Packs
3 packs@trailofbits
Testing Handbook Skills
Skills from the Trail of Bits Application Security Testing Handbook (appsec.guide)
15 skills · pack
@adobe
App Builder
Development, customization, testing, and deployment skills for Adobe App Builder projects
6 skills · pack
curated
Debug Web App with DevTools
Install this pack to test and debug a web application in a real browser using Chrome DevTools MCP.
7 skills · pack
Results for “test-app”
350 skillsrefactor
Restructure existing code without changing its behavior, through a test-gated refactoring loop: a named target, a green suite over that target before any edit, a planned sequence of small named refactorings, and the full suite re-run after every step. Use when the user wants to refactor, restructure, clean up, simplify, or improve the design of existing code, or to apply refactoring recommendations from a code-review or architectural-analysis report. This skill changes code; it does not review code (use code-review), assess architecture (use architectural-analysis), or build new behavior test-first (use tdd). Do not use it on code inside an active tdd loop; the refactor step of tdd owns that cleanup. Runs its planned sequence to completion without pausing for review; to review each named refactoring as it lands, use pairing.
218 · bundle
pyhealth
Comprehensive healthcare AI toolkit for developing, testing, and deploying machine learning models with clinical data. This skill should be used when working with electronic health records (EHR), clinical prediction tasks (mortality, readmission, drug recommendation), medical coding systems (ICD, NDC, ATC), physiological signals (EEG, ECG), healthcare datasets (MIMIC-III/IV, eICU, OMOP), or implementing deep learning models for healthcare applications (RETAIN, SafeDrug, Transformer, GNN).
5 · bundle
sox
Process audio files with SoX (Sound eXchange). Use when a user asks to apply audio effects, mix and combine audio tracks, convert audio formats, batch process audio files, normalize volume, trim silence, add reverb or echo, change tempo or pitch, split audio files, create spectrograms, generate test tones, resample audio, or build audio processing pipelines. Covers all SoX effects, format conversion, mixing, and batch workflows.
0
real-user-qa
Use when asked to "QA this", "is this ready to ship?", "test it like a user", "bug hunt", "sign off this build/phase", or before declaring a web app / feature shippable — a real-user QA pass that files severity-ranked bug reports and returns a binary ship verdict. Not for visual/CRO polish (frontend-audit) or fixing an already-reported UI bug (ui-fix-observe-first).
0 · bundle
code-simplification
Simplify application code for clarity without changing behavior — refactor after tests pass, reduce nesting and duplication, match project conventions. Load when refactoring for readability, cleaning up after a feature ships, or when code review flags complexity. Also triggers on "simplify this code", "code simplification", "make this easier to read", "reduce complexity", "refactor for clarity". Not for compress/split/prune-skill (skill-library files). Pairs with technical-debt-audit.
3 · bundle
cx-dashboard-review
Use to audit a CX dashboard for tiles nobody acts on and metrics nobody agrees on — assign an owner per tile, apply kill criteria, and run an actionability test before adding or keeping a chart. Trigger for "clean up the dashboard", "too many metrics", "which KPIs should we keep", dashboard audit, metrics review workshop, "nobody looks at this anymore", or before a BI migration or exec-pack refresh.
1
nightrun
Build, test, run, and flash NightRun — a bare-metal, no_std Rust UEFI application that boots straight into a local LLM (Llama 3.2, Qwen3, or Granite 4.1) with no operating system underneath. Use when the user wants to build/flash a bootable NightRun USB or Raspberry Pi 5 SD image, convert a GGUF model into the `.nrm` container, run/debug the inference engine on the host or in QEMU/OVMF, or troubleshoot no_std kernel/tokenizer parity issues in the NightRun codebase. Triggers on: "nightrun", "boot into an LLM", "bare-metal LLM runtime", "UEFI LLM appliance", "nrconvert", "nrhost", "cargo xtask", "nrm model file", "flash a bootable LLM USB".
42 · bundle
node
Provides domain-specific best practices for Node.js development with TypeScript, covering type stripping, async patterns, error handling, streams, modules, testing, performance, caching, logging, and more. Use when setting up Node.js projects with native TypeScript support, configuring type stripping (--experimental-strip-types), writing Node 22+ TypeScript without a build step, or when the user mentions 'native TypeScript in Node', 'strip types', 'Node 22 TypeScript', '.ts files without compilation', 'ts-node alternative', or needs guidance on error handling, graceful shutdown, flaky tests, profiling, or environment configuration in Node.js. Helps configure tsconfig.json for type stripping, set up package.json scripts, handle module resolution and import extensions, and apply robust patterns across the full Node.js stack.
