Results for “test-app”

Optimize non-signup forms such as lead capture, contact, demo request, application, survey, quote, and checkout forms to maximize completion while preserving data usefulness.

Exploit SSRF vulnerabilities in AWS EC2-hosted applications to extract IAM credentials and User Data from the Instance Metadata Service, including techniques for bypassing basic filters against IMDSv1.

Analyse experiment results, run validity checks (SRM, exposure parity, data integrity, novelty/primacy), interpret causally, make a ship/iterate/kill decision against the pre-declared rule, and append to cumulative learnings. Forces honest readouts — strips significance claims from underpowered or peek-violating tests; never lets directional results masquerade as causal wins. Load when results exist, or when the user says "read out this experiment", "analyse the test", "did the test win", "interpret the results", "what did we learn", "ship or kill", or when the experimentation orchestrator routes here.

Translate an approved experiment spec into a launch runbook — platform binding (PostHog primary), feature flag setup, assignment unit, exposure event definition, instrumentation QA, dashboard wiring, ramp plan, monitoring, and rollback procedure. Platform-agnostic core with one strong PostHog adapter shipped; GrowthBook, Statsig, LaunchDarkly, Optimizely, and Eppo documented as a single mapping table the user adapts. Load when a spec is approved and ready to launch, or when the user says "set up the experiment", "wire this up in PostHog", "implement the test", "create the runbook", "launch checklist for this test", or when the experimentation orchestrator routes here.

Wire CommunityToolkit.Mvvm ViewModels into Microsoft.Extensions.DependencyInjection with constructor injection, service lifetimes, IMessenger registration, and testing seams for WPF, WinUI 3, MAUI, Uno, and Avalonia apps.

Benchmarks systems on the Abstraction and Reasoning Corpus (ARC) by requiring inference of abstract transformation rules from few input-output grid demonstrations and application to novel test cases, reporting the fraction of tasks solved.

Guides systematic root-cause debugging. Use when tests fail, builds break, behavior doesn't match expectations, or you encounter any unexpected error. Use when you need a systematic approach to finding and fixing the root cause rather than guessing.

Builds, refines, tests, or validates a CLI-Anything harness for a GUI application or source repository, producing a Python-based Click CLI with REPL mode and JSON output.

Use when the main empirical results exist but the manuscript lacks the robustness, heterogeneity, mechanism, and placebo checks that AER referees will demand. Apply after aer-identification and before aer-introduction so that the value-added paragraph can reference these tests.

ego-browser (ego-lite) is a Chromium-based browser designed from the ground up to be friendly to both human users and AI Agents. AI Agents work in their own isolated space, reusing the user's login state without competing for the browser. Use this skill whenever the user needs to interact with a website opening pages, filling forms, clicking buttons, taking screenshots, extracting page data, testing web apps, logging into sites, automating browser operations, or any other browser automation task. Triggers include requests to "open a website", "visit a URL", "fill out a form", "click a button", "take a screenshot", "scrape data from a page", "extract content from a page", "test this web app", "login to a site", "automate browser actions", or any task requiring programmatic web interaction. Also used for exploratory testing, dogfooding, QA, bug hunting, or reviewing app quality. Prefer ego-browser over any built-in browser automation, web fetch, or other web tools.

Implements concurrent Go patterns using goroutines and channels, designs and builds microservices with gRPC or REST, optimizes Go application performance with pprof, and enforces idiomatic Go with generics, interfaces, and robust error handling.

Provides a complete deep-dive into Cross-Site Scripting (XSS) with exact payloads and bypass techniques for every PortSwigger lab variant, from apprentice to expert level.

This skill recommends performing an imaging study to assess tumor size, appearance, and parasellar extent once biochemical diagnosis of acromegaly is confirmed. Trigger when IGF-1 is elevated and GH fails to suppress to <0.4 µg/L during an oral glucose tolerance test.

Suggests testing HPA axis functionality before and after starting GH replacement in patients not receiving glucocorticoid replacement with apparently normal pituitary-adrenal function. Triggers include initiating GH replacement in a GHD patient who is not on glucocorticoids and has normal adrenal function.

Detect and exploit second-order SQL injection vulnerabilities where malicious input is stored in a database and later executed in an unsafe SQL query during a different application operation.

