测试与安全 Skills - 测试与安全 Agent Skills推荐与安装 - 第52页 - AI导哈

butgitbutlerapp/gitbutlerCommit, push, branch, and manage version control with GitButler. Use for commits, selective dirty-file or hunk commits, branches, diffs, PRs, history edits, squashes, amends, undo, merge, fetching, pulling and syncing a branch with its remote, apply, unapply, and linked worktrees. For selected dirty files or hunks, inspect with `but diff`; use compact `but status` for commit order, branch/stack placement, or conflict overview; use `but status -fv` when file IDs or per-commit file details matter. Replaces git write commands, including fetch and pull. Applies in every checkout of the repository, even when a plain branch is checked out, including linked worktrees such as `.claude/worktrees/*`, and to git writes made while testing or cleaning up (stash, checkout -- <file>, restore, reset).929 file-test-bugmicrosoft/azure-skillsfile-test-bug — an installable skill for AI agents.928 revenuecat-testing-setuprevenuecat/ai-toolkitSet up a testing environment for RevenueCat purchases without charging real money. Use when the user says test RevenueCat purchases, sandbox setup, StoreKit configuration file, license tester, how do I test purchases without real money, set up sandbox account, internal testing track, or test paywall on iOS, Android, Kotlin Multiplatform, Flutter, or React Native.924 testing-best-practicesasyrafhussin/ag…t-skillsUnit testing, integration testing, and test-driven development principles. Use when writing tests, reviewing test code, improving test coverage, or setting up testing strategy. Triggers on "write tests", "review tests", "testing best practices", or "TDD".923 npm-security-best-practicesreason-machines/security-skillsExpert guidance on securing npm packages, preventing supply chain attacks, and hardening package manager configurations923 python-code-reviewexistential-birds/beagleReviews Python code for type safety, async patterns, error handling, and common mistakes. Use when reviewing .py files, checking type hints, async/await usage, or exception handling.920 performance-engineersickn33/agentic…e-skillsDiagnose performance bottlenecks using profiling, traces, load tests, and observability; verify latency and capacity improvements.920 qt-qml-reviewtheqtcompanyrnd/agent-skillsInvoke when the user asks to review, check, audit, or look over Qt6 QML code -- or suggest before committing. Runs deterministic linting (48+ rules) then deep-analysis agents (scaled to the size of the change) covering bindings, layout, loaders, delegates, states, and performance. Optionally invokes system qmllint for type-level checks. Reports only high-confidence issues (>80/100) with structured mitigations. Read-only -- never modifies code.920 repomix-safe-mixerdaymade/claude-…e-skillsSafely package codebases with repomix by automatically detecting and removing hardcoded credentials before packing. Use when packaging code for distribution, creating reference packages, or when the user mentions security concerns about sharing code with repomix.919 twilio-sms-send-messagetwilio/aiSMS and MMS deep-dive reference. Covers SMS-specific error codes, message filtering troubleshooting ("Messages Being Filtered or Blocked?" diagnostic checklist), MMS media support (US/CA/AU only), and SMS pumping indicators. For sending SMS, use twilio-send-message instead. Use this skill only when debugging SMS delivery issues or needing SMS-specific details not in the consolidated send skill.918 caselyjohnwayneeee/ca…qa-skillVirtual QA Lead that turns requirements into review-ready, TestRail-importable test cases in one conversation. Use it whenever the user has requirements, a spec, a user story, or acceptance criteria (PDF, DOCX, XLSX, TXT, MD, or pasted text) and wants test cases, a test plan, a checklist, test coverage, a regression suite, or a TestRail/Qase/Zephyr export, even without saying "test cases" ("write tests for this spec", "what should we check here?"). Especially useful when they attach their team's existing test cases to match. When the spec describes an API (endpoints, status codes, schemas, auth, OpenAPI/Swagger), Casely also builds a runnable Postman collection, so use it for "API tests", "Postman collection", or "tests I can run in Newman/CI". Triggers on the same request in any language.917 iso-13485-certificationk-dense-ai/scie…t-skillsPrepare and structurally review ISO 13485 QMS scope, controlled documentation, and local evidence manifests. Use for ISO 13485 certification-readiness documentation or for separating related FDA QMSR, MDSAP, and EU MDR/IVDR evidence boundaries; not for legal applicability, compliance, or certification decisions.915 malware-detection-security-awarenessreason-machines/security-skillsRecognize and educate about malware distribution disguised as legitimate security software913 tech-stack-evaluatoralirezarezvani/…e-skillsTechnology stack evaluation and comparison with TCO analysis, security assessment, and ecosystem health scoring. Use when comparing frameworks, evaluating technology stacks, calculating total cost of ownership, assessing migration paths, or analyzing ecosystem viability.912 senior-secopsalirezarezvani/…e-skillsSenior SecOps engineer skill for application security, vulnerability management, compliance verification, and secure development practices. Runs SAST/DAST scans, generates CVE remediation plans, checks dependency vulnerabilities, creates security policies, enforces secure coding patterns, and automates compliance checks against SOC2, PCI-DSS, HIPAA, and GDPR. Use when conducting a security review or audit, responding to a CVE or security incident, hardening infrastructure, implementing authentication