Testing & Debugging for Claude Code

Use when maintaining, debugging, or modernizing .NET Framework 4.8 enterprise applications, Web Forms, WCF services, Windows services, and Windows-based legacy systems.

Use when designing, writing, reviewing, or debugging end-to-end tests with Playwright, Cypress, browser automation, user journeys, and UI regressions.

Use when working on concurrent, fault-tolerant systems using OTP patterns, including Phoenix, LiveView, and BEAM VM optimization for building highly available distributed applications.

Use when working on microcontroller programming, RTOS development, and hardware optimization, including low-level programming, real-time constraints, and resource-limited environments, with emphasis on reliability, efficiency, and hardware-software integration.

Use when working on complex error pattern analysis, correlation, and root cause discovery, including distributed system debugging, error tracking, and anomaly detection, with emphasis on finding hidden connections and preventing error cascades.

This skill should be used when the user asks to "learn ethical hacking", "understand penetration testing lifecycle", "perform reconnaissance", "conduct security scanning", "exploit vulnerabilities", or "write penetration test reports". It provides comprehensive ethical hacking methodology and techniques.

This skill should be used when the user asks to "test for directory traversal", "exploit path traversal vulnerabilities", "read arbitrary files through web applications", "find LFI vulnerabilities", or "access files outside web root". It provides comprehensive file path traversal attack and testing methodologies.

This skill should be used when the user asks to "test for HTML injection", "inject HTML into web pages", "perform HTML injection attacks", "deface web applications", or "test content injection vulnerabilities". It provides comprehensive HTML injection attack techniques and testing methodologies.

Run stepped HTTP load tests with ab/wrk, ramping concurrency levels to collect p50/p90/p99 latency, detect performance inflection points, and recommend optimal concurrency. Triggered by requests like 'load test this URL', 'benchmark my API', 'find the max concurrency', or mentions of p99 latency, throughput saturation, or capacity planning.

This skill should be used when the user asks to "test for insecure direct object references," "find IDOR vulnerabilities," "exploit broken access control," "enumerate user IDs or object references," or "bypass authorization to access other users' data." It provides comprehensive guidance for detecting, exploiting, and remediating IDOR vulnerabilities in web applications.

Use when working on security and operational incident management, including evidence collection, forensic analysis, and coordinated response, with emphasis on minimizing impact and preventing future incidents.

Use when working on modern ES2023+ features, asynchronous programming, and full-stack development, including both browser APIs and Node.js ecosystem with emphasis on performance and clean code patterns.

Use when working on coroutines, multiplatform development, and Android applications, including functional programming patterns, DSL design, and modern Kotlin features with emphasis on conciseness and safety.

This skill should be used when the user asks to "escalate privileges on Linux", "find privesc vectors on Linux systems", "exploit sudo misconfigurations", "abuse SUID binaries", "exploit cron jobs for root access", "enumerate Linux systems for privilege escalation", or "gain root access from low-privilege shell". It provides comprehensive techniques for identifying and exploiting privilege escalation paths on Linux systems.

Analyze log files to troubleshoot errors, identify peak error periods, and produce error clustering, frequency statistics, and time distribution reports. Supports JSON, syslog, and Nginx formats with automatic detection. Use when a user uploads a .log file and asks to analyze errors, find patterns, debug issues, or get distribution stats.

This skill should be used when the user asks to "use Metasploit for penetration testing", "exploit vulnerabilities with msfconsole", "create payloads with msfvenom", "perform post-exploitation", "use auxiliary modules for scanning", or "develop custom exploits". It provides comprehensive guidance for leveraging the Metasploit Framework in security assessments.

Use when building, reviewing, or debugging Next.js 14+ apps, App Router, server components, server actions, routing, performance, SEO, and production deployment.

Use when building, reviewing, or debugging Node.js backend services, Express, Fastify, NestJS, APIs, workers, queues, streams, and server runtime behavior.

This skill should be used when the user asks to "run pentest commands", "scan with nmap", "use metasploit exploits", "crack passwords with hydra or john", "scan web vulnerabilities with nikto", "enumerate networks", or needs essential penetration testing command references.

Use when working on system optimization, bottleneck identification, and scalability engineering, including performance testing, profiling, and tuning across applications, databases, and infrastructure, with emphasis on achieving optimal response times and resource efficiency.

