测试与安全技能

Audit a pytest suite: surviving mutants and untested code, flaky, order-dependent and slow tests, and removal candidates checked on held-out mutants. Report-only.

中文简介正在准备中。当前显示原文说明。

Run all tests. Codex equivalent of the Claude /test command.

中文简介正在准备中。当前显示原文说明。

Design and review API contract tests across providers and consumers. Use for schema changes, compatibility regressions and client integration failures.

中文简介正在准备中。当前显示原文说明。

Implements and reviews mobile identity and session flows across Flutter, Android, iOS, React Native and Kotlin Multiplatform. Use for sign-in, passkeys, account recovery, provider linking, reauthentication, logout and concurrent refresh. Security audits belong to mobile-security; account deletion belongs to mobile-privacy.

中文简介正在准备中。当前显示原文说明。

Implements and reviews mobile data privacy across Flutter, Android, iOS, React Native and Kotlin Multiplatform. Use for consent withdrawal, SDK collection controls, account and data deletion, retention, privacy manifests or store data disclosures. Covers the app and backend handoff; security exploits belong to mobile-security.

中文简介正在准备中。当前显示原文说明。

Use when contributing to the CopilotKit open-source project — forking, cloning, setting up the monorepo, creating branches, running tests, and submitting pull requests against CopilotKit/CopilotKit.

中文简介正在准备中。当前显示原文说明。

実装が一段落したら、PR本文を課題・解決策・テスト結果・レビュー観点の 形に整形して下書きし、承認を取ってからGitHubへ投稿する。「PRを作って」と 頼まれたときに使う。

中文简介正在准备中。当前显示原文说明。

機能追加や仕様変更の要件を確認し、設計・テスト・実装順を含むプランを作る。プラン作成や実装前の設計を依頼されたときに使う。

中文简介正在准备中。当前显示原文说明。

Ask real executives and domain experts a question through Instant Expert for a written answer or short call: practitioner knowledge, customer discovery. Free test mode; live sends need approval.

中文简介正在准备中。当前显示原文说明。

Install, verify, and operate mdoctor on macOS and Debian/Arch-based Linux. Use when users ask to set up mdoctor, install dependencies, test branch builds on the current machine, run first health checks, troubleshoot install/runtime issues, or perform safe cleanup/fix workflows with mdoctor commands.

中文简介正在准备中。当前显示原文说明。

Repair and triage guide for the NV oOS PHPUnit test suite — Docker test environment (incl. cross-worktree one-off runners), CI log triage, and 74 recurring root-cause patterns (hook resets, singleton interference, WP_Error envelope drift, coverage-manifest drift, preset-accounting gaps, PHPUnit 11 source-exclude walk hangs, static-registry leaks, and more — see the patterns section). Covers the cluster-by-cluster PR workflow against alpha-working and validation gates. Use when fixing failing PHPUnit tests, triaging CI logs, repairing test drift, deciding between a production fix and a test fix, or starting a new fix cluster.

中文简介正在准备中。当前显示原文说明。

Make a WooCommerce plugin HPOS-compatible (High-Performance Order Storage, default-on in WC 10.x) — declare via FeaturesUtil::declare_compatibility on before_woocommerce_init, replace $wpdb->postmeta / WP_Query order code with wc_get_orders + WC_Order::get_meta / update_meta_data, gate runtime branches on OrderUtil::custom_orders_table_usage_is_enabled, build admin hook names dynamically with OrderUtil::get_order_admin_screen (HPOS = woocommerce_page_wc-orders, legacy = shop_order). Use when scaffolding an order-touching plugin, auditing existing code for HPOS readiness, or fixing post-WC-10 silent breakage. Triggers on shop_order, get_post_meta with order context, FeaturesUtil, OrderUtil, custom_order_tables, before_woocommerce_init.

中文简介正在准备中。当前显示原文说明。

Per-toolkit hardening audit loop for NV oOS Pro tools. Systematically scans each addons/pro/includes/tools/<toolkit> (and its plugins/nvoos-content-graph-pro mirror) for the recurring production failure classes — unguarded shell calls that fatal on exec-disabled hosts, calls to nonexistent client methods, string-assuming parsing of provider responses that may be arrays, provider enum/service mismatches, metric/source column drift that silently returns 0, secondary-table denominator gaps, the Chart.js fixed-height loop, misleading native-source errors, and silent import truncation that reports partial writes as success — then fixes, tests (Docker PHPUnit), and validates (phpcs both standards) before moving to the next toolkit. Use when asked to audit a toolkit, review the X tools for similar issues, do the same for the other toolkits, or continue the toolkit audit loop. The first case study (document-generation) found 3 fatal bugs + 1 broken regex; the food-beverage pass added classes 5–10.

