测试与安全 Skills - 测试与安全 Agent Skills推荐与安装 - 第45页 - AI导哈

ot-icszhaoxuya520/rev…se-skillUse for authorized OT/ICS security assessment covering Purdue model zoning, PLC/SCADA exposure, industrial protocol discovery, and safe passive-first evaluation.1142 agent-runtime-gateway-smoke-testaffaan-m/eccVerify a local agent API, temporary gateway tunnel, and remote sandbox callback with a tool-free task, then restore the original app connection.1141 agent-code-review-swarmruvnet/rufloAgent skill for code-review-swarm - invoke with $agent-code-review-swarm1140 agent-tdd-london-swarmruvnet/rufloAgent skill for tdd-london-swarm - invoke with $agent-tdd-london-swarm1138 ai-system-testingpetrkindlmann/qa-skillsTest AI/LLM features that ship in your product. Covers prompt regression testing, response quality evaluation, tool-call validation, hallucination and RAG grounding checks, nondeterministic-output strategies, red-team/safety scans, eval frameworks, and agent-as-target injection (indirect injection via tool output / RAG / scan reports, self-propagating payloads, data exfiltration via an agent) plus a bundled detector for untrusted content. Use when: "test our LLM feature," "prompt regression test," "eval framework," "hallucination test," "RAG grounding," "nondeterministic output," "AI feature testing," "red-team our chatbot," "indirect prompt injection," "agent reading untrusted tool output," "production AI quality." Not for: using AI to generate your own test code — use ai-test-generation. Not for: classifying CI failures with AI — use ai-bug-triage. Not for: EU AI Act / GDPR conformity of an AI feature — use compliance-testing. Not for: canary/flag rollout of an AI feature — use testing-in-production. Related: ai-test-generation, ai-qa-review, api-testing, compliance-testing, security-testing, risk-based-testing, test-data-management.1137 safe-action-testingnext-safe-action/skillsUse when writing tests for next-safe-action actions or hooks -- Vitest patterns for testing server actions directly, middleware behavior, hooks with React Testing Library, validation errors, and server errors1137 vibe-security-skillreason-machines/security-skillsAgent skill that audits vibe-coded apps for common security vulnerabilities introduced by AI coding assistants1137 brownfield-retrospectiveaffaan-m/eccRun the ECC engineering process retroactively against an existing project slice. Audit current state, reconstruct past decisions, produce a four-axis gap register (thinking, coding practice, missing features, technology selection), then execute fixes forward through the plan-TDD-review pipeline. Use when adopting ECC mid-project, taking over an inherited codebase, or asking what was missed and what would have been built differently from day one.1136 gitops-cluster-debugfluxcd/agent-skillsDebug and troubleshoot Flux CD on live Kubernetes clusters via the Flux MCP server — inspects Flux resource status, events and controller logs, traces workloads back to the Flux objects and sources that deliver them, previews what a GitOps change will do on the cluster, and performs installation health checks. Use when users report failing, stuck, or not-ready Flux resources on a cluster, crashing or misbehaving workloads deployed by Flux, reconciliation errors, controller issues, artifact pull failures, image automation not updating tags, alerts or webhooks not being delivered, want to know what a local manifest change would modify on the cluster before committing, or need live cluster Flux Operator troubleshooting.1136 skill-host-compataffaan-m/eccLint ECC skills for Codex/Cursor-safe frontmatter and Claude-only substitutions before a skill PR.1135 qa-dopetrkindlmann/qa-skillsRoute a plain-language QA situation to the next 1-2 skills, then carry out the requested workflow with evidence and a readable report. Use ONLY when the request does not match any other skill's trigger phrases. Use when: "which skill should I use," "where do I start," "validate this app," "run QA and report," "/qa-do," or any vague QA situation that doesn't map to one skill. Not for: bootstrapping a brand-new project with no QA — use qa-start. Not for: capturing project setup/context — use qa-project-context. If the request clearly matches another skill, invoke that skill directly instead of routing through here. Related: