测试与安全技能

YC Office Hours — product validation for a new product, feature, or side-project concept. Startup mode tests demand; Builder mode develops an unvalidated product idea. Use when the user asks whether something is worth building or has an idea whose problem/value is not yet validated. Proactively suggest when the user describes a new product idea or is exploring whether something is worth building — before any code is written. Use BEFORE a plan exists. For reviewing an existing plan, use /mk:plan-ceo-review.

中文简介正在准备中。当前显示原文说明。

Use when generating visual artifacts — explanations, diagrams, slides, or diff visualizations. Triggers on "explain X visually", "diagram this", "show as slides", "diff against main". NOT for rendering a plan as HTML (see mk:visual-plan), live media generation (see mk:multimodal), browser QA (see mk:qa), or plan critique (see mk:plan-ceo-review).

中文简介正在准备中。当前显示原文说明。

Spec-driven manual QA testing and Playwright E2E code generation. Orchestrates browser skills to navigate apps like a human tester, producing structured test reports or production-ready .spec.ts files. Always prompts user for credentials — never guesses or stores auth. Use for QA testing, E2E generation, login flow testing, or exploratory testing from a URL. NOT for AI-autonomous flows (see mk:agent-browser).

中文简介正在准备中。当前显示原文说明。

Chief Security Officer mode. Infrastructure-first security audit: secrets archaeology, dependency supply chain, CI/CD pipeline security, LLM/AI security, skill supply chain scanning, plus OWASP Top 10, STRIDE threat modeling, and active verification. Two modes: daily (zero-noise, 8/10 confidence gate) and comprehensive (monthly deep scan, 2/10 bar). Trend tracking across audit runs. Use when: "security audit", "threat model", "pentest review", "OWASP", "CSO review".

中文简介正在准备中。当前显示原文说明。

Browser automation CLI for AI agents using agent-browser. Use for navigating websites, clicking/filling pages, screenshots, data extraction, web app testing, exploratory QA, dogfooding, Electron apps, Slack automation, Vercel Sandbox browser runs, AWS AgentCore cloud browsers, auth-heavy flows, and long autonomous browser sessions. Prefer over generic browser tools when a fresh/tool-managed Chrome session is fine. NOT for the user's real Chrome cookies/profile (see mk:chrome-profile); NOT for reusable Playwright specs (see mk:qa-manual).

中文简介正在准备中。当前显示原文说明。

Use when working with Angular code — components, signals, services, forms, routing, HTTP, testing, SSR, or tooling. Targets Angular v20+ modern patterns. Auto-activates on .ts files in Angular projects (detected via angular.json).

中文简介正在准备中。当前显示原文说明。

Read-only audit of `.claude/` structural overhead. Reports prioritized "remove X save Y tokens" recommendations against the model context window. NOT for monetary cost tracking — that's /mk:budget. NOT for transcript size monitoring — long-session continuity defers to Claude Code native compaction. NOT for runtime context decisions (what to read, when to compact) — see mk:context-engineering. Use when planning to add context capacity, diagnosing perceived slowdowns, or auditing health.

中文简介正在准备中。当前显示原文说明。

Runtime router for context decisions during a task — decide read-more / stop / ask / assume / delegate, pick a minimal read-set, and time compaction. Front-page mental model is Write / Select / Compress / Isolate; a lazy pattern index routes to 25 context-engineering patterns, one reference per decision. Use when context is near budget, a long session is degrading, you must choose what to read for a task, or you are deciding /compact vs /clear vs a sub-agent. NOT for structural .claude/ overhead audits (see mk:context-audit); NOT for owning persistence (see mk:memory); NOT for USD cost (see mk:budget).

中文简介正在准备中。当前显示原文说明。

Use when answering factual or explanatory questions about the current project — codebase, architecture, conventions, workflows, constraints — with minimal cited evidence. Triggers on "how does X work here", "what does X mean", "why is X structured this way", "is this claim true in the repo", "explain X with sources". NOT for brainstorming or comparing approaches (mk:brainstorming), trade-off decisions (mk:party), debugging/root cause (mk:investigate), code review (mk:review), plans (mk:plan-creator), security audits (mk:cso), visual explanations/diagrams (mk:preview --explain), test-coverage gaps (mk:nyquist), library docs (mk:docs-finder), or workflow navigation (mk:help).