中文简介正在准备中。当前显示原文说明。

Programmatically clear WP Rocket cache from a third-party plugin / theme when data changes — the public rocket_clean_* function family (rocket_clean_post, rocket_clean_files, rocket_clean_term, rocket_clean_user, rocket_clean_home, rocket_clean_minify, rocket_clean_cache_busting, rocket_clean_domain, rocket_clean_cache_dir). Critical detection rule — WP Rocket is a PAID plugin not on Packagist; always feature-detect via function_exists('rocket_clean_post') OR defined('WP_ROCKET_VERSION') before calling, since not every site has it. Never raw-unlink the cache directory or call wp_cache_flush() expecting it to clear WP Rocket — wp_cache_flush is WP object cache, WP Rocket is FILE cache. The before_*_clean_* / after_*_clean_* action lifecycle hooks fire around every clean — useful for audit logging, monitoring, custom invalidation chains. Use when integrating cache invalidation in a companion plugin, WC integration, custom data plugin. Triggers on rocket_clean_, before_rocket_clean, af...

中文简介正在准备中。当前显示原文说明。

Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.

中文简介正在准备中。当前显示原文说明。

Audits WordPress plugin/theme code for secret-handling and credential issues — hardcoded API keys, DB credentials, or signing secrets in source; weak randomness (rand, mt_rand, uniqid) used for security tokens, password reset links, nonces, or session IDs; password storage with md5/sha1/crypt instead of password_hash; insecure cookie flags (missing Secure, HttpOnly, SameSite) on sensitive cookies; secrets logged via error_log / var_dump in production code paths. Use before plugin release, when reviewing auth/registration/login features, when integrating third-party APIs, or when the user mentions "API key", "token", "session", "password reset".

中文简介正在准备中。当前显示原文说明。

Deep security audit for WordPress plugin/theme PHP code, covering issues beyond the basic sanitize/escape/nonce checklist — PHP object injection (unserialize), SSRF in remote requests, CSRF on state-changing GET handlers, mass assignment via $_POST loops, insecure file include / template injection, mail header injection, ZipSlip in archive extraction, type-juggling in auth comparisons, and TOCTOU race patterns in option/meta locks. Use after or alongside wp-security-audit when reviewing complex plugins, REST APIs, integrations that fetch remote URLs, file processors, or any code that handles uploads, archives, or self-rolled auth tokens.

中文简介正在准备中。当前显示原文说明。

Audits WordPress plugin or theme PHP code for the most common security mistakes — missing nonce checks, capability checks, input sanitization, output escaping, unslashing, SQL preparation, AJAX nopriv exposure, file/path traversal, and unsafe redirects. Use when reviewing pull requests, before releasing a plugin, when the user asks "is this secure", or when handling code that touches $_GET / $_POST / $_REQUEST / $_COOKIE / $_FILES / $_SERVER, admin-ajax / admin-post, REST endpoints, options, user meta, custom DB queries, or file uploads.

中文简介正在准备中。当前显示原文说明。

Audits WordPress plugin or theme PHP code for internationalization (i18n) correctness — text-domain consistency, use of escaped translation helpers (esc_html__, esc_attr__, esc_html_e), correct placeholder helpers (sprintf with translator comments, _n for plurals, _x for context), no variable text-domains, no concatenation inside __() calls, presence of load_plugin_textdomain or load_theme_textdomain, and matching declared Text Domain in the plugin/theme header. Use before plugin/theme release, when reviewing contributor PRs, when adding new strings, when migrating to a new text domain, or when a translator reports issues with the .pot file.

中文简介正在准备中。当前显示原文说明。

Picks the right WordPress storage primitive for plugin data: options, user/post/term/comment meta, transients, site options, site transients, or custom tables. Covers grouped settings, autoload management, transient TTL rules, serialized/JSON blob trade-offs, multisite storage caveats, and naming conventions. Use when scaffolding settings, choosing persistence for plugin-owned data, or auditing update_option/get_option/get_post_meta/set_transient/autoload usage.

中文简介正在准备中。当前显示原文说明。

Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, update or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.

中文简介正在准备中。当前显示原文说明。

Manage the NV oOS Pro Toolkit Security Operations system — audit events, security training, maintenance windows, and incident records. Covers the full security ops lifecycle: audit logging, incident detection/response, maintenance scheduling, and compliance training tracking. Use when working with security audit trails, investigating incidents, scheduling maintenance windows, managing security training programs, or troubleshooting security operations data.

中文简介正在准备中。当前显示原文说明。

Autonomous AI security pen testing. Executes real exploits against web applications to find SQL injection, XSS, SSRF, authentication flaws, and IDOR vulnerabilities. Reports only confirmed, reproducible findings — no false positives.

中文简介正在准备中。当前显示原文说明。

Generate production-quality Excalidraw architecture diagrams from natural language. Visual structure maps to conceptual structure — fan-out for one-to-many, timelines for sequences, convergence for aggregation. Includes self-validation via Playwright render review.

中文简介正在准备中。当前显示原文说明。