CD 流水线设计与实现，覆盖 GitHub Actions / GitLab CI / Jenkins。标准阶段：lint → test → build → scan → deploy。关注流水线性能、安全门禁、环境隔离。

中文简介正在准备中。当前显示原文说明。

单元测试实现时使用。覆盖 Jest / Vitest / pytest / JUnit 5 / Go testing。融合 AAA 模式 + 测试替身 + 参数化测试。

中文简介正在准备中。当前显示原文说明。

Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.

中文简介正在准备中。当前显示原文说明。

Expert product discovery guidance for user research and problem validation. Use when conducting user interviews, validating problems, applying jobs-to-be-done framework, sizing opportunities, customer segmentation, competitive analysis, prototype testing, usability testing, designing surveys, or synthesizing research insights. Covers discovery sprints, continuous discovery, and research operations.

中文简介正在准备中。当前显示原文说明。

Expert performance marketing guidance for paid acquisition, CRO, and growth optimization. Use when creating ad campaigns, writing ad copy, optimizing landing pages, setting up A/B tests, analyzing CAC/LTV, building attribution models, or planning retargeting strategies. Use for Google Ads, Meta Ads, LinkedIn Ads, conversion tracking, budget allocation, and funnel optimization.

中文简介正在准备中。当前显示原文说明。

Expert product analytics strategist for SaaS and digital products. Use when designing product metrics frameworks, funnel analysis, cohort retention, feature adoption tracking, A/B testing, experimentation design, data instrumentation, or product dashboards. Covers AARRR, HEART, behavioral analytics, and impact measurement.

中文简介正在准备中。当前显示原文说明。

The Mileva Method (CRISP) — Phase 5: Prove. Success validation against Phase R baseline metrics, test log review, and AI justification validation. Use after deployment. Triggers on "prove", "phase 5", "validate", "did it work", "success criteria", "measure results", or after go-live.

中文简介正在准备中。当前显示原文说明。

The Mileva Method (CRISP) — Phase 1: Clarify. Problem definition, eliciting, painkiller test, buy vs build, AI justification gate, Go/No-Go. Use at the start of any AI implementation project. Triggers on "clarify", "phase 1", "start discovery", "define the problem", "what problem are we solving", or at the beginning of a new client engagement.

中文简介正在准备中。当前显示原文说明。

CRISP Execute — Sprint execution loop with change request management, security gates, product gates, and stakeholder reporting. Use after Phase S (Spec) is complete and crisp-state.json shows ready_for_execute: true. Triggers on "start sprint", "begin build", "execute", "sprint 1", "run sprints", or when handed off from crisp-orchestrator.

中文简介正在准备中。当前显示原文说明。

Audit and rewrite a Threads (Meta) profile end-to-end for 2026: profile photo, name with a searchable keyword, @handle, bio (150 chars, warm and specific), link, pinned post, and the connected-Instagram cross-pull that feeds Threads discovery. Triggers on "review my Threads profile", "fix my Threads bio", "what to pin on Threads", and "profile audit". Turns a default profile into one that converts visitors into followers. Not for writing posts (use threads-post-writer).

中文简介正在准备中。当前显示原文说明。

Repurpose existing content into a native Threads post or thread. Take a LinkedIn post, X thread, blog, YouTube script, or newsletter and rewrite it for Threads: warm the tone, de-corporate it, refit to a short post or light thread, rebuild the hook to clear the soft fold, strip off-platform artifacts, run the humanizer, publish via Publora on approval. Not for writing from scratch (use threads-post-writer), auditing a draft (use threads-humanizer), or a hook teardown (use threads-hook-extractor).

中文简介正在准备中。当前显示原文说明。

Use this skill when a statement of applicability already exists and the team wants its exclusions to survive the audit, and asks "review our SoA exclusions", "is this a valid justification", "can we exclude physical security if we are fully remote", "the auditor challenged our not applicable controls", "rewrite our exclusion justifications" or "we outsource it, so it does not apply, right". Tests every excluded control against scope, assets, activities, suppliers, risks and commitments, gives each a keep, rewrite, reverse or ask verdict, and writes a review table plus rewritten justifications for the owner to approve.

中文简介正在准备中。当前显示原文说明。

Use this skill when an engineering team needs a secure development policy, or has one that does not match how code really ships, and asks "write our secure SDLC policy", "secure development policy from our CI", "document our code review and scanning for the audit", "what does our pipeline already enforce", "change management for engineers" or "secure coding policy for SOC 2 or CRA". Reads the repositories and pipeline definitions, inventories what is actually enforced (reviews, checks, scanners, deploy gates, dependency and secret controls), and writes a policy whose every "must" points to the place it is enforced, with gaps listed as decisions.

