Testing & Security

Runtime security validation including secret scanning, PII detection, prompt injection defense, audit logging, and output validation for AI agents. Use when validating user input, scanning for secrets, detecting PII, preventing data exfiltration, or implementing security guardrails.

Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.

Perform a repo-wide, evidence-based audit of documentation against the current codebase and recent changes. Produces a proposed, fully rewritten documentation set in TempDoc-ForUserReview and asks for approval before any changes are applied to the existing docs.

Reviews code for quality issues, potential bugs, security vulnerabilities, and adherence to best practices. Provides actionable feedback with specific line references.

Use this skill when the user mentions LimaCharlie or wants to work with endpoint detection, cloud security monitoring, detection rules, or security automation. This provides an overview of LimaCharlie components and their interconnections.

Setup and configure testing infrastructure with Vitest, Playwright, and testing patterns. Use when users need to add tests, configure test runners, implement TDD workflows, or create E2E test suites. Covers unit, integration, and end-to-end testing strategies.

Comprehensive testing strategies with Vitest, Jest, and Testing Library

Systematic code quality improvement workflow combining smart-reviewer and test-generator MCP tools with Pareto 80/20 auto-fixes, severity-based review, and comprehensive test generation. Use when p...

Expert in Lighthouse Journey Timeline frontend architecture, React patterns, TypeScript, TanStack Query, Zustand, and component development with strong type safety. Use when building UI components, implementing data fetching, managing state, writing forms, styling with Tailwind, testing React components, or integrating with backend APIs.

Proper delegation patterns for Task() invocations with governance context injection

End-to-end feature development workflow with brainstorming, TDD, implementation, testing, and documentation. Use when adding new features, implementing user stories, or building new capabilities. Enforces test-first development, encourages design exploration, and ensures proper documentation.

Run and debug Rust tests for glhf. Use when running tests, fixing test failures, or adding new test cases.

This skill guides connecting MCP servers to Claude Code plugins for external service integration. Use when configuring MCP servers, setting up authentication, or integrating external tools.

Guides creation of high-quality Agent Skills with domain expertise, anti-pattern detection, and progressive disclosure best practices. Activate on keywords: create skill, review skill, skill quality, skill best practices, skill anti-patterns, improve skill, skill audit. NOT for general coding advice, slash commands, MCP development, or non-skill Claude Code features.

Generate high-quality bilingual programming quiz questions for Codle. Use this skill when creating new quiz questions that test deep understanding rather than rote memorization.

Generate comprehensive unit tests for iOS RxSwift project files (ViewModels, UseCases, Services). Creates complete test files with nested mocks, RxTest patterns, session error handling, and memory leak tests. Use when "generate unit tests", "write tests for", "create unit tests", "add tests for", or analyzing Swift files in PayooMerchant project.

Core development principles and guidelines covering security, QA, performance, documentation, and coding standards. Used by all agents to ensure consistent quality across the Orchestra system.

Query and interact with Supabase databases using real-time subscriptions and PostgreSQL-compatible queries. Supports SELECT operations with Row Level Security (RLS), filtering, ordering, and pagination. Activated when users mention "supabase", "realtime database", or need Supabase backend features.

Spec-First, Agent-Implemented Software Development Lifecycle. Use when:(1) Starting a new software project that needs structured design-before-code approach,(2) User mentions "SDLC", "spec-first", "design docs", or "implementation spec",(3) User wants to go from requirements/intent to working code with traceability,(4) Project requires documented architectural decisions and review checkpoints,(5) User has existing design artifacts and wants to continue from a specific phase.Produces: Intent doc → HLD → ADR-Lite → EIS → Code → Validation tests.

Use this skill whenever the user wants to set up, write, or refactor tests for a NestJS TypeScript backend, including unit tests, integration tests, and e2e tests with Jest, TestingModule, and Supertest.