测试与安全技能

Audit and cut the cost of a machine's scheduled routines: measure tokens per run, pick a lever (cheaper model, split, lower frequency, shorter prefix, retire) and prove the saving with a before-and-after measurement. Use when background routines burn more than interactive work. Triggers: /routine-opt, /ropt, routine audit, cheaper routines.

中文简介正在准备中。当前显示原文说明。

Get a second opinion from an external LLM at three checkpoints: T1 is the plan valid, T2 which path at a fork, T3 finish plus a QA breaker that tries to break the result. One structured move per exchange (PROPOSE, COUNTER, VERIFY, ACCEPT, BLOCK) with memory across turns, and every exchange mirrored into a human-visible channel. Supports a multi-vendor panel instead of a single reviewer. Triggers: "/secondop", "get a second opinion", "run the review panel".

中文简介正在准备中。当前显示原文说明。

Audit recent agent work for recurring manual patterns that have no skill yet, cross-check against installed skills and public skill catalogs (installing beats building), and propose the top two or three as before/after. Read-only analysis. Triggers: "/skill-gap", "what skills should I build", "audit my skills".

中文简介正在准备中。当前显示原文说明。

Package a contribution (gist, script, fix or skill) as a product instead of a bare snippet: README with problem and result, install steps, a test, license, honest limits and a clear entry point. Use before publishing a gist, sharing a fix or releasing a slice of internal tooling. Triggers: /pack, package this properly, make it a product, ship it with quality.

中文简介正在准备中。当前显示原文说明。

Audits a website codebase and makes code changes so AI engines (ChatGPT, Claude, Perplexity, Google AI Overviews) can better discover, parse, quote, and cite the site. Covers structured data, content structure, technical signals, and freshness.

中文简介正在准备中。当前显示原文说明。

- Verify whether an image or video is authentic, original and correctly captioned — provenance checks, error level analysis, noise and JPEG compression analysis, clone and copy-move detection, lighting and shadow consistency, C2PA… Use when fact-checking a photo or video, checking for a deepfake or AI-generated image, spotting manipulation, or testing whether footage is recycled or miscaptioned

中文简介正在准备中。当前显示原文说明。

Health-check, audit and, on approval, fix a self-hosted n8n automation stack. Health is read-only; any workflow edit goes preview, approval, apply. Triggers: "/n8n", "/n8n health", "/n8n fix <id>", "which workflows are failing".

中文简介正在准备中。当前显示原文说明。

Change a Mac's main display resolution in one command: real pixels instead of 4K HiDPI so remote desktop (AnyDesk), screen recording and Screenpipe stop lagging. Use when a remote session is slow or a lower or original resolution is needed: lists modes, picks by width, height, pixel width and refresh rate, self-tests five known traps, verifies after the change and prints a one-line rollback. Triggers: /display-mode, lower the resolution, set 1920x1080, AnyDesk is slow, restore resolution.

中文简介正在准备中。当前显示原文说明。

Have the second brain ask the owner five hard questions about their own long-held beliefs and codex entries that have not been revisited, so assumptions stop fossilizing. Monthly or on demand. Triggers: "/five-hard", "challenge my beliefs", "pressure-test my views".

中文简介正在准备中。当前显示原文说明。

Use Gemini as a third external reviewer alongside two other vendors: diff review with an APPROVE or REQUEST_CHANGES verdict, and QA-breaker duty in the post-build test ritual. Headless over REST with a CLI fallback, and verdicts go to a shared usage journal. Triggers: "/gemini review", "gemini opinion on this diff".

中文简介正在准备中。当前显示原文说明。

Cut background heat and noise on this machine: audit scheduled tasks by runs per hour, autostart entries, GPU holders, power plan and top CPU, then propose disable or stretch candidates, decide line by line with the operator and apply only approved lines. Triggers: /deflate, fan is loud, laptop runs hot, what can I turn off, machine slow from background load.

中文简介正在准备中。当前显示原文说明。

Verifies truthfulness, accuracy, and link integrity of content before publishing. Catches fabricated statistics, dead URLs, misattributed sources, and company claims that contradict the brand DNA.

中文简介正在准备中。当前显示原文说明。

Audits a live website for AI-engine discoverability (AEO/GEO). Crawls the site, runs 16 deterministic checks plus a 6-dimension content evaluation, and produces a scored report (A-F) with prioritized fixes. Use to get a baseline before improve-aeo-geo, or to measure progress after changes.

中文简介正在准备中。当前显示原文说明。

Guide for testing Codex TUI interactively

中文简介正在准备中。当前显示原文说明。

Test authoring guidance

中文简介正在准备中。当前显示原文说明。

How to run tests using remote executor.

中文简介正在准备中。当前显示原文说明。

Quality gate for agent-flow. Runs the repo's test, typecheck and lint commands in the issue worktree, re-runs failures once, reports raw output as JSON. Never modifies code. Use when launched with AGENT_FLOW_ROLE=qa after a review is approved.

