测试与安全 Skills - 测试与安全 Agent Skills推荐与安装 - 第44页 - AI导哈

testing-dagsastronomer/agentsComplex DAG testing workflows with debugging and fixing cycles. Use for multi-step testing requests like "test this dag and fix it if it fails", "test and debug", "run the pipeline and troubleshoot issues". For simple test requests ("test dag", "run dag"), the airflow entrypoint skill handles it directly. This skill is for iterative test-debug-fix cycles.1173 review-deltatirth8205/code-…ew-graphReview only changes since last commit using impact analysis. Token-efficient delta review with automatic blast-radius detection.1173 debuggingsentimony/skillsYou MUST use this when investigating bugs, regressions, failing tests, build or integration failures, flaky behavior, performance anomalies, or other unexpected technical behavior.1170 seo-auditseo-skills/seo-…it-skillAudit websites for SEO, technical, content, security, JS rendering, and AI readiness using SEOmator CLI. Returns LLM-optimized reports with health scores across 373 rules and 20 categories, and can diff two audits to show what a deploy changed. Use when analyzing websites, debugging SEO issues, checking site health, or comparing a site before and after a change.1169 security-testingpetrkindlmann/qa-skillsTest application security against OWASP Top 10 (2025) with automated CI tooling: OWASP ZAP (DAST), dependency/supply-chain scanning (OSV-Scanner, SBOM, provenance), Semgrep SAST, auth/session tests (JWT, OAuth, RBAC), and XSS/CSRF/SQLi/SSRF Playwright patterns. Use when: "security test," "OWASP," "vulnerability," "ZAP," "XSS," "SSRF," "dependency scan," "auth testing," "OWASP LLM Top 10." Scope is automated scanning + negative-path security tests in CI, not manual penetration testing. Not for: mapping security controls to regulations (SOC 2, HIPAA, PCI, GDPR) — use compliance-testing; pipeline stage wiring and deploy gating mechanics — use ci-cd-integration; purely functional API auth/input tests with no attacker model — see api-testing; testing your product's own LLM features or defending the agent itself (prompt-injection detector, indirect injection, jailbreak red-teaming) — use ai-system-testing. Related: ci-cd-integration, compliance-testing, api-testing, shift-left-testing, ai-system-testing.1167 hardware-securityzhaoxuya520/rev…se-skillUse for authorized hardware and embedded interface security research including UART/JTAG discovery, debug pad triage, secure boot overview, and offline firmware extraction support.1167 cli-routingcheaper-inference/omnirouteCreate, list, update, and delete routing combos from the CLI. Test routing strategies, inspect combo metrics, and configure fallback chains interactively.1166 service-itsm-teams-debugforcedotcom/sf-skillsDebug and diagnose Microsoft Teams for Employee Service (ITSM) configuration failures — run a pass/fail validation checklist against the org and report exact remediation. Use this for: 'IT Desk login not working in Teams', 'UEL/CCP user can't log in to IT Service', 'Teams feature not showing / not enabled', 'CI Hub / Service Catalog / My Assets tab not loading', 'Teams Agentforce agent not responding', 'Teams swarming not working', 'Teams SSO failing', or any request to troubleshoot a Teams ITSM setup. Routes the problem to the right checklist (login, feature enablement, tab loading, Agentforce, swarming, SSO) and checks the exact CORS, External Client App, feature toggle, PSL, profile, auth-provider, named-credential, and messaging-channel settings each requires. DO NOT TRIGGER for first-time enablement (service-itsm-teams-configure / -itservice-configure / -itdesk-configure) or building the embedded agent from scratch (service-itsm-teams-employee-agent-configure).1163 llm-securityzhaoxuya520/rev…se-skillUse for authorized security assessment of LLM applications and AI agents, including prompt injection, tool abuse, RAG exposure, memory poisoning, and model supply-chain risks.1162 iam-recommendations-fetchergoogle/skillsFetches raw IAM recommendations and associated security insights from Google Cloud for a specified target scope (Organization, Folder, or Project). Use when you need to retrieve security recommendations before analyzing or applying them. Don't use for applying/acting on recommendations (use the recommendation applier skill) or for general allow policy querying (use the allow policy viewer skill).1162 thick-clientzhaoxuya520/rev…se-skillUse for authorized security testing of desktop thick clients including local storage, update channels, IPC, traffic, and client-side trust boundaries.1161 qa-startpetrkindlmann/qa-skillsSequenced launcher that bootstraps QA on a project with no QA in place. Chains qa-project-context → test-strategy → test-planning in one guided run, then executes available checks and records evidence. Use when: "set up QA on a new project," "QA from scratch," "no QA exists yet," "/qa-start." Not for: onboarding a QA engineer to an existing team with existing tests — use qa-project-bootstrap. Not for: "which skill do I use" with no clear match — use qa-do. Related: qa-project-context, test-strategy, test-planning, qa-project-bootstrap, qa-do.1161 gemini-computer-useam-will/codex-skillsBuild and run Gemini 2.5 Computer Use browser-control agents with Playwright. Use when a user wants to automate web browser tasks via the Gemini Computer Use model, needs an agent loop (screenshot → function_call → action → function_response), or asks to integrate safety confirmation for risky UI actions.1159 review-prtirth8205/code-…ew-graphReview a PR or branch diff using the knowledge graph for full structural context. Outputs a structured review with blast-radius analysis.1159 tddsentimony/skillsYou MUST use this when implementing testable behavior changes - new features, bug fixes, or refactors with observable contracts. Covers writing meaningful failing tests before implementation and verifying behavior through the red-green-refactor cycle. Not for purely mechanical