测试设计、漏洞检测、质量保证（1.3万 个）
Use when working with Trivy — trivy comprehensive security scanner. Covers container image scanning, filesystem scanning, Kubernetes cluster scanning, SBOM generation, secret detection, license scanning, and misconfiguration detection. Use when scanning containers for vulnerabilities, generating SBOMs, scanning K8s clusters, or detecting misconfigurations.
中文简介正在准备中。当前显示原文说明。
Use when working with Aqua — aqua Security platform analysis. Covers container runtime protection, image assurance policies, compliance frameworks, vulnerability management, workload protection, and registry scanning. Use when analyzing container security posture, reviewing image compliance, investigating runtime alerts, or auditing security policies.
中文简介正在准备中。当前显示原文说明。
Use when working with Snyk — snyk security scanning and vulnerability analysis. Covers dependency vulnerability scanning, container image scanning, IaC security scanning, code analysis, license compliance, and fix recommendations. Use when scanning for vulnerabilities, analyzing dependency risks, reviewing container security, or auditing IaC configurations.
中文简介正在准备中。当前显示原文说明。
Use when working with Wiz — wiz cloud security posture management. Covers cloud security posture analysis, vulnerability prioritization, attack path analysis, compliance assessment, container security, and resource inventory. Use when assessing cloud security posture, investigating attack paths, prioritizing vulnerabilities, or auditing cloud compliance.
中文简介正在准备中。当前显示原文说明。
Browse the web for any task — research topics, read articles, interact with web apps, fill forms, take screenshots, extract data, and test web pages. Use whenever a browser would be useful, not just when the user explicitly asks.
中文简介正在准备中。当前显示原文说明。
Understand anti-reversing, obfuscation, and protection techniques encountered during software analysis. Use this skill when analyzing malware evasion techniques, when implementing anti-debugging protections for CTF challenges, when reverse engineering packed binaries, or when building security research tools that need to detect virtualized environments.
中文简介正在准备中。当前显示原文说明。
Build comprehensive attack trees to visualize threat paths. Use when mapping attack scenarios, identifying defense gaps, or communicating security risks to stakeholders.
中文简介正在准备中。当前显示原文说明。
Plan, execute, and document validation, verification, and transfer of analytical procedures under the governing framework - ICH Q2(R2) and Q14, USP <1220>/<1225>/<1226>, ICH M10 bioanalytical, CLSI EP, or ISO/IEC 17025. Use for HPLC, LC-MS/MS, GC, CE, ICP-MS, dissolution, qNMR, qPCR, NIR, and ligand binding or cell-based assays whenever the question is whether a procedure is fit for its intended purpose. Triggers include "method validation", "analytical method validation", "AMV", "validation protocol", "acceptance criteria", "linearity", "reportable range", "accuracy and precision", "repeatability", "intermediate precision", "recovery", "LOD", "LOQ", "detection limit", "quantitation limit", "specificity", "robustness", "method transfer", "method comparison", "Deming", "Passing-Bablok", "Bland-Altman", "equivalence testing", "OOS investigation", "ICH Q2", "Q2(R2)", "Q14", "USP 1225", "ICH M10", "incurred sample reanalysis", "ISR", "CLSI EP", and any request to show that an assay works.
中文简介正在准备中。当前显示原文说明。
Build production Apache Airflow DAGs with best practices for operators, sensors, testing, and deployment. Use when creating data pipelines, orchestrating workflows, or scheduling batch jobs.
中文简介正在准备中。当前显示原文说明。
Regression testing strategies for AI-assisted development. Sandbox-mode API testing without database dependencies, automated bug-check workflows, and patterns to catch AI blind spots where the same model writes and reviews code.