中文简介正在准备中。当前显示原文说明。

Workflow navigation assistant. Scans project state (plans, reviews, tests, git) and recommends the next step in the 7-phase pipeline. Use when asked "what should I do next?", "where am I?", "help", or at session start. NOT for domain complexity routing (see mk:scale-routing); NOT for skill discovery (descriptions handle that automatically).

中文简介正在准备中。当前显示原文说明。

Relentlessly interview the user about THEIR plan or design — one question at a time — resolving each branch of a decision tree until shared understanding. Claude is the interviewer; the user is the interviewee. Triggers on "grill me", "stress-test this plan", "get grilled on my design", "interrogate my plan". Checkpoints every answer to docs/knowledge/<slug>.md so progress survives a context-window reset. Flags knowledge the user cannot answer as a gap to chase. Do NOT use to PROPOSE solutions or compare approaches (→ mk:brainstorming). Do NOT use to validate "is this worth building?" (→ mk:office-hours). Do NOT use when Claude should ANSWER questions about the repo (→ mk:ask-me). Do NOT use for a one-shot review of an existing plan (→ mk:plan-ceo-review). Do NOT use to apply named reasoning lenses to findings (→ mk:elicit).

中文简介正在准备中。当前显示原文说明。

Use after code changes, before releases, or when testing features - runs the right level of QA based on what changed

中文简介正在准备中。当前显示原文说明。

Use when writing or reviewing Go code in fusionaly-oss — adding routes, handlers, domain contexts, background jobs, the manager CLI, wiring the app, or writing tests. Covers the cartridge framework, matcha for the manager, Phoenix Contexts, lifecycle/shutdown, and the test conventions.

中文简介正在准备中。当前显示原文说明。

DraftForge test infrastructure for writing backend unit tests, Playwright E2E tests, and managing test data population. This skill should be used when writing new tests, adding test fixtures, creating populate functions for new features, adding Playwright E2E specs, using login/auth fixtures, creating test users/orgs/leagues/tournaments, or understanding the test data architecture. Covers backend Django tests via Docker, Playwright config (projects, workers, sharding), test auth endpoints that expose backend login to frontend, and feature-isolated test data patterns.

中文简介正在准备中。当前显示原文说明。

Python Invoke task automation for DTX website. This skill should be used when running repo commands, backend tests via Docker, database migrations, updating invoke tasks, Docker operations, or workflow automation. Supports dev/test/prod environments with run, exec, up, down commands. References docs/development/invoke-tasks.md for complete command reference.

中文简介正在准备中。当前显示原文说明。

Routes agent management tasks to the correct manager agent. Use when user requests agent creation, updates, audits, git operations, or verification.

中文简介正在准备中。当前显示原文说明。

Coordinates QA workflow across planning, writing, and execution agents. Use when user requests testing, quality assurance, or test documentation.

中文简介正在准备中。当前显示原文说明。

Pre-flight security analysis before code changes — identifies trust boundary risks, dangerous patterns, and provides proceed/caution/block advisory before implementation starts

中文简介正在准备中。当前显示原文说明。

PostToolUse hook that compresses Playwright MCP tool output using Haiku summarization — Layer 4 of the token defense stack

中文简介正在准备中。当前显示原文说明。

Audit npm dependencies for security and updates

中文简介正在准备中。当前显示原文说明。

CVE triage workflow for vulnerability analysis, reproduction assessment, and patch verification

中文简介正在准备中。当前显示原文说明。

Audit agent dependencies and references

中文简介正在准备中。当前显示原文说明。

dbt best practices for SQL modeling, testing, and analytics engineering workflows

中文简介正在准备中。当前显示原文说明。

On explicit /homework invocation, analyze the current and linked previous sessions, extract mistakes (찐빠), and report them via omcustom-feedback with a confirmation gate. Auto-activation on session cleanup/session-end signals is OPT-IN (default OFF) — requires an explicit project/user directive. Use when explicitly auditing recent work for harness gaps.

中文简介正在准备中。当前显示原文说明。