0 · bundle
agent-mbti
AI Agent personality diagnosis and configuration system based on MBTI framework. Use when users want to (1) test/diagnose an Agent's personality type, (2) understand the gap between Agent's actual personality and user's desired personality, (3) generate configuration recommendations to adjust Agent behavior, (4) customize Agent's communication style, proactivity, reasoning approach, or execution patterns. Supports both free tier (quick assessment) and premium tier (full 93-question assessment with detailed diagnostics).
228 · bundle
senior-secops
Senior SecOps engineer skill for application security, vulnerability management, compliance verification, and secure development practices. Runs SAST/DAST scans, generates CVE remediation plans, checks dependency vulnerabilities, creates security policies, enforces secure coding patterns, and automates compliance checks against SOC2, PCI-DSS, HIPAA, and GDPR. Use when conducting a security review or audit, responding to a CVE or security incident, hardening infrastructure, implementing authentication or secrets management, running penetration test prep, checking OWASP Top 10 exposure, or enforcing security controls in CI/CD pipelines.
0 · bundle
safe-change
Apply one logical code change with mandatory impact mapping, git snapshot, verification, and automatic revert on failure. Load when the user asks for a safe edit, verified change, one change at a time with rollback, or codespine-style edit loop. Also triggers on "safe change", "edit with verification", "don't break the build", "revert if tests fail", or any non-trivial code edit where blast radius matters. Always runs dependency-mapping first. Pairs with incremental-implementation for multi-slice work; this skill is one atomic verify cycle per invocation.
3 · bundle
skill-builder
Builds a new Claude Code skill from scratch through a relentless, evidence-based interview that walks the skill's design tree decision-by-decision — entity fit, use cases, name, description, workflow steps, tools, and progressive-disclosure layout — then reviews the finished skill against the plugin-building guidance and applies every fix it finds. Use when creating, authoring, scaffolding, designing, or drafting a new skill or slash command. Does not build an agent or subagent — use agent-builder. Does not serve, vendor, or refresh the authoring guidance itself — use guidance.
218
runbook
Create or update a runbook for an operational scenario — an incident an alert fires for, a recurring scheduled task, or a known failure mode on a live service — using a consistent template. Use when writing, drafting, authoring, or updating a runbook for an alert, incident, on-call procedure, scheduled maintenance, or operational SOP. Applies a YAGNI preflight requiring the scenario to be real before producing the runbook. Does not produce feature or system documentation — use project-documentation. Does not record architectural decisions — use architectural-decision-record. Does not create coding standards — use coding-standard.
218 · bundle
agent-builder
Builds a new Claude Code agent (subagent) from scratch through a relentless, evidence-based interview that walks the agent's design tree decision-by-decision — entity fit, domain focus and vocabulary, role identity, anti-patterns, description, model tier, tools, and self-containment — then reviews the finished agent against the plugin-building guidance and applies every fix it finds. Use when creating, authoring, scaffolding, designing, or drafting a new agent or subagent. Does not build a skill or slash command — use skill-builder. Does not serve, vendor, or refresh the authoring guidance itself — use guidance.
218
merit-review
Analyzes state merit review for non-covered securities offerings, applying NASAA Statements of Policy to cheap stock, promoter equity investment, voting rights, and promoter compensation. Produces examiner-ready comment responses with cap table analysis and negotiation strategy. Use when filing Reg A, Rule 504, intrastate, or direct public offerings in merit review states, responding to Blue Sky examiner comments, structuring offerings to avoid conditioning, or analyzing NASAA SOPs. Also trigger on cheap stock analysis, promoter equity tests, unequal voting rights review, state examiner correspondence, or phrases like "merit review issues" or "the state examiner sent comments."
34
ad-creative
When the user wants to generate, iterate, or scale ad creative — headlines, descriptions, primary text, or full ad variations — for any paid advertising platform. Also use when the user mentions 'ad copy variations,' 'ad creative,' 'generate headlines,' 'RSA headlines,' 'bulk ad copy,' 'ad iterations,' 'creative testing,' 'ad performance optimization,' 'write me some ads,' 'Facebook ad copy,' 'Google ad headlines,' 'LinkedIn ad text,' 'static ads,' 'static ad concepts,' 'ad templates,' 'iMessage ad,' 'chat reveal ad,' 'fake DM ad,' 'ChatGPT ad,' 'Apple Notes ad,' 'AirDrop ad,' 'creative strategy,' 'creative roadmap,' 'creative retro,' 'hook writing,' 'creative review page,' 'present ad creative for approval,' 'motion video ad,' 'faceless video ad,' 'animated explainer ad,' 'motion collage ad,' or 'I need more ad variations.' Use this whenever someone needs to produce ad copy at scale or iterate on existing ads. For campaign strategy and targeting, see ads. For landing page copy, see copywriting.