qa-start, qa-project-context, test-strategy.1133 page-metadatakostja94/market…g-skillsWhen the user wants a full-page metadata audit or implementation across discovery, search intent, title, description, canonical, robots, hreflang, Open Graph, Twitter Cards, code or CMS changes, build validation, rendered HTML, production verification, localization, or post-release observation. Also use for "metadata audit," "sitewide meta optimization," "metadata implementation," "meta robots," "hreflang," "viewport," or "charset." For an isolated title, description, heading, Open Graph, or Twitter Card task, use its specialist skill directly.1133 triageanthropics/defe…-harnessTriage a batch of raw security findings. Verify each is real, collapse duplicates, re-rank by derived exploitability, and tag with an owner. Takes a directory or file of scanner output and writes TRIAGE.json + TRIAGE.md sorted by what actually needs engineering attention. Use when asked to "triage findings", "validate scanner output", "prioritize vulns", or "review the backlog". Runs interactively by default; pass --auto to skip the interview.1132 code-improvertrailofbits/skillsRuns an autonomous review-and-fix improvement loop over any code target — a skill, plugin, module, or directory — using a reviewer the user names: any installed skill or agent. Keeps a cross-round findings ledger, escalates when fixes stop converging, and guards scope mechanically. Use when asked to 'improve this code until review passes', 'run an improvement loop with <reviewer>', or to iterate review-and-fix with a specific reviewer. For skills prefer the skill-improver entry; for a branch prefer pr-improver.1130 localization-strategykostja94/market…g-skillsPlan, audit, implement, migrate, or validate localization for multilingual products and websites, including locale scope, market readiness, URL architecture, content coverage, hreflang coordination, rollout, and production verification. Use translation for the actual translation, glossary, and language review work.1130 openclaw-security-hardeningreason-machines/security-skillsDeploy and manage security hardening for high-privilege autonomous AI agents (OpenClaw) using zero-trust architecture and automated defense matrices1129 pagespeed-insightsenderpuentes/ai…t-skillsAudit web pages for performance optimization following PageSpeed Insights guidelines. Use when analyzing page performance, optimizing web applications, reviewing performance metrics, implementing Core Web Vitals improvements, or when the user mentions page speed, performance optimization, Lighthouse scores, or Core Web Vitals.1127 ue-state-treesquodsoler/unrea…e-skillsUse when writing or debugging State Tree logic in Unreal Engine C++ — tasks, conditions, evaluators, considerations, schemas, transitions, events or Mass behaviours. Also use when the user mentions 'StateTree', 'state tree', 'FStateTreeTaskBase', 'FStateTreeExecutionContext', 'GetInstanceDataType', 'FInstanceDataType', 'UStateTreeComponent', 'UStateTreeAIComponent', 'FStateTreeReference', 'SendStateTreeEvent', 'EStateTreeRunStatus', 'StateTree schema', 'utility selection', 'scheduled tick', 'FinishTask', or 'Mass StateTree'. For behaviour trees, perception and navigation, see ue-ai-navigation; for Mass processors and fragments, see ue-mass-entity; for USTRUCT basics, see ue-cpp-foundations.1126 mobile-testingpetrkindlmann/qa-skillsTest native, React Native, hybrid, and Flutter mobile apps with Appium 3.x, Detox, Maestro, and Patrol. Covers device farm setup (BrowserStack, Sauce Labs), gesture simulation, deep link and cold-start testing, push notifications, biometric (Face ID) auth, offline/poor-network simulation, and iOS/Android permission dialog handling. Use when: "mobile test," "Appium," "Detox," "Maestro," "Patrol," "Flutter test," "iOS test," "Android test," "device farm," "deep link," "biometric," "Face ID," "permission dialog," "React Native test." Not for: device/browser matrix strategy in the abstract — use cross-browser-testing; app startup/memory/battery profiling depth — use performance-testing; mobile screenshot diffing — use visual-testing. Related: ci-cd-integration, cross-browser-testing, performance-testing, test-data-management, test-reliability.1126 linting-neostandard-eslint9mcollina/skillsConfigures ESLint v9 flat config and neostandard for