Testing & Debugging for Claude Code

Quick 7-Question Gate triage on a finding before writing a report. Kills N/A submissions before they happen. Faster than /validate — for quick go/no-go decisions. Usage: /triage

Finding validation before writing any report — 7-Question Gate (all 7 questions), 4 pre-submission gates, always-rejected list, conditionally valid with chain table, CVSS 3.1 quick reference, severity decision guide, report title formula, 60-second pre-submit checklist. Use BEFORE writing any report. One wrong answer = kill the finding and move on. Saves N/A ratio.

Validate a finding — runs 7-Question Gate + 4-gate checklist. Kills weak findings before report writing. Prevents N/A submissions that hurt validity ratio. Usage: /validate

Finding validator. Runs the 7-Question Gate and 4-gate checklist on a described finding. Kills weak/theoretical findings fast before report writing. Prevents N/A submissions. Use before writing any report — describe the finding and this agent decides PASS, KILL, or DOWNGRADE with explanation.

Web2 recon pipeline — subdomain enumeration (subfinder, Chaos API, assetfinder), live host discovery (dnsx, httpx), URL crawling (katana, waybackurls, gau), directory fuzzing (ffuf), JS analysis (LinkFinder, SecretFinder), continuous monitoring (new subdomain alerts, JS change detection, GitHub commit watch). Use when starting recon on any web2 target or when asked about asset discovery, subdomain enum, or attack surface mapping.

Smart contract security audit — runs through 10 bug class checklist (accounting desync, access control, incomplete path, off-by-one, oracle errors, ERC4626, reentrancy, flash loan, signature replay, proxy/upgrade). Applies pre-dive kill signals first. Generates Foundry PoC template for confirmed findings. Usage: /web3-audit <contract.sol>

Smart contract security audit — 10 DeFi bug classes (accounting desync, access control, incomplete path, off-by-one, oracle, ERC4626, reentrancy, flash loan, signature replay, proxy), pre-dive kill signals (TVL < $500K etc), Foundry PoC template, grep patterns for each class, and real Immunefi paid examples. Use for any Solidity/Rust contract audit or when deciding whether a DeFi target is worth hunting.

Smart contract security auditor. Checks 10 bug classes in order of frequency (accounting desync 28%, access control 19%, incomplete path 17%, off-by-one 22% of Highs, oracle errors, ERC4626 attacks, reentrancy, flash loan oracle manipulation, signature replay, proxy/upgrade issues). Applies pre-dive kill signals first. Use for any Solidity/Rust contract audit or to check if a DeFi target is worth hunting.

Schema validation for notes. Checks against domain-specific templates. Validates required fields, enum values, description quality, and link health. Non-blocking — warns but doesn't prevent capture. Triggers on "/validate", "/validate [note]", "check schema", "validate note", "validate all".

> Analyze all vault tags: find unused, orphan, near-duplicate, over-used, and under-used tags. Suggest merges and cleanup actions. Triggers: EN: "tag garden", "clean up tags", "tag cleanup", "tag audit". IT: "tag garden", "pulizia tag", "revisione tag". FR: "jardinage des tags", "nettoyer les tags". ES: "jardín de tags", "limpiar tags". DE: "Tag-Garten", "Tags aufräumen". PT: "jardim de tags", "limpar tags".

Use when a quest needs to attach, import, reproduce, repair, verify, compare, or publish a baseline and its metrics.

Use when a quest is ready for a concrete implementation pass or a main experiment run tied to a selected idea and an accepted baseline.

Use when a quest does not start from a blank state and the agent must first audit, trust-rank, and reconcile existing baselines, results, drafts, or review materials before choosing the next anchor.

Baseline specialist for attach/import/reproduce/repair work.

Adversarial post-deploy verifier. Use IMMEDIATELY after any systemctl restart or service redeploy. Catches silent skip when config was edited but daemon wasn't reloaded; catches accidental cascade restarts of untouched services. Snapshots pre/post timestamps, verifies a config-drift gate logged in the journal, validates expected config keys loaded in-memory (not just on disk), confirms sibling services weren't bumped. Optionally auto-rolls back if a backup_path is provided.

