测试与安全 Skills - 测试与安全 Agent Skills推荐与安装 - 第48页 - AI导哈

biome-jspaulrberg/agent-skillsThis skill should be used when the user asks to "configure Biome", "extend biome config", "set up BiomeJS", "add biome overrides", "biome lint-staged", "fix biome errors", or mentions biome.jsonc, Biome linting, or Biome formatting configuration.1067 grimoirefranalgaba/grimoireInstall and operate Grimoire, author .spell files with full syntax coverage (including advisory decision logic), and run compile/validate/simulate/cast safely. Use when users ask to create, edit, debug, validate, simulate, execute, or explain Grimoire strategies.1065 karpathy-coderalirezarezvani/…e-skillsUse when writing, reviewing, or committing code to enforce Karpathy's 4 coding principles — surface assumptions before coding, keep it simple, make surgical changes, define verifiable goals. Triggers on "review my diff", "check complexity", "am I overcomplicating this", "karpathy check", "before I commit", or any code quality concern where the LLM might be overcoding.1065 review-resolutionsentimony/skillsYou MUST use this when code-review findings, PR comments, CI review output, or reviewer suggestions need technical validation before any fix or disposition, including feedback from human reviewers, subagents, GitHub, static-analysis tools, or external review systems.1065 security-awareness-malicious-repository-detectionreason-machines/security-skillsDetect and analyze potentially malicious repositories disguising as legitimate software cracks or pirated tools1063 observability-driven-testingpetrkindlmann/qa-skillsUse production telemetry as INPUT to design new tests. Covers OpenTelemetry integration with tests, trace-based assertions, log-informed test creation, production-error analysis for coverage gaps, and telemetry-driven test prioritization. Use when: "trace-based testing," "design tests from logs," "OpenTelemetry assertions," "production errors point to test gaps," "telemetry-driven testing." Not for: safe rollout techniques (flags, canary) during release — use testing-in-production. Not for: scheduled post-deploy probes — use synthetic-monitoring. Not for: triaging CI failures — use ai-bug-triage. Related: testing-in-production, synthetic-monitoring, qa-metrics, ai-bug-triage.1062 python-testingmindrally/skillsExpert in Python testing with pytest and test-driven development1061 conversion-signal-qaaaron-he-zhu/aa…g-skillsUse when the user asks to "QA my conversion tracking before launch", "check my UTMs / pixel / event firing", "set up a tracking pre-flight", or "set the dedup rule so Meta and Google stop double-counting"; builds and fixes the measurement plumbing — conversion-event firing, UTM hygiene, cross-platform dedup rules, attribution-window alignment, and offline/iOS-ATT modeled-gap flags — as a pre-flight checklist plus a UTM/event-spec builder. Not for scoring R1/R2 — that is a scored veto in ad-account-auditor; not for account structure — use campaign-architect. 付费广告转化追踪QA/UTM规范/跨平台去重1061 quality-postmortempetrkindlmann/qa-skillsAnalyze escaped defects and test suite health through blameless postmortems. Covers bug pattern analysis, test suite health reviews, 5 Whys root cause analysis, process improvement cycles, and postmortem/retro meeting templates with action item tracking. Use when: "QA retro," "escaped bugs," "postmortem," "quality incident," "defect analysis," "improvement cycle." Not for: live release go/no-go decisions — use release-readiness. Not for ongoing metric dashboards — use qa-metrics. Not for reviewing existing test code quality — use ai-qa-review. Related: qa-metrics, test-reliability, test-strategy.1060 payment-pci-securityvtex/skillsApply when handling credit card data, implementing secureProxyUrl flows, or working with payment security and proxy code. Covers PCI DSS compliance, Secure Proxy card tokenization, sensitive data handling rules, X-PROVIDER-Forward-To header usage, custom token creation, and the constraint that Secure Proxy applies only to card authorization (not post-auth operations like cancel, capture, or refund). Use for any payment connector that processes credit, debit, or co-branded card payments to prevent data breaches and PCI violations.1060 avast-premium-security-malware-analysisreason-machines/security-skillsAnalyze and understand Avast Premium Security features, protection mechanisms, and security architecture for antivirus research and educational purposes1060 service-virtualizationpetrkindlmann/qa-skillsDecision framework for isolating every external dependency in a test suite: when to use in-process mocks, HTTP