Test design, vulnerability assessment, and quality assurance (13.1K skills)
Investigate suspicious domains, scams, impersonation, and malicious activity using public sources. Preserve source details, check leads against independent evidence, and prepare a threat intelligence handoff that records confidence, verification status, and remaining gaps.
Evaluate how Chatbox answers questions about large attachments using synthetic and real documents. Check whether the model retrieves file content when needed, skips retrieval for unrelated requests, and investigate failures through the actual application flow.
Map security threats into attack trees, branching diagrams that connect an attacker’s goal to possible steps. Assess cost, time, expertise, and detection likelihood to identify defense gaps, prioritize mitigations, and explain risks to stakeholders.
Set up human approval for Claude Code actions such as PR reviews, merges, and CI changes. Configure Cedar authorization rules and signed records of allowed actions that can be checked offline with a public key.
Set up ShellCheck to inspect shell scripts without running them. Understand warnings, configure checks for the intended shell, document exceptions, and integrate analysis into CI, editors, or checks that run before commits.
Identify security threats in system designs using STRIDE, a method covering six threat categories. Use structured questions to review components, prioritize threats by impact, and document findings and possible safeguards.
Set up automated security checks that inspect source code without running the application. Configure Semgrep, SonarQube, or CodeQL, add project-specific rules, reduce false alarms, and define criteria for blocking problematic changes.
Match identified security threats with controls that prevent, detect, or help recover from attacks. Use the mappings to find coverage gaps, prioritize security spending, and create remediation plans with multiple layers of protection.
Turn identified threats and business needs into specific, testable security requirements. Define priorities, explain the rationale, and develop security user stories, acceptance criteria, and test cases linked to the risks they address.
Learn how to check Claude Code tool calls against a policy and create digitally signed execution records. This walkthrough covers setup, offline verification, tamper demonstrations, and CI/CD integration before adopting the protect-mcp runtime plugin.
Review AI-generated code for problems hidden behind successful runs. Check failure handling, resource cleanup, unusual inputs, nonexistent dependencies, and departures from project conventions to identify missing safeguards before merging or accepting the work as complete.
Create automated shell script tests with Bats, a Bash testing tool. Check exit codes, output, and failure cases, organize reusable test helpers and data, and run checks across shells or in CI/CD pipelines.
Capture and analyze network traffic to understand custom protocols, including message boundaries and field meanings. Use the findings to document formats, investigate communication problems, and validate behavior through replay and tests with unusual inputs.
Identify software protections that hinder inspection, such as debugger detection and obfuscation that makes code harder to understand. Support authorized binary analysis and CTF security challenges with protection findings, bypass strategies, reports, and analysis scripts.
Create and organize Python tests with pytest. Use reusable setup, mock replacements for external services, controlled test time, and coverage reports to check normal behavior, failures, retries, and interactions between application components.
Explains how PluginEval combines structural checks and experimental model assessments into quality scores. Helps interpret low scores, identify improvement areas, set marketplace thresholds, and explain what evaluation badges actually represent.
Set up rules that allow or block Claude Code tool calls, and record executed tool names in digitally signed receipts. The skill also explains offline verification and the limits of what those records prove.
Help secure payment systems using PCI DSS, the payment card data security standard. Covers encryption, log masking, access controls, and tokenization, which replaces card details with substitute values to reduce direct handling of sensitive data.
Investigate security incidents using memory dumps, saved copies of RAM. The skill guides memory acquisition, process and network analysis, suspicious code detection, and evidence extraction with Volatility and related tools, including checks for capture integrity.
Write JavaScript and TypeScript tests with Jest, Vitest, and Testing Library. Covers functions, UI components, and APIs, including mock replacements for external services, reusable test data, and setup for automated testing.
Build end-to-end tests with Playwright and Cypress to check complete user workflows, such as login and checkout. Improve test reliability through stable element selection, independent test data, appropriate waits, and debugging with traces and screenshots.
Guides Kubernetes security configuration with network restrictions, Pod execution rules, and role-based access control. Use its configuration examples to separate workloads, limit permissions, and enforce deployment requirements across a cluster.
Guide web app testing with screen readers such as VoiceOver, NVDA, and JAWS. Check forms, dialogs, keyboard navigation, and spoken update notifications to identify accessibility problems across desktop and mobile browser combinations.
Build Solidity contract tests with Hardhat and Foundry. Check individual functions, contract interactions, gas usage, and varied inputs, and use a local copy of mainnet state to test against existing contracts.