测试与安全 Skills - 测试与安全 Agent Skills推荐与安装 - 第15页 - AI导哈

skill-improvertrailofbits/skillsRuns an autonomous review-and-fix improvement loop over a Claude Code skill until a review comes back clean, with a cross-round findings ledger, escalation when fixes stop converging, and a mechanical scope guard. Reviews are performed by the plugin-dev skill-reviewer agent. Use to fix skill quality issues, iteratively refine a skill, or resume a loop after an escalation ('fix my skill', 'improve this skill until it passes review', 'skill improvement loop'). NOT for a one-time review — use the plugin-dev skill-reviewer agent directly.5105 dx-devops-test-failures-analyzeforcedotcom/sf-skillsAnalyzes DevOps Center test failures and Code Analyzer violations in plain language — failure category, offending file/class/method/line, rule violated, fix direction, and prioritized improvement suggestions (test-code vs production-code) — then optionally creates a tracked fix WorkItem on explicit request. Analysis is pure reasoning; work-item creation is a confirmation-gated write. Use this skill to explain failures or improvement suggestions, translate Code Analyzer violations, or track a fix as a work item. TRIGGER when: a run failed and the user wants root cause; a quality gate failure needs explaining; violations need translating; the user shares a failure payload and asks how to address it; wants to strengthen tests; or wants to create a fix work item, log a remediation, or assign a failure. DO NOT TRIGGER when: the user wants fix code written (use platform-apex-generate) or new test classes authored (use platform-apex-test-generate).5097 agent-platform-troubleshootinggoogle/skillsTroubleshoots Google Cloud Gemini Enterprise Agent Platform issues (Agent Gateway, Registry, Identity, Policies, Model Armor, Identity-Aware Proxy (IAP)). Use when agent requests fail with 403 (especially unauthorized egress), Agent Runtime queries return 500, or gateway/IAP logs show permission errors. Don't use for general Google Cloud Identity and Access Management (IAM) debugging or networking issues unrelated to the Agent Platform stack.5097 gmgn-heat-rankgmgnai/gmgn-skillsProduce THE list of tokens that are hot RIGHT NOW and safe enough to look at, across every chain GMGN supports, scored 0-100 and capped at ten names. This is a screening skill: it starts from no address, sweeps all seven chains, gates every candidate on liquidity / real volume / concentration / rug-and-dev risk, scores the survivors on one cross-chain scale, and returns however many clear the score floor — fewer than ten in a weak market, never padded to fill the quota. USE THIS SKILL WHEN the user wants a curated hot list rather than raw rankings: "热榜", "热门代币", "近期热门", "帮我抓一轮热榜", "现在有什么值得关注的热币", "全链热门币", "生成热榜", "有没有新的热门盘", "what is hot right now", "give me the hot list", "which trending tokens are actually worth looking at", "screen the trending list for me". The same questions in any other language route here too - match on meaning, not wording. DO NOT USE THIS SKILL for a raw ranking dump ("show me the top 20 by volume on sol", "1h trending", "hot search list") - that is `gmgn-market trending` / `hot-searches`, which returns the exchange's own ordering untouched; nor for freshly launched bonding-curve tokens ("just launched", "pump.fun new", "新盘") - that is `gmgn-market trenches`; nor for one address the user already has ("is this token safe", "打个分", "尽调") - that is `gmgn-contract-dd`; nor for a chart read ("走势怎么样", "什么形态") - that is `gmgn-kline-pattern`; nor for early-stage hunting below this skill's own floor ("值得埋伏吗", "新币筛选", "早期机会", "discover early-stage opportunities") - that is `gmgn-market trenches`, because the candidate pool here starts at 500k market cap and 100k liquidity and never contains a bonding-curve token; nor for the wallet-side view of the same market ("聪明钱在买什么", "KOL 在买什么", "on-chain alpha", "copy-trade signals") - that is `gmgn-track smartmoney` / `kol`, which answers who is buying rather than what is worth looking at. The split is by who chooses the tokens: if the user names the token, it is not this skill; if the user is asking the skill to choose, it is. When nobody names a token and the wording alone collides with `gmgn-market` - "hot coins", "what's pumping", "trending tokens", "热门币", "什么币在涨" - the deciding test is the shape of the answer being asked for: an untouched ranking of N rows in the exchange's own order is `gmgn-market trending`; a short list that survived risk gates, carries a score and can be acted on is this skill. A bare ambiguous ask with no other signal defaults here, because this skill can point at the raw ranking while the raw ranking cannot screen itself. Nothing has to be supplied to run it - the trigger phrase alone is enough, and no address, chain or amount is ever required. Four things can be narrowed when the user asks for it: which chains are swept, the age ceiling, how many names come back, and the score floor; any value changed that way is named in the report.5097 react-testingaffaan-m/eccReact component testing with React Testing Library, Vitest/Jest, MSW for network mocking, accessibility assertions with axe, and the decision boundary between component tests and Playwright/Cypress end-to-end runs. Use when writing or fixing tests for React components, hooks, or pages.5087 perl-securityaffaan-m/eccComprehensive Perl security covering taint mode, input validation, safe process