stubs (MSW, WireMock), record-replay, fault injection (Toxiproxy), or ephemeral real services (Testcontainers), and how to enforce that no real calls escape in CI. Use when: "mock service," "stub API," "fake service," "WireMock," "MSW," "Toxiproxy," "test isolation," "dependency management," "stub an external API in CI." Not for: consumer-driven contract verification (Pact, broker) — use contract-testing; standing up a full Docker Compose env or seed data — use test-environments; broad resilience/game-day fault campaigns — use chaos-engineering. Related: contract-testing, test-environments, api-testing, test-data-management, chaos-engineering.1059 ai-visibility-auditevery-app/open-seoAudit how a brand shows up in AI answers about its market and deliver a short report on the few changes most likely to get it mentioned or cited, such as a third-party page to get onto, an owned page to improve, or an access problem to fix. Use when the user asks for an AI visibility audit, a GEO or AEO audit, why AI recommends competitors instead of them, or how to show up in ChatGPT, Gemini or Google AI answers.1059 cypress-automationpetrkindlmann/qa-skillsBuild Cypress test suites in TypeScript: E2E tests, component tests, custom commands, cy.intercept network control, cy.session login, Cypress Cloud, and CI integration. Covers retry-ability, the command queue, cross-origin flows with cy.origin, and data-driven testing with fixtures. Use when: "write E2E test in Cypress," "Cypress page object / custom command," "cy.," "cy.intercept," "Cypress component test," "Cypress Cloud," "cypress.config.ts." Not for: Playwright suites — use playwright-automation; flaky-test healing or quarantine — use test-reliability; bulk selector regeneration after a UI refactor — use selector-drift-recovery; Selenium-to-Cypress conversion — use test-migration. Related: playwright-automation, ci-cd-integration, visual-testing, unit-testing, test-reliability.1058 client-reviewanthropics/fina…servicesPrepare for client review meetings with portfolio performance summary, allocation analysis, talking points, and action items. Pulls together account data into a concise meeting-ready format. Use before quarterly reviews, annual checkups, or ad-hoc client meetings. Triggers on "client review", "meeting prep for [client]", "quarterly review", "prep for [client name]", or "client meeting".1058 develop-web-gameopenai/skillsUse when Codex is building or iterating on a web game (HTML/JS) and needs a reliable development + testing loop: implement small changes, run a Playwright-based test script with short input bursts and intentional pauses, inspect screenshots/text, and review console errors with render_game_to_text.1056 campaign-architectaaron-he-zhu/aa…g-skillsUse when the user asks to "plan my paid account structure", "pick Search vs PMax", "lay out ad groups / asset groups", or "audit paid-vs-organic cannibalization"; designs campaign-type selection, ad-group/asset-group layout, targeting + match types, negative/exclusion hygiene, and a paid↔organic overlap audit, and scores the ROAS A (Audience) dimension + structure. Not for computing the final RQS — use ad-account-auditor; not for budget split — use budget-optimizer; not for organic site architecture — use site-structure-optimizer. 付费广告账户结构/广告系列规划/否定关键词1054 testing-patternssickn33/agentic…e-skillsJest testing patterns, factory functions, mocking strategies, and TDD workflow. Use when writing unit tests, creating test factories, or following TDD red-green-refactor cycle.1054 rslib-best-practicesrstackjs/agent-skillsConfigure, review, or troubleshoot Rslib library builds, output formats, declarations, dependency handling, and integrations.1053 contract-helperaaron-he-zhu/aa…g-skillsUse when the user asks to "draft an influencer contract", "review these agreement terms", or "build a partnership template"; produces a full influencer agreement framework (scope, compensation, usage rights, exclusivity, FTC disclosure), a clause-by-clause review with red flags, and a negotiation cheat sheet. Not for outreach negotiation before a deal exists — use outreach-manager. 