Testing Claude Skills
3 543 testing skills from 425 authors. They run test suites, check accessibility and catch what broke. Half of them fit into 1 799 tokens or less — that is what one costs your context window when the agent loads it. 404 ship runnable scripts rather than instructions alone. 2 of them cannot work without an MCP server, most often rube. We also found 429 copies of these same skills sitting in other people's repositories — counted once here, not 429 times.
3 543 unique 425 authors 2 updated this month 331 from vendors
This skill should be used when the user asks to "intercept HTTP traffic", "modify web requests", "use Burp Suite for testing", "perform web vulnerability scanning", "test with Burp Repeater", "analyze HTTP history", or "configure proxy for web testing". It provides comprehensive guidance for using Burp Suite's core features for web application security testing.
This skill should be used when the user asks to "test for directory traversal", "exploit path traversal vulnerabilities", "read arbitrary files through web applications", "find LFI vulnerabilities", or "access files outside web root". It provides comprehensive file path traversal attack and testing methodologies.
This skill should be used when the user asks to "test for HTML injection", "inject HTML into web pages", "perform HTML injection attacks", "deface web applications", or "test content injection vulnerabilities". It provides comprehensive HTML injection attack techniques and testing methodologies.
This skill should be used when the user asks to "test for insecure direct object references," "find IDOR vulnerabilities," "exploit broken access control," "enumerate user IDs or object references," or "bypass authorization to access other users' data." It provides comprehensive guidance for detecting, exploiting, and remediating IDOR vulnerabilities in web applications.
This skill should be used when the user asks to "set up a web server", "configure HTTP or HTTPS", "perform SNMP enumeration", "configure SMB shares", "test network services", or needs guidance on configuring and testing network services for penetration testing labs.
This skill should be used when the user asks to "run pentest commands", "scan with nmap", "use metasploit exploits", "crack passwords with hydra or john", "scan web vulnerabilities with nikto", "enumerate networks", or needs essential penetration testing command references.
This skill should be used when the user asks to "search for exposed devices on the internet," "perform Shodan reconnaissance," "find vulnerable services using Shodan," "scan IP ranges with Shodan," or "discover IoT devices and open ports." It provides comprehensive guidance for using Shodan's search engine, CLI, and API for penetration testing reconnaissance.
This skill should be used when the user asks to "perform SMTP penetration testing", "enumerate email users", "test for open mail relays", "grab SMTP banners", "brute force email credentials", or "assess mail server security". It provides comprehensive techniques for testing SMTP server security.
This skill should be used when the user asks to "test for SQL injection vulnerabilities", "perform SQLi attacks", "bypass authentication using SQL injection", "extract database information through injection", "detect SQL injection flaws", or "exploit database query vulnerabilities". It provides comprehensive techniques for identifying, exploiting, and understanding SQL injection attack vectors across different database systems.
This skill should be used when the user asks to "automate SQL injection testing," "enumerate database structure," "extract database credentials using sqlmap," "dump tables and columns from a vulnerable database," or "perform automated database penetration testing." It provides comprehensive guidance for using SQLMap to detect and exploit SQL injection vulnerabilities.
This skill should be used when the user asks to "pentest SSH services", "enumerate SSH configurations", "brute force SSH credentials", "exploit SSH vulnerabilities", "perform SSH tunneling", or "audit SSH security". It provides comprehensive SSH penetration testing methodologies and techniques.
This skill should be used when the user asks to "pentest WordPress sites", "scan WordPress for vulnerabilities", "enumerate WordPress users, themes, or plugins", "exploit WordPress vulnerabilities", or "use WPScan". It provides comprehensive WordPress security assessment methodologies.
This skill should be used when the user asks to "test for XSS vulnerabilities", "perform cross-site scripting attacks", "identify HTML injection flaws", "exploit client-side injection vulnerabilities", "steal cookies via XSS", or "bypass content security policies". It provides comprehensive techniques for detecting, exploiting, and understanding XSS and HTML injection attack vectors in web applications.
Write thorough tests following TDD and BDD principles
Use for nontrivial Effect-TS work including services/layers, typed errors, Schema/JSONSchema, Config, runtime/concurrency, @effect/vitest, @effect/ai, @effect/sql, or @prb/effect-next.
mocks, testing utilities, and coverage."
Writes, refactors, and evaluates prompts for LLMs — generating optimized prompt templates, structured output schemas, evaluation rubrics, and test suites. Use when designing prompts for new LLM applications, refactoring existing prompts for better accuracy or token efficiency, implementing chain-of-thought or few-shot learning, creating system prompts with personas and guardrails, building JSON/function-calling schemas, or developing prompt evaluation frameworks to measure and improve model performance.
