菜单
Black-box pentest of the Go/Gin REST API. JWT handling, IDOR, rate limiting, payment-callback verification, business-logic abuse. Run before major releases.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Generate a BRAID reasoning graph (Mermaid flowchart TD) for a complex multi-step task. Cache to .local-artifacts/braid/<task-slug>.mmd. Hand to the braid-solver agent for execution. Use before non-trivial features, multi-hypothesis debugging, architecture decisions.
Run unit-test coverage for the changed surface and block if below threshold. Backend (Go) via go test -cover. Frontend (web) via vitest --coverage. Threshold 70% now, target 80%. Reports delta vs base branch.
Audit the gap between what the code is documented to do and what it actually does. Run before claiming any feature works, before a release, and whenever a doc/README/CLAUDE.md says a subsystem is "done". Turns "Presence ≠ completeness" into a repeatable check. Especially for marketplace sync, payment, invoice.
Create a GitHub issue with required milestone + labels + body template. Enforces the "no issue, no branch" rule. Returns the issue number for the branch name.
Capture Playwright snapshots + screenshots for a list of URLs. Saves artifacts to .local-artifacts/screenshots/<branch>/. Lightweight helper invoked by wtf-ux-playwright or directly when verifying a specific surface.
Black-box pentest of the deployment surface. TLS config, security headers, exposed ports, DNS, container exposure. Run before major releases and after infra changes.
| name | api-pentest |
| description | Black-box pentest of the Go/Gin REST API. JWT handling, IDOR, rate limiting, payment-callback verification, business-logic abuse. Run before major releases. |
Black-box test of the Go API. Probe: JWT forgery/expiry/refresh rotation, IDOR on member resources, rate-limit bypass, payment callback tampering (amount mismatch, replay), reservation race (two buyers, last unit), and business-logic abuse. File findings under Phase S.
