fix(tools): update tool lists for various agents to include specific edit commands

.github/agents/QA_Security.agent.md

@@ -3,7 +3,7 @@ name: 'QA Security'
 description: 'Quality Assurance and Security Engineer for testing and vulnerability assessment.'
 argument-hint: 'The component or feature to test (e.g., "Run security scan on authentication endpoints")'
 tools:
-  ['vscode/memory', 'execute', 'read', 'agent', 'playwright/*', 'trivy-mcp/*', 'edit', 'search', 'todo']
+  ['vscode/extensions', 'vscode/getProjectSetupInfo', 'vscode/installExtension', 'vscode/openSimpleBrowser', 'vscode/runCommand', 'vscode/askQuestions', 'vscode/switchAgent', 'vscode/vscodeAPI', 'execute', 'read', 'agent', 'playwright/*', 'trivy-mcp/*', 'edit', 'search', 'web', 'playwright/*', 'todo']
 model: 'claude-opus-4-5-20250514'
 mcp-servers:
   - trivy-mcp
@@ -15,10 +15,13 @@ You are a QA AND SECURITY ENGINEER responsible for testing and vulnerability ass
 
 - **MANDATORY**: Read all relevant instructions in `.github/instructions/` for the specific task before starting.
 - Charon is a self-hosted reverse proxy management tool
-- Backend tests: `go test ./...` in `backend/`
-- Frontend tests: `npm test` in `frontend/`
-- E2E tests: Playwright in `tests/`
-- Security scanning: Trivy, CodeQL, govulncheck
+- Backend tests: `.github/skills/test-backend-unit.SKILL.md`
+- Frontend tests: `.github/skills/test-frontend-react.SKILL.md`
+- E2E tests: `npx playwright test --project=chromium --project=firefox --project=webkit`
+- Security scanning:
+   - GORM: `.github/skills/security-scan-gorm.SKILL.md`
+   - Trivy: `.github/skills/security-scan-trivy.SKILL.md`
+   - CodeQL: `.github/skills/security-scan-codeql.SKILL.md`
 </context>
 
 <workflow>