Security & Testing Agent Skills for Gemini CLI

Production deployment checklist for Persona identity verification.

Secure Persona API keys, webhook secrets, PII handling in verification

Derive a SET of simulation personas for an agent from product artifacts — backend payloads, UI screenshots, journey/product docs, and…

Use when debugging any bug. Enforces a 5-phase protocol where code edits are blocked until root cause is confirmed. Prevents premature fix…

Use when configuring CodeIgniter 4-specific security mechanisms - CSRF protection mode (cookie vs session), output escaping with esc()…

Use when asked to verify a CodeIgniter 4 project before a PR, after a major refactor or dependency upgrade, or before deploying to…

When to activate: PHPUnit, Pest, PHP testing, data providers, mocking, test doubles, Laravel testing, RefreshDatabase, feature tests, HTTP…

Design comprehensive test cases using PICT (Pairwise Independent Combinatorial Testing) for any piece of requirements or code.

Use when an app sends errors/logs/traces to more than one sink (Sentry events, spans, and logs; a structured logger like pino/winston; an…

Use whenever a server error with a structured payload flows into a UI error handler.

Plan the system tests needed for a feature — analyzes code, identifies what's worth covering at the browser layer, and produces a…

Audit automatically audits AI assistant code plugins for security vulnerabilities,

Executes a comprehensive 8-phase audit pipeline to validate the structure, quality, and security of AI skills and plugins.

Find the actual cause of an admitted failure instead of a plausible one using a systematic empirical method grounded in Agans and Zeller…

Write code that resists attack — parameterizing rather than escaping, encoding for the right output context, checking authorization per…

Refute your own work before delivering it.

Pre-publish safety audit for a professional's public GitHub presence.

Secure PostHog integration: API key management, project key vs personal

Use when reviewing a pull request for security issues — automatically analyzes the diff for vulnerabilities, hardcoded secrets, injection…

Pre-commit review: security scan, quality gates, auto-fix.

Deep audit before GitHub push: removes junk files, dead code, security holes, and optimization issues.