Testing & Security

Comprehensive backend development guide for Node.js/Express/TypeScript microservices. Use when creating routes, controllers, services, repositories, middleware, or working with Express APIs, Prisma database access, Sentry error tracking, Zod validation, unifiedConfig, dependency injection, or async patterns. Covers layered architecture (routes → controllers → services → repositories), BaseController pattern, error handling, performance monitoring, testing strategies, and migration from legacy patterns.

Stripe payment integration for SaaS. Use when implementing Stripe checkout, webhooks, subscriptions, or payment flows. Includes secure patterns for Next.js.

Playwright E2E testing patterns with chrome-devtools MCP integration.Reference for integration tests, A11y validation, and visual regression.

Complete Sveltia CMS skill for lightweight, Git-backed content management.Sveltia is the modern successor to Decap/Netlify CMS with 5x smaller bundle (300 KB),faster GraphQL-based performance, and solves 260+ predecessor issues.Use this skill when setting up Git-based CMS for static sites (Hugo, Jekyll,11ty, Gatsby, Astro, SvelteKit, Next.js), blogs, documentation sites, marketingsites, or migrating from Decap/Netlify CMS. Framework-agnostic with first-classi18n support and mobile-friendly editing interface.Prevents 8+ common errors including OAuth authentication failures, TOML formattingissues, YAML parse errors, CORS/COOP policy problems, content not listing, scriptloading errors, image upload failures, and deployment problems. Includes completeKeywords: Sveltia CMS, Git-backed CMS, Decap CMS alternative, Netlify CMS alternative, headless CMS, static site CMS, Hugo CMS, Jekyll CMS, 11ty CMS, Gatsby CMS, Astro CMS, SvelteKit CMS, Next.js CMS, content management, visual editing, markdown CMS, YAM

Implement tasks from plans with test-first approach, user-story-centric execution, and AC verification. Use proactively when executing implementation plans. Enforces quality gates, MVP-first delivery, and Article VII story-by-story implementation.

Implementation Agent: Full TDD workflow in a single context window. Writes tests, implements code, and iterates until all tests pass.

Scaffolds new frontend pages/features with TDD approach, following established UI patterns from BuildProject/Baker pages. Generates page component, test file, updates routing, and maintains 90%+ test coverage before implementing production code. Use this when creating new pages or features in the Bucket app.

Automates TEST_CATALOG updates after test execution. Records test metrics, pass/fail status, coverage data, and execution time. Maintains single source of truth for all test files and their health status.

Comprehensive security specialist that performs vulnerability assessments, secure code reviews, dependency audits, and provides remediation guidance following OWASP, CWE, and industry security standards

Generate and optimize PRDs, Implementation Plans, and Progress Tracking documents optimized as AI artifacts for development agents. Use when creating new feature plans, breaking down long planning docs (>800 lines), or setting up progress tracking. Supports: 1) Create PRD from feature request, 2) Create Implementation Plan from PRD with phase breakdown and subagent assignments, 3) Optimize existing plans by breaking into phase-specific files, 4) Create progress tracking with task assignments. Example: "Create a PRD for user authentication feature" or "Break down the sidebar-polish implementation plan into phase files" or "Create progress tracking for data-layer-fixes PRD".

Detects hardcoded values, magic numbers, and duplicate constants using Ruff, Semgrep, and jscpd. Use when auditing for hardcodes, magic numbers, PLR2004, constant detection, or before release.

Debug SystemVerilog testbench failures in the SVC project. Use when a testbench fails (make <module>_tb), to analyze CHECK_* assertion failures, watchdog timeouts, or unexpected signal values. Provides systematic debugging workflow using VCD waveforms and failure output analysis.

This skill should be used when the user asks to "add unit tests", "write tests", "set up Vitest", "create a utility function", "add test coverage", or mentions TDD, test-driven development, or testing utilities. Provides guidance for unit testing with Vitest in TypeScript/Next.js projects using TDD approach.

Security-focused code review guidelines for identifying vulnerabilities

Perform comprehensive code audits on repositories or directories. Use when asked to audit code, review a codebase, analyze code quality, find bugs, check for security issues, review architecture, check SOLID/DRY compliance, or generate a code audit report. Produces well-formatted markdown reports with prioritized recommendations.

Validate requirements quality - unique keys, acceptance criteria, testability, clarity. Sensor detecting requirement quality issues. Use before moving to Design stage or as quality gate.

Use this skill when integrating Cloudflare Zero Trust Access authentication with Cloudflare Workers applications. Provides Hono middleware setup, manual JWT validation patterns, service token authentication, CORS handling with Access, and multi-tenant configurations. Prevents 8 common errors including CORS preflight blocking (45 min saved), key cache race conditions (20 min), missing JWT headers (30 min), and dev/prod team mismatches (15 min). Saves ~58% tokens (3,250 tokens) and 2.5 hours per implementation. Covers user authentication flows, service-to-service auth, geographic restrictions, role-based access control, and Access policy configuration.Keywords: Cloudflare Access, Zero Trust, Cloudflare Zero Trust Access, Access authentication, JWT validation, access jwt, service tokens, hono cloudflare access, hono-cloudflare-access middleware, workers authentication, protect worker routes, admin authentication, access policy, identity providers, azure ad access, google workspace access, okta access, github a

WHEN: Go project review, error handling, goroutines, interfaces, testingWHAT: Error handling patterns + Concurrency safety + Interface design + Testing + Idiomatic GoWHEN NOT: Go API frameworks → go-api-reviewer, Rust → rust-reviewer

Use when you need to research, analyze, and plan technical solutions that are scalable, secure, and maintainable.

Web application security patterns including STRIDE threat modeling, OWASP Top 10 compliance, ABP authorization, and security audit procedures. Use when: (1) conducting security audits, (2) implementing authentication/authorization, (3) creating threat models, (4) reviewing code for vulnerabilities.