القائمة
Skills في هذا المستودع
جمع SkillsMP عدد ٢٠٠ من skills من ModernNomad-98/Project-Aegis. افتح أي skill لمراجعة مصدره وتفاصيله.
ModernNomad-98/Project-Aegisعرض ٤٠ من أصل ٢٠٠ skills مجمعة.
Review the integrity of the data and pipelines that shape a model's behavior against data and model poisoning (OWASP LLM04) — training and fine-tuning datasets (provenance, curation, who can contribute), RLHF/feedback loops (can attackers mass-signal bad…
لغة النص الأصلي: الإنجليزية
Design or review the security of a RAG / retrieval pipeline and its vector store (OWASP LLM08) — enforce authorization AT RETRIEVAL TIME so a query only ever returns documents the calling user and tenant may see (never post-retrieval filtering), scope every…
لغة النص الأصلي: الإنجليزية
Prevent an LLM feature from disclosing sensitive information (OWASP LLM02) — audit and design the data-minimization and redaction pipeline so secrets, credentials, PII, and other-tenant data are stripped BEFORE they enter model context, prompts, or logs;…
لغة النص الأصلي: الإنجليزية
Derive SLOs from user journeys, not infrastructure — inventory the journeys users depend on, select symptom-based SLIs per journey (availability, latency percentiles, correctness, freshness — measured where users experience them, blind spots named), set…
لغة النص الأصلي: الإنجليزية
Define the end-to-end operating model for AI-assisted software work — the named stages (context, classify, plan, implement, validate, review, merge, close, learn), the authority holder at each (human, agent, or agent-with-approval), each stage's entry/exit…
لغة النص الأصلي: الإنجليزية
Design the accessibility verification harness — WCAG-oriented coverage of keyboard operability (tab order, visible focus, no traps), accessible names/labels/roles, focus management in dialogs and route changes, color contrast, and screen-reader expectations…
لغة النص الأصلي: الإنجليزية
Design contract tests that VERIFY implementations against API, command, provider, webhook, and edge-function contracts WITHOUT UI tests — request/response schema validation (shape, types, required fields, error envelope), provider-side and consumer-side…
لغة النص الأصلي: الإنجليزية
Drive a flaky (intermittently failing) test to its root cause and proven stability through the fixed sequence CLASSIFY (ordering, shared state, timing/race, environment, infrastructure, or real intermittent product bug) → REPRODUCE deterministically (repeat…
لغة النص الأصلي: الإنجليزية
Design integration tests — the layer BETWEEN unit and E2E — that exercise modules through REAL service, command, database, auth, and permission boundaries with no browser. Every suite names exactly which boundaries are real and which seams stay faked…
لغة النص الأصلي: الإنجليزية
Write full manual test cases executable by ANOTHER tester with zero tribal knowledge — each case has an id, requirement/risk trace, role/persona, environment, preconditions, exact test data, numbered steps with ONE observable expected result per step,…
لغة النص الأصلي: الإنجليزية
Design the test-automation architecture that implements a QA strategy — tool/runner selection per layer with rationale, test project structure and naming, fixture/helper/factory layers, auth-state handling, parallelization and isolation rules,…
لغة النص الأصلي: الإنجليزية
Define the product- or repo-level QA strategy — a risk inventory ranked by business/security impact, the test-layer split (what gets unit, integration, contract, E2E, manual coverage and WHY), ownership per layer, environment and test-data posture, required…
لغة النص الأصلي: الإنجليزية
Curate WHAT belongs in the regression suite and at which tier — promotion criteria (every fixed bug gets a regression test; which tests earn smoke-tier status), retirement/demotion with written rationale (dead features, duplicated coverage, negative-value…
لغة النص الأصلي: الإنجليزية
Design the screenshot/visual-evidence policy for testing and releases — WHICH checkpoints require captures (risk-worthy states, not everything), a deterministic NAMING convention, mandatory MASKING of sensitive data (PII, tokens, tenant identifiers) before…
لغة النص الأصلي: الإنجليزية
Audit what the EXISTING tests actually cover — map requirements, risks, and code surfaces (routes, commands, services, schema, jobs) to the tests that exercise them, then rank the uncovered critical paths by risk. Distinguishes real verification from tests…
لغة النص الأصلي: الإنجليزية
Design the test-data strategy across all test layers — deterministic seed/fixture/factory design (personas, tenants, roles, stable ids), per-layer data sources (inline builders for unit, seeded DB for integration, API-created fixtures for E2E), parallel-run…
لغة النص الأصلي: الإنجليزية
Design the concrete test plan for ONE feature, change, or release — the requirement/risk being verified, in-scope and out-of-scope items, the test-layer split for THIS change (what is automated at which layer, what is manual), test data needs, environment…
لغة النص الأصلي: الإنجليزية
Design and specify an executable negative-test suite that PROVES tenant isolation and object-level authorization hold — cross-tenant reads/writes, IDOR by-id enumeration, privilege escalation, wrong-role and wrong-tenant access, and…
لغة النص الأصلي: الإنجليزية
Audit and (where asked) author row-level-security policies for a tenant-scoped database — inspect SELECT/INSERT/UPDATE/DELETE policies per table for missing tenant scope, deny-by-default gaps, policy recursion, unsafe SECURITY DEFINER helpers, over-broad…
لغة النص الأصلي: الإنجليزية
Review a database migration for security and deploy safety before it ships — privilege and GRANT changes, RLS/policy enablement gaps (a new tenant table with no policy), unsafe defaults, destructive or irreversible operations (DROP,…
