测试与安全技能

Delegate implementation work to a dedicated implementer subagent, then review its diff, send it back to iterate, gate on the full test suite, and ship it as a PR. Use this whenever the user wants a separate model to write code, mentions handing off / delegating implementation, asks to work through a plan or spec unit-by-unit with a subagent doing the coding, or wants a review-and-merge loop wrapped around delegated output — and also when resuming such a loop ("keep going", "next unit", "继续下一个"). It encodes constraints that are expensive to rediscover: the implementer self-reports success, must not run the full test suite by default, must not touch git, and its report is a claim rather than evidence. Cursor port of implementation-loop. This loop expects an approved plan or an equivalently precise spec; settle an unsolved high-level goal into a plan first, using the cursor-engineering-mode skill (it ships in this same plugin).

中文简介正在准备中。当前显示原文说明。

Show where this machine's Claude Code tokens went - cost by token type, context tax per tool, biggest tool outputs.

中文简介正在准备中。当前显示原文说明。

Use when writing or reviewing TypeScript frontend tests — Jest unit/integration tests for React components and hooks built with Chakra UI, React Query, Zustand, and Next.js App Router. Triggers on edits to `*.test.tsx`, React component/hook test files (`.tsx`, not `.ts`) under `**/__tests__/`, custom test render helpers, or mentions of "frontend test", "component test", "hook test", "React test", "UI test".

中文简介正在准备中。当前显示原文说明。

Design, analyze, and optimize cold outbound email campaigns on Instantly. Handles end-to-end ICP definition, expert panel scoring (recursive to 90+), sequence copywriting, infrastructure audit, capacity planning, and an implementation/strategy doc for human review. Use when asked to build cold outbound sequences, optimize cold email, audit an outbound motion, write sales sequences, or design cold email campaigns. Supports "start from scratch" and "optimize existing" modes. Execution skill — it produces copy, math, and a doc; it does not auto-send. Requires Instantly for audit/send features.

中文简介正在准备中。当前显示原文说明。

Use when writing or reviewing TypeScript backend tests — Jest unit tests for services/controllers (mocked Prisma) or Supertest integration tests against a real isolated PostgreSQL test database. Triggers on edits to `*.service.test.ts`, `*.controller.test.ts`, `*.integration.test.ts`, service/controller/API test files (`.ts`, not `.tsx`) under `**/__tests__/`, or mentions of "backend test", "service test", "API test", "database test".

中文简介正在准备中。当前显示原文说明。

Use when reviewing or auditing a library of Claude Code skills, agents, slash commands, and workflows — frontmatter correctness, routing quality, tool allowlists, command arg-hints, workflow meta/phase coherence, cross-reference coherence, single-responsibility, file structure, and anti-pattern detection. Triggers on mentions of "review skills", "audit agents", "skill library", "agent definition review", "review this command", "review this workflow", "is this skill right", or when iterating on `.claude/skills/`, `.claude/agents/`, `.claude/commands/`, or `.claude/workflows/` directories. For code review of source code see code-review-and-quality.

中文简介正在准备中。当前显示原文说明。

Tests in real browsers. Use when building or debugging anything that runs in a browser. Use when you need to inspect the DOM, capture console errors, analyze network requests, profile performance, or verify visual output with real runtime data via Chrome DevTools MCP.

中文简介正在准备中。当前显示原文说明。

Auto-assembles a domain-specific expert panel (7–10 experts), scores any content or strategy artifact against a typed rubric, and iterates until the aggregate hits 90+ (max 3 rounds). Use as a quality gate on copy, email sequences, landing-page drafts, strategy docs, charts, titles, or recruiting evaluations — or when another skill needs a final review gate on its output. Triggers on "expert panel this", "score this", "rate these variants", "quality check this", "panel review", "expert score", "evaluate this copy/strategy/page". For variant generation and multi-round conversion optimization see autoresearch; for live-URL CRO auditing see conversion-ops; for the scripted content-production pipeline see content-pipeline.

中文简介正在准备中。当前显示原文说明。

Scan and redact PII and sensitive data (emails, phone numbers, SSNs, API keys, IP addresses, credentials, amounts, company/person names) from repository files. Includes a pre-commit hook to block commits containing PII. Use when asked to audit code for sensitive data, sanitize files before publishing, or install PII detection hooks. For application security hardening see security-engineering.

中文简介正在准备中。当前显示原文说明。

Use when adversarially reviewing a document that makes formal or technical claims — math derivations, physics papers, statistical analyses, benchmark reports, whitepapers. Inventories every equation and quantitative claim, verifies each AS NAMED in the text (never a paraphrase or a neighboring statement), and classifies VERIFIED / REFUTED / UNVERIFIABLE / VACUOUS. Triggers on "check this paper", "verify these claims", "is this derivation right", "review this proof", "audit this benchmark", "does the math hold up". For source-code review see code-review-and-quality; for skill/agent library audits see skill-library-review; for content quality scoring see content-ops.