0 · bundle
edit-for-readability
Applies Han's shared Human-Readable Output Standard to a target you already have — a file on disk, text pasted into the prompt, or a draft already produced in the conversation — by dispatching the readability-editor to rewrite its prose so the main point comes first, headings are descriptive, each paragraph carries one idea, and sentences stay short and active, while preserving every fact. Use when you want to make a document or draft readable, edit or polish prose for readability, clean up writing, tighten wording, or re-apply the readability standard to something already written. Rewrites prose only, leaving code, diagrams, and citation identifiers unchanged. Does not write new feature or system documentation — use project-documentation. Does not restructure code or review it — use refactor to restructure code and code-review to audit it. Does not judge the underlying work or raise findings; it only rewrites the writing.
218
frontend-responsive-design-standards
Build responsive, mobile-first layouts using fluid containers, flexible units, media queries, and touch-friendly design that works across all screen sizes. Use this skill when creating or modifying UI layouts, responsive grids, breakpoint styles, mobile navigation, or any interface that needs to adapt to different screen sizes. Apply when working with responsive CSS, media queries, viewport settings, flexbox/grid layouts, mobile-first styling, breakpoint definitions (mobile, tablet, desktop), touch target sizing, relative units (rem, em, %), image optimization for different screens, or testing layouts across multiple devices. Use for any task involving multi-device support, responsive design patterns, or adaptive layouts.
3
palmier-pro
Drive Palmier Pro, an open source AI-native macOS video editor (Swift, SwiftUI/AppKit, AVFoundation) that exposes its timeline as an MCP server at `http://127.0.0.1:19789/mcp` so Claude Code/Desktop, Cursor, or Codex can read and edit a project's tracks, clips, media, transcript, captions, color/effects, and trigger generative AI (video/image/audio) requests side-by-side with a human editor. Use when the user wants to connect an agent to Palmier Pro's MCP server, call its timeline/clip/media/generation tools (`get_timeline`, `add_clips`, `move_clips`, `generate_video`, ...), build/run/test the Swift app from source, or debug the MCP tool surface in `ToolDefinitions.swift`/`ToolExecutor+*.swift`. Triggers on: "palmier pro", "palmier-pro", "AI video editor MCP", "connect Claude to my video editor", "palmier MCP server", "edit my timeline with an agent", "swift build PalmierPro", "palmier-pro mcpb", "manage_project"/"get_timeline"/"add_clips" tool.
42 · bundle
pci-compliance
Expert PCI DSS compliance advisor covering PCI DSS v4.0.1 (current) and v4.0. Use this skill whenever a user asks about PCI DSS, payment card security, cardholder data protection, CDE scoping, SAQ types (A, A-EP, B, B-IP, C, C-VT, P2PE, D), ROC, AOC, QSA assessments, ASV scans, merchant levels, service provider levels, network segmentation, penetration testing, tokenisation, encryption of PAN data, or any of the 12 PCI DSS requirements. Also trigger for questions like "are we PCI compliant?", "how do I scope my CDE?", "which SAQ applies to us?", "what changed in PCI DSS v4.0?", "how do I prepare for a QSA audit?", or any request involving payment data security, cardholder data environment, or PCI certification readiness.
2 · bundle
guidance
Authoritative guidance for building Claude Code skills, agents, and plugins, plus init and update steps that install and refresh the plugin-building skills in the current repository. Use when you need the rules or best practices for a skill, agent, hook, or plugin — designing, reviewing, hardening, or checking one against the guidance. Run with `init` to vendor the guidance, skill-builder, and agent-builder skills into the current repository (so they run with no dependency on this plugin) plus a path-scoped rule index, or `update` to refresh an already-vendored copy. Does not run an interview to build a new skill or agent from scratch — use skill-builder or agent-builder. Does not write feature code, review application code, or build non-plugin features.
