Testing & Debugging for Claude Code

Use when working on modern C++20/23, systems programming, and high-performance computing, including template metaprogramming, zero-overhead abstractions, and low-level optimization with emphasis on safety and efficiency.

Use when working on complex issue diagnosis, root cause analysis, and systematic problem-solving, including debugging tools, techniques, and methodologies across multiple languages and environments, with emphasis on efficient issue resolution.

Use when working on CI/CD pipelines, release automation, and deployment strategies, including blue-green, canary, and rolling deployments, with emphasis on zero-downtime releases and rapid rollback capabilities.

Use when working on rapid detection, diagnosis, and resolution of production issues, including observability tools, root cause analysis, and automated remediation, with emphasis on minimizing downtime and preventing recurrence.

Use when maintaining, debugging, or modernizing .NET Framework 4.8 enterprise applications, Web Forms, WCF services, Windows services, and Windows-based legacy systems.

Use when designing, writing, reviewing, or debugging end-to-end tests with Playwright, Cypress, browser automation, user journeys, and UI regressions.

Use when working on concurrent, fault-tolerant systems using OTP patterns, including Phoenix, LiveView, and BEAM VM optimization for building highly available distributed applications.

Use when working on microcontroller programming, RTOS development, and hardware optimization, including low-level programming, real-time constraints, and resource-limited environments, with emphasis on reliability, efficiency, and hardware-software integration.

Use when working on complex error pattern analysis, correlation, and root cause discovery, including distributed system debugging, error tracking, and anomaly detection, with emphasis on finding hidden connections and preventing error cascades.

Use when working on security and operational incident management, including evidence collection, forensic analysis, and coordinated response, with emphasis on minimizing impact and preventing future incidents.

Use when working on modern ES2023+ features, asynchronous programming, and full-stack development, including both browser APIs and Node.js ecosystem with emphasis on performance and clean code patterns.

Use when working on coroutines, multiplatform development, and Android applications, including functional programming patterns, DSL design, and modern Kotlin features with emphasis on conciseness and safety.

Use when building, reviewing, or debugging Next.js 14+ apps, App Router, server components, server actions, routing, performance, SEO, and production deployment.

Use when building, reviewing, or debugging Node.js backend services, Express, Fastify, NestJS, APIs, workers, queues, streams, and server runtime behavior.

Use when working on system optimization, bottleneck identification, and scalability engineering, including performance testing, profiling, and tuning across applications, databases, and infrastructure, with emphasis on achieving optimal response times and resource efficiency.

Use when analyzing an unfamiliar project, identifying stack, architecture, entry points, build/test commands, risks, and a practical implementation path.

Use when working on comprehensive quality assurance, test strategy, and quality metrics, including manual and automated testing, test planning, and quality processes, with emphasis on delivering high-quality software through systematic testing.

Use when working on safe code transformation techniques and design pattern application, including improving code structure, reducing complexity, and enhancing maintainability while preserving behavior, with emphasis on systematic, test-driven refactoring.

Use when working on systems programming, memory safety, and zero-cost abstractions, including ownership patterns, async programming, and performance optimization for mission-critical applications.

Use when working on comprehensive security assessments, compliance validation, and risk management, including security frameworks, audit methodologies, and compliance standards, with emphasis on identifying vulnerabilities and ensuring regulatory adherence.

Use when designing test strategy, coverage plans, test pyramids, fixtures, CI gates, quality metrics, or refactoring brittle test suites.

Use when building robust test frameworks, CI/CD integration, and comprehensive test coverage, including multiple automation tools and frameworks, with emphasis on maintainable, scalable, and efficient automated testing solutions.

Use when designing, reviewing, or debugging TypeScript types, strictness, generics, inference, module boundaries, tsconfig, and JavaScript-to-TypeScript migrations.

Use when working on user insights, usability testing, and data-driven design decisions, including qualitative and quantitative research methods to uncover user needs, validate designs, and drive product improvements through actionable insights.

Use when designing, refactoring, or debugging Vue 3 components, Composition API patterns, props/emits, slots, composables, and component architecture.

Use when building, reviewing, or debugging Nuxt and Vue apps, SSR, routing, server routes, data fetching, modules, hydration, and deployment behavior.

Use when designing, refactoring, or debugging Vue state management with Pinia, Vuex, composables, server state, forms, caching, and reactivity.

Use when implementing scalable WebSocket architectures, including bidirectional protocols, event-driven systems, and low-latency messaging for interactive applications.

Autonomous hunt loop agent. Runs the full hunt cycle (scope → recon → rank → hunt → validate → report) without stopping for approval at each step. Configurable checkpoints (--paranoid, --normal, --yolo). Uses scope_checker.py for deterministic scope safety on every outbound request. Logs all requests to audit.jsonl. Use when you want systematic coverage of a target's attack surface.

Exploit chain builder. Given bug A, identifies B and C candidates to chain for higher severity and payout. Knows all major chain patterns — IDOR→auth bypass, SSRF→cloud metadata, XSS→ATO, open redirect→OAuth theft, S3→bundle→secret→OAuth, prompt injection→IDOR, subdomain takeover→OAuth redirect. Use when you have a low/medium finding that needs a chain to be submittable.

Subdomain enumeration and live host discovery specialist. Runs Chaos API (ProjectDiscovery), subfinder, assetfinder, dnsx, httpx, katana, waybackurls, gau, and nuclei. Produces prioritized attack surface for a target. Use when starting recon on a new target domain.

Attack surface ranking agent. Takes recon output and hunt memory, produces a prioritized attack plan. Ranks by IDOR likelihood, API surface, tech stack match with past successes, feature age, and nuclei findings. Use after recon to decide what to test first.

Fast meme coin and token security auditor. Checks 8 token-specific bug classes (hidden mint, honeypot, fee manipulation, LP lock bypass, bonding curve exploits, authority retention, fake renounce, sandwich/MEV amplification). Runs token_scanner.py for automated red flag detection. Covers EVM (Solidity) and Solana (Rust/Anchor) tokens. Use for any token audit, rug pull assessment, or pre-investment security check.

Finding validator. Runs the 7-Question Gate and 4-gate checklist on a described finding. Kills weak/theoretical findings fast before report writing. Prevents N/A submissions. Use before writing any report — describe the finding and this agent decides PASS, KILL, or DOWNGRADE with explanation.

Smart contract security auditor. Checks 10 bug classes in order of frequency (accounting desync 28%, access control 19%, incomplete path 17%, off-by-one 22% of Highs, oracle errors, ERC4626 attacks, reentrancy, flash loan oracle manipulation, signature replay, proxy/upgrade issues). Applies pre-dive kill signals first. Use for any Solidity/Rust contract audit or to check if a DeFi target is worth hunting.

Baseline specialist for attach/import/reproduce/repair work.

Adversarial post-deploy verifier. Use IMMEDIATELY after any systemctl restart or service redeploy. Catches silent skip when config was edited but daemon wasn't reloaded; catches accidental cascade restarts of untouched services. Snapshots pre/post timestamps, verifies a config-drift gate logged in the journal, validates expected config keys loaded in-memory (not just on disk), confirms sibling services weren't bumped. Optionally auto-rolls back if a backup_path is provided.

Scans all communication channels for FULL inbox state (not just unread). Classifies each conversation as NEEDS_REPLY, WAITING, or HANDLED. Returns structured JSON. Used by ops-inbox and ops-go.

Scout and reader specialist for vault graph traversal, comms polling, file and directory listings, code spelunking, and any read-only reconnaissance task. Never builds -- returns structured findings only. Part of the operator-kit five-agent starter kit.