tool-abuse-detection
Detect tool misuse and unexpected code execution via dialogue testing. Use when the agent exposes file, code-execution, or network tools.
Browse reusable Agent Skills, each with a clear purpose and practical guidance.
Detect tool misuse and unexpected code execution via dialogue testing. Use when the agent exposes file, code-execution, or network tools.
Test that requirements/install.sh works for an embodied model/env by building its venv and running the matching CI e2e test. Use when asked to test or verify an install, check a new model/env installs cleanly, run the e2e test for a model/env, confirm a venv works, or check that the model/checkpoint paths referenced by an e2e config actually exist on disk.
Reviews SARIF, CodeClimate, Compact, Markdown, and Badge output formats for spec compliance and CI integration correctness. Use when reviewing changes to fallow's CI-oriented output formats.
Reviews JSON output schema design, backwards compatibility, actions arrays, and machine-readability. Use when reviewing changes to fallow's JSON output format.
Red team agent for vm2 sandbox escape testing. Systematically attempts to break out of the vm2 JavaScript sandbox by exploiting known and novel attack vectors. Use this skill whenever the user makes changes to vm2's sandbox code (bridge.js, setup-sandbox.js, setup-node-sandbox.js, vm.js, nodevm.js, transformer.js) and wants to verify the sandbox still holds. Also use when the user asks to "hack", "attack", "test security", "try to escape", "red team", or "pentest" the sandbox. Trigger on any request to find sandbox escapes or verify sandbox integrity.
DashPlayer 日志聚焦调试技能。Use when developers ask to reduce noisy logs, focus on one feature log chain, add temporary focus markers (e.g. [FOCUS:token]), or clean up temporary debug logs after task completion. Triggers on: "日志太乱", "只看某个功能日志", "focus token", "withFocus", "临时日志标记", "清理调试日志".
DashPlayer 三层 Vitest-BDD 技能。Use when developers want business-readable BDD scenarios without coupling scenario writing to code implementation details. Triggers on: "BDD 三层", "行为测试分层", "给定当那么", "Vitest BDD", "不想在场景里写实现".
Post-commit PR review automation. After every commit to a PR, poll for AI reviewer comments (CodeRabbit, Sourcery, Claude Code Action, Kimi, SonarCloud), address every actionable item, wait for CI checks to pass, and loop until zero open comments and all checks green. Only then is the task considered done.
Testing conventions, CI pipeline rules, and smoke test coverage for SkillHub. Ensures agents write tests correctly and understand the CI gate requirements.