218 · bundle
research
Researches an open-ended question — options, possible solutions, prior art, trade-offs, or how something works — and produces a durable, evidence-backed, adversarially-validated report that recommends an option without committing the team to any artifact. Use when you want to research approaches, weigh options, survey prior art or the state of the art, or understand how something works before committing to a direction. Does not diagnose a bug, failure, or root cause — use investigate. Does not specify a feature — use plan-a-feature. Does not create or update a coding standard — use coding-standard. Does not compare two concrete artifacts for gaps — use gap-analysis. Does not assess an existing module's architecture — use architectural-analysis. Does not capture feedback on Han's own skills — use han-feedback.
218 · bundle
full-empirical-analysis-skill
Classical end-to-end empirical analysis workflow in the traditional Python econometric stack — pandas + numpy + scipy + statsmodels + linearmodels + pyfixest + rdrobust + econml + causalml + matplotlib/seaborn. **Defaults to economics empirical-paper style** (AER / QJE / AEJ) — every run produces a publication-ready output set with a multi-column regression table (M1→M6 progressive controls/FE) as the centerpiece, plus Table 1 (descriptives), mechanism / heterogeneity / robustness tables, and event-study + coefficient + trend figures. Covers the full 8-step pipeline an applied economist or quantitative social scientist runs on every paper — (1) data cleaning, (2) variable construction & transformation, (3) descriptive statistics & Table 1, (4) statistical diagnostic tests, (5) baseline empirical modeling, (6) robustness battery, (7) further analysis (mechanism, heterogeneity, mediation, moderation), (8) publication-ready tables & figures. **Also covers two parallel domain modes that share the same 8-step scaf
1k · bundle
arbor
Autonomously improve a real artifact (code, training recipe, agent harness, data pipeline, prompt) against an objective and an evaluator, using Hypothesis Tree Refinement (HTR) from the Arbor paper. Use this whenever someone wants to iteratively optimize something over many experiments without overfitting — e.g. "get my model's eval score up", "improve this agent/harness", "tune this pipeline", "beat the baseline on this benchmark", "run a search over approaches and keep the best", "do an MLE-bench / Kaggle-style optimization", or any long-horizon "make this artifact better and don't just memorize the dev set" task. Trigger it even when the user doesn't say "Arbor" or "hypothesis tree" but describes repeated experiment-and-evaluate loops, branching exploration of competing ideas, or worries about a dev/test gap. Runs Claude itself as the coordinator with subagent executors in...
2 · bundle
full-empirical-analysis-skill-stata
Classical end-to-end empirical analysis workflow in the traditional Stata ecosystem — native Stata + reghdfe + ivreg2 + csdid + did_imputation + eventstudyinteract + sdid + rdrobust + rddensity + synth + synth_runner + psmatch2 + teffects + ebalance + coefplot + esttab + asdoc + binscatter. **Defaults to economics empirical-paper style** (AER / QJE / AEJ) — every run produces a publication-ready output set with a multi-column regression table (M1→M6 progressive controls/FE) as the centerpiece, plus Table 1 (descriptives), mechanism / heterogeneity / robustness tables, and event-study + coefficient + trend figures. Covers the full 8-step Stata pipeline an applied economist runs on every paper — (1) data import & cleaning (use/import, destring, misstable, duplicates, merge assert), (2) variable construction (gen/egen/winsor2/xtile/xtset with L./F./D.), (3) descriptive statistics & Table 1 (tabstat/balancetable/asdoc), (4) classical diagnostic tests (sktest/swilk/hettest/imtest/xtserial/xttest3/vif/dfuller/kpss/
1k · bundle
taw
Single entrypoint for taw-kit. User types `/taw <anything in VN or EN>` — this skill classifies the intent (BUILD / FIX / SHIP / MAINTAIN / ADVISOR) and loads the matching branch file to execute. Replaces the old one-command-per-task model (/taw-new, /taw-add, /taw-fix, /taw-deploy, /taw-security) with a single unified command. Supports dev workflows out of the box: test, upgrade, clean, perf, rollback, refactor, types, seed, review, stack-swap, status, and ADVISOR group (analyze, suggest, coverage, adversarial, scope-check) for opinionated review of existing code. User-visible strings match the user's input language (Vietnamese by default for VN users). Two modes: SAFE (default — clarify + approval, max 1 round-trip) and YOLO (skip gates, smart defaults — for demos/power users). YOLO triggers: prose contains `yolo`, `nhanh nha`, `lam luon`, `khoi hoi`, `auto`, or args start with `yolo`. Trigger phrases (EN + VN) — broad match so user can keep typing plain prose without re-invoking /taw every turn. Grouped by
3 · bundle