Testing & Security

Multi-agent orchestration system sử dụng Claude subagents thực tế từ thư mục agents/ cho security reviews, code quality analysis, deployment validation, infrastructure checks. Auto-activates với orchestrator-worker pattern và extended thinking mode.

Scaffold a native-looking, effective Electron app with best practices baked in. Creates a production-ready Electron application with security hardening, modern tooling, proper IPC patterns, auto-updates, native UI elements, and optimal build configuration. Use this skill when users want to start a new Electron project or modernize an existing one.

Design and implement end-to-end type-safe APIs using tRPC with proper router organization, procedure definitions, input validation with Zod schemas, context management, and middleware. Use this skill when creating or modifying tRPC router files like server/routers/*.ts, src/server/api/routers/*.ts, *.router.ts, or any files containing tRPC procedure definitions, queries, and mutations. Use this when defining tRPC routers with .query() for read operations and .mutation() for write operations, implementing input validation using Zod schemas with .input(z.object({...})) for type-safe runtime validation of all procedure parameters, creating and organizing reusable sub-routers by feature or domain (user router, post router, comment router) and composing them into a main app router using mergeRouters or router nesting, setting up tRPC context in createContext functions to provide request-scoped data like user sessions, database connections, or authentication state to all procedures, implementing tRPC middleware wit

Use when scaffolding, auditing, or validating Prisma database packages in MetaSaver monorepos. Covers package structure, Prisma schema setup, database client initialization, and seed scripts. File types: .prisma, .ts, package.json.

Generates Husky Git hooks configuration with pre-commit checks. Creates .husky/pre-commit file for running linting, testing, and formatting before commits.

Use when you need to plan technical solutions that are scalable, secure, and maintainable.

This skill should be used when auditing or comparing Claude Code and Cursor IDE configurations to identify feature gaps, equivalencies, and migration opportunities. Useful when managing AI development tooling across both platforms or deciding how to structure AI workflows.

Create and manage OSCAL component definitions for reusable security control implementations. Inspired by CivicActions components and community patterns. Use for building component libraries and shared control implementations.

Develop Python applications using modern patterns, uv, and functional-first design. Activate when working with .py files, pyproject.toml, uv commands, or user mentions Python, itertools, functools, pytest, mypy, ruff, async, or functional programming patterns.

Expert skill for implementing JWT-based authentication in FastAPI applications. Handles token generation, verification, user authentication, protected routes, and security best practices. Includes setup for password hashing, OAuth2 schemes, and user data isolation. Use when implementing JWT authentication in FastAPI applications, securing API endpoints with token-based authentication, or implementing user registration and login functionality.

30 pragmatic rules for production JavaScript covering async operations, V8 optimization, memory management, testing, error handling, and performance. Use when writing JavaScript, optimizing performance, handling promises, or building production-grade applications. Includes promise rejection handling, V8 hidden classes, memory leak prevention, and structured testing patterns.

Scans code for security vulnerabilities and suggests fixes. Use when checking for security issues, validating input handling, or performing security audits.

Implement mobile-first responsive designs with fluid layouts, breakpoints, relative units, and touch-friendly interfaces that work across all device sizes. Use this skill when writing or modifying React components (.tsx, .jsx files), when implementing CSS or Tailwind responsive utilities (sm:, md:, lg:, xl: breakpoints), when working on layout components, navigation menus, grid systems, when optimizing for mobile devices, tablets, or desktop screens, when implementing media queries, when ensuring touch-friendly UI elements, or when testing cross-device compatibility.

Use when creating new skills, editing existing skills, or verifying skills work before deployment - applies TDD to process documentation by testing with subagents before writing, iterating until bulletproof against rationalization

Testing patterns for Vercel AI SDK including mock providers, streaming tests, tool calling tests, snapshot testing, and test coverage strategies. Use when implementing tests, creating test suites, mocking AI providers, or when user mentions testing, mocks, test coverage, AI testing, streaming tests, or tool testing.

Systematic UI testing using Playwright for GAO-Dev web interface. Provides patterns for testing layouts, interactions, and visual regressions. Use when testing web interface changes or verifying UI bug fixes.

Tests JavaScript and TypeScript applications with Jest test runner including mocking, snapshot testing, and code coverage. Use when setting up testing, writing unit tests, or when user mentions Jest, test runner, or JavaScript testing.

Repository discovery and development commands for Soracom repos. Use when cloning repos, running builds/tests, or identifying which repos a feature affects.

Find and attach the newest screenshot PNG in ~/temp/screenshots. Use when a user asks to locate, show, or attach the latest screenshot or wants the newest PNG from the screenshots folder.

Use when creating new skills, editing existing skills, or verifying skills work before deployment - applies TDD to process documentation by testing with subagents before writing, iterating until bulletproof against rationalization