测试与安全 Skills - 测试与安全 Agent Skills推荐与安装 - 第13页 - AI导哈

laravel-securityaffaan-m/eccLaravel security best practices — authentication, authorization, Eloquent safety, CSRF, XSS prevention, API security, and secure deployment configurations. Use when reviewing Laravel auth, Eloquent safety, CSRF, XSS, API security, or deployment configuration.5777 building-pydantic-ai-agentspydantic/skillsBuild AI agents with Pydantic AI — tools, capabilities (including on-demand loading), workspaces, structured output, streaming, testing, and multi-agent patterns. Use when the user mentions Pydantic AI, imports pydantic_ai, or asks to build an AI agent, add tools/capabilities, attach a workspace, defer capability loading, stream output, define agents from YAML, or test agent behavior.5767 solana-vulnerability-scannertrailofbits/skillsScans Solana programs for 6 critical vulnerabilities including arbitrary CPI, improper PDA validation, missing signer/ownership checks, and sysvar spoofing. Use when auditing Solana/Anchor programs.5741 agentforce-testforcedotcom/sf-skillsWrite, run, and analyze structured test suites for Agentforce agents — functional AND security. TRIGGER when: user writes or modifies test spec YAML (AiEvaluationDefinition); runs sf agent test create, run, run-eval, or results commands; asks about test coverage strategy, metric selection, or custom evaluations; interprets test results or diagnoses test failures; asks about batch testing, regression suites, or CI/CD test integration; requests security testing, OWASP LLM Top 10, red-teaming, penetration testing, prompt-injection tests, a security grade, or a vulnerability assessment of an agent. DO NOT TRIGGER when: user creates, modifies, previews, or debugs .agent files (use agentforce-generate); deploys or publishes agents; writes Agent Script code; uses sf agent preview for development iteration; analyzes production session traces (use agentforce-observe); performs a static safety review of .agent file content (use agentforce-generate Section 15).5727 wordpress-routerwordpress/agent-skillsUse when the user asks about WordPress codebases (plugins, themes, block themes, Gutenberg blocks, WP core checkouts) and you need to quickly classify the repo and route to the correct workflow/skill (blocks, theme.json, REST API, WP-CLI, performance, security, testing, release packaging).5703 mom-testwondelai/skillsTalk to customers without leading them using Mom Test rules: discuss their life not your idea, ask about specifics in the past, and talk less. Use when the user mentions "customer interviews", "validate my idea", "users say they want it but dont buy", "leading questions", "The Mom Test", "customer feedback bias", or "interview script". Also trigger when preparing user-research questions, interpreting ambiguous feedback, or designing customer-discovery that avoids false positives. Covers commitment and advancement, avoiding compliments, and extracting signal from noise. For product-market fit, see jobs-to-be-done. For rapid prototype testing, see design-sprint.5698 event-code-of-conductsamber/dev-even…r-skillsWrite a technical event's code of conduct and build the enforcement pipeline behind it - what the policy has to say, who and which spaces it binds (attendees, speakers, volunteers, sponsor and booth staff, satellite events), the reporting channels including an anonymous path, response-team composition and rehearsal, the on-site incident runbook and its response clock, the sanctions ladder, which rungs carry an appeal, and the transparency report. Use whenever asked to write or review an event or conference code of conduct, set up incident reporting, staff or train a CoC response team, decide a sanction for an attendee, or handle an on-site incident. Do NOT use for accessibility provisions - use samber/dev-event-organizer-skills@event-accessibility-inclusion. Not legal advice.5665 event-vip-managementsamber/dev-even…r-skillsReceive named guests who are neither speaking nor sponsoring but whose presence creates escort, protocol, security or discretion obligations the general attendee flow cannot absorb - public officials, dignitaries, major funders, executives with no booth duty. Covers the qualification test (obligation, never status), the identification roster, escort depth, and a visibility posture that meets the obligation without building a status tier attendees can read. Use whenever the user mentions receiving a minister, mayor, funder or visiting executive, VIP badges or reserved seating, escorting a dignitary, or coordinating with a guest's own security detail - even if they never say "VIP". Do NOT use for speakers - use samber/dev-event-organizer-skills@event-speaker-experience instead.5660 event-vendor-sourcingsamber/dev-even…r-skillsSource, vet