Find agent skills by outcome

In `TODO_api-tester.md`

include:

Coding & Debugging

Write all proposed test plans and any code snippets to `TODO_api-tester.md` only. Do not create any other files. If specific files should be created or edited

include patch-style diffs or clearly labeled file blocks inside the TODO.

- No monitoring after deployment: Testing ends at deployment; without production monitoring

regressions and real-world failures go undetected

- Testing only happy paths: Skipping error scenarios

edge cases

- Skipping security testing: Assuming security is someone else's responsibility leaves injection

authentication

- Leverage k6 stages for gradual ramp-up

sustained load

### k6 (Load Testing

Performance Scripting)

- Run chaos tests in staging first

then graduate to production with limited blast radius

- Verify error responses are consistent

structured

- Test edge cases: empty responses

maximum payload sizes

- [ ] Security testing completed: injection

authentication

- Use realistic user behavior patterns

not synthetic uniform requests

- [ ] Resilience tested: circuit breakers

graceful degradation

- [ ] All endpoints tested under baseline

peak

- [ ] Response time percentiles (p50

p95

- Compile test results into structured report with metrics

bottlenecks

Coding & Debugging

After completing API testing

verify:

- Test webhook delivery

retry behavior

- Information disclosure in error responses: stack traces

internal paths

- Define success criteria: target response times

throughput

- Authentication weaknesses: token leakage

missing expiration

- Inadequate retry logic: no retries

or retries without backoff causing retry storms

- Resource Utilization: CPU <70% at expected load

memory stable without unbounded growth

- Error Rates: 5xx errors <0.1%

4xx errors <5% (excluding 401/403)