Loading...
Loading...
Found 2,347 Skills
World-class QA engineering - systematic testing, automation, and the mindset that finds bugs before users doUse when "QA, quality assurance, testing, test automation, e2e tests, integration tests, regression testing, test coverage, playwright, cypress, selenium, test suite, bug report, test strategy, flaky tests, testing, QA, automation, e2e, integration, regression, quality" mentioned.
Tests APIs for mass assignment (auto-binding) vulnerabilities where clients can modify object properties they should not have access to by including additional parameters in API requests. The tester identifies writable endpoints, adds undocumented fields to request bodies (role, isAdmin, price, balance), and checks if the server binds these to the data model without filtering. Part of OWASP API3:2023 Broken Object Property Level Authorization. Activates for requests involving mass assignment testing, parameter binding abuse, auto-binding vulnerability, or API over-posting.
Performs GraphQL introspection attacks to extract the full API schema including types, queries, mutations, subscriptions, and field definitions from GraphQL endpoints. The tester uses introspection queries to map the attack surface, identifies sensitive fields and mutations, tests for query depth and complexity limits, and exploits GraphQL-specific vulnerabilities including batching attacks, alias-based brute force, and nested query DoS. Activates for requests involving GraphQL security testing, introspection attack, GraphQL enumeration, or GraphQL API penetration testing.
Performs automated static analysis of Android applications using Mobile Security Framework (MobSF) to identify hardcoded secrets, insecure permissions, vulnerable components, weak cryptography, and code-level security flaws without executing the application. Use when assessing Android APK/AAB files for security vulnerabilities before deployment, during penetration testing, or as part of CI/CD security gates. Activates for requests involving Android static analysis, MobSF scanning, APK security assessment, or mobile application code review.
Django + Celery async task patterns — configuration, task design, beat scheduling, retries, canvas workflows, monitoring, and testing. Use when adding background jobs, scheduled tasks, or async processing to a Django app.
This skill should be used when debugging full-stack issues that span UI, backend, and database layers. It provides a systematic workflow to detect errors, analyze root causes, apply fixes iteratively, and verify solutions through automated server restarts and browser-based testing. Ideal for scenarios like failing schedulers, import errors, database issues, or API payload problems where issues originate in backend code but manifest in the UI.
Performs pseudo-mutation analysis on .NET production code to find gaps in existing test suites. Use when the user asks to find weak tests, discover untested edge cases, check if tests would catch a bug, or evaluate test effectiveness through mutation-style reasoning. Analyzes production code for mutation points (boundary conditions, boolean flips, null returns, exception removal, arithmetic changes) and checks whether existing tests would detect each mutation. Works with MSTest, xUnit, NUnit, and TUnit. DO NOT USE FOR: writing new tests (use writing-mstest-tests), detecting test anti-patterns (use test-anti-patterns), measuring assertion diversity (use assertion-quality), or running actual mutation testing tools.
Guide TDD workflow and testing strategy. Use when implementing features with tests, writing new tests, or establishing test coverage. Triggers on "TDD", "write tests", "test coverage", "red-green-refactor".
Perform relative value analysis on bonds by combining pricing, yield curve context, credit spreads, and scenario stress testing. Use when analyzing bond richness/cheapness, computing spread decomposition, comparing bonds, assessing bond value vs curves, or running rate shock scenarios.
Guides digital forensics for security incidents—evidence acquisition and chain of custody, disk/memory/mobile/cloud artifact analysis, log and network forensics, timeline correlation, malware artifact triage, and investigation reports for legal/IR and expert-witness preparation outlines (not legal advice). Use when preserving and analyzing forensic artifacts, building super-timelines, documenting acquisition worksheets, triaging malware samples, or preparing forensic findings for counsel—not live incident command (incident-responder), SOC alert queue triage (soc-analyst), authorized penetration testing (penetration-tester), deep binary RE (reverse-engineer), LLM red team (ai-redteam), enterprise ISMS programs (information-security-engineer), audit control mapping (compliance-engineer), or cloud guardrail implementation (cloud-security-engineer).
Guides engineering of multi-agent systems—agent roles and specialization, orchestration topologies (supervisor, peer-to-peer, hierarchical, blackboard), task decomposition and routing, inter-agent messaging (A2A-style patterns), shared vs partitioned state, fan-out/fan-in and DAG workflows, synchronization and consensus, conflict resolution, fault tolerance and retries across agents, cost/latency/token budgets, cross-agent observability, testing multi-agent flows, and deployment (queues, durable workflows). Framework-agnostic; high-level LangGraph, Deep Agents, and agenthub—not single-agent loops (agentic-ai-developer), ML training (ai-engineer), strategy-only whiteboard (enterprise-strategist), or PM planning (technical-program-manager). Use for multi-agent system, multi-agent engineer, agent orchestration, supervisor agent, agent topology, fan-out fan-in, agent handoff protocol, multi-agent workflow, agent coordination, blackboard pattern, hierarchical agents, A2A, agent DAG, multi-agent architecture.
Comprehensive SAP Joule CLI (formerly sapdas CLI) assistant for managing digital assistants from the command line — compiling capabilities, deploying assistants, running BDD tests, linting, and troubleshooting errors. Use this skill whenever the user mentions "joule cli", "sapdas", "joule compile", "joule deploy", "joule test", "joule login", "joule lint", digital assistant deployment, capability compilation, DAAR files, RTA artifacts, or any task involving the Joule command line interface — even if they just say something like "deploy my assistant" or "how do I log in to Joule from the terminal". Also trigger when the user asks about testing Joule capabilities with Cucumber, linking AI assistants, managing deployed assistants, or automating Joule workflows in CI/CD pipelines.