测试与安全 Skills - 测试与安全 Agent Skills推荐与安装 - 第76页 - AI导哈

accessibility-auditwebflow/webflow-skillsRun comprehensive accessibility audit (WCAG 2.1) on Webflow pages - checks buttons, forms, links, focus states, headings, keyboard navigation, and generates detailed reports with fixes. Requires Webflow Designer connection. Excludes image alt text (covered by asset-audit skill).486 skills-security-auditagentnode-dev/s…ty-auditAudit AI agent skills for security risks before installation or periodically. Works on Claude Code, OpenClaw, and all platforms. Detect prompt injection, data exfiltration, malicious commands, obfuscated code, privilege abuse, supply chain risks, memory poisoning, trust exploitation, and behavioral manipulation. Use before installing third-party skills from any marketplace.485 proof-checkerwanshuiyin/auto…in-sleepRigorous mathematical proof verification and fixing workflow. Reads a LaTeX proof, identifies gaps via cross-model review (external reviewer backend, ultra reasoning), fixes each gap with full derivations, re-reviews, and generates an audit report. Use when user says "检查证明", "verify proof", "proof check", "审证明", "check this proof", or wants rigorous mathematical verification of a theory paper.485 tldr-deepparcadei/contin…laude-v3Full 5-layer analysis of a specific function. Use when debugging or deeply understanding code.484 browserbrowser-use/bro…-harnessDirect browser control via CDP. Use when the user wants to automate, scrape, test, or interact with web pages. Connects to the user's already-running Chrome.484 accessibility-complianceaj-geddes/usefu…-promptsImplement WCAG 2.1/2.2 accessibility standards, screen reader compatibility, keyboard navigation, and a11y testing. Use when building inclusive web applications, ensuring regulatory compliance, or improving user experience for people with disabilities.484 110-java-maven-best-practicesjabrena/plinthUse when you need to review, improve, or troubleshoot a Maven pom.xml file — including dependency management with BOMs, plugin configuration, version centralization, multi-module project structure, build profiles, or any situation where you want to align your Maven setup with industry best practices. This should trigger for requests such as Review pom.xml to improve it; Apply Maven best practices to pom.xml; Improve Maven POM configuration; Review Maven dependency management and plugin configuration; Modernize Maven build conventions for a Java project. Part of Plinth Toolkit484 releaseparcadei/contin…laude-v3Release preparation workflow - security audit → E2E tests → review → changelog → docs483 rust-async-internalsmohitmishra786/…v-skillsRust async internals skill for understanding and debugging async Rust. Use when understanding the Future trait and poll model, Pin and Unpin, tokio task scheduling, debugging async stack traces with tokio-console, tracking waker leaks, using select! and join!, or avoiding blocking in async contexts. Activates on queries about Rust async internals, Future poll, Pin, Unpin, tokio-console, waker, async stack traces, select!, join!, or blocking in async.483 plan-design-reviewgarrytan/gstackDesigner's eye plan review — interactive, like CEO and Eng review. (gstack)483 bug-bountyawarexone/agent…g-hunterComplete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit), pre-hunt learning (disclosed reports, tech stack research, mind maps, threat modeling), vulnerability hunting (IDOR, SSRF, XSS, auth bypass, CSRF, race conditions, SQLi, XXE, file upload, business logic, GraphQL, HTTP smuggling, cache poisoning, OAuth, timing side-channels, OIDC, SSTI, subdomain takeover, cloud misconfig, ATO chains, agentic AI), LLM/AI security testing (chatbot IDOR, prompt injection, indirect injection, ASCII smuggling, exfil channels, RCE via code tools, system prompt extraction, ASI01-ASI10), A-to-B bug chaining (IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth), bypass tables (SSRF IP bypass, open redirect bypass, file upload bypass), language-specific grep (JS prototype pollution, Python pickle, PHP type juggling, Go template.HTML, Ruby YAML.load, Rust unwrap), and reporting (7-Question Gate, 4 validation gates, human-tone writing, templates by vuln class, CVSS 3.1, PoC generation, always-rejected list, conditional chain table, submission checklist). Use for ANY bug bounty task — starting a new target, doing recon, hunting specific vulns, auditing source code, testing AI features, validating findings, or writing reports. 