Security & Testing Agent Skills for Claude Desktop

Investigate OpenClaw pnpm test memory growth, Vitest OOMs, RSS spikes, and heap snapshot deltas.

Benchmark, diagnose, and optimize OpenClaw test and plugin-suite runtime, import hotspots, CPU/RSS, heap growth, and slow coverage paths.

Choose, run, rerun, or debug OpenClaw tests, CI checks, Docker E2E lanes, release validation, and the cheapest safe verification path.

QA opencode itself, per case: verify the CLI/terminal (opencode run, db, serve, export), prove a specific plugin hook/action/event fired…

Implement data privacy controls for OpenRouter API usage.

Browser-based user acceptance testing via Playwright MCP tools.

Orchestrate fixing a bug — reproduce it as a failing regression test, fix to green, review, and gated commit — by delegating each phase to…

Test-driven development workflow with comprehensive coverage requirements including unit, integration, and E2E tests

Set up Cloudflare Turnstile end-to-end in a project: scan the codebase, create the widget via the Cloudflare API, deploy the managed…

Comprehensive quality verification system for code changes with build, type, lint, test, and security checks

Run a unified audit across all quality dimensions — architecture, code quality, testing, security, docs, and release readiness.

A simple file reader utility

Run a complete unattended audit of a codebase and leave a ranked findings report, draft check scripts, and a list of what was not examined.

Route Node.js/TypeScript backend security questions to the matching OWASP Top 10 category and the correct library reference (express…

OWASP Top 10 vulnerability scanning and remediation

This skill should be used when running or interpreting an OWASP ZAP baseline DAST scan of the Expo web export — after changes to HTTP…

Use when hardening JavaScript npm dependencies against fresh package publishes, supply-chain attacks, typosquatting windows, compromised…

Periodic pass that keeps a project's verification skill and feature map honest: parallel source readers per feature, one live session…

Apply after completing a task, before declaring done.

Run macOS Parallels smoke with Discord send, host verification, host reply, and guest readback proof.

Use when you need to evaluate the strength of a password or passphrase, give actionable improvement advice, or explain password policy…