测试与安全 Skills - 测试与安全 Agent Skills推荐与安装 - 第47页 - AI导哈

malware-warning-avast-piracyreason-machines/security-skillsWARNING - This repository distributes pirated software and potential malware disguised as Avast Premium Security1090 avast-security-awarenessreason-machines/security-skillsRecognize and avoid malicious software distribution repositories disguised as legitimate security tools1089 ue-mass-entityquodsoler/unrea…e-skillsUse when writing or debugging Mass Entity ECS code in Unreal Engine C++ — processors, queries, fragments, tags, observers, traits, spawning and large-scale agent simulation. Also use when the user mentions 'MassEntity', 'UMassProcessor', 'FMassEntityQuery', 'ForEachEntityChunk', 'FMassEntityManager', 'FMassFragment', 'FMassTag', 'FTransformFragment', 'UMassObserverProcessor', 'ObservedTypes', 'Defer', 'archetype', 'AMassSpawner', 'entity config asset', 'MassCrowd', 'ISM crowd', 'entity relations', or 'thousands of agents'. For State Tree behavior on entities, see ue-state-trees; for ZoneGraph and Smart Objects, see ue-ai-navigation; for thread-safety rules, see ue-async-threading.1088 eval-auditai-evals-course/evals-skillsAudit an LLM eval pipeline and surface problems: missing error analysis, unvalidated judges, vanity metrics, etc. Use when inheriting an eval system, when unsure whether evals are trustworthy, or as a starting point when no eval infrastructure exists. Do NOT use when the goal is to build a new evaluator from scratch (use error-discovery, write-judge-prompt, or validate-evaluator instead).1088 observability-onboardingelastic/agent-skillsOnboard an application into Elastic Observability with the Elastic Distribution of OpenTelemetry (EDOT): route on language and runtime, detect and replace a classic Elastic APM agent, apply the required OTLP configuration, and then verify with ES|QL that traces, metrics, and logs actually arrive under the expected service name. Use when adding observability to a service, migrating off the classic Elastic APM agent, or debugging why an instrumented service is not showing up in Elastic.1086 customizeanthropics/defe…-harnessAdapt this C/C++ ASAN vulnerability pipeline to a different vulnerability class, target shape, language, or detection mechanism. Use when the user wants to port, migrate, retarget, customize, or fork the pipeline for something other than C/C++ memory-safety bugs — web apps, smart contracts, deserialization, ML systems, or any other domain.1085 sepia-reviewnanako0129/sepiaUse when a user explicitly requests Sepia review to diagnose prose without editing.1083 report-malicious-repositoryreason-machines/security-skillsIdentify and report potentially malicious software repositories masquerading as legitimate security tools1083 penetration-testingaj-geddes/usefu…-promptsEthical hacking and security testing methodologies using penetration testing tools, exploit frameworks, and manual security validation. Use when assessing application security posture and identifying exploitable vulnerabilities.1079 test-suite-curationpetrkindlmann/qa-skillsAudit a whole regression suite and prune/restructure it with evidence: per-test coverage fingerprinting, AST near-duplicate clustering, CI-history mining for never-failing and flaky tests, prune decision rules (redundant/obsolete/low-value/keep), smoke/core/extended tiering by risk and defect-detection history, and a defensible "what we deleted and why" record. Deletion is destructive — quarantine and human sign-off are mandatory. Use when: "audit the test suite," "prune redundant tests," "find duplicate tests," "which tests can we delete," "restructure into smoke/core/extended," "is this test pulling its weight," "shrink the regression suite." Not for: Judging whether an individual test is WELL-WRITTEN (smells, assertions) — that is ai-qa-review. Healing one flaky test at runtime — that is test-reliability. Bulk selector regeneration after a UI refactor — that is selector-drift-recovery. Related: ai-qa-review, coverage-analysis, test-reliability, risk-based-testing, qa-project-context.1078 qa-project-bootstrappetrkindlmann/qa-skillsOnboard a new QA engineer to an existing codebase, or audit an existing test architecture. Produces a 30-day ramp plan: codebase orientation, framework walkthrough, test architecture audit, mentorship pairing, and first-test guidance. Use when: "QA onboarding," "new tester," "ramp up," "test architecture audit," "first 30 days," "QA mentorship," "joining QA team." Not for: setting up QA on a brand-new project from scratch — use `qa-start`. Related: