菜单
Black-box pentest of the Next.js storefront + admin. Auth flows, CSRF, XSS, client-side access control, cookie flags, CSP. Run before major releases.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Generate a BRAID reasoning graph (Mermaid flowchart TD) for a complex multi-step task. Cache to .local-artifacts/braid/<task-slug>.mmd. Hand to the braid-solver agent for execution. Use before non-trivial features, multi-hypothesis debugging, architecture decisions.
Run unit-test coverage for the changed surface and block if below threshold. Backend (Go) via go test -cover. Frontend (web) via vitest --coverage. Threshold 70% now, target 80%. Reports delta vs base branch.
Audit the gap between what the code is documented to do and what it actually does. Run before claiming any feature works, before a release, and whenever a doc/README/CLAUDE.md says a subsystem is "done". Turns "Presence ≠ completeness" into a repeatable check. Especially for marketplace sync, payment, invoice.
Create a GitHub issue with required milestone + labels + body template. Enforces the "no issue, no branch" rule. Returns the issue number for the branch name.
Capture Playwright snapshots + screenshots for a list of URLs. Saves artifacts to .local-artifacts/screenshots/<branch>/. Lightweight helper invoked by wtf-ux-playwright or directly when verifying a specific surface.
Black-box pentest of the Go/Gin REST API. JWT handling, IDOR, rate limiting, payment-callback verification, business-logic abuse. Run before major releases.
| name | web-app-pentest |
| description | Black-box pentest of the Next.js storefront + admin. Auth flows, CSRF, XSS, client-side access control, cookie flags, CSP. Run before major releases. |
Black-box test of the web surface. Probe: login/register/refresh flows, CSRF double-submit, stored
and reflected XSS, client-side route guards vs server-side enforcement, cookie flags
(httpOnly/Secure/SameSite), CSP and security headers. File findings under Phase S.