لغة النص الأصلي: الإنجليزية
Security-focused review of an ACTUAL diff (PR, branch delta, or staged/working changes) — hunts authn/authz gaps, missing object-level and tenant-scope checks, injection, unsafe deserialization, secrets in code/config/logs, SSRF, mass assignment, and unsafe…
لغة النص الأصلي: الإنجليزية
Triage SAST / CodeQL / SARIF / linter-security output on first-party code into what actually matters — sort each finding into true-positive, false-positive, duplicate, or accepted-risk, and rank the true positives by reachability, exploitability, asset…
لغة النص الأصلي: الإنجليزية
Build a threat model for a feature or system BEFORE it is implemented — assets, actors, trust boundaries, data flows, STRIDE-style threat enumeration per boundary, abuse cases written from attacker behavior, risks ranked with concrete exploit paths,…
لغة النص الأصلي: الإنجليزية
Design a durable, tenant-scoped audit log system — an audit event taxonomy (authentication events, access-control changes, data access and exports, admin/support actions, security events, billing changes), a record schema (actor, tenant, action, target,…
لغة النص الأصلي: الإنجليزية
Turn pricing plans into enforceable entitlements — map plan × feature × limit into an entitlement matrix (boolean features, numeric limits, usage-metered quotas), define one resolution point and a uniform enforcement-point map (UI, API, command paths,…
لغة النص الأصلي: الإنجليزية
Review an existing multi-tenant system or design for cross-tenant leakage across EVERY surface — identity, data, API, storage, logs, analytics, support tooling, exports, imports, background jobs, search, AI retrieval, billing, feature flags, and audit — not…
لغة النص الأصلي: الإنجليزية
Define the tenant model for a SaaS product — what a tenant IS (organization, workspace, account), the hierarchy between those concepts, user-to-tenant membership (roles attached to membership, invitations, users in multiple tenants), ownership semantics, and…
لغة النص الأصلي: الإنجليزية
Write an Architecture Decision Record for a significant technical choice — context, the decision itself, alternatives genuinely considered, consequences (good and bad), operational impact, a rollback/reversal plan, and a review date. Use when a decision has…
لغة النص الأصلي: الإنجليزية
Design or redesign system structure — components, dependencies, data ownership, integration points — grounded in an inspection of the CURRENT architecture first, never from an imagined one. Produces a component map, dependency map, coupling/cohesion risk…
لغة النص الأصلي: الإنجليزية
Implement against frameworks, libraries, or external services by first identifying the EXACT versions installed in this repo and reading the matching documentation — official docs, local node_modules/vendored docs, changelogs — before writing any code.…
لغة النص الأصلي: الإنجليزية
Model the business domain before any implementation — extract ubiquitous language, actors, workflows, subdomains, bounded contexts, entities, value objects, aggregates, domain services, domain events, and context relationships from requirements, docs, and…
لغة النص الأصلي: الإنجليزية
Produce a principal-level analysis of a subsystem or codebase area that connects code-level findings upward to architecture, data ownership, security posture, tenant isolation, reliability, performance, operating cost, and maintainability — and outputs an…
لغة النص الأصلي: الإنجليزية
Drive an unknown-cause bug to its root cause through the fixed sequence reproduce → reduce → isolate → fix one thing → verify → prevent, with evidence at every step and no shotgun fixes. Use when something fails and the cause is not yet known — an…
لغة النص الأصلي: الإنجليزية
Implement behavior test-first with a strict red-green-refactor loop — write the failing test, run it, CONFIRM it fails for the intended reason (not a typo, import error, or wrong assertion), implement the minimal change to pass, and refactor only once green.…
لغة النص الأصلي: الإنجليزية
Run at the start of any repository or coding task, before reading or writing code. Verifies the working directory is the intended repo (git remote, landmark files), reads project instructions, status, and architecture docs, and separates verified facts from…
لغة النص الأصلي: الإنجليزية
Produce the end-of-task closeout report — what changed, what was intentionally NOT done or was omitted (always a dedicated section, "None" written explicitly when empty), files touched, tests and validation actually run with real results, evidence, risks,…
لغة النص الأصلي: الإنجليزية
Classify a requested change before starting work — docs-only, UI/style, frontend logic, backend/API, schema/migration, RLS/security, cloud/IaC, AI/agentic behavior, QA/test-only, refactor, bug fix, or release — and map the class to its required validation…
لغة النص الأصلي: الإنجليزية
Stop and obtain explicit human approval before work touches schema changes or destructive migrations, RLS or security policy, production data, secrets, deployments or releases, billing, git history rewrites, broad multi-file refactors, or any behavior whose…
لغة النص الأصلي: الإنجليزية
Keep a change small, scoped, and reviewable while implementing it — one intent per branch or PR, no drive-by edits, no opportunistic refactors, no generated noise or secrets staged. Stages only the intended files by explicit path and verifies the staged set…
لغة النص الأصلي: الإنجليزية
Resolve conflicts between current user instructions, repo docs, code, tests, PR history, and older chat or memory context before acting on any of them. Use when two sources disagree (a doc says X, the code does Y), when instructions reference repo state that…
لغة النص الأصلي: الإنجليزية