Assess Azure resource capacity, quota utilization, and growth trends to prevent outages from resource exhaustion. Use when asked about capacity, quotas, scaling readiness, load testing prep, Black Friday readiness, or growth projections.
Testing Craft CMS 5 plugins and modules with Pest — test isolation, database safety, and the markhuot/craft-pest-core harness. ALWAYS load when writing, running, fixing, or reviewing tests for a Craft plugin or module, and whenever a suite touches a real Craft install. Covers why rollback is opt-in, tests/Pest.php + tests/bootstrap.php wiring, phpunit.xml.dist <env> pins (force the DB name and table prefix, default the connection coordinates so CI still connects), why --configuration= defeats DB isolation, installing the plugin under test, pinning the process timezone after app creation, per-test site fixtures, idempotent Install migrations, stale service caches when components get swapped, muting audit sinks, queue stubs, factories, HTTP/DB assertions, CI test jobs. Triggers on: Pest, pestphp, craft-pest-core, markhuot, RefreshesDatabase, InstallsCraft, tests/Pest.php, phpunit.xml.dist, vendor/bin/pest, composer test, ddev craft pest, db_test, CRAFT_DB_DATABASE, CRAFT_DB_TABLE_PREFIX, Entry::factory(), assertDatabaseHas, afterEach, transaction rollback, test site fixture, fixture cleanup sweep, createIndexIfMissing, Db::findForeignKey, UserPermissions::reset(), 'too many keys', 'tests pollute the database', 'tests created thousands of entries', 'passes on dev but fails in isolation', 'passes alone but fails in the suite', 'datetimes off by hours in tests', 'connects locally but not on CI', flaky order-dependent test, no Pest job in CI. Do NOT trigger for front-end/JS testing or PHP style analysis.
Craft CMS 5 plugin and module development — extending Craft with PHP. Covers elements, element queries, services, models, records, controllers, migrations, queue jobs, console commands, field types, native fields, events, behaviors, Twig extensions, widgets, filesystems, permissions, project config, GraphQL, testing, and debugging. Triggers on: beforePrepare()/afterSave()/defineSources()/defineTableAttributes()/attributeHtml(), MemoizableArray, BaseNativeField, EVENT_REGISTER_*/DEFINE_*/BEFORE_*/AFTER_*, CraftVariable, custom element or field type (normalizeValue/serializeValue/inputHtml), webhook, API endpoint, queue/batch job, CP section, dashboard widget, utility page, element action/exporter/condition, registerUserPermissions, requirePermission vs requireAdmin, kebab-case permission handles, allowAdminChanges, canView/canSave/canDelete, defineRules, elevated session, project-config/apply, drafts/revisions, element edit sidebar (EVENT_DEFINE_SIDEBAR_HTML) + toolbar buttons, metaFieldsHtml, VueAdminTable, GeneralConfig, getIsMultiSite/refreshSites stale after creating a site, deleteSite phantom sites, element query stops filtering by siteId, naive UTC datetime columns and strtotime drift, element-query ['like'] tuple matches nothing. Always use when writing, editing, or reviewing Craft plugin/module PHP — even when no API is named. For plugin-specific work also load craft-plugins. Do NOT trigger for front-end Twig (craft-site) or content modeling (craft-content-modeling).
Route OpenSkills development tasks to the right project skill or subagent, including sequencing rules for debugging, feature work, regression checks, and release readiness.
Run deterministic OpenSkills end-to-end validation across runtime tests and example agents, then report tool calls, activation behavior, and regressions.
Prepare and validate OpenSkills release readiness across runtime, bindings, examples, and regression gates with a deterministic checklist and go/no-go outcome.
Producing automated feature demo videos via Playwright E2E tests. Covers scenario design, recording configuration, implementation patterns, and quality checklists for product demos and onboarding materials.
Implementing pure-native app features for iOS (Swift 6.3 + SwiftUI + Liquid Glass), Android (Kotlin 2.4+ + Jetpack Compose + Material 3 Expressive), and macOS desktop (SwiftUI for Mac + AppKit interop, scenes/menu bar/document apps, sandbox + notarization + Sparkle, Mac HIG). Builds production features with @Observable/Swift Concurrency, Compose Strong Skipping, SwiftData/Room, Passkeys, Privacy Manifest, App Intents, Foundation Models/Gemini Nano, and store-compliance staged rollout. Also runs the agent visual loop for screen implementation and visual debugging against a reference design (Xcode MCP RenderPreview, XcodeBuildMCP, mobile-mcp, screenshot diffing). Use when building production iOS/Android/macOS features or iterating a native screen until it matches a design. Not for cross-platform (RN/Flutter/KMP/CMP), porting design (Port), prototypes (Forge), mockup-to-code (Pixel), automating existing Mac apps via AppleScript/JXA (Hearth), test suites (Snap/Voyager), or web (Artisan).
