test-red-team — Adversarial Full-App Defect Sweep

The job is not done when the code compiles or even when the happy path works. It is done when a hostile, skeptical attacker has tried every angle — UI/UX, data pipeline, security, and performance — and the defect list is in the user's hands. This skill exists because nobody ships a perfect first pass. Red teaming finds the gaps before real users do.

This skill produces a defect list. Unlike test-playwright (fix-as-you-go PDCA), the default output is a severity-ranked report, not inline fixes. Offer to fix after the report is delivered; ask which defects to prioritize.

Before ANY browser action, read protocol-browser-anti-stall and apply every rule — especially Rule 0 (manual & headed, never scripted). Also read references/playwright-session-coordination.md — shared browser, tab discipline, persisted auth.