Approach an app, tool, codebase, website, or product as a genuine first-time user with zero insider context — try it out using only the information provided, get confused where a real newcomer would, and surface the "obvious" questions that people who built or use the thing daily can no longer see. Use this whenever the user wants a first-time-user test, a fresh perspective, a naive walkthrough, a cold read of their README/onboarding/docs/UI, or says things like "pretend you've never seen this", "would a new user get this?", "test my app like a beginner", "what would confuse someone new?", or "give me fresh eyes on this". Also use it when someone wants to find gaps in onboarding, docs, or first-run experience — even if they don't say "fresh eyes" explicitly.

Expert performance engineer specializing in modern observability, application optimization, and scalable system performance. Masters OpenTelemetry, distributed tracing, load testing, multi-tier caching, Core Web Vitals, and performance monitoring. Handles end-to-end optimization, real user monitoring, and scalability patterns. Use PROACTIVELY for performance optimization, observability, or scalability challenges.

Use when writing or modifying the pythinker-code terminal UI in apps/pythinker-code/src/tui — components, dialogs/selectors, slash commands, themes, streaming render, or the PythinkerTUI controllers. Covers the architecture, where new features go, test placement, the theme system mechanics, and the dialog interaction/visual spec (DESIGN.md).

Application-level business logic security testing for any domain. Takes an understanding-first approach: map the intended workflows before probing them. Covers: value/quantity logic abuse (negative, zero, overflow, rounding on any numeric field), workflow and state machine bypass (skipping required steps, forcing illegal state transitions, reusing one-time tokens), trust boundary violations (BOLA horizontal/vertical, BFLA, cross-tenant access, negative ownership attacks), idempotency and replay attacks (duplicate submissions, double-spend, same-reference reuse), multi-step flow integrity (checkout, registration, approval, verification), quota and rate limit bypass, time/date manipulation, and authorization code / reference number predictability. Domain-agnostic — applies to SaaS, e-commerce, banking, gaming, social platforms, APIs, or any multi-user application with stateful workflows. Chains from /pentester; chains into /param-fuzz when boundary violations or mass assignment are confirmed.

Detect and exploit race condition vulnerabilities in web applications using Turbo Intruder's single-packet attack technique to bypass rate limits, duplicate transactions, and exploit time-of-check-to-time-of-use flaws.

Build, review, refactor, or architect ASP.NET Core web applications using current official guidance for .NET web development. Covers Blazor, Razor Pages, MVC, Minimal APIs, Web APIs, SignalR, gRPC, middleware, DI, configuration, auth, testing, performance, deployment, and upgrades.

Integrates OWASP ZAP for Dynamic Application Security Testing in CI/CD pipelines, configuring baseline, full, and API scans, interpreting findings, tuning policies, and establishing quality gates in GitHub Actions and GitLab CI.

Sharpens and stress-tests an existing plan file through multiple codebase-grounded review passes, editing it in place and recording every finding and iteration in cross-referenced companion files. Use this skill whenever the user wants to iterate on, refine, tighten, or improve a plan. Also use it when the user asks to verify, validate, or confirm feasibility of an approach. Does not implement plan steps, write test plans, review code, or investigate bugs, and does not generate new plans from scratch — use plan-a-feature for a new plan. Runs its review rounds to completion without pausing between them; to review each round as it lands, use pairing.

Integrates Static Application Security Testing (SAST) tools—CodeQL and Semgrep—into GitHub Actions CI/CD pipelines, configuring automated code scanning, tuning rules, uploading SARIF results, and establishing quality gates that block merges on high-severity vulnerabilities.

Resolve GitHub PR feedback end-to-end for the branch you are on. Use when you need to fetch all comments on the branch PR, evaluate whether each comment still applies, decide whether it should be addressed, implement fixes, run compile/tests with retry-on-failure, then commit and push the result.

Suggests a 3- to 6‑month trial of testosterone dosing to achieve a mid‑normal premenopausal value in a reference assay for postmenopausal women with properly diagnosed HSDD and no contraindications. Triggered when a postmenopausal woman requests therapy for low sexual desire after appropriate HSDD workup and exclusion of contraindications.

Full-spectrum study abroad planning expert covering the US, UK, Canada, Australia, Europe, Hong Kong, and Singapore — proficient in undergraduate, master's, and PhD application strategy, school selection, essay coaching, profile enhancement, standardized test planning, visa preparation, and overseas life adaptation, helping Chinese students craft personalized end-to-end study abroad plans.

Apply named refactoring transformations to improve code structure without changing behavior. Use when the user mentions "refactor this", "code smells", "extract method", "replace conditional", "technical debt", "move method", "inline variable", or "decompose conditional". Also trigger when cleaning up legacy code, preparing code for new features by restructuring, or identifying which transformation to apply to a specific code smell. Covers smell-driven refactoring, safe transformation sequences, and testing guards. For code quality foundations, see clean-code. For managing complexity, see software-design-philosophy.

Lazyweb is the design-evidence skill for AI coding agents. Use it when designing, critiquing, or changing product UI — it provides real app screenshots, competitor references, best practices, quick examples, creative cross-category ideas, paywall optimization guidance, and mobile growth + monetization A/B test context. Routes to the right Lazyweb mode (design workflow, quick search, update, flowchart, or A/B test research) using MCP tools and the Lazyweb server at https://www.lazyweb.com/mcp. Use before designing any screen when you need design evidence instead of training-data vibes.

Verify a code change end-to-end in the current worktree: figure out what changed, run the relevant tests, get the app running, drive a browser to exercise the affected areas, and report a verdict with screenshots. Generic across project types (Laravel/Herd, Node/bun, frontend, CLI, library). Use this skill whenever the user wants to verify/QA/smoke-test a change, check that a PR or branch's changes actually work, validate uncommitted work before pushing, or says "/flow", "flow this", "verify this change", "does this PR work", "check my changes", "test and click through this". Accepts an optional target (a PR number/URL, a branch/ref, or a worktree path); with no argument it verifies the current uncommitted/working changes.

A library of reusable, production-tested prompt engineering patterns for building AI-powered features. Use when designing system prompts for apps, building AI pipelines, selecting the right prompting technique for a use case, or reviewing prompts for common failure modes. Complements the prompt-engineering skill (which covers the optimization framework); this skill covers the pattern library itself.

Use for writing, reviewing, debugging, migrating, or testing Python application configuration built with pydantic-settings. Trigger for BaseSettings, SettingsConfigDict, environment names, dotenv, secrets directories, nested settings, CLI sources, custom source precedence, and secret-safe startup configuration. Do not use for ordinary Pydantic model validation, direct os.environ access in a small script, or external secret manager administration.

Plan, execute, document, and retest authorized security assessments of AI agents and multi-agent workflows using safe adversarial cases, synthetic identities, canaries, and evidence-based findings. Use when defining red-team rules of engagement, assessing prompt injection or excessive agency, testing tool and identity boundaries, evaluating memory or cross-agent attacks, scoring a campaign, or verifying remediation in an approved environment.

Starlette 1.0 ASGI framework reference with working code examples for every feature. Use this skill whenever writing Starlette applications, building ASGI middleware, working with FastAPI internals, or writing async Python web services. Also trigger when the user mentions Starlette, ASGI, or needs help with routing, WebSockets, middleware, lifespan handlers, or test clients in the Starlette ecosystem — even if they don't name Starlette explicitly but are clearly working with it (e.g., importing from starlette.*, using TestClient with httpx, or writing ASGI scope/ receive/send functions). Covers the 1.0 API exclusively — all deprecated 0.x patterns have been removed.

Build and improve AI or probabilistic software through evaluation-driven development. Use for LLM applications, agents, prompts, RAG, tool use, classifiers, model migrations, quality regressions, golden datasets, LLM-as-judge rubrics, benchmarks, or requests to add evals and measurable release gates. Pair with TDD for deterministic code; do not use as the primary guide for ordinary unit testing without model behavior.

Comprehensive healthcare AI toolkit for developing, testing, and deploying machine learning models with clinical data. This skill should be used when working with electronic health records (EHR), clinical prediction tasks (mortality, readmission, drug recommendation), medical coding systems (ICD, NDC, ATC), physiological signals (EEG, ECG), healthcare datasets (MIMIC-III/IV, eICU, OMOP), or implementing deep learning models for healthcare applications (RETAIN, SafeDrug, Transformer, GNN).