execution, DBI parameterized queries, web security (XSS/SQLi/CSRF), and perlcritic security policies. Use when reviewing Perl input handling, process execution, DBI queries, or web-facing code.5078 agent-architecture-auditaffaan-m/eccFull-stack diagnostic for agent and LLM applications. Audits the 12-layer agent stack for wrapper regression, memory pollution, tool discipline failures, hidden repair loops, and rendering corruption. Produces severity-ranked findings with code-first fixes. Essential for developers building agent applications, autonomous loops, or any LLM-powered feature. Use when an agent or LLM feature misbehaves and the failing layer is unknown, or before shipping an agent stack.5038 dx-devops-test-pipeline-configureforcedotcom/sf-skillsConfigures DevOps Center pipeline testing infrastructure: enables a test provider so its suites become available, re-syncs a configured provider to pull in new suites, or creates a quality gate with rules on a stage. Routes by intent across three modes after running shared prerequisite checks and an explicit confirmation gate. Use this skill when a user wants to set up, configure, enable, sync, or refresh a test provider, or set/configure a quality gate or coverage threshold on a DevOps Center pipeline stage. TRIGGER when: the user wants to configure/enable/add/set up a test provider, re-sync or refresh a provider's suite list, pull in new suites, or set/configure a quality gate, coverage threshold, or testing benchmark on a stage. DO NOT TRIGGER when: assigning existing suites to a stage (use dx-devops-test-suite-assignments-configure), running or retriggering a suite (use dx-devops-test-suite-run), or non-DevOps-Center work.5030 gke-productionizegoogle/skillsOrchestrates comprehensive production readiness reviews and assessments for GKE clusters and workloads across scalability, security, reliability, observability, backup/DR, and cost optimization. Use when asked to productionize, prepare, assess, audit, or review a GKE cluster or workload before going live to production. Don't use for deep-dive single-domain implementation (use specific domain skills like gke-workload-scaling, gke-platform-security, gke-workload-security, gke-service-networking, gke-reliability instead).5018 security-scanaffaan-m/eccScan your Claude Code configuration (.claude/ directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions. Use when auditing a .claude/ directory — CLAUDE.md, settings.json, MCP servers, hooks, or agent definitions.5017 k6grafana/skillsGenerate, validate, and review k6 test scripts — load, stress, spike, soak, smoke, breakpoint, functional, and protocol. Covers HTTP, WebSocket, gRPC, browser, all executors, thresholds, checks, custom metrics, the k6-testing library, k6 Cloud execution, and the xk6 extension ecosystem; uses the xk6-docs CLI (with grafana.com web fallback) for docs lookup and validates every script by running it. Use when writing, generating, validating, or debugging any k6 or load-test script (including plain-language asks like "load test this API" or "stress test my service"), choosing executors/scenarios, or setting thresholds. For end-to-end website performance suites use k6-perf-test-website; for documenting k6 itself use k6-docs; for a browser/UI test authored from a plain-language user journey (selectors discovered by exploring the live site) use k6-browser-test.5017 dx-devops-test-suite-runforcedotcom/sf-skillsRuns DevOps Center test suites on a pipeline stage (Pre-Promote, Post-Promote, or Review event) end to end: triggers async execution via the Connect API after an explicit confirmation gate, then polls by runId at provider-specific intervals until it completes, fails, or times out, and hands results to failure analysis. Also retriggers a quality gate after fixes, but only once coverage meets the threshold. Use this skill when a user wants to run, kick off, or launch test suites on a stage, re-run a quality gate, or watch an in-progress run to completion. TRIGGER when: the user wants to run/launch suites on a stage, execute tests before or after promotion, re-run a quality gate after fixing failures, unblock a blocked promotion after adding tests, or poll/watch an in-progress run. DO NOT TRIGGER when: running sf apex run test directly (use platform-apex-test-run), or configuring a NEW gate or threshold (use dx-devops-test-pipeline-configure).5015 dx-devops-test-suite-assignments-configureforcedotcom/sf-skillsRecommends and manages DevOps Center test suite assignments for pipeline stages. Mode A analyzes a commit diff against assigned suite metadata to recommend relevant existing suites and flag coverage gaps (pure reasoning). Modes B-D assign a single suite, bulk-map multiple suites with a mandatory impact preview, or add/remove test classes with governance rules, via the testSuiteStages Connect API. Use this skill to recommend suites for a commit, assign or map suites to stages, or add/remove tests in a suite. TRIGGER when: the user asks which suites to run for a commit/diff or what covers their changes; a suite is unlinked and the user wants it assigned; the user wants to configure suite-to-stage mappings, assign multiple suites, or add/remove/sync tests in a suite. DO NOT TRIGGER when: configuring or syncing a test provider (use dx-devops-test-pipeline-configure), running suites (use dx-devops-test-suite-run), or authoring/running tests directly (use platform-apex-test-generate