中文简介正在准备中。当前显示原文说明。
Autonomously improve a real artifact (code, training recipe, agent harness, data pipeline, prompt) against an objective and an evaluator, using Hypothesis Tree Refinement (HTR) from the Arbor paper. Use this whenever someone wants to iteratively optimize something over many experiments without overfitting — e.g. "get my model's eval score up", "improve this agent/harness", "tune this pipeline", "beat the baseline on this benchmark", "run a search over approaches and keep the best", "do an MLE-bench / Kaggle-style optimization", or any long-horizon "make this artifact better and don't just memorize the dev set" task. Trigger it even when the user doesn't say "Arbor" or "hypothesis tree" but describes repeated experiment-and-evaluate loops, branching exploration of competing ideas, or worries about a dev/test gap. Runs Claude itself as the coordinator with subagent executors in isolated git worktrees; for the standalone `arbor` CLI tool see references/arbor-upstream.md.
中文简介正在准备中。当前显示原文说明。
Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.
中文简介正在准备中。当前显示原文说明。
Write the test first, watch it fail, write minimal code to pass
中文简介正在准备中。当前显示原文说明。
Review docs/prose for Writing Guidelines compliance. Use when asked to "review my docs", "check writing style", "audit prose", "review docs voice and tone", or "check this page against the writing handbook".
中文简介正在准备中。当前显示原文说明。
Implement WCAG 2.2 compliant interfaces with mobile accessibility, inclusive design patterns, and assistive technology support. Use when auditing accessibility, implementing ARIA patterns, building for screen readers, or ensuring inclusive user experiences.
中文简介正在准备中。当前显示原文说明。
TDD for process documentation - test with subagents before writing, iterate until bulletproof
中文简介正在准备中。当前显示原文说明。
Never test mock behavior. Never add test-only methods to production classes. Understand dependencies before mocking.
中文简介正在准备中。当前显示原文说明。
RED-GREEN-REFACTOR for process documentation - baseline without skill, write addressing failures, iterate closing loopholes
中文简介正在准备中。当前显示原文说明。
Playwright automation, Chrome DevTools debugging, and browser interaction testing. Use for E2E/unit tests, capturing screenshots, inspecting network/console logs, or validating user flows in web applications.
中文简介正在准备中。当前显示原文说明。
Use when doing ANY task involving Supabase. Triggers: Supabase products (Database, Auth, Edge Functions, Realtime, Storage, Vectors, Cron, Queues); client libraries and SSR integrations (supabase-js, @supabase/ssr) in Next.js, React, SvelteKit, Astro, Remix; auth issues (login, logout, sessions, JWT, cookies, getSession, getUser, getClaims, RLS); Supabase CLI or MCP server; schema changes, migrations, declarative schemas, security audits, Postgres extensions (pg_graphql, pg_cron, pg_vector); debugging and troubleshooting errors or unexpected behavior on Supabase projects (HTTP errors, Postgres errors, RLS surprises, permission denied, schema cache issues, timeouts, Edge Function crashes, Realtime drops, Storage failures) and reading or querying logs (Logs Explorer, ClickHouse).
中文简介正在准备中。当前显示原文说明。
Comprehensive web quality audit covering performance, accessibility, SEO, and best practices. Use when asked to "audit my site", "review web quality", "run lighthouse audit", "check page quality", or "optimize my website".
中文简介正在准备中。当前显示原文说明。
AI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when asked to scan code for security vulnerabilities, find bugs, check for SQL injection, XSS, command injection, exposed API keys, hardcoded secrets, insecure dependencies, access control issues, or any request like "is my code secure?", "review for security issues", "audit this codebase", or "check for vulnerabilities". Covers injection flaws, authentication and access control bugs, secrets exposure, weak cryptography, insecure dependencies, and business logic issues across JavaScript, TypeScript, Python, Java, PHP, Go, Ruby, and Rust.
中文简介正在准备中。当前显示原文说明。
Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Trigger only for supported languages (python, javascript/typescript, go). Do not trigger for general code review, debugging, or non-security tasks.
中文简介正在准备中。当前显示原文说明。
Install audited skills from a curated list or GitHub repo path into Codex or Claude Code after selecting the target host. Use when a user asks to list or install a skill, including from a private repo; preserve Codex system-skill boundaries and use an explicit Claude destination for Claude Code.
中文简介正在准备中。当前显示原文说明。