测试设计、漏洞检测、质量保证（1.3万 个）
Use when working with Dependabot — dependabot and Renovate dependency update management. Covers vulnerability alerts, dependency update PRs, auto-merge configuration, version pinning, update scheduling, and security advisory tracking. Use when managing dependency updates, reviewing vulnerability alerts, configuring auto-merge policies, or auditing dependency health.
中文简介正在准备中。当前显示原文说明。
Use when working with Great Expectations — great Expectations data quality framework analysis. Covers expectation suite management, validation result review, data docs generation, checkpoint execution, datasource configuration, and batch analysis. Use when reviewing data quality results, managing expectation suites, investigating validation failures, or auditing data quality configurations.
中文简介正在准备中。当前显示原文说明。
Use when working with Prowler — prowler cloud security assessment tool. Covers AWS, Azure, and GCP security posture assessment, CIS benchmark evaluation, compliance frameworks (PCI-DSS, HIPAA, SOC2), multi-account scanning, and remediation guidance. Use when assessing cloud security posture, running compliance audits, or investigating security findings across cloud providers.
中文简介正在准备中。当前显示原文说明。
Use when working with Checkov — checkov infrastructure-as-code security scanning. Covers Terraform, CloudFormation, Kubernetes, and Dockerfile scanning, policy management, custom checks, compliance frameworks, and suppression management. Use when scanning IaC for security misconfigurations, evaluating compliance, managing custom policies, or reviewing scan results.
中文简介正在准备中。当前显示原文说明。
SonarQube code quality and security analysis. Use when working with code quality metrics, security hotspots, quality gates, or issue tracking in SonarQube Cloud or Server.
中文简介正在准备中。当前显示原文说明。
Use when working with Trivy — trivy comprehensive security scanner. Covers container image scanning, filesystem scanning, Kubernetes cluster scanning, SBOM generation, secret detection, license scanning, and misconfiguration detection. Use when scanning containers for vulnerabilities, generating SBOMs, scanning K8s clusters, or detecting misconfigurations.
中文简介正在准备中。当前显示原文说明。
Use when working with Snyk — snyk security scanning and vulnerability analysis. Covers dependency vulnerability scanning, container image scanning, IaC security scanning, code analysis, license compliance, and fix recommendations. Use when scanning for vulnerabilities, analyzing dependency risks, reviewing container security, or auditing IaC configurations.
中文简介正在准备中。当前显示原文说明。
Use when working with Kubescape — kubescape Kubernetes security posture analysis. Covers NSA/CISA framework assessment, MITRE ATT&CK mapping, CIS Kubernetes benchmarks, workload scanning, RBAC analysis, and network policy evaluation. Use when assessing Kubernetes cluster security, evaluating compliance frameworks, or analyzing workload configurations.
中文简介正在准备中。当前显示原文说明。
Use when working with Aqua — aqua Security platform analysis. Covers container runtime protection, image assurance policies, compliance frameworks, vulnerability management, workload protection, and registry scanning. Use when analyzing container security posture, reviewing image compliance, investigating runtime alerts, or auditing security policies.
中文简介正在准备中。当前显示原文说明。
Use when working with Firestore — google Cloud Firestore collection analysis, index management, security rules review, usage metrics, and query optimization.
中文简介正在准备中。当前显示原文说明。
Understand anti-reversing, obfuscation, and protection techniques encountered during software analysis. Use this skill when analyzing malware evasion techniques, when implementing anti-debugging protections for CTF challenges, when reverse engineering packed binaries, or when building security research tools that need to detect virtualized environments.
中文简介正在准备中。当前显示原文说明。
Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders.
中文简介正在准备中。当前显示原文说明。
Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.
中文简介正在准备中。当前显示原文说明。
Autonomously improve a real artifact (code, training recipe, agent harness, data pipeline, prompt) against an objective and an evaluator, using Hypothesis Tree Refinement (HTR) from the Arbor paper. Use this whenever someone wants to iteratively optimize something over many experiments without overfitting — e.g. "get my model's eval score up", "improve this agent/harness", "tune this pipeline", "beat the baseline on this benchmark", "run a search over approaches and keep the best", "do an MLE-bench / Kaggle-style optimization", or any long-horizon "make this artifact better and don't just memorize the dev set" task. Trigger it even when the user doesn't say "Arbor" or "hypothesis tree" but describes repeated experiment-and-evaluate loops, branching exploration of competing ideas, or worries about a dev/test gap. Runs Claude itself as the coordinator with subagent executors in isolated git worktrees; for the standalone `arbor` CLI tool see references/arbor-upstream.md.
中文简介正在准备中。当前显示原文说明。
Plan, execute, and document validation, verification, and transfer of analytical procedures under the governing framework - ICH Q2(R2) and Q14, USP <1220>/<1225>/<1226>, ICH M10 bioanalytical, CLSI EP, or ISO/IEC 17025. Use for HPLC, LC-MS/MS, GC, CE, ICP-MS, dissolution, qNMR, qPCR, NIR, and ligand binding or cell-based assays whenever the question is whether a procedure is fit for its intended purpose. Triggers include "method validation", "analytical method validation", "AMV", "validation protocol", "acceptance criteria", "linearity", "reportable range", "accuracy and precision", "repeatability", "intermediate precision", "recovery", "LOD", "LOQ", "detection limit", "quantitation limit", "specificity", "robustness", "method transfer", "method comparison", "Deming", "Passing-Bablok", "Bland-Altman", "equivalence testing", "OOS investigation", "ICH Q2", "Q2(R2)", "Q14", "USP 1225", "ICH M10", "incurred sample reanalysis", "ISR", "CLSI EP", and any request to show that an assay works.
中文简介正在准备中。当前显示原文说明。
Browse the web for any task — research topics, read articles, interact with web apps, fill forms, take screenshots, extract data, and test web pages. Use whenever a browser would be useful, not just when the user explicitly asks.
中文简介正在准备中。当前显示原文说明。
Regression testing strategies for AI-assisted development. Sandbox-mode API testing without database dependencies, automated bug-check workflows, and patterns to catch AI blind spots where the same model writes and reviews code.
中文简介正在准备中。当前显示原文说明。
Build production Apache Airflow DAGs with best practices for operators, sensors, testing, and deployment. Use when creating data pipelines, orchestrating workflows, or scheduling batch jobs.
中文简介正在准备中。当前显示原文说明。
TDD for process documentation - test with subagents before writing, iterate until bulletproof
中文简介正在准备中。当前显示原文说明。
Comprehensive web quality audit covering performance, accessibility, SEO, and best practices. Use when asked to "audit my site", "review web quality", "run lighthouse audit", "check page quality", or "optimize my website".
中文简介正在准备中。当前显示原文说明。
Never test mock behavior. Never add test-only methods to production classes. Understand dependencies before mocking.
中文简介正在准备中。当前显示原文说明。
Review docs/prose for Writing Guidelines compliance. Use when asked to "review my docs", "check writing style", "audit prose", "review docs voice and tone", or "check this page against the writing handbook".
中文简介正在准备中。当前显示原文说明。
Playwright automation, Chrome DevTools debugging, and browser interaction testing. Use for E2E/unit tests, capturing screenshots, inspecting network/console logs, or validating user flows in web applications.
中文简介正在准备中。当前显示原文说明。
RED-GREEN-REFACTOR for process documentation - baseline without skill, write addressing failures, iterate closing loopholes
中文简介正在准备中。当前显示原文说明。