Explorar skills

Use when implementation and tests are complete and you're ready to close out a task

Docker and OCI image hardening — base-image selection, USER/caps/read-only FS discipline, distroless migration, build-time scanning with trivy/grype, image signing via sigstore, and runtime guardrails (seccomp, AppArmor).

Use when you need to request a code review for a PR/MR and want a consistent review brief (context, scope, risk areas, test instructions, acceptance criteria) before merge.

Vendor security questionnaire workflow — vendor tiering, standardized questionnaires (CAIQ, SIG-Lite/Core, VSA), custom authoring, evidence reuse against existing attestations (SOC 2, ISO 27001), and ongoing vendor-risk monitoring.

Verification discipline for completion claims. Use when about to assert success, claim a fix is complete, report tests passing, or before commits and PRs. Enforces evidence-first workflow.

Gerencie atualizações de versão de dependências principais com análise de compatibilidade, lançamento faseado e testes abrangentes. Utilize ao atualizar versões de frameworks, dependências principais ou ao lidar com mudanças que quebram a compatibilidade em bibliotecas.

Use when implementation is complete and tests pass — presents structured options for merge, PR, or cleanup to integrate the work.

Generate integration tests for a Java class using Testcontainers. Supports Spring Boot (3.1+), Quarkus (3.0+), and Micronaut (4.0+). Detects class type (repository, controller, service) and applies framework-appropriate test patterns. Requires Java 17+.

Use cabal with --disable-optimization for development builds and tests, and add --enable-tests to avoid rebuilds. Use when running or suggesting cabal build or test commands in Haskell development.

Use when creating demo data, test fixtures, seed scripts, or factory functions, when preparing for a sales demo and the screenshots are full of "John Doe", when test data is missing edge cases, or when seed scripts crash on a second run.

Show the current Qualflare state for this project — detected frameworks, test counts, hook setting, and last upload info. Use when the user runs /qf-state, asks "what does Qualflare know about this project?", or asks about their current Qualflare setup.

Use when user says "validate this", "get feedback", "cross-validate", "what are we missing", when seeking external review before committing to major decisions, when stress-testing a design with senior reviewers, or when reviewer responses need to be synthesized into actionable changes.