and contract the suppliers a venue does not include - caterers, AV and production suppliers, security firms, insurance brokers, swag and print. Covers the venue-exclusivity check that precedes any evaluation, one identical brief per category, sourcing posture and quote-comparison depth, contract red flags and the certificate-of-insurance ask, ordering lead times, delivery buffers, and day-of coordination. Use whenever the user mentions finding a caterer, comparing supplier quotes, briefing an AV or security supplier, ordering swag or t-shirts, or reading a vendor contract before signing - even if they never say "vendor". Refuses to invent supplier prices. Do NOT use to write the AV technical spec - use samber/dev-event-organizer-skills@event-production instead.5654 event-speaker-sourcingsamber/dev-even…r-skillsFind and qualify speakers for a technical event outside the open call for papers - the proactive channel running alongside or instead of a CFP. Covers program gaps worth filling by invitation, sourcing channels (referral asks, expert and speaker directories, prior-talk review, community scouting), international sourcing by region and language, evidence-based Hot/Warm/Cold/Skip qualification, and a ranked shortlist carrying the "why" behind each name. Use whenever the user mentions finding speakers, a keynote or invited-speaker shortlist, sourcing international or under-represented speakers, or a programme a CFP did not fill - even if they never say "sourcing". Do NOT use to write the invitation - use samber/dev-event-organizer-skills@event-speaker-cold-outreach instead.5654 security-reviewgithub/awesome-copilotAI-powered codebase security scanner that reasons about code like a security researcher — tracing data flows, understanding component interactions, and catching vulnerabilities that pattern-matching tools miss. Use this skill when asked to scan code for security vulnerabilities, find bugs, check for SQL injection, XSS, command injection, exposed API keys, hardcoded secrets, insecure dependencies, access control issues, or any request like "is my code secure?", "review for security issues", "audit this codebase", or "check for vulnerabilities". Covers injection flaws, authentication and access control bugs, secrets exposure, weak cryptography, insecure dependencies, and business logic issues across JavaScript, TypeScript, Python, Java, PHP, Go, Ruby, and Rust.5631 e2e-testingaffaan-m/eccPlaywright E2E testing patterns, Page Object Model, configuration, CI/CD integration, artifact management, and flaky test strategies. Use when writing Playwright tests, structuring page objects, or fixing flaky E2E runs in CI.5575 healthcheckopenclaw/openclawAudit/harden OpenClaw hosts: SSH, firewall, updates, exposure, backups, disk encryption, gateway security.5555 guidelines-advisortrailofbits/skillsSmart contract development advisor based on Trail of Bits' best practices. Analyzes codebase to generate documentation/specifications, review architecture, check upgradeability patterns, assess implementation quality, identify pitfalls, review dependencies, and evaluate testing. Use when asking whether a smart contract project follows development best practices, reviewing on-chain/off-chain split, upgradeability, or delegatecall proxy patterns against guidelines, or seeking recommendations on contract design, inheritance, events, documentation, dependencies, or test strategy.5547 tdd-workflowaffaan-m/eccTest-driven development workflow: write a failing test first, watch it fail, implement the smallest change to green, then refactor with 80%+ coverage across unit, integration, and E2E tests. Use when writing a new feature, fixing a bug, refactoring, or when told to write failing tests first.5542 playwright-interactiveopenai/skillsPersistent browser and Electron interaction through `js_repl` for fast iterative UI debugging.5540 code-reviewgetsentry/skillsPerform code reviews following Sentry engineering practices. Use when reviewing pull requests, examining code changes, or providing feedback on code quality. Covers security, performance, testing, and design review.5533 setup-pre-commitvinvcn/mattpoco…ls-zh-cn在当前仓库设置 Husky pre-commit hooks，集成 lint-staged (Prettier)、类型检查和测试。适用于用户想添加 pre-commit hooks、设置 Husky、配置 lint-staged，或在提交时运行格式化、类型检查和测试时。