中文触发词：漏洞赏金、安全测试、渗透测试、漏洞挖掘、信息收集、子域名枚举、XSS测试、SQL注入、SSRF、安全审计、漏洞报告483 supabase-audit-auth-signupyoanbernabeu/su…t-skillsTest if user signup is open and identify potential abuse vectors in the registration process.482 suggesting-cursor-hooksspencerpauly/aw…r-skillsWhen the user keeps asking for the same check to run (lint, tests, type-check), suggest a Cursor hook to automate it.482 paper-claim-auditwanshuiyin/auto…in-sleepZero-context verification that every number, comparison, and scope claim in the paper matches raw result files. Uses a fresh cross-model reviewer with NO prior context to prevent confirmation bias. Use when user says "审查论文数据", "check paper claims", "verify numbers", "论文数字核对", or before submission to ensure paper-to-evidence fidelity.482 systematic-debuggingnousresearch/he…es-agent4-phase root cause debugging: understand bugs before fixing.482 requesting-code-reviewnousresearch/he…es-agentPre-commit review: security scan, quality gates, auto-fix.482 testing-cors-misconfigurationmukul975/anthro…y-skillsIdentifying and exploiting Cross-Origin Resource Sharing misconfigurations that allow unauthorized cross-domain data access and credential theft during security assessments.482 ethical-hacking-methodologysickn33/agentic…e-skillsMaster the complete penetration testing lifecycle from reconnaissance through reporting. This skill covers the five stages of ethical hacking methodology, essential tools, attack techniques, and professional reporting for authorized security assessments.480 active-directory-attackssickn33/agentic…e-skillsAssess Active Directory attack paths using scoped configuration review and controlled synthetic lab validation; identify prerequisites, evidence and mitigations.425 pentest-commandssickn33/agentic…e-skillsProvide a comprehensive command reference for penetration testing tools including network scanning, exploitation, password cracking, and web application testing. Enable quick command lookup during security assessments.422 review-changestirth8205/code-…ew-graphPerform a structured code review using change detection and impact283 debug-issuetirth8205/code-…ew-graphSystematically debug issues using graph-powered code navigation277 orca-clicub-hq/orcaUse the public `orca` CLI to operate Orca-managed worktrees, folder contexts, terminals, repos, automations, worktree comments, and the browser embedded inside the Orca app. Use when the user says "$orca-cli", "use orca cli", "Orca worktree", "child worktree", "cardStatus", "spawn codex/claude in a worktree", "read/wait/send Orca terminal", "terminal send", "full handoff", "handover", "give this to another agent", "another worktree", "Orca browser", or "control the browser inside Orca". Prefer this over raw `git worktree`, ad hoc PTYs, Playwright, or Computer Use when the task touches Orca-managed state. Use Computer Use for browser windows, webviews, or desktop UI outside Orca's embedded browser.191 use-my-browserxixu-me/skillsUse when work depends on the user's live browser session or visible rendered state rather than static fetches, especially for browser debugging contexts or DevTools-selected elements or requests, logged-in dashboards or CMS flows, localhost apps, forms, uploads, downloads, media inspection, DOM or iframe inspection, Shadow DOM, or browser failures that look like soft 404s, auth walls, anti-bot checks, or rate limits.13 soultracesoultrace-ai/so…ce-skillTake a personality assessment via the SoulTrace API. Use when the user wants to take a personality test, discover their psychological archetype, understand their personality traits, or get a color-based personality profile. The API uses a 5-color psychological model (White=structure, Blue=understanding, Black=agency, Red=intensity, Green=connection) with Bayesian adaptive question selection to classify users into one of 25 archetypes. Triggers on: personality test, personality assessment, what's my personality, take a quiz, archetype test, color personality, soultrace.12 viral-instagram-reelsvyralcontent/co…t-skillsPlan, write, and diagnose Instagram Reels that earn cold-audience reach. Use whenever someone wants a reels script or reels hook for a specific Reel, is debugging why a Reel flopped, wants to know if a draft is worth testing with Trial Reels before going public, or needs a reels caption tuned for the post-hashtag instagram algorithm. Built around what Mosseri has publicly named as the signal hierarchy (watch time, sends per reach, likes per reach), the Trial Reels test-then-publish loop, the Original Content Guidelines and 30-day recovery window, the Edits app, and Reels Insights metrics (skip rate, share rate, followers from this post). Covers a Reels-specific reels strategy: send-driving CTAs, originality without watermarks, audio licensing by account type, captions as the primary SEO signal, and the anti-patterns that quietly cap distribution. Pattern-based guidance, not a virality promise.11 claude-code-guidedavila7/claude-…emplatesMaster guide for using Claude Code effectively. Includes configuration templates, prompting strategies "Thinking" keywords, debugging techniques, and best practices for interacting with the agent.1 Browser Automationclaude-office-s…s/skillsAutomate web browser interactions, scraping, testing, and workflow automation with Puppeteer/Playwright0 Pair Programmingruvnet/rufloAI-assisted pair programming with multiple modes (driver$navigator$switch), real-time verification, quality monitoring, and comprehensive testing. Supports TDD, debugging, refactoring, and learning sessions. Features automatic role switching, continuous code review, security scanning, and performance optimization with truth-score verification.0 V3 Core Implementationruvnet/rufloCore module implementation for claude-flow v3. Implements DDD domains, clean architecture patterns, dependency injection, and modular TypeScript codebase with comprehensive testing.0