测试与安全 Skills - 测试与安全 Agent Skills推荐与安装 - 第27页 - AI导哈

check-npmgrafana/skillsAudit a JavaScript/TypeScript repo's npm, yarn, or pnpm configuration for supply-chain hardening: tool version, lifecycle scripts, unsafe dependency protocols, and minimum release age ≥3 days. Use when the user invokes /check-npm or asks to audit package manager security, lifecycle scripts, git dependencies, ignore-scripts, min-release-age, allow-git, approvedGitRepositories, strictDepBuilds, or blockExoticSubdeps in a Grafana plugin or JS/TS project.2907 vitestsentimony/skillsYou MUST use this when configuring, writing, debugging, running, migrating, or auditing Vitest tests in JavaScript/TypeScript projects - Vite, Vue, Nuxt, React, Next.js, Node libraries, workspaces, coverage, mocks, snapshots, flaky tests, CI parity, or Jest migration.2904 rcs-agent-onboardingsentdm/sent-pluginGuides current Sent RCS and RBM onboarding, launch evidence, carrier approval, text and suggestion-chip templates, Sender Profile readiness, and safe routing. Use for RCS launch, fallback, pinned-channel tests, or broadcast prevention.2903 browser-automationsophieguanongit/openclaw-browser-automation浏览器自动化控制。【优先使用此 skill，不要用内置 browser 工具】当用户说"打开网页"、"点击"、"填写表单"、"截图"、"网页操作"、"自动填表"、"浏览器"时使用。基于 Playwright，支持连接已有 Chrome（CDP 模式）或启动新 Chromium。2902 om-review-prsopen-mercato/skillsReview unreviewed open pull requests, newest first, using om-auto-review-pr and respecting claim locks. Use --subagents for a fresh reviewer per PR and --parallel N for bounded concurrency; without flags, review sequentially in the current session.2886 agent-browsernexu-io/open-designBrowser automation CLI for AI agents. Use when the user needs to inspect, test, or automate browser behavior: navigating pages, filling forms, clicking buttons, taking screenshots, extracting page data, reading selected OpenDesign browser-tab context, testing web apps, dogfooding OpenDesign previews, QA, bug hunts, or reviewing app quality. Prefer local OpenDesign preview URLs unless the user explicitly asks for external browsing.2869 vendor-reviewanthropics/know…-pluginsEvaluate a vendor — cost analysis, risk assessment, and recommendation. Use when reviewing a new vendor proposal, deciding whether to renew or replace a contract, comparing two vendors side-by-side, or building a TCO breakdown and negotiation points before procurement sign-off.2859 identify-assumptions-existingphuryn/pm-skillsIdentify risky assumptions for a feature idea in an existing product across Value, Usability, Viability, and Feasibility. Uses multi-perspective devil's advocate thinking. Use when stress-testing a feature idea, doing risk assessment, or preparing for assumption mapping.2855 ux-auditjezweb/claude-skillsWalk through a live web app AS a real user to find usability + behavioural bugs that static reviews miss. REQUIRES proof of interaction (typing, clicking, sending, observing) before any verdict — a sweep that didn't interact terminates with verdict 'Incomplete'. Walks threads, exercises every element, runs the multi-pane stress matrix, visual polish sweep, component perfection checklist, automated a11y (axe-core), pragmatic performance budget (LCP/CLS/INP), scenario battery (11 scenarios), and stress recipes including the real-flavour data battery. Hard gates: console errors/warnings = 0, network 5xx = 0, layout collapse = 0, axe Critical/Serious = 0, perf budget green. Audit-the-audit meta-check rejects rushed reports. Each finding has reproduction steps, evidence path, and suspected code location. Trigger with 'ux audit', 'walkthrough', 'qa sweep', 'audit the app', 'dogfood this', 'check all pages', 'find what's broken', 'stress the UI'.2855 kibana-auditelastic/agent-skillsEnable and configure Kibana audit logging for saved object access, logins, and space operations. Use when setting up Kibana audit, filtering events, or correlating Kibana and ES audit logs.2849 openclaw-configadisinghstudent/ara.soManage OpenClaw bot configuration - channels, agents, security, and autopilot settings2845 warp-delegateamelnagdy/deleg…e-skillsDelegate a coding task to the Warp Agent