测试与安全 Skills - 测试与安全 Agent Skills推荐与安装 - 第56页 - AI导哈

skill-security-auditoralirezarezvani/…e-skillsSecurity audit and vulnerability scanner for AI agent skills before installation. Use when: (1) evaluating a skill from an untrusted source, (2) auditing a skill directory or git repo URL for malicious code, (3) pre-install security gate for Claude Code plugins, OpenClaw skills, or Codex skills, (4) scanning Python scripts for dangerous patterns like os.system, eval, subprocess, network exfiltration, (5) detecting prompt injection in SKILL.md files, (6) checking dependency supply chain risks, (7) verifying file system access stays within skill boundaries. Triggers: "audit this skill", "is this skill safe", "scan skill for security", "check skill before install", "skill security check", "skill vulnerability scan".793 reviewjuliusbrussee/cavekitAdversarial senior review of the spec before any code is written. Constructs a skeptical reviewer whose authority comes from the codebase, §R research, and live best-practice — then tries to REFUTE the spec, not rubber-stamp it. Every finding cites evidence (file:line or source); unverifiable ones are flagged. Survivors harden §V; the run ends in an explicit go / no-go gate. Triggers before building anything high-blast-radius, when the user says "review the spec", "red-team this", "is this plan sound", "senior review", or invokes /ck:review.793 project-skill-auditdimillian/skillsAnalyze a project's past Codex sessions, memory files, and existing local skills to recommend the highest-value skills to create or update. Use when a user asks what skills a project needs, wants skill ideas grounded in real project history, wants an audit of current project-local skills, or wants recommendations for updating stale or incomplete skills instead of creating duplicates.792 test-crewai-projectcrewaiinc/skillsDeterministic, offline testing of CrewAI crews and flows with pytest: a stub BaseLLM (shipped in references/stub_llm.py) that drives text, structured output and tool calls with no API key, asserting on the prompts crewai built, testing guardrails and flow routing, what `crewai test` really does, event listeners for debugging, and the exact tracing/telemetry env var values. Use when writing tests for a crewai project, mocking or stubbing the LLM, writing a custom BaseLLM, seeing `TypeError: ... call() got an unexpected keyword argument 'from_task'`, `ValueError: OPENAI_API_KEY is required` in CI, `TraceGrantError` in pytest, running `crewai test`, adding a BaseEventListener, or setting CREWAI_TRACING_ENABLED / CREWAI_DISABLE_TELEMETRY / OTEL_SDK_DISABLED.791 quality-manager-qms-iso13485alirezarezvani/…e-skillsISO 13485 Quality Management System implementation and maintenance for medical device organizations. Provides QMS design, documentation control, internal auditing, CAPA management, and certification support. Use when working with medical device quality systems, preparing for ISO 13485 audits, managing regulatory compliance documentation, setting up corrective actions, or building audit preparation programs. Useful for quality management, audit preparation, regulatory compliance, medical device documentation, and corrective action workflows.790 django-safe-migrationvintasoftware/d…-pluginsWrite, review, and rewrite Django migrations for PostgreSQL with zero-downtime guarantees. Use this skill whenever the user mentions migrations, Django schema changes, or deployment safety — even if they don't say "zero downtime" explicitly. Trigger on: "review this migration", "is this migration safe?", "write a migration for...", "rewrite this migration", "how do I add a NOT NULL column / drop a column / add an index / rename a column / add a FK without downtime", "will this migration cause locks?", "this migration is blocking production". Covers: SeparateDatabaseAndState two-file splits, AddIndexConcurrently, FK NOT VALID + VALIDATE, db_default for NOT NULL columns, lock_timeout, and RunPython safety rules.786 agentflowagfnow/agentflowKeep development work resumable with a devlog, proportionate plans, optional advisors and checked results. Trigger by browfield, godev, gdd, devlog, fast-lane, grill-me, skip-review, advisors, 3ways, append-rounds, append-tasks, prepare-tasks, run-tasks, handle-tasks, new-feature, merge-feature or drop-feature. aliases: ag, agf.785 neo4j-driver-go-skillneo4j-contrib/n…j-skillsCovers the Neo4j Go Driver v6 — driver lifecycle, ExecuteQuery, managed and explicit transactions, session config, error handling, data type mapping, and connection tuning. Use when writing Go code that connects to