Production-ready CI/CD configurations for Playwright — GitHub Actions, GitLab CI, CircleCI, Azure DevOps, Jenkins, Docker, parallel sharding, reporting, code coverage, and global setup/teardown.

Automates browser interactions for web testing, form filling, screenshots, and data extraction using playwright-cli. Use when the user needs to navigate websites, interact with web pages, fill forms, take screenshots, test web applications, extract information from web pages, mock network requests, manage browser sessions, or generate test code.

Battle-tested Playwright patterns for E2E, API, component, visual, accessibility, and security testing. Covers locators, assertions, fixtures, network mocking, auth flows, debugging, and framework recipes for React, Next.js, Vue, and Angular. TypeScript and JavaScript.

Step-by-step migration guides for moving to Playwright from Cypress or Selenium/WebDriver — command mappings, architecture changes, and incremental adoption strategies.

Page Object Model patterns for Playwright — when to use POM, how to structure page objects, and when fixtures or helpers are a better fit.

This skill should be used when the user asks to "escalate privileges", "get root access", "become administrator", "privesc techniques", "abuse sudo", "exploit SUID binaries", "Kerberoasting", "pass-the-ticket", "token impersonation", or needs guidance on post-exploitation privilege escalation for Linux or Windows systems.

Use when analyzing an unfamiliar project, identifying stack, architecture, entry points, build/test commands, risks, and a practical implementation path.

Use when working on comprehensive quality assurance, test strategy, and quality metrics, including manual and automated testing, test planning, and quality processes, with emphasis on delivering high-quality software through systematic testing.

This skill should be used when the user asks to "follow red team methodology", "perform bug bounty hunting", "automate reconnaissance", "hunt for XSS vulnerabilities", "enumerate subdomains", or needs security researcher techniques and tool configurations from top bug bounty hunters.

Use when working on safe code transformation techniques and design pattern application, including improving code structure, reducing complexity, and enhancing maintainability while preserving behavior, with emphasis on systematic, test-driven refactoring.

Run regression analysis (OLS or logistic) on uploaded CSV/Excel data, generating coefficients, R², p-values, VIF, and plain-language interpretation. Triggered by requests for regression modeling, fitting data, testing significance, checking multicollinearity, or keywords like OLS, logit, coefficient, p-value, or R-squared.

Use when working on systems programming, memory safety, and zero-cost abstractions, including ownership patterns, async programming, and performance optimization for mission-critical applications.

This skill should be used when the user asks to "perform vulnerability scanning", "scan networks for open ports", "assess web application security", "scan wireless networks", "detect malware", "check cloud security", or "evaluate system compliance". It provides comprehensive guidance on security scanning tools and methodologies.

Use when working on comprehensive security assessments, compliance validation, and risk management, including security frameworks, audit methodologies, and compliance standards, with emphasis on identifying vulnerabilities and ensuring regulatory adherence.

This skill should be used when the user asks to "search for exposed devices on the internet," "perform Shodan reconnaissance," "find vulnerable services using Shodan," "scan IP ranges with Shodan," or "discover IoT devices and open ports." It provides comprehensive guidance for using Shodan's search engine, CLI, and API for penetration testing reconnaissance.

This skill should be used when the user asks to "perform SMTP penetration testing", "enumerate email users", "test for open mail relays", "grab SMTP banners", "brute force email credentials", or "assess mail server security". It provides comprehensive techniques for testing SMTP server security.

This skill should be used when the user asks to "test for SQL injection vulnerabilities", "perform SQLi attacks", "bypass authentication using SQL injection", "extract database information through injection", "detect SQL injection flaws", or "exploit database query vulnerabilities". It provides comprehensive techniques for identifying, exploiting, and understanding SQL injection attack vectors across different database systems.

This skill should be used when the user asks to "automate SQL injection testing," "enumerate database structure," "extract database credentials using sqlmap," "dump tables and columns from a vulnerable database," or "perform automated database penetration testing." It provides comprehensive guidance for using SQLMap to detect and exploit SQL injection vulnerabilities.

This skill should be used when the user asks to "pentest SSH services", "enumerate SSH configurations", "brute force SSH credentials", "exploit SSH vulnerabilities", "perform SSH tunneling", or "audit SSH security". It provides comprehensive SSH penetration testing methodologies and techniques.

Use when designing test strategy, coverage plans, test pyramids, fixtures, CI gates, quality metrics, or refactoring brittle test suites.