qa-start, qa-project-context, shift-left-testing, ai-qa-review.1078 typescript-qualityclaude-dev-suite/claude-dev-suiteTypeScript/JavaScript code quality with ESLint, Biome, and strict TypeScript. Covers linting, formatting, type safety, and best practices. USE WHEN: user works with "TypeScript", "JavaScript", "ESLint", "Biome", asks about "TS strict mode", "type safety", "linting rules", "code formatting" DO NOT USE FOR: SonarQube - use `sonarqube` skill, testing - use Vitest/Jest skills, security - use security skills1078 wxmini-security-auditreason-machines/security-skillsAutomated WeChat mini-program security auditing framework using Claude Code Agent Teams with 7 specialized agents for comprehensive static analysis1078 testing-in-productionpetrkindlmann/qa-skillsSafe-release techniques DURING rollout: feature flags, progressive rollouts, canary analysis, guardrail metrics, production smoke tests, and synthetic users. Bridges QA and SRE practices. Use when: "feature flag testing," "canary deploy," "progressive rollout," "guardrail metrics," "dark launch," "safe rollout." Not for: scheduled probes that run continuously after release — use `synthetic-monitoring`. Not for: designing tests from prod telemetry — use `observability-driven-testing`. Related: release-readiness, synthetic-monitoring, observability-driven-testing, qa-metrics.1077 deliver-acceptance-criteriaproduct-on-purpose/pm-skillsGenerates structured Given/When/Then acceptance criteria for a user story or feature slice, covering the happy path, key failure scenarios, and non-functional expectations in testable form. Use when turning requirements into verifiable scenarios for engineering handoff and QA sign-off. For a dedicated catalog of boundary conditions, error states, and recovery paths across a feature, use deliver-edge-cases; to write the stories themselves, use deliver-user-stories.1076 zodanivar/zod-skillZod v4 best practices, patterns, and API guidance for schema validation, parsing, error handling, and type inference in TypeScript applications. Covers safeParse, object composition, refinements, transforms, codecs, branded types, v3→v4 migration, and testing schemas with Jest or Vitest. Baseline: zod ^4.6.0. Triggers on: zod imports, z.object, z.string, z.infer, safeParse, mentions of "zod", "schema validation", "zod v4", "z.enum", or testing a schema — "schema test", "zod mock", zod-schema-faker.1076 review-requestsentimony/skillsYou MUST use this when a completed or partially committed implementation needs an independent code review against explicit requirements, a defined task scope, and the actual Git diff, including committed and working-tree changes.1075 shift-left-testingpetrkindlmann/qa-skillsMove quality earlier in the development lifecycle. Covers dev/QA pairing patterns, Three Amigos sessions, TDD facilitation (Red-Green-Refactor), PR review checklists for testability, and Definition of Done with quality gates. Includes shift-left maturity model for team assessment. Use when: "shift left," "TDD," "dev-QA pairing," "definition of done," "testability," "quality culture," "QA in sprint planning." Not for: writing the unit tests themselves — use unit-testing; automated PR test-quality review at scale — use ai-qa-review; multi-quarter QA direction or roadmap — use test-strategy. Related: unit-testing, ai-qa-review, test-strategy.1074 java-code-reviewdecebals/claude…ode-javaSystematic code review for Java with null safety, exception handling, concurrency, and performance checks. Use when user says "review code", "check this PR", "code review", or before merging changes.1073 avast-premium-security-detectionreason-machines/security-skillsIdentify and analyze suspicious software distribution repositories claiming to offer cracked or pirated security software1073 compliance-testingpetrkindlmann/qa-skillsTest for regulatory compliance: GDPR/CMP consent verification, Google Consent Mode v2, Global Privacy Control (GPC), CCPA/US state opt-out, EU AI Act Article 50 transparency, Better Ads Standards, and cookie-inventory auditing. Covers automated consent-flow testing, policy-based script blocking before consent, and cookie drift detection. Use when: "GDPR test," "compliance," "CMP test," "cookie consent," "consent mode," "CCPA," "GPC," "AI Act," "Better Ads," "privacy banner." Not for: WCAG/axe-core test authoring — use accessibility-testing. Not for: OWASP/vuln scanning — use security-testing. Not for: evaluating your LLM feature's quality or safety — use ai-system-testing. Related: accessibility-testing, security-testing, ai-system-testing, ci-cd-integration.1072 flagsreact/reactUse