Claude Code: Testing & Development Skills

Orchestration workflow for delegating work to the configured custom agents (bug-finder, bulk-scanner, codebase-analysis, debugger, executor, planning-agent, researcher, verifier, vulnerability-audit) and built-in subagents. Use whenever any task component matches an agent role, work can run in parallel or in an isolated context, research, review, audit, planning, debugging, validation, or bounded implementation can be dispatched, multi-step work needs task tracking, background agents need monitoring, steering, or resuming, or delegated work must be verified and turned into commits or pull requests.

Change external libraries, frameworks, SDKs, runtimes, compilers, or build tools with verified compatibility and bounded scope. Use when an authorized change adds, upgrades, downgrades, replaces, or removes a dependency, including CVE remediation. Do not use for internal imports, inventory or advice only, or wholesale stack replacement.

Code quality practices: error handling, validation, logging, and DRY. Use when writing or reviewing code.

Independently verify acceptance criteria and delivery risk for high-impact code, configuration, data, artifact, migration, release, rollout, or rollback work. Do not use for implementation, routine checks, or style-only review.

Design, implement, review, debug, and operate risk-based testing for full-stack software in any language or framework. Use whenever behavior changes, a defect is fixed, a system boundary or schema changes, tests are added or flaky, CI is designed, or confidence is needed across unit, component, integration, contract, browser E2E, accessibility, security, performance, resilience, migration, and production verification.

Evolve a live API, database schema, event, stored format, configuration format, or provider contract while old and new states must coexist. Use for staged compatibility or production-data migrations. Do not use for private atomic refactors, greenfield contracts, one-off repairs, readiness review, or destructive execution without explicit authorization.

Production Node.js runtime and backend engineering guidance for Claude Code. Use when creating, modifying, reviewing, debugging, testing, packaging, or deploying Node.js apps, APIs, CLIs, workers, libraries, monorepos, package scripts, package.json files, npm/pnpm/yarn projects, ESM/CJS modules, async code, runtime configuration, observability, security, or Node-specific architecture.

Assess and improve go-live readiness for a service, API, worker, migration, infrastructure change, or release. Use for explicit readiness decisions or changes that materially affect capacity, external failures, observability, recovery, deployment, or production data. Do not use for routine implementation, local libraries, ordinary code review, or active incident response.

Test design and authoring workflow for effective, fast, deterministic test suites. Use when writing or modifying tests, adding coverage for new or changed behavior, creating regression tests for bugs, designing a test strategy for a feature, diagnosing or fixing flaky tests, choosing test doubles, structuring fixtures and test data, or reviewing test quality in any language or framework.

Select, design, implement, review, and verify software tests across languages and systems, including unit, integration, contract, database, migration, property, fuzz, mutation, performance, security, accessibility, visual, smoke, acceptance, end-to-end, and model or agent evaluations. Use for test strategy, coverage gaps, regression tests, flaky tests, or substantial test work. Use the TDD skill instead when the user explicitly requests red-green-refactor.

Threat-model, implement, review, and verify defensive security for web frontends, backends, APIs, data stores, dependencies, build pipelines, and deployments. Use whenever work touches authentication, sessions, authorization, tenant or object access, untrusted input or output, browsers, uploads, outbound requests, secrets, cryptography, privacy, logging, dependencies, CI/CD, infrastructure, abuse controls, or incident-sensitive behavior.