or platform-apex-test-run).5015 babysitthedotmack/claude-memWatch a pull request or review cycle until it is ready to merge. Use when asked to babysit, monitor, or keep checking PR comments, reviews, and CI until all actionable issues are resolved.5011 cpp-testingaffaan-m/eccUse only when writing/updating/fixing C++ tests, configuring GoogleTest/CTest, diagnosing failing or flaky tests, or adding coverage/sanitizers.5007 gh-issuesopenclaw/openclawFetch GitHub issues, select candidates, spawn background fix agents, open PRs, and optionally process PR review comments.5003 django-tddaffaan-m/eccDjango testing strategies with pytest-django, TDD methodology, factory_boy, mocking, coverage, and testing Django REST Framework APIs. Use when writing Django or DRF tests with pytest-django, or driving a Django feature test-first.5002 cmux-testingmanaflow-ai/cmuxChoose scoped cmux verification, add behavioral tests, and validate Swift test targets and wiring. Use when adding tests or deciding what local/CI evidence a change needs.4964 springboot-tddaffaan-m/eccTest-driven development for Spring Boot using JUnit 5, Mockito, MockMvc, Testcontainers, and JaCoCo. Use when adding features, fixing bugs, or refactoring.4962 agent-introspection-debuggingaffaan-m/eccStructured self-debugging workflow for AI agent failures using capture, diagnosis, contained recovery, and introspection reports. Use when an agent run fails and you need a reproducible diagnosis instead of a retry.4954 laravel-verificationaffaan-m/eccVerification loop for Laravel projects: env checks, linting, static analysis, tests with coverage, security scans, and deployment readiness. Use when verifying a Laravel project before merge or deploy — lint, static analysis, tests, coverage, security.4952 ai-regression-testingaffaan-m/eccRegression testing strategies for AI-assisted development. Sandbox-mode API testing without database dependencies, automated bug-check workflows, and patterns to catch AI blind spots where the same model writes and reviews code. Use when adding regression coverage to AI-assisted code, or when the same model both wrote and reviewed a change.4947 n8n-code-pythonczlonkowski/n8n-skillsWrite Python in n8n Code nodes (native Python, `language` pythonNative, n8n 2.x). Use when the user explicitly wants Python in a Code node, when migrating old Pyodide/"Python (Beta)" code that used _input/_json/_node/_now, or when a Python Code node fails with NameError, "Security violations detected", "Import of standard library module … is disallowed", "__build_class__ not found", "A 'json' property isn't a dictionary", or "Python runner unavailable". Covers the only two variables (_items/_item), dict-only access, imports blocked by default, the sandbox's denied builtins, accepted return shapes, and how errors interact with onError. JavaScript is the default for Code nodes — native Python has no n8n helpers and, by default, no imports. EXCEPTION — for Python in the AI-agent-callable Custom Code Tool (@n8n/n8n-nodes-langchain.toolCode), use the n8n-code-tool skill instead (input is _query, return must be a string).4938 kotlin-testingaffaan-m/eccKotlin testing patterns with Kotest, MockK, coroutine testing, property-based testing, and Kover coverage. Follows TDD methodology with idiomatic Kotlin practices. Use when writing Kotlin tests with Kotest or MockK, or testing coroutines and checking coverage.4933 production-auditaffaan-m/eccLocal-evidence production readiness audit for shipped apps, pre-launch reviews, post-merge checks, and "what breaks in prod?" questions without sending repo data to an external audit service. Use when auditing production readiness before launch, after a merge, or when asked what breaks in prod.4926 unit-test-bean-validationgiuseppe-trisciuoglio/developer-kitProvides patterns for unit testing Jakarta Bean Validation (JSR-380), including @Valid, @NotNull, @Min, @Max, @Email constraints with Hibernate Validator. Generates custom validator tests, constraint violation assertions, validation groups, and parameterized validation tests. Validates data integrity logic without Spring context. Use when writing validation tests, bean validation tests, or testing custom constraint validators.4926 indexion-wikitrkbt10/indexion-skillsProject wiki lifecycle — create pages, track source changes with ingest, update stale pages, lint structural integrity, detect code-to-doc drift with reconcile, and manage search indexes. A runbook for navigating and maintaining the wiki as an agent.4924 indexion-kgftrkbt10/indexion-skillsDebug and inspect KGF specs — view tokenization results, parse trees, and extracted edges from source files. Use when adding/fixing language support or when indexion's analysis output looks wrong.4922 indexion-identitytrkbt10/indexion-skillsDetect and review name/content drift in code using `indexion identity audit`, then plan verified renames, moves, folder changes, or splits.4916 debug-mantrathananon/9arm-skillsFour-mantra debugging discipline — reproduce, trace the fail path, falsify the hypothesis, cross-reference every breadcrumb. Recite the mantra block verbatim at the start of any debugging session, then apply the four steps in order before proposing any fix. Trigger on /debug-mantra and proactively whenever debugging starts — user reports a bug, says something is broken/throwing/failing, asks to debug/diagnose/investigate an issue, or pastes a stack trace or error log.4897