when you need to check feature flag states, compare channels, or debug why a feature behaves differently across release channels.1072 review-monitoringnexscope-ai/eco…e-skillsSet up systematic review monitoring across e-commerce platforms. Track new reviews, detect negative review spikes, monitor competitor reviews, and automate review response workflows.1071 chaos-engineeringpetrkindlmann/qa-skillsValidate system resilience through controlled fault injection. Covers hypothesis-driven chaos experiments, failure injection types (network, service, infrastructure, dependency), LitmusChaos/Chaos Mesh/AWS FIS/Gremlin/toxiproxy tooling, automated abort gating, game day planning, and progressive chaos adoption. Use when: "chaos engineering," "fault injection," "resilience test," "game day," "failure recovery," "system reliability," "blast radius." Not for: safe rollout flags/canary/dark launch during a release — use testing-in-production; designing new tests from production telemetry — use observability-driven-testing. Related: testing-in-production, observability-driven-testing, performance-testing, release-readiness, test-environments.1070 running-dbt-commandsdbt-labs/dbt-ag…t-skillsFormats and executes dbt CLI commands, selects the correct dbt executable, and structures command parameters. Use when running models, tests, builds, compiles, or show queries via dbt CLI. Use when unsure which dbt executable to use or how to format command parameters.1070 catalyst-functionscatalystbyzoho/…t-skillsCatalyst serverless functions — all 7 types (Basic I/O, Advanced I/O, Event, Cron, Job, Integration, Browser Logic), handler signatures, catalyst-config.json, Security Rules, API Gateway routing, file uploads, busboy, Express middleware, environment variables, function URL, and function testing. Requires MCP connection — check for CatalystbyZoho_* tools before any operation. Trigger on 'write a function', 'catalyst function', 'API Gateway', 'Security Rules', 'function not found', 'function returns 401', 'busboy', 'middleware', 'function URL', 'environment variable in function', 'duplicate CORS headers', 'CORS error in browser', 'Access-Control-Allow-Origin multiple values', 'function URL 404', 'execute suffix', 'function timeout', 'function hangs', or any function type question. Do NOT use for persistent servers, long-running processes, or Docker deployments — use catalyst-appsail instead.1070 test-migrationpetrkindlmann/qa-skillsMigrate a test suite from one framework to another, incrementally and without losing coverage. Covers Selenium→Playwright, Cypress→Playwright, Jest→Vitest, Mocha→Vitest, and Protractor→Playwright, with parallel CI running, locator/assertion translation, and a coverage-parity track. Use when: "migrate tests," "switch framework," "Selenium to Playwright," "Jest to Vitest," "framework migration." Not for: bulk selector regeneration after a UI refactor on the SAME framework — use selector-drift-recovery. Not for: healing one flaky test at runtime — use test-reliability. Not for: modernizing patterns without changing framework — use ai-qa-review. Related: playwright-automation, cypress-automation, unit-testing, ci-cd-integration, test-reliability.1069 landing-optimizeraaron-he-zhu/aa…g-skillsUse when the user asks to "optimize our landing page for influencer traffic", "fix our promo-code landing page", or "improve conversion from a creator campaign"; produces a message-match audit, page-structure and social-proof recommendations, a promo-code/CTA conversion plan, and an A/B test roadmap. Not for measuring campaign results after launch — use performance-analyzer. 落地页优化/达人流量转化提升1069 playwright-devopsmicrosoft/playwrightDevOps workflows for Playwright - CI failure analysis, workflow debugging, and release operations.1068 deliverability-qaaaron-he-zhu/aa…g-skillsUse when the user asks to "run a deliverability pre-flight before I send", "check my SPF/DKIM/DMARC/BIMI", "why am I landing in spam / promotions", or "score my sender reputation and list hygiene"; runs the ONE-TIME pre-send SEND S1 authentication pre-flight and builds the SEND S (Sender-integrity / Deliverability) evidence read — DNS + DMARC-RUA auth, domain/IP reputation, inbox placement, content/link/render, and point-in-time bounce/complaint hygiene — using Pass/Partial/Fail/Unknown/N/A states and scoring only at complete applicable coverage. Not for the recurring hygiene trend — use list-hygiene-monitor; not for final EQS or veto verdicts — use email-quality-auditor; not for segments/suppression lists — use list-segment-builder. 邮件送达率预检/SPF DKIM DMARC认证/发件域声誉1068