NeVibeCode · 1,630 items
Skills for Testing and QA
Skills for Testing and QA: what each one does, an install command and example prompts.
performing-web-application-vulnerability-triage skill Triages SAST and DAST scanner findings, filters false positives, and calculates OWASP risk scores. It helps teams prioritize fixes and cut alert fatigue.
CX Codex +1
433installs
tdd-guide skill Guides test-driven development, builds unit tests, and detects test coverage gaps. It supports Jest, Pytest, JUnit, and Vitest projects.
1,017installs
d3k skill Runs a project dev server and a monitored browser with a shared chronological event timeline. Helps developers and agents debug local web app issues.
CX Codex +1
859installs
api-auth-and-jwt-abuse skill A playbook for probing bearer tokens, API keys and claim trust. Useful when an API leans on JWT or request headers for identity.
CX Codex +1
3,800installs
api-recon-and-docs skill A playbook skill for mapping REST, mobile, and GraphQL API surfaces. It finds hidden routes, OpenAPI schemas, and legacy version drift before testing.
CX Codex +1
3,800installs
idor-broken-object-authorization skill A testing playbook for IDOR, BOLA and BFLA: where object identifiers hide, how to run A-B tests, and how to chain a finding into privilege escalation.
CX Codex +1
3,800installs
authbypass-authentication-flaws skill Testing playbook for authentication flaws. It guides assessments of login flows, password reset logic, account enumeration, brute-force protections, and MFA bypasses.
CX Codex +1
3,800installs
ux-review skill Runs a UX spec, HUD design or pattern library through a checklist and returns a verdict, from APPROVED to MAJOR REVISION NEEDED.
CX Codex +1
474installs
self-improving-agent skill Turns workflow failures, corrections, and workarounds into auditable rules for agents. Prevents blind instruction rewrites by requiring executable proof first.
CX Codex +1
35,100installs
bug-report skill Formats structured bug reports from descriptions, inspects source files for bugs, and verifies fixes. Built for game dev workflows that need clear reproduction steps and severity levels.
CX Codex +1
473installs
wp-patterns skill Creates and updates WordPress block patterns, then checks registration and markup. Useful for templates, starter pages, and Query Loop layouts.
CX Codex +1
2,200installs
asset-audit skill Audits game assets against naming conventions and size budgets, flagging orphaned files and broken references in code.
CX Codex +1
469installs
check skill The skill reads SPEC.md and diffs it against the code. It writes nothing and only reports violations grouped by severity.
CX Codex +1
2,700installs
build skill Implements tasks from SPEC.md through a plan, execution and verification loop. Use it for a specific §T task or the next unfinished item.
CX Codex +1
2,700installs
working-with-legacy-code skill A skill for untested codebases: get classes under test, pin current behavior, and change code one verifiable step at a time.
CX Codex +1
3,300installs
csrf-cross-site-request-forgery skill A CSRF testing playbook for state-changing web flows, token checks, SameSite behavior, JSON requests, login CSRF, and OAuth state.
CX Codex +1
3,700installs
business-logic-vuln skill Routes security testing toward business logic and state machine flaws. Focuses on race conditions, stacked discounts, quota bypasses, and workflow abuse.
CX Codex +1
3,700installs
injection-checking skill A router skill for injection testing: pick the right workflow based on where attacker-controlled input ends up.
CX Codex +1
3,700installs
auth-sec skill Entry P1 category router for authentication and authorization testing. Helps choose the right audit path before digging into specific attacks.
CX Codex +1
3,700installs
api-authorization-and-bola skill A playbook for testing API authorization: reaching other users' objects, calling functions your role should not have, and writing hidden fields.
CX Codex +1
3,700installs
websocket-security skill Helps analyze WebSocket security, detect CSWSH vulnerabilities, and review handshake headers. Useful when auditing real-time messaging, notifications, or WS-backed APIs.
CX Codex +1
3,800installs
a11y-audit skill Scans web projects for WCAG 2.2 Level A and AA issues, suggests fixes, then checks the result again. Use it before a release or when adding accessibility checks to CI/CD.
970installs
prototype skill This skill turns one game mechanic into a throwaway prototype and returns a PROCEED, PIVOT, KILL, or NOT ASSESSED verdict. Use it before GDD work.
CX Codex +1
461installs
ux-researcher-designer skill This skill helps turn user data into personas, journey maps, usability test plans, and design recommendations. Use it when research findings need a clear structure.
962installs
launch-checklist skill Builds a game launch-readiness checklist across code, content, store setup, infrastructure, and sign-offs. It supports planned runs and dry-run mode.
CX Codex +1
454installs
localize skill A localization pipeline for games: finds hardcoded strings, builds translation tables, checks RTL layouts, runs cultural review and pre-release QA.
CX Codex +1
453installs
backprop skill Turns bug fixes into specification updates in SPEC.md. The agent traces the failure, drafts a testable invariant, adds a failing test, and commits everything together.
CX Codex +1
2,600installs
prototype-pollution skill Tests JavaScript stacks for prototype pollution, from unsafe object merges to polluted-property reads. Use it for authorized Node or browser security reviews.
CX Codex +1
3,600installs
hash-attack-techniques skill A playbook for hash attacks: length extension, MD5 and SHA-1 collisions, HMAC timing leaks, proof of work. Built for CTFs and authorized testing.
CX Codex +1
3,600installs
saml-sso-assertion-attacks skill A playbook for SAML SSO testing: which XML nodes are signed, how Audience and ACS checks behave, and where IdP/SP trust breaks down.
CX Codex +1
3,600installs
clickjacking skill A clickjacking playbook: find out whether a page can be framed and whether an invisible overlay can trigger a sensitive action.
CX Codex +1
3,600installs
jndi-injection skill A playbook for JNDI injection: lookup abuse over RMI and LDAP, JDK version limits, and post-8u191 bypasses. Useful when testing Java apps for Log4Shell.
CX Codex +1
3,600installs
csv-formula-injection skill A skill for testing how CSV exports and spreadsheets handle formulas coming from user fields. Useful when reports or exports reach a spreadsheet.
CX Codex +1
3,600installs
http-host-header-attacks skill Playbook for HTTP Host header attacks: password reset poisoning, cache poisoning, routing SSRF, and virtual host bypass. Useful for auditing applications that trust incoming headers.
CX Codex +1
3,600installs
web-cache-deception skill This skill guides checks for cached authenticated pages and cache poisoning conditions. Use it when auditing a CDN, reverse proxy, or application cache.
CX Codex +1
3,600installs
crlf-injection skill A playbook for CRLF injection: smuggling carriage-return and line-feed characters into response headers, redirects and logs. Useful when scanners miss it.
CX Codex +1
3,600installs
symbolic-execution-tools skill A symbolic execution playbook that keeps your agent's angr, Z3 and Unicorn scripts from breaking on state setup and missing libc hooks.
CX Codex +1
3,600installs
race-condition skill A skill for testing web apps for race conditions and TOCTOU: parallel requests, rate-limit bypass, one-time operations.
CX Codex +1
3,600installs
http-parameter-pollution skill Guides agents through HTTP Parameter Pollution tests when WAFs, proxies, and backends parse duplicate parameters differently. Built for API security assessments.
CX Codex +1
3,600installs
format-string-exploitation skill Walks through exploiting printf-family calls that take a user-controlled format string: stack reads, writes via %n, GOT overwrites. Built for CTF work and binary review.
CX Codex +1
3,600installs
601–640 of 1,630