edits without behavior changes.1158 wifi-wirelesszhaoxuya520/rev…se-skillUse for authorized wireless security assessment including Wi-Fi capture, WPA handshake analysis, rogue AP detection research, and lab-only deauth testing.1156 playwrightpproenca/dot-skillsPlaywright testing best practices for Next.js applications (formerly test-playwright). This skill should be used when writing, reviewing, or debugging E2E tests with Playwright. Triggers on tasks involving test selectors, flaky tests, authentication state, API mocking, hydration testing, parallel execution, CI configuration, or debugging test failures.1155 heal-skillboshu2/agentopsCheck or repair structural hygiene in AgentOps skill packages. Triggers: "heal skill", "repair skill hygiene", "audit skill structure", "check skill package".1154 cli-providerscheaper-inference/omnirouteManage provider connections from the CLI: list available/configured providers, add, test, test-all, validate, rotate API keys, and view per-provider metrics.1154 test-case-managementpetrkindlmann/qa-skillsAuthor and maintain MANUAL and hybrid test cases and suites in TestRail, Xray (Jira), Zephyr Scale, and Qase. Covers test-case anatomy (title, preconditions, steps, expected results, test data), suite/section organization, bulk authoring from user stories and acceptance criteria, ambiguous-step linting, CSV/API import-export payloads per tool, requirement traceability and coverage gaps, review hygiene, and when a manual case should graduate to automation. Use when: "write a test case," "manual test case," "TestRail case," "Xray test," "Zephyr Scale case," "Qase case," "import CSV into TestRail," "lint these steps," "traceability report," "should this be automated." Not for: Generating automated TEST CODE — that is ai-test-generation. Sprint-level WHAT-to-test selection — that is test-planning. Related: ai-test-generation, test-planning, exploratory-testing, qa-project-context.1152 vuln-scananthropics/defe…-harnessStatic source-code vulnerability scan. Reads a target directory (and THREAT_MODEL.md if present), spawns parallel review subagents per focus area, and writes VULN-FINDINGS.json + .md for /triage to consume. Read-only — no building, running, or network. For execution-verified crashes, use vuln-pipeline instead. Use when asked to "scan for vulns", "review this code for security issues", "find bugs in <dir>", or as the step between /threat-model and /triage.1152 supply-chain-securityzhaoxuya520/rev…se-skillUse for software supply-chain security assessment covering SBOM, SCA, CI/CD pipelines, container images, build integrity, dependency provenance, and vulnerability reachability.1151 code-revieweralirezarezvani/…e-skillsUse for any code review: a pull request, a diff, a commit, or a pasted function, handler or file in TypeScript, JavaScript, Python, Go, Swift, Kotlin, C#/.NET, Java, C, C++, Rust, Ruby, PHP or Dart/Flutter. Applies per-language rule packs (security such as SQL injection and missing auth, async and resource handling, error handling, performance) and scripts that score a PR's risk and complexity, then gives a merge verdict with blocking and non-blocking findings. Use whenever the user asks to review, check or look over code, says 'code review', 'review this PR', 'review this diff' or 'is this safe to merge', or asks what is wrong with a snippet, even a single function.1151 csharp-expertdotnet/skillsRoute C# and .NET requests to the exact installed specialist or smallest dotnet/skills marketplace plugin. USE FOR: "which specialist should own this" or "how do I add the skill" requests involving ASP.NET Core endpoints, Blazor, MAUI binding, Windows Forms specialist selection or installation, EF Core queries, test or framework migration, runtime CPU/allocation evidence, file-based C#, editor/compiler defects, a surviving MSBuild `.binlog`, or a plugin missing from `/skills`; also use for C# semantics when no narrower specialist exists. DO NOT USE FOR: requests that already name the exact installed specialist to invoke, or work unrelated to C# or .NET.1150 supabase-audit-rlsyoanbernabeu/su…t-skillsTest Row Level Security (RLS) policies for common bypass vulnerabilities and misconfigurations.1148 git-notesneolabhq/contex…ring-kitUse when adding metadata to commits without changing history, tracking review status, test results, code quality annotations, or supplementing commit messages post-hoc - provides git notes commands and patterns for attaching non-invasive metadata to Git objects.1148 pr-finishgjkim42/kanon-repoFinish an open PR by batching review feedback, applying valid fixes, running verification, pushing once per batch, and monitoring CI with bounded waits. Use when the user asks to update code until PR review comments are handled, review-all has no valid blocking findings, and required checks pass.1148 accessibility-auditaccesslint/skillsWhole site or product — a full web accessibility (a11y) audit against WCAG 2.2, following the WCAG-EM methodology. Defines scope, samples representative pages and flows, runs the automated tier (`accessibility-scan`) and the hands-on manual tier (`accessibility-inspect`), and produces one conformance report. Grades each finding by severity and evidence basis, and states per-criterion conformance as pass, fail, or undetermined (needs a human). Use it for 'audit my site for accessibility', 'is this product accessible', 'a11y audit', 'WCAG or Section 508 conformance report', or any multi-page assessment. Assesses; does not fix (use `accessibility-fix`) or diff (use `accessibility-diff`). For a single page use `accessibility-scan`; for hands-on keyboard and screen-reader checks use `accessibility-inspect`.1147 email-securityzhaoxuya520/rev…se-skillUse for authorized email security review including phishing analysis, header authentication (SPF/DKIM/DMARC), BEC patterns, and mailbox token abuse research.1146 systematic-debuggingjnmetacode/supe…owers-zh遇到任何 bug、测试失败或异常行为时使用，在提出修复方案之前执行1144