5528 contract-reviewclaude-office-s…s/skillsAnalyze contracts for risks, check completeness, and provide actionable recommendations. Supports employment contracts, NDAs, service agreements, and more.5477 verification-loopaffaan-m/eccRun a six-phase verification of a Claude Code session's work — build, type check, lint, tests with coverage, security grep, and diff review — then produce a PASS/FAIL verification report. Use when verifying work after completing a feature or refactor, before creating a PR, or when quality gates must pass.5465 test-masterjeffallan/claude-skillsGenerates test files, creates mocking strategies, analyzes code coverage, designs test architectures, and produces test plans and defect reports across functional, performance, and security testing disciplines. Use when writing unit tests, integration tests, or E2E tests; creating test strategies or automation frameworks; analyzing coverage gaps; performance testing with k6 or Artillery; security testing with OWASP methods; debugging flaky tests; or working on QA, regression, test automation, quality gates, shift-left testing, or test maintenance.5436 worktrunkmax-sixty/worktrunkGuidance for Worktrunk (the `wt` CLI) — git worktree management, hooks, and config. Load when working out which worktree a `wt` command will act on, or reaching for the global `-C <path>` to target one; editing .config/wt.toml or ~/.config/worktrunk/config.toml; adding, modifying, or debugging hooks (post-merge, post-start, pre-commit, pre-merge, post-switch, etc.); configuring commit message generation or command aliases; or troubleshooting wt behavior. Also answers general worktrunk/wt questions.5402 cosmos-vulnerability-scannertrailofbits/skillsScans Cosmos SDK blockchain modules and CosmWasm contracts for consensus-critical vulnerabilities — chain halts, fund loss, state divergence. 25 core + 16 IBC + 10 EVM + 3 CosmWasm patterns. Use when auditing custom x/ modules, reviewing IBC integrations, or assessing pre-launch chain security. Updated for SDK v0.53.x.5385 review-agent-setupwshobson/agentsConfigure human-in-the-loop gating for AI agent review actions in Claude Code. Use when setting up a project where an agent may post PR reviews, comments, merges, or edit CI configuration, and you want a cryptographically auditable approval trail with Cedar-enforced gates.5374 playwright-expertjeffallan/claude-skillsUse when writing E2E tests with Playwright, setting up test infrastructure, or debugging flaky browser tests. Invoke to write test scripts, create page objects, configure test fixtures, set up reporters, add CI integration, implement API mocking, or perform visual regression testing. Trigger terms: Playwright, E2E test, end-to-end, browser testing, automation, UI testing, visual testing, Page Object Model, test flakiness.5368 semgrep-rule-variant-creatortrailofbits/skillsCreates language variants of existing Semgrep rules. Use when porting a Semgrep rule to specified target languages. Takes an existing rule and target languages as input, produces independent rule+test directories for each language.5363 swift-testing-expertavdlee/swift-te…nt-skillExpert guidance for Swift Testing: test structure, #expect/#require macros, traits and tags, parameterized tests, test plans, parallel execution, async waiting patterns, and XCTest migration. Use when writing new Swift tests, modernizing XCTest suites, debugging flaky tests, or improving test quality and maintainability in Apple-platform or Swift server projects.5362 bmad-evalbmad-code-org/b…d-methodRuns the evals of a BMad skill through the agent harness the user works in and reports what they show: baseline against the bare model, variant against a stripped or prior version, quality against a rubric, and trigger accuracy of the description with an optional optimization loop. Use when the user asks to evaluate, benchmark, test the triggers of, grade, or compare versions of a skill, or when the bmad-toolsmith skill asks for an eval of a skill it built.5359 browser-automationweb-infra-dev/m…e-skillsVision-driven browser automation using Midscene. Operates from screenshots — no DOM or accessibility labels needed. Runs in headless Puppeteer — does NOT take over the user's mouse or keyboard. Also supports CDP mode and Bridge mode to connect to an existing Chrome. Use this skill when the user wants to: - Browse, navigate, or open web pages - Scrape, extract, or collect data from websites - Fill out forms, upload local files, click buttons, or interact with web elements - Verify, validate, test, or QA frontend UI behavior - Take screenshots of web pages - Automate multi-step web workflows - Test what was just built, see if it works in browser - Connect to Chrome via CDP, DevTools Protocol, or remote debugging - Connect to user's Chrome browser, control my browser, operate my Chrome Powered by Midscene.js (https://midscenejs.com)5344 second-opiniontrailofbits/skillsGets independent code reviews from Codex or Antigravity for uncommitted changes, branch diffs, and commits. Use when the user requests an external review, a second opinion on code, a codex review, a gemini review, an antigravity review, or /second-opinion.5343