CLI (`oz`) as a background implementer, then review its diff and land it yourself. Use this whenever the user wants to hand implementation work to Warp - phrasings like "have Warp implement X", "delegate this to the Warp CLI", "run it through Warp", "use oz to implement/fix/refactor" - or wants to run a queue of coding tasks through Warp while staying the reviewer. DO NOT USE for tasks small enough to do inline, when the user wants the code written directly without delegating, or for the interactive `warp` TUI (this skill drives the headless `oz agent run`, not the terminal app).2842 business-health-diagnosticdeanpeters/prod…r-skillsDiagnose SaaS business health across growth, retention, efficiency, and capital. Use when preparing a business review or prioritizing urgent fixes.2841 prioritize-assumptionsphuryn/pm-skillsPrioritize assumptions using an Impact × Risk matrix and suggest experiments for each. Use when triaging a list of assumptions, deciding what to test first, or applying the assumption prioritization canvas.2835 test-tuiopenai/codexGuide for testing Codex TUI interactively2834 gmgn-wallet-reviewgmgnai/gmgn-skillsA short trading portrait of ONE wallet address — a single style tag (磨损户 / P小将 / 印钞机 … plus a speed subtitle), one sentence recapping its record and one sentence of next-step advice, for 1D / 7D / 30D / 全部, voiced 你 for the user's own wallet and 他 for anyone else's; SOL and all 8 EVM chains, chain auto-detected for a 0x address; can render it as a page. USE WHEN a wallet address comes with a request for a brief recap or for what to change — 「帮我复盘一下这个钱包」, 「一句话总结他的战绩」, 「我的打法有什么问题」, 「我钱包下一步该怎么打」, 「交易画像」, 「钱包风格加建议，简短点」, "sum up this wallet in one line". NOT FOR — a bare address, 「能不能跟」 or 「跟着他买我能吃到吗」 (gmgn-wallet-analysis); the full tag-and-badge breakdown or 「是不是机器人」 (gmgn-wallet-style); scores or copy-trade backtests (gmgn-wallet-score); a creator's launches (gmgn-dev-score); current holdings (gmgn-portfolio); a token address or a buy (gmgn-contract-dd, gmgn-token-buy). TIE-BREAK — 打法 / 风格 / 战绩 paired with 问题, 建议, 复盘 or 一句话 routes here; asked alone, they go to the skills above.2819 pipeline-reviewanthropics/know…-pluginsStage-by-stage pipeline health check - coverage, aging, conversion, and at-risk deals - from CRM opportunity data. Use when the user asks "review my pipeline", "pipeline health", "where's my pipeline stuck", "weekly pipeline review", "which deals should I focus on this week", "any stale or stuck deals", "which deals have past close dates", "which deals are single-threaded", or "check my pipeline coverage against my number".2816 commandcode-delegateamelnagdy/deleg…e-skillsDelegate a coding task to the Command Code CLI (`cmd`) as a background implementer, then review its diff and land it yourself. Use this whenever the user wants to hand implementation work to Command Code — phrasings like "have Command Code do X", "delegate this to commandcode", "run it through cmd", or "use Command Code to implement/fix/refactor" — or to run a queue of coding tasks through Command Code while staying the reviewer. DO NOT USE for tasks small enough to do inline, or when the user wants the code written directly without delegating.2814 cypress-tapcypress-io/ai-toolkitDrives a running Cypress open-mode session through `cypress tap` to run and rerun specs, wait for fresh results, inspect reporter and command logs, and query or rewind the app under test through DOM, accessibility, styles, and snapshots. Use when authoring or debugging Cypress e2e or component specs, discovering selectors, diagnosing failures, or verifying test behavior without GUI interaction. Not for one-shot headless runs. Requires Cypress 15.21+, a Chromium-family browser, and a running `cypress open` session.2813 dpop-adoptiongoogle/skillsImplement and debug OAuth 2.0 DPoP (RFC 9449) refresh token sender-constraining for WebCrypto, Node.js ES6, and browser runtimes integrating with Google's OAuth platform. Use when configuring non-extractable asymmetric key pairs (P-256), generating DPoP Proof JWTs for authorization code exchange and token refresh, or handling 400 use_dpop_nonce