Build a new application from a plain-English description using Shipwright's autonomous 9-phase pipeline

Scans all communication channels for FULL inbox state (not just unread). Classifies each conversation as NEEDS_REPLY, WAITING, or HANDLED. Returns structured JSON. Used by ops-inbox and ops-go.

Developer agent — implements features based on technical design, follows TDD patterns, and produces clean, tested code

Scout and reader specialist for vault graph traversal, comms polling, file and directory listings, code spelunking, and any read-only reconnaissance task. Never builds -- returns structured findings only. Part of the operator-kit five-agent starter kit.

Deeply analyzes codebase for a phase and returns structured assumptions with evidence. Spawned by discuss-phase assumptions mode.

Manages multi-cycle /gsd:debug checkpoint and continuation loop in isolated context. Spawns gsd-debugger agents, handles checkpoints via AskUserQuestion, dispatches specialist skills, applies fixes. Returns compact summary to main context. Spawned by /gsd:debug command.

Investigates bugs using scientific method, manages debug sessions, handles checkpoints. Spawned by /gsd:debug orchestrator.

Verifies factual claims in generated docs against the live codebase. Returns structured JSON per doc.

Retroactive audit of an implemented AI phase's evaluation coverage. Checks implementation against the AI-SPEC.md evaluation plan. Scores each eval dimension as COVERED/PARTIAL/MISSING. Produces a scored EVAL-REVIEW.md with findings, gaps, and remediation guidance. Spawned by /gsd:eval-review orchestrator.

Verifies cross-phase integration and E2E flows. Checks that phases connect properly and user workflows complete end-to-end.

Fills Nyquist validation gaps by generating tests and verifying coverage for phase requirements

Verifies phase goal achievement through goal-backward analysis. Checks codebase delivers what phase promised, not just that tasks completed. Creates VERIFICATION.md report.

Tier 1 (surface) Ralph Review. Dispatched by the /ralph-review command. Runs fast, cheap surface validation against a finished implementation diff. Never writes code.

Multi-service infrastructure health checker. Probes every AWS service the caller has IAM access to (ECS, EC2, RDS, Lambda, S3, CloudFront, ALB/NLB, API Gateway, SQS, SNS, DynamoDB, ElastiCache, Route 53, ACM, CloudWatch, Budgets, IAM) plus Vercel and GitHub Actions. Returns structured JSON with service health, accessible/inaccessible service lists, and severity-ranked anomaly flags. Used by ops-fires and ops-deploy.

Lightweight APM and metrics probe agent. Queries Datadog, New Relic, and OpenTelemetry backends for active alerts, error traces, and entity health. Returns structured JSON. Read-only — used by ops-monitor skill.

Pair programming mode — step-by-step collaboration with 5 confirmation checkpoints for learning and sensitive operations

Spawn a Codex reviewer agent against a specific PR

Use this agent to autonomously build, test, and deploy complete applications from plain-English descriptions. Runs a 9-phase pipeline across 4 stacks with enterprise-grade safety hooks.

Triage pull request CI results and review feedback with slop-mop

Run slop-mop's fast iterative development validation loop

Tier 2 (logic) Ralph Review. Dispatched by the /ralph-review command after Tier 1 passes. Runs medium-depth logic validation — evidence quality, scope alignment, fail-fast, observability, cross-boundary contracts. Never writes code.

Verify the TLS Radar plugin's connection and configuration

Run a free SSL/TLS scan on a domain (no account required)

Investigates a specific issue from Sentry, Linear, or GitHub. Finds the root cause in code, checks if it's already fixed, and either confirms resolution or creates a fix branch with a PR.

Agent that verifies build, lint, test, and checklist after TASK completion within a WORK. Automatically invoked by the scheduler. Verifies in read-only mode without modifying code.