中文简介正在准备中。当前显示原文说明。

Use this skill when a team must define what its management system covers before a certification project, or its current scope is one vague sentence, and asks "write our ISMS scope", "what should be in scope", "can we exclude the sales office", "scope for the certificate", "draw the boundary of our management system" or "the auditor says our scope is unclear". Drafts the scope statement with boundaries, interfaces, dependencies and justified exclusions, for a security, privacy or AI management system, and writes a statement file plus a boundary table of open questions.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company needs its information security policy set written or rebuilt, or asks "write our security policies", "draft the information security policy", "we need policies for the audit", "policy pack for a startup", "our template policies are 40 documents nobody reads" or "which policies do we actually need". Maps the policy set to the company's size and owners, drafts the top-level policy and the topic policies in testable language that reflects what the company does, flags commitments that need a decision, and prepares the approval and communication record for leadership.

中文简介正在准备中。当前显示原文说明。

Use this skill when a supplier has returned a security questionnaire, assurance report, certificate or trust pack and someone asks "review this vendor's answers", "is this supplier safe to use", "read their SOC report for us", "what should we ask the vendor next", "triage the vendor security assessment" or "does their certificate cover the service we buy". Checks report and certificate scope against the service in use, sorts answers into evidenced, asserted, contradicted and evasive, lists the obligations the report puts back on the customer, and writes a triage note with follow-up questions and a proposed decision for the owner.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company needs to decide how much assessment each supplier deserves, or asks "tier our vendors", "which suppliers are critical", "we have 200 vendors and cannot assess them all", "build a third-party risk tiering", "rank suppliers by risk" or "which vendors need a security review this year". Builds the complete supplier population from finance, single sign-on and contracts, scores each supplier on data, access and dependency, assigns a tier by the highest axis, sets the assessment depth and cycle per tier, and writes a tiered list with the reason for every score.

中文简介正在准备中。当前显示原文说明。

Use this skill when a certification audit is booked and the team wants to know whether the first stage will go through, and asks "are we ready for stage 1", "pre-audit readiness check", "what will the auditor read first", "documentation review before the certification audit", "mock stage 1" or "what would stop the audit". Walks the documentation set the way a certification auditor reads it, checks that documents agree with each other and with the records, and writes a list of stoppers, likely findings and polish items with an owner and a fix for each.

中文简介正在准备中。当前显示原文说明。

Use this skill when the implementation status column of a statement of applicability may not match reality, and the team asks "is our SoA accurate", "check the implemented column", "do we have evidence for every implemented control", "reconcile the SoA with our evidence", "pre-audit evidence check" or "the auditor found a control marked implemented with no records". Samples the records behind every control marked implemented, grades the evidence, proposes a corrected status for each row and writes a reconciliation table plus an evidence gap list with owners.

中文简介正在准备中。当前显示原文说明。

Use this skill when controls have no clear owner, or "security" owns everything, and the team asks "who owns each control", "build a RACI for our controls", "assign control owners", "nobody knows who runs the access review", "set a review cadence per control" or "the auditor asked who is accountable". Assigns one accountable role and the operators to every applicable control, checks workload and segregation of duties, sets a review cadence from how each control runs, and writes a RACI table plus a one-page brief per owner role.

中文简介正在准备中。当前显示原文说明。

Use this skill when an incident may have to be reported to an authority, customers or affected people, and the team asks "do we have to notify", "72 hours", "24 hour early warning", "is this a notifiable breach", "major incident report", "who do we tell and by when", "draft the breach notification" or "do we tell the customers". Fixes the facts and the awareness time, tests each regime and contract that may apply, builds one table of recipients and deadlines with the earliest first, drafts each notification for review, and records the reasoning for every decision not to notify.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company needs rules for how staff use company systems, data, devices and AI tools, or asks "write our acceptable use policy", "AUP for employees", "can staff use ChatGPT at work", "AI usage policy", "BYOD rules", "remote work security rules" or "a policy people will actually read". Finds how people really work (devices, apps, AI tools, travel), puts the choices to the reader as decisions, drafts a short plain-language policy with concrete do and do not examples, and adds a comprehension check and an acknowledgement text for onboarding.

中文简介正在准备中。当前显示原文说明。