达人合同/合作协议条款审查1053 effect-tsjoelhooks/effec…s-skillsWrite idiomatic Effect v4 TypeScript following official best practices from effect-solutions and the Effect source. Use when writing, reviewing, or refactoring Effect code: services (ServiceMap.Service), layers and dependency injection, error handling (Schema.TaggedErrorClass), data modeling (Schema.Class, branded types, variants), testing (@effect/vitest), HTTP clients (effect/unstable/http), CLI tools (effect/unstable/cli), config, observability, and project setup. Triggers on: 'Effect', 'effect-ts', '@effect/', 'Schema', 'ServiceMap', 'Layer', 'Effect.gen', 'Effect.fn', 'TaggedError', 'branded types', or any Effect-TS related code.1052 security-auditorzhaono1/agent-playbookSecurity vulnerability expert covering OWASP Top 10 and common security issues. Use when conducting security audits or reviewing code for vulnerabilities.1052 liveavatar-debugheygen-com/live…t-skillsTroubleshoot and debug LiveAvatar integration issues. Use when the user's LiveAvatar integration isn't working, the avatar is silent, audio is garbled, sessions fail to start, events aren't received, or they're getting API errors.1052 add-cucumber-testsdecathlon/tzatzikiGenerates Tzatziki-based Cucumber BDD tests (.feature files) from a functional specification. Use this skill whenever a user wants to write Cucumber tests, add BDD scenarios, create feature files, generate tests, or test application behaviors with Gherkin — especially in Java/Spring projects using Tzatziki step definitions for HTTP, JPA, Kafka, MongoDB, OpenSearch, logging, or MCP. Also use when the user mentions writing integration tests, acceptance tests, or end-to-end tests in a project that already has Tzatziki/Cucumber dependencies, including TestNG-based setups.1051 avast-security-analysisreason-machines/security-skillsAnalyze and understand Avast antivirus security mechanisms, behavior shields, and protection components for security research1051 avast-premium-security-awarenessreason-machines/security-skillsIdentify and analyze potentially malicious software distribution repositories disguised as legitimate security software1051 analytics-tracking-testingpetrkindlmann/qa-skillsValidate that analytics and marketing tracking fire CORRECTLY: GA4/GTM dataLayer events, Meta/TikTok/LinkedIn pixels, and ad-tech tags. Covers building a tracking plan as the contract, intercepting collect-endpoint beacons and dataLayer.push in Playwright, asserting event name + params + values + timing + de-duplication, Consent Mode v2 gating, CI regression gating, and news-media events (article-view, scroll-depth, paywall). Use when: "test analytics tracking," "GA4 event test," "verify the pixel fires," "dataLayer test," "tracking plan," "Meta Pixel dedup," "scroll-depth tracking test," "gate tracking in CI." Not for: whether tracking is ALLOWED to fire under consent law (GDPR/CMP) — that is compliance-testing; this skill checks the data is CORRECT. SEO meta tags / structured data — out of scope. Related: compliance-testing, playwright-automation, api-testing, qa-project-context.1050 ad-test-designeraaron-he-zhu/aa…g-skillsUse when the user asks to "design an A/B test", "set up a creative/landing test", "run an incrementality test", or "is this result statistically and practically material?"; produces a hypothesis, variant matrix, sample-size/duration/power plan, and a documented effect/uncertainty read from own exported results. It applies only a precommitted owner-approved action rule; the statistical helper never chooses a business action. Not for producing variants — use ad-creative-builder; not for reading back one shipped change — use paid-measurement-loop. 广告AB测试设计/实验设计/显著性判定/增效测试1050 selector-drift-recoverypetrkindlmann/qa-skillsBulk-regenerate broken test selectors after a UI refactor or redesign. Detects drift between old and new DOM with an aria-snapshot diff, maps old locators to new equivalents using role-first + region scoping, validates against the new build, and produces a single PR with grouped per-file selector updates and per-change evidence. Assumes Playwright >= 1.50 (trace viewer DOM-snapshot panel, getByRole filtering, ariaSnapshot). Use when: "UI refactor broke tests," "redesign broke tests," "bulk update selectors," "regenerate selectors after refactor," "selector drift," "fix N broken tests after redesign." Not for: healing one flaky test at runtime — use test-reliability. Not for: writing a new test suite from scratch — use playwright-automation. Not for: re-recording tests after a framework switch (Selenium to Playwright) — use test-migration. Related: test-reliability, playwright-automation, test-migration, ci-cd-integration, visual-testing.1049 ce-poveveryinc/compou…g-pluginJudge a supplied subject against the project's evidence and constraints. Use when assessing an external-adoption question, a holistic take on a document, or a supplied approach set. Use for an oracle panel to consult other models and reconcile their opinions. Use ce-explain for understanding and ce-doc-review for findings review.1048