跳到正文
cccskills

测试与安全技能

测试设计、漏洞检测、质量保证(1.3万 个)

按价格或排序方式筛选

Fan six specialist reviewers (general correctness, silent failures, type design, test gaps, comment accuracy, simplification) out over the current diff, a branch, or a PR in parallel, then merge their findings into one deduplicated, ranked report. Use for a thorough review before merging. Not for editing code or approving on someone's behalf.

中文简介正在准备中。当前显示原文说明。

codewhale-hq/codewhale-plugin-marketplace52026年10月21日 更新

Review a change, module, or surface for exploitable defects — trust boundaries, authn/authz, injection, secret exposure, filesystem and network reach, dependency risk. Use when the user asks for a security review, audit, or vulnerability check of concrete code. Not for general code review, lint, or compliance paperwork.

中文简介正在准备中。当前显示原文说明。

codewhale-hq/codewhale-plugin-marketplace52026年10月21日 更新

verify

免费

Exercise the real app/API/CLI and collect observable evidence; tests alone do not count as end-to-end verification.

中文简介正在准备中。当前显示原文说明。

codewhale-hq/codewhale-plugin-marketplace52026年10月21日 更新

release

免费

Prepare a named version: preflight, version consistency, build/package, smoke test, checksums/notes, and release readiness. Publishing/tagging/deploy need separate authorization. Explicit-only.

中文简介正在准备中。当前显示原文说明。

codewhale-hq/codewhale-plugin-marketplace52026年10月21日 更新

Start/reuse a local app, wait for readiness, inspect rendered state/console/network, act from observed selectors, and verify with evidence.

中文简介正在准备中。当前显示原文说明。

codewhale-hq/codewhale-plugin-marketplace52026年10月21日 更新

test

免费

Detect the project’s test stack, run the narrowest useful tests, create tests when authorized, and report coverage/gaps honestly.

中文简介正在准备中。当前显示原文说明。

codewhale-hq/codewhale-plugin-marketplace52026年10月21日 更新

当已经有观测与模型预测(或一份拟合输出)、要判断这个拟合信不信时使用。看残差结构、带不确定度的拟合优度、杠杆值与影响点、信息准则。残差里有结构,说明模型、测量过程或不确定度模型三者之一不完整:必须说出可能是哪一处、用什么检查分辨,而不是加参数;疑似仪器漂移、温度、批次这类测量偏差时转 dataset-systematic-error-hunter 查原始数据。不在有数据之前选模型,也不悄悄删离群点。

中文简介正在准备中。当前显示原文说明。

ChromiteCr/Skills52026年10月24日 更新

照片电影感调色、低饱和冷暖分离、先保原片再调色。用确定性像素处理而不是生成式重绘;先确认用途与色彩输入,输出带 sRGB ICC 的新图和隐私优先的参数/QA 边车。支持 8-bit SDR JPEG/PNG 的 render、固定三选候选小样 candidates 与数值 QA,以及原尺寸前后对比 compare;card、LUT 尚未实现。不负责 RAW 显影、修图换景、冲印交付或精确复刻电影/胶片。

中文简介正在准备中。当前显示原文说明。

ChromiteCr/Skills52026年10月24日 更新

当 AI 写完测试、要决定信不信这份测试时使用。查三类假信心:断言与实现是否同源复制、有没有边界与异常用例、失败信号够不够强;再规划 2–5 个突变抽样,能执行时再实跑,看把被测代码改坏之后测试会不会变红,没实跑就不声称测试抓得住错。测试全绿不等于代码对,也可能是测试根本抓不住错。要决定整份 diff 能不能合并时走 ai-diff-review-protocol。

中文简介正在准备中。当前显示原文说明。

ChromiteCr/Skills52026年10月24日 更新

当 AI 改完代码、要决定这份 diff 放不放行时使用。不逐行精读,按四步走查高风险点——意图是否匹配、有没有碰到边界条件、副作用面有多大、能不能回滚——每步有明确的放过与打回判据。改动文件数、增删行数、动到的迁移/锁文件/CI/配置/鉴权/测试文件和危险 hunk 先由 scripts/diff_risk.py 统计(粘贴进来的 diff 文本也能读,不需要 Git),越过固定阈值时必须人工逐段过。只有口头描述、没有改动内容时不给结论,只列要补的材料。diff 里新写的测试可不可信交给 ai-generated-test-auditor;没有基线的整段新代码走 ai-code-onboarding-checklist。

中文简介正在准备中。当前显示原文说明。

ChromiteCr/Skills52026年10月24日 更新

当一个模拟跑出了结果、要判断它是物理还是数值假象时使用。查三件事:守恒量的漂移曲线、步长收敛阶、功率谱里可疑的高频内容。守恒量在哪一步开始漂,就指向哪个物理过程被离散化破坏。结果随步长改变时,必须先做收敛性检查再解释现象。

中文简介正在准备中。当前显示原文说明。

ChromiteCr/Skills52026年10月24日 更新

normalize

免费

Audits and realigns UI to match design system standards, spacing, tokens, and patterns. Use when the user mentions consistency, design drift, mismatched styles, tokens, or wants to bring a feature back in line with the system.

中文简介正在准备中。当前显示原文说明。

waynesutton/teleprompter52026年6月28日 更新

Audits Convex performance for reads, subscriptions, write contention, and function limits. Use for slow features, insights findings, OCC conflicts, or read amplification.

