Testing & Security

Provides step-by-step instructions for accessing the Rackspace Spot Kubernetes cluster to debug ARC runners using spotctl. Covers installation, authentication via GCP Secret Manager, kubeconfig retrieval, and common debugging commands. Activates on "spotctl", "cluster access", "rackspace debug", "kubeconfig", or "spot cluster".

Security auditing patterns for Midnight Network smart contracts and dApps. Use when reviewing code for vulnerabilities, privacy leaks, cryptographic weaknesses, or performing security audits.

Common vulnerability patterns in Solidity and how to prevent them. Use when reviewing contracts for security issues or learning about common exploits.

Integrate Cloudflare services with Dokploy templates: R2 storage, DNS challenge for SSL, Zero Trust Access, Workers, WAF, and Tunnel. Default to CF services for external dependencies.

Review test cases for Token Endpoint. Covers grant_type=authorization_code, client authentication (client_secret_basic, client_secret_post), token request/response validation, and all requirements per OIDC Core 1.0 Section 3.1.3 and OAuth 2.1.

Authentication system design and implementation guidance with Python examples using strict typing. Use when: (1) Designing authentication flows (signup, login, logout, refresh), (2) Selecting between session vs token-based auth, (3) Designing JWT structure and claims, (4) Implementing OAuth 2.0 flows, (5) Setting up multi-service authentication patterns, (6) Creating password reset and email verification flows, (7) Implementing role-based access control (RBAC), (8) Creating security checklists for auth systems, (9) Planning frontend/backend auth integration. All examples follow Python typing standards and security best practices.

Scaffold a new Angular component with test file following project conventions. Use when creating new components, widgets, or UI elements.

Systematically identify unused code by inverting the burden of proof. Assumes ALL added code is dead until proven used. Extracts all code items (procs, types, fields, imports), generates "X is dead" claims, verifies each with caller search, detects write-only dead code (stored but never read), performs iterative re-scanning after removals to find orphaned code, produces report with removal plan. Use when: reviewing code changes, auditing new features, cleaning up PRs, or user says "find dead code", "find unused code", "check for unnecessary additions", "what can I remove".

Automatically analyze test coverage when user asks which code is tested, mentions coverage gaps, or shows code asking about testing. Identifies untested code paths and suggests test additions. Invoke when user asks "what's not tested?", "coverage", "untested code", or "which tests are missing?".

Audit and optimize WordPress SEO (Yoast/Rank Math) - checks focus keywords, meta descriptions, featured images. Uses Unsplash API for missing images. Run on all pages/posts to identify and fix SEO issues.

Comprehensive testing and verification checklist for agent-created pull requests. Use when preparing to submit a PR, verifying changes work correctly, or ensuring all evidence requirements are met. Covers Docker setup, database seeding, performance baselines, and proof-of-functionality requirements.

Connect Supabase databases to Claude Desktop artifacts with authentication and read-only queries using native fetch API.

Use when auditing, scaffolding, or validating MetaSaver React portal app directory structure. Includes file organization patterns, domain grouping, feature composition, routing configuration, and Auth0 integration setup. File types: .tsx, .ts, directory layouts.

Elixir-specific security patterns, OWASP mitigations, and compliance best practices

Guidelines for contributing to brynhild itself - use when making changes to the brynhild codebase, running tests, or understanding project conventions

VS Code workspace settings template and validation logic with file cleanup enforcement. Includes 8 required standards (Prettier as default formatter, format on save enabled, ESLint auto-fix, pnpm package manager, terminal configuration, TypeScript workspace SDK, search exclusions, only settings.json required). Critical Rule 8 enforces deletion of unnecessary files (extensions.json, launch.json, tasks.json). Use when creating or auditing .vscode/settings.json files and detecting unnecessary workspace files.

Third-party integration connectors for MyDetailArea. Implements secure API integrations with accounting software (QuickBooks, Xero), CRM systems, inventory management, payment processors, and webhooks. Includes OAuth flows, API authentication, rate limiting, error handling, and data synchronization patterns. Use when connecting external systems or building API integrations.

A specialist skill for security reviews, threat modeling, and remediation guidance. Use for auth/permissions changes, secrets or PII handling, public endpoints, or dependency upgrades.

Enforces test-driven development (TDD) following Kent Beck's methodology. MANDATORY micro-cycle approach - write ONE test, watch it fail, write minimal implementation, refactor, then NEXT test. NEVER write all tests first or implementation first. Use for ANY code writing task.

This skill should be used when the user asks to "add a component", "use shadcn", "install Button", "create Dialog", "add Form", "use DataTable", "implement dark mode toggle", "use cn utility", or discusses UI components, component libraries, or accessible components. Always use the latest shadcn/ui version and modern patterns.