// Autonomous testing skill that opens a deployed app, goes through user flows, tries to break things, and writes detailed bug reports. Use after deploying to staging. Triggers on: test the app, find bugs, QA the deployment, break the app, test staging.
Convert bug reports into prd.json user stories for autonomous fixing. Use after running test-and-break skill. Triggers on: convert bugs to stories, fix these bugs, add bugs to prd, create fix stories.
Python-based threat modeling using pytm library for programmatic STRIDE analysis, data flow diagram generation, and automated security threat identification. Use when: (1) Creating threat models programmatically using Python code, (2) Generating data flow diagrams (DFDs) with automatic STRIDE threat identification, (3) Integrating threat modeling into CI/CD pipelines and shift-left security practices, (4) Analyzing system architecture for security threats across trust boundaries, (5) Producing threat reports with STRIDE categories and mitigation recommendations, (6) Maintaining threat models as code for version control and automation.
Hardcoded secret detection and prevention in git repositories and codebases using Gitleaks. Identifies passwords, API keys, tokens, and credentials through regex-based pattern matching and entropy analysis. Use when: (1) Scanning repositories for exposed secrets and credentials, (2) Implementing pre-commit hooks to prevent secret leakage, (3) Integrating secret detection into CI/CD pipelines, (4) Auditing codebases for compliance violations (PCI-DSS, SOC2, GDPR), (5) Establishing baseline secret detection and tracking new exposures, (6) Remediating historical secret exposures in git history.
Convert PRDs to prd.json format for the Ralph autonomous agent system. Use when you have an existing PRD and need to convert it to Ralph's JSON format. Triggers on: convert this prd, turn this into ralph format, create prd.json from this, ralph json.
Analyze a PRD for edge cases, failure modes, and scenarios that might be missed. Use after creating a PRD to strengthen it. Triggers on: analyze edge cases, find edge cases, what could go wrong, edge case analysis.
Review user stories for quality, proper sizing, sequencing, and acceptance criteria. Use before converting to prd.json. Triggers on: review stories, check user stories, story quality, validate stories.
| name | test-and-break |
| description | Autonomous testing skill that opens a deployed app, goes through user flows, tries to break things, and writes detailed bug reports. Use after deploying to staging. Triggers on: test the app, find bugs, QA the deployment, break the app, test staging. |
Systematically test a deployed application by going through user flows, trying edge cases, and attempting to break things. Outputs structured bug reports that can be converted to user stories for autonomous fixing.
npm install -g agent-browser && agent-browser install)Read tasks/prd.md and tasks/architecture.md to understand:
agent-browser open [DEPLOYMENT_URL]
agent-browser snapshot -i
For each major feature/flow in the PRD:
Try these at each input/interaction point:
Input Edge Cases:
<script>alert('xss')</script>, '; DROP TABLE users;--)Interaction Edge Cases:
State Edge Cases:
Visual/UX Issues:
For each issue found, document:
## BUG-XXX: [Short descriptive title]
**Severity:** Critical | High | Medium | Low
**Type:** Functional | UI/UX | Security | Performance | Accessibility
**Steps to Reproduce:**
1. Go to [URL]
2. Do [action]
3. Enter [input]
4. Click [button]
**Expected Behavior:**
[What should happen]
**Actual Behavior:**
[What actually happens]
**Screenshot:** [if applicable]
**Console Errors:** [if any]
**Notes:** [any additional context]
| Severity | Definition | Examples |
|---|---|---|
| Critical | App broken, data loss, security issue | Crash, XSS vulnerability, data not saving |
| High | Major feature broken, bad UX | Can't complete main flow, confusing errors |
| Medium | Feature works but has issues | Minor validation missing, UI glitches |
| Low | Polish/minor issues | Typos, slight misalignment, minor UX |
Save bug report to tasks/bug-report-[date].md:
# Bug Report: [App Name]
**Tested:** [Date]
**URL:** [Deployment URL]
**Tester:** Claude (Automated)
## Summary
- Total bugs found: X
- Critical: X
- High: X
- Medium: X
- Low: X
## Critical Bugs
[List critical bugs first]
## High Priority Bugs
[List high bugs]
## Medium Priority Bugs
[List medium bugs]
## Low Priority Bugs
[List low bugs]
## Positive Findings
[List things that worked well - important for context]
## Recommendations
[Overall suggestions for improvement]
After generating the bug report, convert each bug to a user story format:
{
"id": "BUG-001",
"title": "Fix: [Bug title]",
"description": "As a user, I expect [expected behavior] but currently [actual behavior].",
"acceptanceCriteria": [
"Specific fix criterion 1",
"Specific fix criterion 2",
"Regression test: [original bug steps] no longer reproduces",
"Typecheck passes"
],
"priority": 1,
"passes": false,
"notes": "Original bug: [reference]"
}
Priority mapping:
After generating bug stories, they can be:
To add to existing prd.json:
# Read current max priority
MAX_PRIORITY=$(cat prd.json | jq '[.userStories[].priority] | max')
# Add bug stories starting after max priority
# (Claude should do this programmatically)
# 1. Open the app
agent-browser open https://my-app-staging.vercel.app
# 2. Take initial snapshot
agent-browser snapshot -i
# 3. Test login flow
agent-browser fill @e1 "test@example.com"
agent-browser fill @e2 "password123"
agent-browser click @e3
agent-browser wait --load networkidle
agent-browser snapshot -i
# 4. Try to break it
agent-browser fill @e1 "" # empty email
agent-browser click @e3 # submit anyway
agent-browser snapshot -i # check error handling
# 5. Try XSS
agent-browser fill @e1 "<script>alert('xss')</script>"
agent-browser snapshot -i
# Continue testing other flows...
Before finishing testing: