skills/local/cali-testing/SKILL.md
--- name: cali-testing description: Run post-implementation testing protocol. Triggers when: user says "test this", "run tests", "QA", "dogfood", "check quality", user finishes implementing a feature, or when a PR is ready for review. Also triggers on mentions of: test coverage, accessibility audit, WCAG, design review, code review, subagent review. Covers: parallel review via subagents, UI quality audit, accessibility check, and browser testing. --- # Testing Protocol After implementing any f
npx skillsauth add renatocaliari/agent-sync-public-skills skills/local/cali-testingInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
After implementing any feature, run this protocol before marking complete.
| Phase | What | When to skip | |-------|------|--------------| | Phase 1: Unit Tests | Run test suite, block on failure | Never | | Phase 2: Code Review | Parallel subagent review | <3 files changed | | Phase 3: UI Quality | Accessibility + design audit | Non-visual features | | Phase 4: Browser Testing | Interactive QA | Non-interactive features | | Phase 5: Final Checklist | Pre-completion verification | Never |
Run the project's test suite first:
# Go
go test ./...
# Node
npm test
# Python
pytest
Block until tests pass. Do not proceed with failing tests.
Launch fresh-context reviewers in parallel:
subagent({
tasks: [
{
agent: "reviewer",
task: "Review this diff for correctness, regressions, and edge cases. Focus on: logic errors, missing error handling, security issues, performance regressions. Provide specific line references.",
output: false
},
{
agent: "reviewer",
task: "Review this diff for simplicity and code quality. Focus on: unnecessary complexity, dead code, naming clarity, adherence to project conventions. Remove slop and verbosity.",
output: false
}
],
concurrency: 2,
context: "fresh"
})
When to use subagents:
When to skip:
Only if the scope involves a visual interface.
Load the audit skill for WCAG compliance:
/audit
Checks:
Load the critique skill for design quality:
/critique
Checks:
Load agent-browser and dogfood skills for interactive testing:
/dogfood
Steps:
Before marking feature complete:
Implement feature
↓
Run unit tests → FAIL? Fix first
↓
Parallel subagent review (if 3+ files)
↓
UI audit + critique (if visual)
↓
Browser testing (if interactive)
↓
Final checklist → All green? Mark complete
Input: "Just finished implementing the login form"
Steps:
go test ./... (or npm test)/audit for accessibility/dogfood to test in browserOutput: "All tests pass. Login form is accessible. Browser testing shows happy path works."
Input: "Just finished the payment system — touches 6 files"
Steps:
go test ./...Output: "Tests pass. Subagent review found 1 issue (missing error handling in payment_handler.go). Fixed."
Input: "Finished the dashboard redesign — new charts and layout"
Steps:
npm test/audit → found contrast issue on chart labels/critique → suggested reducing cognitive load/dogfood → all interactive elements workOutput: "Tests pass. Review clean. Accessibility found 1 contrast issue (fixed). Design review suggests simpler chart layout."
references/subagent-patterns.md — Subagent task structure patternstools
Auto-initialize structured documentation for any project using lat.md (knowledge graph of markdown files with [[wiki links]], // @lat: code refs, and semantic search). Detects cali-product-workflow artifacts (spec-product.md, spec-tech.md, critiques) and uses them as seed material. Falls back to extracting business rules, architecture, and design decisions directly from the codebase. Use when a project lacks structured documentation or when lat.md/ is missing. After seeding, lat.md extension hooks keep documentation alive automatically.
testing
[Cali] Server security audit and hardening for private servers behind Tailscale. Use when: auditing server security, hardening SSH/firewall/Docker, checking for vulnerabilities, setting up fail2ban, reviewing port exposure, or responding to security alerts. Covers 6 layers: CloudFlare, UFW, Tailscale, SSH, Docker, Application. Triggers: "server security", "security audit", "harden server", "SSH hardening", "firewall rules", "UFW config", "fail2ban", "port security", "Docker security", "vulnerability check", "security review".
tools
Run supply chain security scans before installing packages or before releases. Triggers when: user installs a package (npm, pip, go get, brew), user asks to 'scan dependencies', 'check vulnerabilities', 'supply chain', 'security audit', 'run trivy', 'run socket', or before any release/deployment. Also triggers on mentions of: socket.dev, trivy, OSV-scanner, dotenvx, CVE, dependency audit. Covers all four tools with concrete commands.
tools
Create GitHub releases following project conventions. Triggers when: user says 'release', 'create release', 'push release', 'deploy to main', 'merge to main', user merges a PR to main, or when git push to main is detected. Also triggers on mentions of: gh release, semver, version bump, changelog, release-please. Covers: config-driven (read .release.yml and execute) and fallback (gh CLI) release flows, versioning rules, tag management, and the mandatory release-on-merge convention.