Defining KPIs, designing tracking events, and specifying dashboards. Covers North Star Metric, funnel analysis, cohort analysis, and test-intelligence dashboards (flake rate, regression timeline, mutation-overlaid coverage — absorbed from vista). GA4/Amplitude/Mixpanel/PostHog integration. Use when metrics or test-telemetry dashboards are needed.
Adding edge-case tests, repairing flaky tests, and improving coverage. Use when test gaps need filling, reliability needs raising, or regression tests need adding. Multi-language support (JS/TS, Python, Go, Rust, Java).
Automating iOS UI via XCUITest, accessibility-identifier-driven queries, programmatic screenshot capture, and fastlane snapshot pipelines for App Store assets. Authors XCUITest targets with XCUIApplication/XCUIElement/XCUIElementQuery patterns, Page Objects in Swift, status-bar-clean sessions, and xcodebuild+xcresulttool CI. Use when authoring iOS UI tests or store-screenshot pipelines. Not for cross-platform E2E (Voyager — Appium/Detox/Maestro), iOS feature impl (Native), demo recording (Director), or unit tests (Radar).
Verifying system resilience via load testing, contract testing, chaos engineering, and mutation testing. Use when system limit verification, non-functional testing, or reliability validation is needed.
Investigating git history, analyzing regression root causes, and performing code archaeology. Time-travels through commit history to uncover truth. Use when git history investigation or regression analysis is needed.
Automating browsers via Playwright and Chrome DevTools for data collection, form interaction, screenshot capture, and network monitoring. Task completion focus (vs Voyager for E2E testing).
Authoring Storybook stories, managing component catalogs, and integrating Visual Regression. Covers UI component docs, visual testing, CSF 3.0/Factories. Supports Storybook 10 (ESM-only) and React Cosmos. Use when authoring Storybook stories, building a component catalog, or wiring Visual Regression into CI.
Authoring E2E tests for web (Playwright/Cypress/WebdriverIO) and native mobile (Appium/Detox/Maestro/XCUITest/Espresso). Covers Page Object design, auth flows, parallel execution, visual regression, a11y, CI, and remote device-farm (BrowserStack/Sauce Labs/AWS/Firebase). Use when authoring E2E suites. Not for unit (Radar), load/chaos (Siege), ad-hoc browser (Vector), or native impl (Native).
Systematic root cause analysis for production and development bugs. Hypothesis-driven debugging — never guess-and-check.
Test real system boundaries, not mocks of mocks. Integration tests verify that components work together, not that they work in isolation.
Red-green-refactor cycle with meaningful coverage. Tests are written before implementation. Coverage is a side effect of good tests, not the goal.
Use when the user wants to create a new CLAUDE.md from scratch for a repository, bootstrap project memory for a new repo, set up a repo for Claude Code for the first time, or completely rewrite an existing CLAUDE.md deemed unsalvageable. Produces a lean, high-signal file under 80 lines (120 hard cap) by scanning the repo for mechanical content (stack, commands, structure) and interviewing the user for judgment content (WHY, gotchas, out-of-scope, approval gates, testing philosophy, external docs like Confluence pages). NOT for auditing or incrementally improving an existing CLAUDE.md — that is the claude-md-improver skill's role.
Ecto patterns for Phoenix/Elixir apps. Covers schemas, changesets, migrations, queries, Ecto.Multi, transactions, constraints, associations, pagination, tenant partitioning, performance, and testing.
Production gRPC in Go: protobuf layout, codegen, interceptors, deadlines, error codes, streaming, health checks, TLS, and testing with bufconn
Comprehensive Go testing strategies including table-driven tests, testify assertions, gomock interface mocking, benchmark testing, and CI/CD integration
Production-ready Express.js development covering middleware architecture, error handling, security hardening, testing strategies, and deployment patterns
Hono testing patterns - app.request(), test client, mocking environment, and integration testing strategies
Cypress end-to-end and component testing patterns for web apps: reliable selectors, stable waits, network stubbing, auth handling, CI parallelization, and flake reduction
WordPress plugin and theme testing with PHPUnit integration tests, WP_Mock unit tests, PHPCS coding standards, and CI/CD workflows
pytest - Python's most powerful testing framework with fixtures, parametrization, plugins, and framework integration for FastAPI, Django, Flask
Axum (Rust) web framework patterns for production APIs: routers/extractors, state, middleware, error handling, tracing, graceful shutdown, and testing
Production Fastify (TypeScript) patterns: schema validation, plugins, typed routes, error handling, security hardening, logging, testing with inject, and graceful shutdown
Jest with TypeScript - Industry standard testing framework with 70% market share, mature ecosystem, React Testing Library integration