Test design, vulnerability assessment, and quality assurance (13.1K skills)
Run repeatable tests of Cherry Studio’s key workflows with Playwright, which checks application behavior through automated interactions. Collect results on macOS and Windows and produce English reports for release acceptance or development validation.
Audit a Python pytest suite for missed faults, uncovered code, slow tests, and unstable results. Deeper checks deliberately alter code to measure detection, while proposed test removals receive separate validation. The skill reports findings without changing tests.
Check whether tests detect faults in changed Python code by deliberately modifying the changed lines. Add tests for missed behavior, confirm which tests fail against the previous code, and report measured evidence alongside any remaining gaps.
Design and review API contract tests, which check agreed request and response behavior. Examine schemas, server output, and client parsing to identify compatibility problems, reproduce failures locally, and report gaps in test coverage.
Check a local web page after editing by opening it in Chromium and exercising its controls automatically. It reports inconsistent behavior without requiring test scripts or an API key, giving you findings to investigate before further changes.
Create YAML test scenarios for web applications and run them in a real browser with Playwright. Use image matching and text recognition to check screens, then organize failure findings for investigation.
Plan centralized audit logging for infrastructure and applications. Use configuration examples and checklists to record security events, define retention, assess tamper detection, and connect logs to SIEM platforms, systems that collect and analyze security information.
Audit an AI agent's completion claims using existing logs, artifacts, approvals, and deployment records. Reconstruct the run and assess each claim separately, distinguishing proven results, partial support, contradictory evidence, and missing proof without rerunning the work.
Support authorized penetration testing of AWS environments by examining IAM permissions and resources such as S3, EC2, and Lambda. It guides identifying privilege escalation paths, where access can be expanded, and documenting security audit findings.
Store database credentials and API keys in AWS Secrets Manager, configure automatic credential changes, and connect applications to stored secrets. Follow examples for access policies, Lambda rotation functions, and integration with ECS and EKS.
Build attack trees, diagrams showing paths toward an attacker's goal. Break scenarios into required or alternative steps, assess effort and detectability, and map defenses to identify gaps and prioritize security work.
Plan and coordinate an authorized security assessment across reconnaissance, access testing, privilege escalation, and reporting. Route work to specialist skills, review each stage, and adjust the assessment path within the agreed scope.
Understand a codebase before searching for bugs or vulnerabilities. This skill examines functions line by line, documents assumptions and state changes, and traces calls across modules to build an evidence-based picture of system behavior.
Review AI skills and bundles without running their code. Checks for data leaks, suspicious permissions, hidden code, and system changes across desktop and mobile platforms, then reports flagged actions, risk scores, and suggested mitigations.
Create Appium tests that automate Android and iOS app interactions in Java, Python, or JavaScript. Configure local devices, emulators, simulators, or TestMu AI cloud devices, with guidance on element selection, waits, and gestures.
Guide authorized API security assessments from endpoint discovery to documented findings. Use a staged workflow to examine authentication, access permissions, input handling, data exposure, and request limits across REST, GraphQL, WebSocket, and SOAP APIs.
Design mock APIs, simulated services that reproduce expected responses, authentication, errors, and delays. Define scenarios and repeatable test data to support frontend development, integration testing, and realistic demos before the real backend is ready.
Assess REST and GraphQL API security through checks of authentication, access permissions, input validation, and request limits. The workflow guides endpoint discovery, testing, and documentation of findings and remediation within an authorized scope.
Implement and review API security within an application's existing authentication and data model. Covers token verification, resource permissions, input validation, request limits, secrets, and logging, with concrete checks for unauthorized access and invalid requests.
Guide an authorized Android security assessment from app inventory and APK acquisition to decompilation, embedded secret checks, exposed component review, runtime inspection, and network traffic analysis. The skill provides documentation and examples rather than bundled executable helpers.
Inspect authorized Android APKs by unpacking files, reading decompiled Java, and observing runtime behavior with Frida. The skill also guides smali bytecode changes, rebuilding and signing packages, and deciding when native .so libraries need further analysis.
Test app interfaces on an Android emulator using ADB, a command-line device tool. Inspect element positions, perform taps and text entry, then check screenshots and React Native logs to verify behavior and investigate layout or interaction bugs.
Test Android app flows defined in XML by performing taps, swipes, and text entry, then checking screen states. Produce a JSON report with step results, commands, and failure reasons, stopping at the first failure.
Review an API request against the supplied specification without sending it. Check the method, URL, headers, body, authentication format, and query parameters, then receive a brief verdict or a specific correction.