JavaScript and TypeScript projects, including migrating from legacy `.eslintrc*` files or the `standard` package. Use when you need to set up or fix linting with `eslint.config.js` or `eslint.config.mjs`, troubleshoot lint errors, configure neostandard rules, migrate from `.eslintrc` to flat config, or integrate linting into CI pipelines and pre-commit hooks.1126 fusion-developer-appequinor/fusion-skillsGuides feature development in Fusion Framework React apps, including app-scoped framework research, test authoring, and test-time mocking needed to choose and verify the right integration patterns. USE FOR: building features, components, pages, hooks, services, API integrations, module configuration, and their tests. DO NOT USE FOR: issue authoring, skill authoring, CI/CD configuration, backend service changes, or general Fusion documentation unrelated to app implementation.1125 agent-security-managerruvnet/rufloAgent skill for security-manager - invoke with $agent-security-manager1125 qa-metricspetrkindlmann/qa-skillsDefine, track, and act on QA metrics: test coverage percentage, flakiness rate, defect escape rate, MTTR, test execution time trends, automation ROI, quality gates, and SLAs for test suites. Includes metric formulas, realistic targets by company stage, and the action to take when each metric goes red. Use when: "QA metrics," "test metrics," "quality KPIs," "test health," "flakiness rate," "defect escape rate." Not for: building the dashboard UI (Allure/Grafana) — use qa-dashboard; measuring coverage gaps and mutation score — use coverage-analysis. Related: qa-dashboard, coverage-analysis, ci-cd-integration, release-readiness, quality-postmortem.1124 cross-browser-testingpetrkindlmann/qa-skillsDesign analytics-driven browser test matrices and execute cross-browser tests. Covers BrowserStack/Sauce Labs configuration, Playwright browser channels, common cross-browser CSS/JS divergences, a known-issues documentation log, and progressive enhancement validation. Use when: "cross-browser," "browser matrix," "BrowserStack," "Safari issues," "browser compatibility," "Edge," "works in Chrome but not Safari." Not for: pixel-level baseline strategy and threshold tuning — use visual-testing; device-farm testing of native/hybrid apps — use mobile-testing. Related: visual-testing, playwright-automation, ci-cd-integration, mobile-testing.1124 agent-test-long-runnerruvnet/rufloAgent skill for test-long-runner - invoke with $agent-test-long-runner1124 patchanthropics/defe…-harnessGenerate candidate fixes for verified security findings. Consumes TRIAGE.json (preferred), VULN-FINDINGS.json, INCIDENTS.json, or a vuln-pipeline results directory. Pipeline input is delegated to the execution-verified `vuln-pipeline patch` ladder; static-analysis input gets a per-finding patch subagent + independent reviewer and is written as inert diffs for human review. Writes PATCHES/bug_NN/{patch.diff,patch_result.json}, PATCHES.md, and PATCHES.json. Use when asked to "fix the findings", "patch these vulns", "generate fixes", or "close the loop on triage".1123 agent-v3-security-architectruvnet/rufloAgent skill for v3-security-architect - invoke with $agent-v3-security-architect1123 autopentestx-automated-pentestingreason-machines/security-skillsAutomated penetration testing toolkit for security assessment, vulnerability scanning, and automated security reporting1123 vtex-io-security-boundariesvtex/skillsApply when reviewing or designing security-sensitive boundaries in VTEX IO apps. Covers public versus private exposure, trust assumptions at route and integration boundaries, sensitive data handling, validating what crosses the app boundary, and avoiding leakage across accounts, workspaces, users, or integrations. Use for route hardening, data exposure review, or evaluating whether a service boundary is too permissive.1122 test-collaborationaffaan-m/eccInventory and govern a project's test assets. Connect requirements, business rules, risks, bugs, and cross-boundary contracts to stable TEST-IDs and executable evidence in the repository's existing test registry or TESTS.md. Use for test inventory, test gap analysis, unit/integration/contract/E2E/smoke classification, bug-to-test regression protection, consumer/provider contract testing, test-necessity review, and pre-delivery evidence review.1121