Use when code has deliberate error paths but the tests only prove the success case. For each happy-path test, generates parameterized tests for validation errors, missing fields, wrong types, authorization failures, rate limits, conflicts and attack payloads in the project's test runner format.

Use when a weekly quality review, sprint check-in or quarterly portfolio review is due and the numbers already exist in CI, the tracker and the quarantine list. Computes pass rate, escaped defects and flake debt, rates each area red, amber or green, and rolls teams up into a portfolio view.

Use when a service is about to ship and its release steps live only in people's heads or a chat thread, or a shared release window needs its cutover order. Writes a six-phase runbook (pre-flight, smoke, canary, promote gate, rollout, verification) with baseline-relative criteria and rollback paths.

Use when AWS Lambda functions with API Gateway need testing locally: sam local invoke with event payloads, start-api for a local API Gateway, start-lambda for SDK clients and generate-event, plus .NET Lambda handler tests with Amazon.Lambda.TestUtilities.

Use for any question or task about CodeQL or deep semantic static analysis (SAST) on a GitHub repo, including setting up code scanning and finding injection that flows through helper functions across files: codeql database create and analyze per language, query packs, SARIF upload to code scanning, and suppressions.

Use whenever the task is to test a WebSocket endpoint or real-time server: connect, send and receive messages, ping/pong, close codes, reconnect after the server drops, subprotocols and backpressure, with ws, Python websockets or Playwright.

Use for any question or task about a Definition of Done, including what one should include, checking a PR or story against it, and stories marked done that bounce back from QA. Drafts a starter DoD and a per-PR checklist, and audits work line by line against an existing DoD with repository evidence, never on self-attestation.

Use when a pull request, release branch or feature is about to be security tested and needs a targeted test list. Maps the changed code to nine attack surfaces and attaches OWASP ASVS 4.0.3 requirements, Top 10 2021 IDs and WSTG sections, only for surfaces the change touches.

Use when customer-facing PDFs must meet PDF/UA (Section 508, EU accessibility rules, public tenders) and each file must be proven tagged before release. Checks structure tags, alt text, reading order, language and title with veraPDF, PAC or similar, mapped to WCAG PDF techniques.

Use when designing or adding tenant isolation tests to a multi-tenant app, adding a CI leak gate, or investigating a leak. Inventories tenant-bearing surfaces, then tests read-by-ID, list leaks, spoofed tenant IDs, JWT replay, storage IDOR, search, jobs and caches, plus Postgres row-level security.

Use for any question or task about scanning infrastructure code for misconfigurations with one tool, including Kubernetes manifests, Terraform, CloudFormation, Helm, ARM and Dockerfiles that run as root, or migrating off tfsec: trivy config with severity gating, .trivyignore suppressions, custom Rego checks and SARIF for GitHub code scanning. Legacy tfsec is in its references.

Use for any request to call or inspect a gRPC service from the command line or a script, including one quick call and servers without reflection: grpcurl list and describe via reflection or .proto files, unary and streaming calls with JSON input, TLS and plaintext flags, auth headers, and exit codes for smoke tests and CI gates.

Use when a gRPC service needs load testing or a latency regression gate: ghz runs with request count, concurrency, rate and duration, JSON, CSV or HTML output, and p50, p95 and p99 latency, RPS and error rates checked in CI.

Use whenever a GraphQL Yoga or Mercurius server needs tests: in-process yoga.fetch() for queries and mutations, executor-http for subscriptions and streaming, auth headers, and checks for disabled introspection and persisted operations. Mercurius app.inject() patterns are in its references.

Use when a game needs recorded play sessions as regression tests, netcode replays for spectators or esports, or reproducible bug repros for cert. Replays sessions bit-for-bit and checks the end state, via Unity InputEventTrace, Unreal's Replay System or deterministic Godot input replay.

Use for any question about whether a database migration is safe to run in production, including quick ones (is adding a NOT NULL column to a big Postgres table safe?) and after a migration locked a table: rename or drop a column, add a default, index or foreign key, change a type on a large PostgreSQL or MySQL table. Classifies each statement (additive, locking, breaking, data-loss) by lock and rewrite.

Use when a team runs ProjectDiscovery Nuclei for template-based web scanning, alongside or beyond ZAP: choosing templates by path, tag or severity, rate limits, JSONL output, custom YAML matchers for app-specific checks, community CVE templates and CI severity gates.

Use when deciding which browsers, OS versions and devices to test: a three-tier matrix built from traffic data, quarterly re-tier reviews, a published support policy and test budget, or the case for dropping an old browser. The Playwright, Selenium Grid and cloud-grid skills run it.

Use when designing or testing a command-line tool's output: a new flag, command or error message, CLI assertions, or flaky tests caused by unstable output. Sets the contract for exit codes, stdout vs stderr, --json output, ordering, color and --help, based on the Command Line Interface Guidelines.

Use whenever the code under test is a shell script, a CLI binary or anything run from Bash: argument parsing, flags, exit codes and output. Sets up Bats-core with @test blocks, run, status and output assertions, setup/teardown, shared helpers and TAP output for CI.