Neo4j, setting up NewDriver or ExecuteQuery, debugging sessions/transactions/result handling, or working with neo4j-go-driver v5→v6 migration. Triggers on NewDriver, ExecuteQuery, SessionConfig, ManagedTransaction, neo4j-go-driver. Does NOT handle Cypher query authoring — use neo4j-cypher-skill. Does NOT cover driver version migration steps — use neo4j-migration-skill.784 zen-ai-pentest-frameworkreason-machines/security-skillsAI-powered autonomous penetration testing framework with multi-agent system, real security tool execution, and compliance reporting783 code-qualitymiles990/claude…e-skillsClean code principles, SOLID, and code review practices782 cookbook-auditanthropics/clau…ookbooksAudit an Anthropic Cookbook notebook based on a rubric. Use whenever a notebook review or audit is requested.782 test-value-evidencedotnet/skillsAssess tests for an identified code or test change, feature, PR or commit. USE FOR: review changed behavior or regression tests, prove pre-fix/missing behavior is detected, revision-bound red-green evidence. Polyglot. DO NOT USE without an identified change: hypothetical mutations or general suite blind spots (test-gap-analysis). Also exclude per-test readiness/A-F grades (grade-tests), coverage (coverage-analysis), new suites (code-testing), or mutation engines.782 skill-file-securityreason-machines/security-skillsBattle-tested security checks for AI coding assistants — 29 categories covering OWASP Top 10, CWE Top 25, and ASVS Level 3782 security-auditorovachiever/droid-tingsContinuous security vulnerability scanning for OWASP Top 10, common vulnerabilities, and insecure patterns. Use when reviewing code, before deployments, or on file changes. Scans for SQL injection, XSS, secrets exposure, auth issues. Triggers on file changes, security mentions, deployment prep.780 copilotkit-clicopilotkit/copilotkitUse for the CopilotKit CLI — `npx copilotkit@latest`. Covers proving a project's wiring with `verify` before debugging anything by hand, scaffolding with `create`, signing in and selecting a hosted Intelligence project, agent-assisted onboarding of an existing app, generating type-safe agent ids, and importing thread history. Reach for `verify` first whenever a CopilotKit app is not working.778 bitdefender-malware-investigationreason-machines/security-skillsInvestigate and analyze the MistDuckCount/Bitdefender-Total-Security-Crack-2026 repository for security threats and malware distribution patterns778 playwright-bot-bypassgreekr4/playwri…t-bypassThis skill should be used when the user asks to "bypass bot detection", "avoid CAPTCHA", "stealth browser automation", "undetected playwright", "bypass Google bot check", "rebrowser-playwright", or needs to automate websites that detect and block bots.777 tribunala-tokyo/agent-skillsRuns a doer -> verifier-panel -> consensus loop to verify a deliverable before it ships. An orchestrator freezes acceptance criteria before implementation, dispatches a doer, then convenes a context-walled panel of independent verifiers - including an adversary with an explicit must-oppose mandate - for evidence-anchored review adjudicated to a SHIP / SHIP_WITH_CAVEATS / ITERATE / BLOCK / ESCALATE verdict logged to a ledger. Use for multi-agent verification of any artifact - code slices, plans, documents, audits - whenever asked to verify a deliverable, vet a plan, run a consensus review or independent review, set up a doer-verifier loop, or gate a ship decision. Works on any platform with parallel subagents; degrades to sequential fresh-context sessions without them; on detached, sandboxed or asynchronous runtimes the artifact is handed over by fetchable address and the budgets travel in the handoff. Not for trivial single-file edits or ordinary code review.772 replica-testjakeschincariol/replica-skillClicks through every flow of an app clone and tests it for bugs: a test plan generated from the recon flows with happy paths and edge cases, Playwright end-to-end tests where possible, a browser click-through where not, and bug reports in a fixed format with severity, steps and evidence. Use when the user says "test my clone", "find bugs", "QA this", "click through everything", "write e2e tests", "does it work", or after /replica-build or /replica-backend.772 deno-typescriptmindrally/skillsGuidelines for developing with Deno and TypeScript using modern runtime features, security model, and native tooling770 minecraft-moddingjahrome907/mine…t-skillsCreate, modify, debug, or migrate Minecraft mods for current NeoForge or Fabric 26.x, legacy 1.21.x, and Forge 1.20.1. Use for loader-based gameplay code