测试与安全技能

Design automated evaluation pipelines for LLM and agent systems — combining deterministic checks, statistical metrics, and LLM-as-judge scoring into repeatable, CI-integrated eval suites. Load when the user asks to set up automated evals, design an eval pipeline, integrate evals into CI/CD, create an eval suite, do eval-driven development, or says "automate my evals", "CI eval integration", "evaluation pipeline", "continuous evaluation", "monitoring eval quality", "set up regression testing for my agent". Sub-skill of eval-output orchestrator.

中文简介正在准备中。当前显示原文说明。

Translate an approved experiment spec into a launch runbook — platform binding (PostHog primary), feature flag setup, assignment unit, exposure event definition, instrumentation QA, dashboard wiring, ramp plan, monitoring, and rollback procedure. Platform-agnostic core with one strong PostHog adapter shipped; GrowthBook, Statsig, LaunchDarkly, Optimizely, and Eppo documented as a single mapping table the user adapts. Load when a spec is approved and ready to launch, or when the user says "set up the experiment", "wire this up in PostHog", "implement the test", "create the runbook", "launch checklist for this test", or when the experimentation orchestrator routes here.

中文简介正在准备中。当前显示原文说明。

Put on the adversarial hat and systematically attack any document, plan, strategy, or idea to expose its weakest points before commitment. Structured devil's advocate with red team rigour — not pessimism, but evidence-based critique across three phases: diagnostic (are claims accurate?), creative (is the problem artificially constrained?), challenge (are solutions robust?). Load when the user asks to stress test a document, red team this plan, poke holes in this, devil's advocate this, challenge my assumptions, or when product-soul, brainstorming, prd-writing, or inversion calls for adversarial review. Also triggers on "what am I missing", "what could kill this", "find the flaws", or "critique this rigorously".

中文简介正在准备中。当前显示原文说明。

Audit UI, docs, or prose for AI-generated tells in design and copy, then fix approved findings. Use when the user says de-slop, slop check, "looks AI-generated", or wants copy humanized.

中文简介正在准备中。当前显示原文说明。

Verify a code change end-to-end in the current worktree: identify what changed, run the relevant tests, get the app running, drive a browser over the affected areas, and report a verdict with screenshots. Generic across project types (Laravel/Herd, Node/bun, frontend, CLI, library). Use when the user wants to verify/QA/smoke-test a change, check that a PR or branch works, validate uncommitted work, or says "/flow", "verify this change", "does this PR work", "test and click through this". Optional target: PR number/URL, branch/ref, or worktree path; default is the current working changes.

中文简介正在准备中。当前显示原文说明。

Use when AI contribution metadata must match the actual workflow, when model alias and dated identifiers need auditing, when verified and fabricated citation counts feed a release decision, or when a venue's AI disclosure statement needs evidence behind it.

中文简介正在准备中。当前显示原文说明。

Use when authoring a new manuscript, thesis chapter, or abstract from scratch in Turkish and English in parallel — building the claim skeleton first, then drafting Turkish and re-authoring English — not for auditing parity between existing versions.

中文简介正在准备中。当前显示原文说明。

Use when a construct, scale, or key term crosses Turkish and English and conceptual equivalence must be audited: translation and back-translation, construct drift, and culturally bound meaning, before measurement or cross-cultural claims.

中文简介正在准备中。当前显示原文说明。

Use when authorship order, CRediT contribution roles, or AI-assistance attribution must be recorded transparently for a manuscript, when an author dispute needs an evidence trail, or before a contributorship statement is required at submission; this skill maintains the human-attribution ledger of who contributed what and in which role (authorship order, CRediT taxonomy, revision responsibilities), which is distinct from the disclosure-metadata audit owned by ai-disclosure-auditor.

中文简介正在准备中。当前显示原文说明。

Use when paired tr.md and en.md files need a parity verdict, when titles, frontmatter, headings, or DOI sets may have drifted between languages, or when a bilingual document is approaching release and its translation coverage needs an audit.

中文简介正在准备中。当前显示原文说明。

Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.

中文简介正在准备中。当前显示原文说明。

Systematic exploratory QA testing of web applications — find bugs, capture evidence, and generate structured reports

中文简介正在准备中。当前显示原文说明。

You extend the browser to give users superpowers. You understand the unique constraints of extension development - permissions, security, store policies. You build extensions that people install and actually use daily. You know the difference between a toy and a tool.

中文简介正在准备中。当前显示原文说明。

This skill ensures all code follows security best practices and identifies potential vulnerabilities. Use when implementing authentication or authorization, handling user input or file uploads, or creating new API endpoints.

中文简介正在准备中。当前显示原文说明。

Identify and exploit authentication and session management vulnerabilities in web applications. Broken authentication consistently ranks in the OWASP Top 10 and can lead to account takeover, identity theft, and unauthorized access to sensitive systems.

中文简介正在准备中。当前显示原文说明。

Execute comprehensive web application security testing using Burp Suite's integrated toolset, including HTTP traffic interception and modification, request analysis and replay, automated vulnerability scanning, and manual testing workflows.

中文简介正在准备中。当前显示原文说明。

Azure Key Vault Keys Java SDK for cryptographic key management. Use when creating, managing, or using RSA/EC keys, performing encrypt/decrypt/sign/verify operations, or working with HSM-backed keys.

中文简介正在准备中。当前显示原文说明。

Bash scripting workflow for creating production-ready shell scripts with defensive patterns, error handling, and testing.

中文简介正在准备中。当前显示原文说明。

Azure Key Vault Secrets Java SDK for secret management. Use when storing, retrieving, or managing passwords, API keys, connection strings, or other sensitive configuration data.

中文简介正在准备中。当前显示原文说明。

Azure Key Vault Keys SDK for .NET. Client library for managing cryptographic keys in Azure Key Vault and Managed HSM. Use for key creation, rotation, encryption, decryption, signing, and verification.

中文简介正在准备中。当前显示原文说明。

Master Bash Automated Testing System (Bats) for comprehensive shell script testing. Use when writing tests for shell scripts, CI/CD pipelines, or requiring test-driven development of shell utilities.

中文简介正在准备中。当前显示原文说明。

Azure Resource Manager SDK for Microsoft Playwright Testing in .NET.

中文简介正在准备中。当前显示原文说明。

Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.

中文简介正在准备中。当前显示原文说明。

Run Playwright tests at scale with cloud-hosted browsers and integrated Azure portal reporting.

中文简介正在准备中。当前显示原文说明。