中文简介正在准备中。当前显示原文说明。

Orchestrator for agent-flow. Runs one issue or task through Implementer, Reviewer and QA as separate processes, with mechanical risk classification, a review-round cap and escalation to Needs Me, ending in a PR. Use for /implement <issue> or when asked to take an issue end to end ("have an agent take issue

中文简介正在准备中。当前显示原文说明。

Maintenance for agent-flow context. Runs /doctor, /sync-context, /audit-risk, /repair-docs, /garden, /debt and /audit-lean; re-verifies context claims against the code before refreshing timestamps; turns repeated agent mistakes into mechanical checks. Use on a schedule, after merges flagged [CONTEXT_STALE], or when asked whether AGENTS.md is stale or the risk baseline needs review.

中文简介正在准备中。当前显示原文说明。

Universal desktop application controller for Windows. Automate any desktop app — send messages, click buttons, type text, take screenshots, and interact with native Windows applications. Use this skill when the user asks to: "control my computer", "automate desktop", "send a message on [any chat app]", "click on [something]", "type into [app]", "take a screenshot", "操控电脑", "自动化桌面", "给某某发消息", "打开某某软件", "截个屏", or any task involving interacting with Windows desktop applications. WeChat triggers: "send a WeChat message", "message someone on WeChat", "打开微信发消息", "给某某发微信", "微信发送", "微信发消息", "用微信发", "帮我发微信". Email/Web triggers: "打开邮箱", "发邮件", "send email", "open browser", "操控浏览器", "网页操作". Supports: WeChat, WeCom, DingTalk, Feishu/Lark, QQ, Telegram, Slack, Teams, any browser-based web app, and any other Windows desktop application. Inspired by OpenAI's playwright-interactive skill, combining code-based automation with visual screenshot feedback loops. ROUTING: For web/Electron apps (email, Slack, browser), prefer Playwright with CSS selectors for speed and precision. For native desktop apps (WeChat, QQ, DingTalk), use Win32 API automation.

中文简介正在准备中。当前显示原文说明。

Plan, write, and maintain automated tests in any language, with worked examples in Python and JavaScript/TypeScript. Use this skill whenever the user wants to write or plan tests, apply TDD (red-green-refactor), structure unit tests with arrange-act-assert and given-when-then naming, choose between fakes, stubs, and mocks, set up dependency injection for testability, build integration tests with testcontainers, database seeding, or transaction rollback, write Playwright or Cypress end-to-end tests, use property-based testing with Hypothesis or fast-check, create pytest fixtures or factory_boy factories, review coverage or mutation testing, or triage flaky tests in CI. Also trigger for "test pyramid", "test trophy", "test isolation", "mocking", "snapshot tests", "golden files", "parametrized tests", "make the tests pass".

中文简介正在准备中。当前显示原文说明。

Decompose systems into microservices and apply canonical distributed-systems patterns. Use this skill whenever the user wants to split a monolith into services, design service boundaries, choose between microservices and a modular monolith, implement sagas or the outbox pattern, set up CQRS or event sourcing, configure an API gateway or BFF, add resilience (circuit breakers, retries, timeouts), or implement distributed tracing with OpenTelemetry. Also trigger for distributed transactions, service discovery, event-driven architecture, contract testing with Pact, canary releases, and idempotent consumers.

中文简介正在准备中。当前显示原文说明。

Systematically find and fix performance problems in applications, frontend and backend, by measuring first. Use this skill whenever the user reports slow endpoints, high latency, poor throughput, memory leaks, large bundles, or slow page loads; wants to profile with cProfile, py-spy, Chrome DevTools, Node --cpu-prof, or perf; run load tests with locust or k6; set performance budgets or SLOs; optimize database queries (EXPLAIN, indexes, N+1); add caching (Redis); improve frontend performance (code splitting, lazy loading, image optimization, memoization, virtualization); or tune the network (CDNs, gzip/br, HTTP/2/3). Also trigger for p50/p95/p99 latency, throughput, error rate, connection pooling, async vs threads, GIL, and memory leak investigations.

中文简介正在准备中。当前显示原文说明。

Practical security review and hardening guidance for application code in Python, JavaScript/TypeScript, and Go. Use this skill whenever the user asks for a security review or audit, wants to harden authentication (password hashing, sessions, JWT, OAuth2/OIDC, MFA), fix OWASP Top 10 issues (injection, XSS, IDOR, CSRF, SSRF, deserialization), threat-model with STRIDE, clean up secrets and .env handling, or set up dependency scanning (pip-audit, npm audit, osv-scanner, gitleaks, SBOM). Also trigger for "make this secure", "is this safe to deploy", bcrypt/argon2id, rate limiting logins, RBAC/ABAC, CSP and security headers, cookie flags, and secure-by-default coding help.

中文简介正在准备中。当前显示原文说明。