测试与安全技能

Identifies and fixes XSS, SQL injection, and command injection vulnerabilities with validation schemas, sanitization libraries, and safe coding patterns. Use for "input validation", "XSS prevention", "SQL injection", or "sanitization".

中文简介正在准备中。当前显示原文说明。

Generates Bruno collection files (.bru) from Express, Next.js, Fastify, or other API routes. Creates organized collections with environments, authentication, and folder structure for the open-source Bruno API client. Use when users request "generate bruno collection", "bruno api testing", "create bru files", or "bruno import".

中文简介正在准备中。当前显示原文说明。

Defines ROI-based coverage targets with critical path identification, layer-specific targets, and explicit "don't test this" guidelines. Use for "test coverage", "coverage strategy", "test priorities", or "coverage targets".

中文简介正在准备中。当前显示原文说明。

Produces build artifacts with Software Bill of Materials (SBOM) and supply chain metadata for security and compliance. Use for "artifact publishing", "SBOM generation", "supply chain security", or "build provenance".

中文简介正在准备中。当前显示原文说明。

Hardens API security with rate limiting, input validation, authentication, and protection against common attacks. Use when users request "API security", "secure API", "rate limiting", "input validation", or "API protection".

中文简介正在准备中。当前显示原文说明。

Reviews authentication and authorization implementation for session management, CSRF, cookie security, and auth flow vulnerabilities with findings, severity assessment, and fix recommendations. Use for "auth review", "session security", "CSRF protection", or "authentication audit".

中文简介正在准备中。当前显示原文说明。

Audits and implements web accessibility (a11y) following WCAG 2.1 guidelines with ARIA patterns, keyboard navigation, screen reader support, and contrast checking. Use when users request "accessibility audit", "a11y review", "WCAG compliance", "screen reader support", or "keyboard navigation".

中文简介正在准备中。当前显示原文说明。

Sets up end-to-end testing with Cypress or Playwright including page objects, fixtures, and CI integration. Use when users request "E2E testing", "Cypress setup", "Playwright setup", "browser testing", or "integration tests".

中文简介正在准备中。当前显示原文说明。

Implements secure authentication patterns including login/registration, session management, JWT tokens, password hashing, cookie settings, and CSRF protection. Provides auth routes, middleware, security configurations, and threat model documentation. Use when building "authentication", "login system", "JWT auth", or "session management".

中文简介正在准备中。当前显示原文说明。

Generates comprehensive API test suites using Jest, Vitest, or Supertest from Express, Next.js, Fastify, or other API routes. Creates integration tests, contract tests, and edge case coverage. Use when users request "generate api tests", "create endpoint tests", "api test suite", or "integration tests for api".

中文简介正在准备中。当前显示原文说明。

Premium brand-kit image generation skill for creating high-end brand-guidelines boards, logo systems, identity decks, and visual-world presentations. Trained for minimalist, cinematic, editorial, dark-tech, luxury, cultural, security, gaming, developer-tool, and consumer-app brand systems. Optimized for intentional logo concepting, refined composition, sparse typography, strong symbolic meaning, premium mockups, art-directed imagery, and flexible grid layouts.

中文简介正在准备中。当前显示原文说明。

Configures Cross-Origin Resource Sharing with proper headers, preflight handling, and security best practices. Use when users request "CORS setup", "cross-origin requests", "API CORS", "preflight requests", or "CORS headers".

中文简介正在准备中。当前显示原文说明。

Build an animation from scratch, making the decisions in the order that determines whether it feels right — should it animate at all, what purpose, which tool, which properties, which curve and duration, how it interrupts, how it exits. Writes the implementation. Use when asked to animate something, add motion, make a component feel alive, or build a transition. For critiquing existing motion use review-animations; for auditing a whole codebase use improve-animations.

中文简介正在准备中。当前显示原文说明。

Generates ready-to-run cURL commands from Express, Next.js, Fastify, or other API routes. Creates copy-paste commands with proper headers, authentication, and request bodies. Use when users request "generate curl commands", "curl examples", "api curl", or "command line api testing".

中文简介正在准备中。当前显示原文说明。

Detects data integrity issues including orphaned records, broken foreign key relationships, constraint violations, and provides automated fix migrations. Use for "data integrity", "orphaned records", "broken relationships", or "data quality".

中文简介正在准备中。当前显示原文说明。

Implements API contract testing to ensure provider-consumer compatibility using Pact or similar tools. Prevents breaking changes with contract specifications and bi-directional verification. Use for "contract testing", "API contracts", "Pact", or "consumer-driven contracts".

中文简介正在准备中。当前显示原文说明。

Use when a running Spark or DSH web service needs real-browser verification — page load, client-plugin boot errors, console errors, failed requests, or onboarding/dialog rendering — with the repository's own Playwright chromium.

中文简介正在准备中。当前显示原文说明。

Use when AI contribution metadata must match the actual workflow, when model alias and dated identifiers need auditing, when verified and fabricated citation counts feed a release decision, or when a venue's AI disclosure statement needs evidence behind it.

中文简介正在准备中。当前显示原文说明。

Use when authoring a new manuscript, thesis chapter, or abstract from scratch in Turkish and English in parallel — building the claim skeleton first, then drafting Turkish and re-authoring English — not for auditing parity between existing versions.

中文简介正在准备中。当前显示原文说明。

Use when authorship order, CRediT contribution roles, or AI-assistance attribution must be recorded transparently for a manuscript, when an author dispute needs an evidence trail, or before a contributorship statement is required at submission; this skill maintains the human-attribution ledger of who contributed what and in which role (authorship order, CRediT taxonomy, revision responsibilities), which is distinct from the disclosure-metadata audit owned by ai-disclosure-auditor.

中文简介正在准备中。当前显示原文说明。

Use when paired tr.md and en.md files need a parity verdict, when titles, frontmatter, headings, or DOI sets may have drifted between languages, or when a bilingual document is approaching release and its translation coverage needs an audit.

中文简介正在准备中。当前显示原文说明。

Use when a construct, scale, or key term crosses Turkish and English and conceptual equivalence must be audited: translation and back-translation, construct drift, and culturally bound meaning, before measurement or cross-cultural claims.

中文简介正在准备中。当前显示原文说明。

This skill should be used when the user asks for "browser tests", "playwright tests", "end-to-end testing", "test user flows", "E2E coverage", "integration tests for UI", "page object pattern", "/e2e command", or discusses automated browser testing. Covers the E2E test loop workflow, Playwright patterns, page objects, and selector strategies.

中文简介正在准备中。当前显示原文说明。

This skill should be used when the user asks to "improve test coverage", "add unit tests", "TDD", "test this module", "write tests for", "increase coverage", "/ut command", or discusses unit testing strategies. Covers the unit test loop workflow, React Testing Library best practices, query priorities, and coverage improvement strategies.

中文简介正在准备中。当前显示原文说明。