or secrets management, running penetration test prep, checking OWASP Top 10 exposure, or enforcing security controls in CI/CD pipelines.912 visual-verdictyeachan-heo/oh-…audecodeStructured visual QA verdict for screenshot-to-reference comparisons911 capacitor-apple-review-preflightcap-go/capgo-skillsAudits a Capacitor iOS app against Apple App Review Guidelines before submission or after a rejection. Use when the user pastes a rejection (Guideline 4.2 Minimum Functionality, 4.8 Login Services / Sign in with Apple, 5.1.1 data collection or account deletion, 5.1.2(i) sharing data with third-party AI, 3.1.1 in-app purchase, 2.1 app completeness, 2.3 metadata, 4.3 spam), an upload warning (ITMS-91053 missing API declaration, ITMS-91061 missing privacy manifest, ITMS-90683 missing purpose string), or wants a preflight of metadata, PrivacyInfo.xcprivacy, Info.plist usage strings, entitlements, subscriptions, reviewer notes, live-update disclosure, and Xcode 27 / UIScene readiness. Do not use for Google Play review, upload mechanics, screenshots and listing setup (capacitor-app-store), building a web wrapper from scratch (webapp-to-capacitor), or non-Capacitor runtimes.906 java-testingpluginagentmarketplace/custom-plugin-javaTest Java applications - JUnit 5, Mockito, integration testing, TDD patterns904 investigating-agentforce-architectureforcedotcom/sf-skillsDeclared architecture snapshot for one Agentforce agent: planner, topics, actions, flows, Apex, prompt templates, and NGA plugins. Renders a human-readable architecture document and Mermaid invocation graph from design-time metadata (not runtime audit rows). TRIGGER when user asks to describe, diagram, inventory, audit, document, or diff (e.g. v3 vs v5) the architecture / action tree / topic structure / tool inventory of a specific agent by agent API name in a specific org. DO NOT TRIGGER for runtime session traces, conversation transcripts, generation timings, or gateway audit chains — this skill reads design-time metadata only (use investigating-agentforce-d360 for session traces).903 ultraqayeachan-heo/oh-…audecodeQA cycling workflow - test, verify, fix, repeat until goal met902 test-specialistailabs-393/ai-l…e-skillsThis skill should be used when writing test cases, fixing bugs, analyzing code for potential issues, or improving test coverage for JavaScript/TypeScript applications. Use this for unit tests, integration tests, end-to-end tests, debugging runtime errors, logic bugs, performance issues, security vulnerabilities, and systematic code analysis.902 draftanthropics/clau…or-legalFirst draft of a common clinic document — practice-area templates (asylum applications, eviction answers, protective order petitions, demand letters), jurisdiction-aware formatting, explicitly a starting point requiring student analysis and attorney review. Use when a student needs a first draft of a motion, letter, petition, declaration, or other clinic document.901 nerd-reviewdanangjoyoo/nerdReview existing code, documents, products, tests, and hotfixes with relevant companion skills and evidence-backed, severity-ranked findings, without editing reviewed content.898 gjalla-spec-reviewgjalla/engineeringFull review of a plan or spec to be sure there are no surprises, gaps, or mistakes. Use to harden a spec before implementation.897 fork-disciplinejezweb/claude-skillsAudit and enforce the core/client boundary in multi-client projects. Detects where shared platform code is tangled with client-specific code, finds hardcoded client checks, config files that replace instead of merge, scattered client code, migration conflicts, and missing extension points. Produces a boundary map, violation report, and refactoring plan. Optionally generates FORK.md documentation and restructuring scripts. Triggers: 'fork discipline', 'check the boundary', 'is this core or client', 'platform audit', 'client separation', 'fork test', 'refactor for multi-client', 'clean up the fork'.896 openapi-specification-v3.2hairyf/skillsOpenAPI Specification 3.2 — write and interpret OpenAPI descriptions (OAD), paths, operations, parameters, request/response, schema (JSON Schema 2020-12), security, and extensions. Use when authoring or validating OpenAPI 3.2 documents.896 api-security-testingsickn33/agentic…e-skillsAPI security testing workflow for REST and GraphQL APIs covering authentication, authorization, rate limiting, input validation, and security best practices.892 ponytailcheaper-inference/omnirouteExternal agent skill (MIT, github.com/DietrichGebert/ponytail). Forces the laziest solution that actually works: question whether the task needs to exist at all (YAGNI), reuse what is already in the codebase, reach for the standard library before custom code, native platform features before dependencies, one line before fifty. Climb the ladder on every coding task — writing, adding, refactoring, fixing, reviewing, or designing code, and choosing libraries or dependencies. Supports intensity levels: lite, full (default), ultra. Never cut validation, error handling, security, or accessibility.892 rwxrwx-cloud/skillsUsed to create, modify, or understand an RWX CI/CD config or any other file in a `.rwx` directory. TRIGGER when: the user asks about RWX; wants to create or modify an RWX config; says things like "CI failed", "CI is red", or "tests are failing in CI"; asks "what's failing on my PR / branch / commit?"; wants to run tests or build steps in a sandbox; wants to debug test failures, check a run status, fetch logs/artifacts, or start a run loop.890 owasp-top-10microsoft/hve-coreOWASP Top 10 for Web Applications (2025) knowledge base for identifying, assessing, and remediating web application security risks.889