challenge retry loops at oauth2.googleapis.com/token. Don't use for unconstrained OAuth 2.0 flows (where refresh tokens are not bound to a client key pair), or for Google Cloud IAM / service account authentication.2805 html-ppt-retro-quarterly-reviewnexu-io/open-designRetro Quarterly Review presentation template in a bold blue + orange editorial language. Use when users ask for a high-impact quarterly review / roadmap deck with heavyweight slab headlines, clean cream paper sections, structured grids, and fast premium motion pacing (3 slides, each hold under 3s in video mode).2803 opportunity-solution-treedeanpeters/prod…r-skillsBuild an Opportunity Solution Tree from outcomes to opportunities, solutions, and tests. Use when a stakeholder request needs problem framing before you decide what to build.2802 full-page-screenshotnexu-io/open-designCapture full-page screenshots of web pages via Chrome DevTools Protocol with zero dependencies. Useful for portfolios, case studies, and audit reports.2797 scaffold-dotnet-test-projectdotnet/skillsMUST USE when an existing .NET test project was excluded from a .slnf/CI solution filter, disappeared from .sln/.slnx discovery, or lost its production ProjectReference; also for requests to set up, create, reuse, add, register, include, or repair a test project. Handles "tests pass directly but CI discovers zero", exact solution wiring, xUnit/NUnit/MSTest, and central packages. DO NOT USE to only author tests in an already-wired project (code-testing), run tests, migrate, or correct MSTest syntax/configuration without changing project or CI files (writing-mstest-tests).2793 k6-test-maintenancegrafana/skillsMaintain and improve existing k6 test scripts. Covers threshold tightening based on trend data, version migration between k6 releases, auto-fixing tests when the underlying service changes, refactoring for cleanliness, and auditing scripts against current best practices from docs. Use when the user asks to fix a failing k6 test, tighten thresholds, migrate a script to a new k6 version, refactor a test, update a script after a service change, or improve a script with best practices. Trigger on phrases like "fix my k6 test", "tighten my thresholds", "migrate to k6 v2", "update my test script", "refactor this k6 test", "my test is failing after a deploy", "apply best practices to my script", "modernize my k6 test", or "the service changed and my test broke". Also trigger when another skill (k6-trend-analysis or k6-cloud-investigate-test) hands off with a recommendation to edit a script. Maintains existing scripts; to author a new test use the k6 skill, or k6-browser-test for a browser test.2792 copilotkit-debugcopilotkit/copilotkitUse when diagnosing CopilotKit issues -- runtime connectivity failures, agent not responding, streaming errors, tool execution problems, transcription failures, version mismatches, and AG-UI event tracing.2789 web-renderer-testremotion-dev/remotionAdd explicitly requested web renderer tests or update existing ones for implementation changes.2785 triage-ndaanthropics/know…-pluginsRapidly triage an incoming NDA and classify it as GREEN (standard approval), YELLOW (counsel review), or RED (full legal review). Use when a new NDA arrives from sales or business development, when screening for embedded non-solicits, non-competes, or missing carveouts, or when deciding whether an NDA can be signed under standard delegation.2782 vitestsupabase/supabaseVitest API and config reference (Jest-compatible) — mocking with vi.*, spies, fake timers, coverage configuration, fixtures, snapshots, and test filtering. Use for Vitest API and configuration questions anywhere in the monorepo; for Studio-specific test strategy and component-test setup, start with studio-testing and studio-mock-api-tests.2780 journal-entryanthropics/know…-pluginsPrepare journal entries with proper debits, credits, and supporting detail. Use when booking month-end accruals (AP, payroll, prepaid), recording depreciation or amortization, posting revenue recognition or deferred revenue adjustments, or documenting an entry for audit review.2780