Testing & Security

Implement comprehensive audit logging for all admin actions, capturing user ID, action type, entity changes, IP address, and user agent. Use when tracking system activities or adding audit trails.

Expert guidance for Zig build system engineering. Use when working with build.zig files, including creating new build configurations, adding executables/libraries/tests, managing dependencies and modules, setting up cross-compilation, configuring build options, troubleshooting build issues, or any other Zig build system tasks. Provides patterns, API references, and best practices for the Zig build system's DAG-based architecture.

CRA評価パイプラインのオーケストレーター。対象（Android端末FW、Androidアプリ、PCアプリ、Webアプリ）に応じた適切なスキルを連携させてCRAフル評価を自動実行。Triggers on: CRA full assessment, CRA pipeline, security assessment pipeline, automated CRA evaluation, skill orchestration, full security review, Android device, Android app, PC app, web app, CRAフル評価, CRA分析, セキュリティ評価.

Obsidian LiveSync プロジェクトの Rust 開発を支援します。DDD 4層アーキテクチャ（domain/application/infrastructure/interfaces）に従った新規モジュール追加、axum ハンドラー・ルーティング実装、DomainError と thiserror を使用したエラーハンドリング、tokio-test・mockall・rstest によるテスト作成を行います。新機能追加、コード修正、アーキテクチャ設計、テスト実装を依頼されたときに使用してください。

This skill should be used when the user asks about "phase management", "6-phase protocol", "explore phase", "plan phase", "code phase", "test phase", "fix phase", "document phase", "phase transitions", "phase enforcement", or needs guidance on managing the mandatory orchestration phases.

Use when working on Nuxt 4+ projects - provides server routes, file-based routing, middleware patterns, Nuxt-specific composables, and configuration with latest docs. Covers h3 v1 helpers (validation, WebSocket, SSE) and nitropack v2 patterns.

OAuth 2.1 Token Endpoint implementation guide. Use when implementing token endpoint requirements beyond OpenID Connect, including grant types, token response format, Cache-Control headers, CORS support, and error handling. Covers OAuth 2.1 Section 3.2 and Section 4 requirements.

Build WCAG 2.1 AA compliant web applications for University of Sheffield. Covers semantic HTML, ARIA patterns, form accessibility, keyboard navigation, color contrast, alt text, captions, and automated testing. Use when creating websites, web apps, forms, interactive components, or auditing accessibility for WCAG compliance, screen readers, keyboard access, or inclusive design.

Provides patterns and examples for generating test data using factory libraries. Use this skill when you need to create realistic and maintainable test data for your application. It covers factory patterns (e.g., Factory Boy for Python, Polly.js for JavaScript), handling relationships between models, using traits for data variations, sequence generation for unique values, and cleanup strategies. Trigger this skill for tasks involving test fixtures, data seeding for tests, or factory implementation.

Enterprise-grade Python expertise with production patterns for Python 3.13.9, FastAPI 0.115.x, Django 5.2 LTS, Pydantic v2, SQLAlchemy 2.0; activates for API development, ORM usage, async patterns, testing frameworks, and production deployment strategies.

Rails project implementation, testing, and documentation support. Use this skill when working on Rails projects for implementing new features, adding tests to existing code, updating documentation, creating CRUD operations, building API endpoints, adding authentication, or any Rails development task. Triggers on Rails-specific implementation requests.

This skill should be used when creating a new .md file, completing an analysis or audit, deciding whether to archive or delete docs, or when uncertain if something should be documented. Covers document types, naming conventions, the "Link Test", and when to extract patterns to skills.

How to make good playwright (e2e) tests for this project.

Secure GitHub Actions trigger patterns for pull requests, forks, and reusable workflows. Preventing privilege escalation and code injection through trigger misconfiguration.

Implements standard Supabase authentication flows including signup, login, password reset, OAuth providers, email verification, and session management with complete security best practices

Server-side rendering patterns for Composable Svelte. Use when implementing SSR, hydration, server rendering, isomorphic code, or working with meta tags and SEO. Covers renderToHTML, hydrateStore, server-side routing, state serialization, and avoiding common SSR pitfalls.

Enforces test-driven development workflow for Claude Code. Implements Red-Green-Refactor cycle with configurable gates. Use when writing code, implementing features, or fixing bugs.

Build, test, or manage the Gradle multi-module monorepo. Use when building, testing, or debugging build issues across backend, frontend, or analytics.

Use when working with Rails projects, ActiveRecord models, controllers, routes, or Rails-specific patterns. Covers naming conventions, models, migrations, service objects, and testing with RSpec.

Essential exploitation payloads: anti-virus test files, file name exploits, malicious files. Curated for testing.