中文简介正在准备中。当前显示原文说明。

waynesutton/teleprompter52026年6月28日 更新

Run convex-doctor static analysis, interpret findings, and fix issues across security, performance, correctness, schema, and architecture categories. Use when running convex-doctor, fixing convex-doctor warnings or errors, improving the convex-doctor score, or when asked about Convex code quality, static analysis, or linting Convex functions.

中文简介正在准备中。当前显示原文说明。

waynesutton/teleprompter52026年6月28日 更新

Guide for when to use and when not to use return validators in Convex functions. Use this skill whenever the user is writing Convex queries, mutations, or actions and needs guidance on return value validation. Also trigger when the user asks about Convex type safety, runtime validation, AI-generated Convex code, Convex AI rules, Convex security best practices, or when they're debugging return type issues in Convex functions. Trigger this skill when users mention "validators", "returns", "return type", or "exact types" in the context of Convex development. Also trigger when writing or reviewing Convex AI rules or prompts that instruct LLMs how to write Convex code.

中文简介正在准备中。当前显示原文说明。

waynesutton/teleprompter52026年6月28日 更新

sec-check

免费

Security review checklist for Convex functions, auth logic, public queries, admin routes, webhooks, uploads, and AI-generated code. Use when reviewing code that touches user data, PII, or access control.

中文简介正在准备中。当前显示原文说明。

waynesutton/teleprompter52026年6月28日 更新

critique

免费

Evaluate design from a UX perspective, assessing visual hierarchy, information architecture, emotional resonance, cognitive load, and overall quality with quantitative scoring, persona-based testing, and actionable feedback. Use when the user asks to review, critique, evaluate, or give feedback on a design or component.

中文简介正在准备中。当前显示原文说明。

waynesutton/teleprompter52026年6月28日 更新

audit

免费

Run technical quality checks across accessibility, performance, theming, responsive design, and anti-patterns. Generates a scored report with P0-P3 severity ratings and actionable plan. Use when the user wants an accessibility check, performance audit, or technical quality review.

中文简介正在准备中。当前显示原文说明。

waynesutton/teleprompter52026年6月28日 更新

Expert Convex Auth setup, production, OAuth, security, and debugging guidance. Use when adding or auditing Convex Auth, configuring GitHub/Google/Apple OAuth, setting auth env vars, protecting Convex functions with getAuthUserId, debugging callback URLs, preparing production auth, rotating keys, or reviewing auth security.

中文简介正在准备中。当前显示原文说明。

waynesutton/teleprompter52026年6月28日 更新

devops

免费

Use for pull-request, merge, version and release mechanics in the Syntropic137 repo, and for CI or release-pipeline failures. Trigger phrases include "open a PR", "submit my changes", "address the review comments", "Copilot left comments", "merge this PR", "push this nit straight to main", "CI is red", "the release gate failed", "smoke test broke", "why is this PR BLOCKED", "bump the version", "cut a release", "release v1.x", "write the release notes", "main -> release PR", "approve the release gate", "the release published a bad asset", "triage the open PRs", "PR backlog", "which PRs are ready to merge", "merge order", "DORA metrics", "deploy frequency", "lead time", "change failure rate", "time to restore", "why didn't the issue auto-close". Covers trunk-based `main`, the `release` branch, local gates (`just qa-ci`, `just preflight`), GitHub Actions gates, review and merge policy, and post-release verification. Do NOT use for deciding what to dispatch, running the orchestrator loop, or deciding when to deploy a beta or run a pit stop (see `orchestrating`); for whether a task belongs in a workspace or locally (see `dogfooding`); for using the `syn` CLI as an end user (see the syntropic137 plugin skills).

中文简介正在准备中。当前显示原文说明。

syntropic137/syntropic13752026年10月25日 更新

Use when deciding WHERE to do work on Syntropic137 itself - "run this through Syntropic", "dispatch a workflow", "should this go in a workspace or local", "kick off a run on the Mini", "dogfood this", "build Syntropic inside Syntropic", "why did the agent's push fail", "can an agent run our QA", "the execution says completed but nothing shipped". Covers what a workspace agent can and cannot do, why `.github/workflows` pushes must come from the local machine, how to write a task prompt that does not repeat a known failure, and how to verify a run actually delivered. Do NOT use for PR/release mechanics (see `devops`), for using the `syn` CLI as an end user (see the syntropic137 plugin skills), or for authoring workflow YAML.

中文简介正在准备中。当前显示原文说明。

syntropic137/syntropic13752026年10月25日 更新

grilling

免费

Grill the user relentlessly about a plan, decision, or idea. Use when the user wants to stress-test their thinking, or uses any 'grill' trigger phrases.

中文简介正在准备中。当前显示原文说明。

abekoh/dotfiles52026年10月3日 更新

implement step of mspec workflow — write code/tests with TDD red→green and anchors

中文简介正在准备中。当前显示原文说明。

tubone24/mspec52026年6月9日 更新

ci

免费

Guide for testing conventions and CI pipelines — unit tests, integration smoke tests, pytest markers, and GitHub Actions workflows. Use when the user asks about testing, CI, running tests, or adding tests for a recipe.

中文简介正在准备中。当前显示原文说明。

uiuc-kang-lab/rlvr_generalization_bounds52026年5月13日 更新