Testing & Security

This skill should be used when the user asks to "create literate tests", "generate markdown tests", "specification-as-tests", "TDD with markdown", "agent-driven testing", or mentions test suites where markdown IS the test format. NOT for pytest/jest/unittest. Creates .md test files with inline assertions and uses a bundled custom test runner.

Builds complete features full-stack (backend + frontend + tests). Triggers when user wants to implement a feature, add functionality, or build a specific capability.

Test authenticated routes in the your project using cookie-based authentication. Use this skill when testing API endpoints, validating route functionality, or debugging authentication issues. Includes patterns for using test-auth-route.js and mock authentication.

Build applications that require compilation. Use this skill before testing or running apps that need a build phase (e.g., C++ desktop app).

Consistent drawdown control pattern for trading systems - backtests, live trading, and training

Systematically fixes all failing tests in a project by running test commands repeatedly until 100% pass with zero warnings. Use when tests are failing, validation is not passing, or when asked to fix test suites. Works with any testing framework (Jest, Pytest, Go test, etc.) and ensures complete test compliance without skipping or modifying tests.

Design fix plans based on root cause analysis. Use after root cause is identified to plan specific code changes and test cases needed to fix the bug.

Turbo.json configuration template and validation logic for Turborepo pipelines. Use when creating or auditing turbo.json files to ensure correct pipeline task configuration, caching strategy, and the 7 required MetaSaver standards (schema, globalEnv, globalDependencies, 18 required tasks, build requirements, persistent task cache, clean task cache).

Audit code for security vulnerabilities using OWASP Top 10 guidelines. Use for security audits, pre-deploymentchecks, authentication reviews, or when checking for XSS, SQL injection, CSRF, or authorization issues. EXCLUSIVE to security-expert agent.

Use when working with Expo SDK modules for camera, location, notifications, file system, secure storage, and other device APIs. Covers permissions, configurations, and best practices.

테스트 실행 및 품질 검증. Use when:(1) 테스트 실행 요청, (2) 변경 후 검증 필요,(3) 커버리지 확인, (4) CI 전 로컬 검증.

Finalize a completed ticket: write 5-final.md, update 4-progress.md, commit.WHEN TO USE:- All required tests pass (via /pmc:ticket-status)- Ready to mark ticket as COMPLETE or BLOCKED- User says "complete ticket", "finalize", "wrap up ticket"PRODUCES:- 5-final.md with Status: COMPLETE or BLOCKED- Updated 4-progress.md frontmatter- Git commit: "T0000N: complete"

Write secure, optimized database queries using parameterized statements, proper indexing, and efficient data fetching patterns. Use this skill when writing database queries, ORM query methods, SQL statements, or data access layer code. When working on files containing Prisma queries, TypeORM query builders, raw SQL statements, database transaction logic, eager loading and joins, query optimization code, files implementing data pagination or filtering, cache strategies for expensive queries, or files handling database connection pooling and query timeouts.

PostCSS configuration template and validation logic for Tailwind CSS processing with Autoprefixer. Includes 4 required standards (required base plugins, critical plugin order with tailwindcss first and autoprefixer last, file naming as postcss.config.js, required dependencies). Use when creating or auditing postcss.config.js files to ensure correct CSS build pipeline.

DEPRECATED umbrella Skill (backward compatibility). Use only for cross-cutting security reviews spanning remote content + XSS/sanitization + store compliance. Prefer focused openwebf-security-* Skills.

Validate PM environment and authentication status. Use when (1) new PM onboarding, (2) checking required tools (gh CLI, Git, GitHub Projects access), (3) verifying GitHub auth and project permissions, (4) orchestrator auto-runs at work start.

Comprehensive 9-step development workflow ensuring quality through planning, implementation, review, testing, and documentation with worktree isolation. Includes agent assignments, quality gates, and AskUserQuestion usage. Use when orchestrating feature development or understanding the development process.

Strict test-driven development state machine with red-green-refactor cycles. Enforces test-first development, meaningful failures, minimum implementations, and full verification. Activates when user requests: 'use a TDD approach', 'start TDD', 'test-drive this'.

Build GitLab CI/CD pipelines with multi-stage workflows, caching, and distributed runners for scalable automation. Use when implementing GitLab CI/CD, optimizing pipeline performance, or setting up automated testing and deployment.

Use when you need to plan technical solutions that are scalable, secure, and maintainable.