菜单
Periodic penetration testing suite. Covers web app (Next.js), REST API (Go/Gin), and deployment surface. Use before every major release and quarterly thereafter. Complements wtf-security (code review) with black-box dynamic testing.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Generate a BRAID reasoning graph (Mermaid flowchart TD) for a complex multi-step task. Cache to .local-artifacts/braid/<task-slug>.mmd. Hand to the braid-solver agent for execution. Use before non-trivial features, multi-hypothesis debugging, architecture decisions.
Run unit-test coverage for the changed surface and block if below threshold. Backend (Go) via go test -cover. Frontend (web) via vitest --coverage. Threshold 70% now, target 80%. Reports delta vs base branch.
Audit the gap between what the code is documented to do and what it actually does. Run before claiming any feature works, before a release, and whenever a doc/README/CLAUDE.md says a subsystem is "done". Turns "Presence ≠ completeness" into a repeatable check. Especially for marketplace sync, payment, invoice.
Create a GitHub issue with required milestone + labels + body template. Enforces the "no issue, no branch" rule. Returns the issue number for the branch name.
Capture Playwright snapshots + screenshots for a list of URLs. Saves artifacts to .local-artifacts/screenshots/<branch>/. Lightweight helper invoked by wtf-ux-playwright or directly when verifying a specific surface.
Black-box pentest of the Go/Gin REST API. JWT handling, IDOR, rate limiting, payment-callback verification, business-logic abuse. Run before major releases.
| name | security-pentest |
| description | Periodic penetration testing suite. Covers web app (Next.js), REST API (Go/Gin), and deployment surface. Use before every major release and quarterly thereafter. Complements wtf-security (code review) with black-box dynamic testing. |
Black-box dynamic pentest. Complements wtf-security (static code review). Three sub-skills,
run in parallel before every major release and quarterly:
security-pentest/web-app-pentest — Next.js frontend flows.security-pentest/api-pentest — Go REST API (JWT, IDOR, rate limiting, business logic).security-pentest/network-pentest — TLS, headers, exposed ports, DNS.Findings → GitHub issues under the Phase S: Security Hardening milestone. CRITICAL → hotfix branch immediately.
This skill family was inspired by mukul975/Anthropic-Cybersecurity-Skills.