测试与安全技能

Use this skill when a company needs its internal audit programme for the certification or examination cycle, or asks "plan our internal audits", "internal audit schedule for the year", "audit programme for the three-year cycle", "who can do our internal audit", "we are too small for an independent auditor", "readiness audit before the examination" or "which areas do we audit first". Ranks audit areas by risk, change and past findings, sets how often each is audited across the cycle, assigns auditors who are independent of what they audit, sizes the effort, and writes a programme, a coverage matrix and a calendar for leadership to approve.

中文简介正在准备中。当前显示原文说明。

Use this skill when an internal auditor has one process or area to audit and needs a working checklist built from the company's own documents, or asks "build an internal audit checklist", "audit questions for access management", "what do I test in the supplier process", "audit plan for this area", "how many samples should I take", "internal audit of our data protection process" or "test our incident process against what the policy says". Turns each commitment in the company's policies and procedures into a test with a question, a record to inspect, a sample and a pass criterion, adds framework-specific checks through a lookup, and writes a checklist file the auditor fills in during fieldwork.

中文简介正在准备中。当前显示原文说明。

Use this skill when a bank, payment or e-money institution, investment firm, insurer, crypto-asset service provider or other financial entity in scope of DORA needs to know whether its ICT risk management setup holds up, or when someone asks "DORA gap analysis", "are we DORA compliant on ICT risk", "check our ICT risk management framework", "prepare for the supervisor's DORA review", "does our ISO 27001 ISMS cover DORA" or "audit our Article 6 framework". Confirms the entity type and whether the simplified regime applies, maps the entity's own documents and records against the ICT risk management articles, and writes a gap list with owners, evidence and priorities.

中文简介正在准备中。当前显示原文说明。

Use this skill when a company has no incident response plan, has one copied from a template that names teams it does not have, or an auditor, customer or insurer asks for it, and the team says "write our incident response plan", "IR plan", "security incident procedure", "who does what in an incident", "incident playbooks", "contact tree for incidents" or "our plan failed in the last incident". Drafts a plan sized to the company with roles and deputies, a severity scale, a contact tree with an out-of-band channel, one-page playbooks for the likely scenarios, evidence handling and a notification decision step, plus a one-page quick reference card.

中文简介正在准备中。当前显示原文说明。

Premium brand-kit image generation skill for creating high-end brand-guidelines boards, logo systems, identity decks, and visual-world presentations. Trained for minimalist, cinematic, editorial, dark-tech, luxury, cultural, security, gaming, developer-tool, and consumer-app brand systems. Optimized for intentional logo concepting, refined composition, sparse typography, strong symbolic meaning, premium mockups, art-directed imagery, and flexible grid layouts.

中文简介正在准备中。当前显示原文说明。

Analyze a repository to generate recommended Claude Code settings.json permissions. Use when setting up a new project, auditing existing settings, or determining which read-only bash commands to allow. Detects tech stack, build tools, and monorepo structure.

中文简介正在准备中。当前显示原文说明。

Comprehensive guide for configuring and managing GitHub Dependabot. Use this skill when users ask about creating or optimizing dependabot.yml files, managing Dependabot pull requests, configuring dependency update strategies, setting up grouped updates, monorepo patterns, multi-ecosystem groups, security update configuration, auto-triage rules, or any GitHub Advanced Security (GHAS) supply chain security topic related to Dependabot. For pre-commit dependency vulnerability scanning in AI coding agents via the GitHub MCP Server, this skill references the Advanced Security plugin (`advanced-security@copilot-plugins`). Use this skill when an agent needs to scan dependencies for known vulnerabilities before committing.

中文简介正在准备中。当前显示原文说明。

Audits project dependencies across language ecosystems for known vulnerabilities, license conflicts, transitive risks, and outdated packages, and plans safe upgrades. Use before a release, when adding dependencies, or during a security or license compliance review.

中文简介正在准备中。当前显示原文说明。

Helm chart development agent skill and plugin for Claude Code, Codex, Gemini CLI, Cursor, OpenClaw — chart scaffolding, values design, template patterns, dependency management, security hardening, and chart testing. Use when: user wants to create or improve Helm charts, design values.yaml files, implement template helpers, audit chart security (RBAC, network policies, pod security), manage subcharts, or run helm lint/test.

中文简介正在准备中。当前显示原文说明。

Scaffolds an xUnit integration test project for validating Oracle-to-PostgreSQL database migration behavior in .NET solutions. Creates the test project, transaction-rollback base class, and seed data manager. Use once per project before writing Oracle-to-PostgreSQL migration integration tests.

中文简介正在准备中。当前显示原文说明。

Maps the files relevant to a task before any edit: files to modify, dependencies that may need updates, test files, reference patterns to follow, and risks such as API, migration, or config changes. Use at the start of a non-trivial change in an unfamiliar codebase.

中文简介正在准备中。当前显示原文说明。

Audits SwiftUI performance: rendering, scrolling, CPU and memory, unnecessary view updates, body re-evaluations, and layout thrashing, with Instruments guidance when code review is inconclusive. Use when a SwiftUI screen stutters, scrolls poorly, or uses too much CPU.

中文简介正在准备中。当前显示原文说明。

Audits Python + BigQuery pipelines for cost safety, idempotency, and production readiness. Returns a structured report with exact patch locations. Use before deploying or after a cost spike in a Python pipeline that queries BigQuery.

中文简介正在准备中。当前显示原文说明。

Drives development with tests. Use when implementing any logic, fixing any bug, or changing any behavior. Use when you need to prove that code works, when a bug report arrives, or when you're about to modify existing functionality.

中文简介正在准备中。当前显示原文说明。

Creates integration test cases for .NET data access artifacts during Oracle-to-PostgreSQL database migrations. Generates DB-agnostic xUnit tests with deterministic seed data that validate behavior consistency across both database systems. Use after the test project is scaffolded, to cover a project's data access code before porting it.

中文简介正在准备中。当前显示原文说明。

Creates an integration testing plan for .NET data access artifacts during Oracle-to-PostgreSQL database migrations. Analyzes a single project to identify repositories, DAOs, and service layers that interact with the database, then produces a structured testing plan. Use when planning integration test coverage for a migrated project, identifying which data access methods need tests, or preparing for Oracle-to-PostgreSQL migration validation.

中文简介正在准备中。当前显示原文说明。

AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when asked to scan code for security vulnerabilities, find bugs, check for SQL injection, XSS, command injection, exposed API keys, hardcoded secrets, insecure dependencies, access control issues, or any request like "is my code secure?", "review for security issues", "audit this codebase", or "check for vulnerabilities". Covers injection flaws, authentication and access control bugs, secrets exposure, weak cryptography, insecure dependencies, and business logic issues across JavaScript, TypeScript, Python, Java, PHP, Go, Ruby, and Rust.

中文简介正在准备中。当前显示原文说明。

Enforce output quality, evidence verification, and quality gates across security audits. Use this skill when you perform SAST, SCA, threat modeling, or security code reviews. Use this skill to verify code locations and taint traces for all findings. Use this skill to prevent the suppression of valid security findings. Use this skill to evaluate reports against quality thresholds (score ≥ 8/10) before delivery.

中文简介正在准备中。当前显示原文说明。

Use when building anything that accepts user input, implementing authentication or authorization, storing or transmitting sensitive data, integrating external APIs, or adding file uploads, webhooks, or callbacks. Covers input validation, secrets, authz checks, and PII and payment handling.

中文简介正在准备中。当前显示原文说明。

Tests in real browsers via Chrome DevTools MCP. Use when building or debugging anything that runs in a browser. Use when you need to inspect the DOM, capture console errors, analyze network requests, profile performance, or verify visual output with real runtime data. Requires the chrome-devtools MCP server to be configured.

中文简介正在准备中。当前显示原文说明。

Use when designing defensive monitoring for agent systems whose risks accumulate across users, sessions, subagents, files, or tool calls. Adds online cross-context clustering with rare escalation, time-to-detect evaluation, provenance checks for control-like workspace content, and sanitized commits for persistent prompt-injection defense.

中文简介正在准备中。当前显示原文说明。

Patterns and techniques for evaluating and improving AI agent outputs. Use this skill when: - Implementing self-critique and reflection loops - Building evaluator-optimizer pipelines for quality-critical generation - Creating test-driven code refinement workflows - Designing rubric-based or LLM-as-judge evaluation systems - Adding iterative improvement to agent outputs (code, reports, analysis) - Measuring and improving agent response quality

中文简介正在准备中。当前显示原文说明。

Use when improving, evolving, benchmarking, or maintaining agent skills over time. Treats skills as long-lived structured artifacts: execute tasks, diagnose trajectory evidence, accumulate textual momentum, patch at the correct abstraction layer, test per model and harness, canary changes, and roll back regressions.

中文简介正在准备中。当前显示原文说明。

Improve AI application with evaluation-driven development. Define eval criteria, instrument the application, build golden datasets, observe and evaluate application runs, analyze results, and produce a concrete action plan for improvements. ALWAYS USE THIS SKILL when the user asks to set up QA, add tests, add evals, evaluate, benchmark, fix wrong behaviors, improve quality, or do quality assurance for any Python project that calls an LLM model.

中文简介正在准备中。当前显示原文说明。