and assets; use minecraft-multiloader when one codebase must target both modern loaders.770 pr-reviewcarsxe/skillsPerforms a high-signal senior-engineer PR review of code changes, classifies how critical the changed surfaces are, and decides whether the PR can be self-merged or must go to a human reviewer. Use this skill for pull request reviews, branch diffs, pasted diffs, uncommitted changes, GitHub PR URLs, or requests like "review my changes", "check this PR", "is this ready", "can I merge this", "does this need a reviewer", "how risky is this change", "what could this break", "audit this diff", "sanity check before I push", or "does this look clean". Covers correctness, security, contracts, blast radius, prior failed fixes in the same code path, tests, maintainability, and regressions while aggressively avoiding noisy false positives. When the PR title contains `[CU-<ticket number>]`, reads the ClickUp ticket and verifies the diff builds the feature the ticket describes. Designed to work reliably even with smaller/cheaper models.769 appbuilder-e2e-testingadobe/skillsUse this skill whenever the user wants browser-based end-to-end tests for an Adobe App Builder application. Covers Playwright E2E testing for ExC Shell SPAs, AEM extension UIs, and full-stack flows. Use when the user mentions: "E2E test", "end-to-end test", "Playwright", "browser test", "test my SPA in the browser", "test my AEM extension", "test the full flow", "integration test with UI", "headless browser test", "E2E in CI". This skill is for BROWSER-based testing only. For Jest unit tests of actions or React components, use appbuilder-testing instead.767 write-manualrohitg00/ai-eng…-scratchWrites a long technical manual that explains one subject at one pinned version, from its purpose to each request and response. Every listing comes from an offline capture, every claim traces to a ranked source, and an audit must report TOTAL 0. Use it for "write a manual", "write a 101 manual for <subject>", "manual.json", "add a manual section", "build a capture kit", "audit the manual", or "pin a spec version and document it".767 review-swarmdimillian/skillsParallel read-only multi-agent review of a current git diff or explicit file scope to find behavioral regressions, security or privacy risks, performance or reliability issues, and contract or test coverage gaps. Use when the user asks for a review swarm, parallel review, diff review, regression review, security review, or wants high-signal issues plus a prioritized fix path without editing files.766 remote-run-curlbuildbuddy-io/buildbuddyRun bazel commands in a remote runner. Use when the user asks to run `bazel build`, `bazel test` or `bazel run`.763 iphone-duo-readinessmirzaaghazadeh/…o-skillsAudit and port an iOS app to iPhone Duo, Apple's first foldable iPhone. Use when asked to support, adapt, prepare, test, or review an app for iPhone Duo, foldable iPhone, the inner/outer display, device poses, or the fold. Entry point that routes to the layout, bars, hinge/scenes, camera, and design skills.763 argos-pr-reviewargos-ci/argos-…vascriptReview Argos visual regression builds as one input to a pull request review. Use when a PR has an Argos build link, an Argos status check, or a bot comment pointing to an Argos build, and you need to decide whether the visual diffs match the developer's intent before approving.761 argos-cliargos-ci/argos-…vascriptOperate Argos visual testing from the terminal with the `argos` CLI — inspect builds and snapshot diffs, submit reviews, request reviewers, post comments, inspect a test's flakiness and its recurring changes, ignore flaky test changes, configure a project and its contributors, manage a team's members, invites and email domains, manage automation rules, fetch analytics, upload screenshots, and manage CI builds. Use whenever running `argos` commands or working with Argos builds, snapshots, flakiness, projects, teams, or visual-regression reviews from a shell, script, or CI pipeline. Load before running `argos` — it covers the token model and JSON output contract that prevent silent failures.761 replica-diffjakeschincariol/replica-skillCompares an app clone against the original: a feature parity score from the feature matrix (weighted by must, should, could) with the missing list in build order, plus a screenshot layout diff that ignores colour so a rebrand does not count against you. Two standard-library Python tools. Use when the user says "how close is my clone", "compare it to the original", "what's missing", "parity check", "diff the screens", "is it ready", or after /replica-test.761