中文简介正在准备中。当前显示原文说明。

AI-powered conversion rate optimization: landing page audits, CRO scoring, survey segmentation, and lead magnet generation. Use when asked to audit a landing page, run a CRO analysis, segment survey responses, or generate lead magnets. For content quality scoring see content-ops.

中文简介正在准备中。当前显示原文说明。

Autonomous growth experimentation framework: creates experiments with hypotheses, logs data points, runs statistical analysis (bootstrap CI + Mann-Whitney U), auto-promotes winners to a living playbook, and suggests next experiments. Use when asked to run growth experiments, analyze A/B tests, build experiment scorecards, or generate pacing alerts. For SEO-specific experiments see seo-ops; for outbound experiments see outbound-engine.

中文简介正在准备中。当前显示原文说明。

Cross-stack security review — auditing vulnerabilities across infrastructure, smart contracts, CI/CD pipelines, and AI agent systems, plus auth/sessions/crypto and validating user input at API and infrastructure boundaries. Triggers on mentions of "vulnerability", "pentest", "OWASP", "access control", "injection", "CSRF", "JWT", "smart contract audit", "supply chain", "OIDC", or any review of security-sensitive code paths spanning more than one layer. For PII sanitization see [security](../security/SKILL.md).

中文简介正在准备中。当前显示原文说明。

Use when designing and operating the in-app purchase catalog of a game — SKU design, price-tier ladder, bundles, starter packs, battle pass tiering, A/B price tests, store config (App Store / Google Play / Steam DLC / web / web3), and per-region price localization. Triggers on "IAP catalog", "store SKUs", "pricing tiers", "starter pack", "bundle design", "battle pass tiering", "price test", "price localization", "App Store Connect", "Google Play Console", "Steam DLC", or when handed a monetization strategy with the catalog still open. Produces a catalog spec, per-region price tables, bundle compositions, and a price-test plan. For in-game economy curves see game-balancer.

中文简介正在准备中。当前显示原文说明。

Use when forensically auditing a Claude Code skill/agent/command/workflow library against RULESET.md by a fixed mechanical protocol — probing every file against the mechanically-checkable rules and reporting CONFORMS / VIOLATES / UNVERIFIABLE / N-A counts with quoted evidence. It casts NO judgment and emits NO pass/fail verdict; counts are the headline. Triggers on "investigate the library", "audit against RULESET", "find every violation", "forensic library audit", "evidence-only check". Not for routing/quality/single-responsibility judgment — use skill-library-review. Not the full sharded sweep — use the audit-library command.

中文简介正在准备中。当前显示原文说明。

Scientific research engine for hypothesis testing, literature gap analysis, experimental validation, and data-driven discovery. Enforces adversarial review (Reviewer 2), 32 quality gates, tree search over hypotheses, confounder harness for quantitative claims, and serendipity detection. TRIGGER when: user asks to analyze scientific data, test hypotheses, validate findings, search for research gaps, design experiments, or investigate results. DO NOT TRIGGER when: pure code review, documentation writing, devops tasks, general conversation, or non-scientific data transformation.

中文简介正在准备中。当前显示原文说明。

Audit Apple-platform applications, proposed features, code changes, App Store metadata, privacy practices, and submission readiness against Apple's current App Review Guidelines. Use during feature planning, PR review, pre-release QA, App Store rejection triage, or whenever StoreKit, HealthKit, permissions, authentication, user-generated content, or App Review policy matters.

中文简介正在准备中。当前显示原文说明。

Audit and improve web accessibility following WCAG 2.2 guidelines. Use when asked to "improve accessibility", "a11y audit", "WCAG compliance", "screen reader support", "keyboard navigation", or "make accessible".

中文简介正在准备中。当前显示原文说明。

Use when building, testing, or deploying JavaScript/TypeScript applications. Reach for Bun when you need to run scripts, manage packages, bundle code, or test applications with a single unified toolkit.

中文简介正在准备中。当前显示原文说明。

Vitest fast unit testing framework powered by Vite with Jest-compatible API. Use when writing tests, mocking, configuring coverage, or working with test filtering and fixtures.

中文简介正在准备中。当前显示原文说明。

This is the MistEye security gate skill. It is triggered by pre-installation risk checks (including Skill/MCP dependency manifests), pre-access security checks for domains or URLs, IoC malicious detection, and supply-chain risk blocking, especially for common requests such as "take a look at this address/website." It must use `https://app-api.misteye.io/functions/v1/detect`; in dependency and external-link scenarios it has the highest priority. If the API returns `status="malicious"` or any `matches`, the action must be blocked and explicitly reported as "blocked". Only after the first installation is complete should the user be reminded that daily patrols can be enabled with OpenClaw or Hermes (default once per day).

中文简介正在准备中。当前显示原文说明。

Diagnose and fix flaky tests. Covers race conditions, timing issues, test pollution, async leaks.

中文简介正在准备中。当前显示原文说明。

Unit testing patterns for backend and frontend. AAA structure, effective mocking, test isolation.

中文简介正在准备中。当前显示原文说明。

Implement rate limiting on APIs. Per-IP, per-user, sliding window patterns. Express and framework-agnostic.

中文简介正在准备中。当前显示原文说明。