测试与安全技能

[Code Quality] Use when a workflow step or the user asks for security audits: OWASP, secrets, supply chain, infrastructure, CI/CD and AI-agent risks.

中文简介正在准备中。当前显示原文说明。

[Git] Use when asked to create, open, finish, update or mark ready a pull request. Runs in the main session with risk-based test/review choices and automatic checks for routine CI repairs: branch, commit, open PR, CI to green.

中文简介正在准备中。当前显示原文说明。

[Workflow] Write and verify spec-traced integration tests, or diagnose and fix failing suites to repeatable green. --mode={write|green}.

中文简介正在准备中。当前显示原文说明。

[Documentation] Use when a workflow step or the user asks for documentation sync after code/spec/test changes (--mode=update), or explicit reference-doc initialization and reconciliation (--mode=init).

中文简介正在准备中。当前显示原文说明。

[Testing] Use when initializing, writing, reviewing or verifying performance/load/soak/capacity tests. --mode=verify --fix-loop (or --mode=green) diagnoses, fixes and remeasures with performance-review. Static bottleneck audits use performance-review.

中文简介正在准备中。当前显示原文说明。

[Testing] Automate browser interactions, test web pages, and work with Playwright tests.

中文简介正在准备中。当前显示原文说明。

[Testing] Use when a workflow step or the user asks for runtime review of a UI, API, CLI or service against intended behavior. --rounds=0 reports only; --rounds=N bounds repairs.

中文简介正在准备中。当前显示原文说明。

[Testing] Use when generating a demo video from E2E screenshots for current changes, a commit, pull request or named user journey, covering every relevant case.

中文简介正在准备中。当前显示原文说明。

[Architecture] Use when a workflow step or the user asks for architecture design, compliance review, scalability grading or whole-project audit via --mode={design|review|scalability|full}.

中文简介正在准备中。当前显示原文说明。

Use when reverse engineering binaries, firmware, mobile apps, JavaScript/Electron apps, .NET assemblies, network protocols, or malware samples; when decompiling, deobfuscating, unpacking, debugging, or hooking shipped artifacts; when solving CTF challenges (pwn, crypto, forensics, web); when a conclusion needs evidence from a shipped artifact rather than available source; or when routing authorized pentest and security-analysis work. Do not use for ordinary review of source code you already have.

中文简介正在准备中。当前显示原文说明。

Use when testing whether the jevaluate rubric and instructions lead graders to the right answers: after a rubric or instruction change, before freezing a rubric, before publishing ratings, or when a grader's calls look wrong.

中文简介正在准备中。当前显示原文说明。

Use to iterate a change until tests/quality checks pass — bounded run→revise→re-run gated by a numeric threshold, then a judge confirms. Triggers 'iterate to green', 'keep fixing until tests pass'.

中文简介正在准备中。当前显示原文说明。

Use BEFORE writing any test — enumerate cases per behavior (happy / boundary / error / abuse), prioritize by likelihood × impact, cross-check via subagent — even if the user just says 'add tests'.

中文简介正在准备中。当前显示原文说明。

Use when applying security best practices — authentication, authorization, CSRF protection, input sanitization, rate limiting, or secure coding — stack-agnostic.

中文简介正在准备中。当前显示原文说明。

Use when hardening a Linux host you operate — SSH posture, a default-deny firewall baseline, and unattended security upgrades, each verified on the box rather than assumed from a config file.

中文简介正在准备中。当前显示原文说明。

Implementing a feature, fixing a bug, refactoring — failing test first, then the code. For a WRONG test, `testing-anti-patterns` wins.

中文简介正在准备中。当前显示原文说明。

Use when reviewing, auditing, or optimizing skills — validates against the 7 Skill Killers checklist and produces fix recommendations.

中文简介正在准备中。当前显示原文说明。

Use when optimizing test suite performance — database setup, seeder optimization, parallel testing, CI pipeline efficiency, or RefreshDatabase alternatives.

中文简介正在准备中。当前显示原文说明。

Deep multi-pass codebase audit — orchestrates project-analysis-core plus the framework-specific project-analysis-*; explicit request only. Single-pass scan → project-analyzer.

中文简介正在准备中。当前显示原文说明。

BEFORE writing/changing tests, mocks, or test-only methods on production classes — mocking-the-mock, production pollution, overfit assertions; for order, `test-driven-development` wins.

中文简介正在准备中。当前显示原文说明。

Use when the user wants a security-maturity scorecard / posture assessment of a module — category ratings with evidence, not a vulnerability hunt. Also on 'wie sicher ist dieses Modul aufgestellt?'

中文简介正在准备中。当前显示原文说明。

Use to run a depth-bounded self-correction loop (attempt → critic verdict → re-attempt) as a tunable test-time compute knob — a do-and-judge specialisation, default off, capability-gated.

中文简介正在准备中。当前显示原文说明。

Single-pass tech-stack detection with an agents/evidence/analysis/ write-up; explicit request only. Deep multi-pass audit → universal-project-analysis. Raw primitives → project-analysis-core.

中文简介正在准备中。当前显示原文说明。

Security audit — vulnerability scan, pentest review, attack-surface sweep; explicit request only, not regular feature work. Pre-implementation threat pass → threat-modeling.

中文简介正在准备中。当前显示原文说明。