Test design, vulnerability assessment, and quality assurance (13.9K skills)
Audit code changes against Karpathy's 4 principles (Think Before Coding, Simplicity First, Surgical Changes, Goal-Driven Execution). Auto-called after Phase 5 IMPLEMENT; can also be invoked manually. Produces scored compliance report and blocks advancement if threshold not met.
The English summary is being prepared. Showing the original description.
Run WCAG 2.2 Level AA accessibility audits against generated UI. Use when a story has ui:true or when asked to audit accessibility.
The English summary is being prepared. Showing the original description.
Scans Cosmos SDK blockchains for 9 consensus-critical vulnerabilities including non-determinism, incorrect signers, ABCI panics, and rounding errors. Use when auditing Cosmos chains or CosmWasm contracts. (project, gitignored)
The English summary is being prepared. Showing the original description.
Testing for timing side channels and constant-time implementation verification.
The English summary is being prepared. Showing the original description.
Detects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or constant-time programming questions in C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, or Ruby.
The English summary is being prepared. Showing the original description.
Analyze code changes for security vulnerabilities using LLM reasoning and threat model patterns. Use for PR reviews, pre-commit checks, or branch comparisons.
The English summary is being prepared. Showing the original description.
Automate browser interactions for web testing, form filling, screenshots, and data extraction. Use when the user needs to: - Navigate websites and interact with web pages - Fill forms and click buttons - Take screenshots of web content - Test web applications - Extract information from web pages - Debug frontend issues in the browser - Monitor console logs and network requests - Record browser sessions as video This skill uses agent-browser for comprehensive browser automation. RECOMMENDATION: Disable Chrome DevTools or Playwright MCP when using this skill to save context.
The English summary is being prepared. Showing the original description.
Web application security testing with Burp Suite.
The English summary is being prepared. Showing the original description.
Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects. (project, gitignored)
The English summary is being prepared. Showing the original description.
Go-based security techniques from "Black Hat Go" extended with macOS, Cloud, Mobile, IoT, Supply Chain, API, Web3, AI/ML, Red Team, ATT&CK, and LLM chapters. 186 techniques, 36 tools, 33 defenses across 37 chapters. Includes adversarial bisimulation games with Ungar (order-dependent) and join-semilattice structures. AAIF-compatible multiplayer agent games for human-agent security exercises.
The English summary is being prepared. Showing the original description.
This skill integrates **Boxxy sandbox boundary testing** with the complete Trail of Bits firmware extraction methodology. Use this for extracting and analyzing firmware in heavily obfuscated, containerized, or restricted environments.
The English summary is being prepared. Showing the original description.
Prepare your codebase for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates comprehensive documentation (flowcharts, user stories, inline comments). (project, gitignored)
The English summary is being prepared. Showing the original description.
Python fuzzing with Atheris for discovering vulnerabilities in Python code.
The English summary is being prepared. Showing the original description.
Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.
The English summary is being prepared. Showing the original description.
Brain-Computer Interface with colored operad security boundaries. Maximally isolated EEG/neural data processing via VM→Container→Process enclosure with GF(3) conservation for Agent-O-Rama neural pathways.
The English summary is being prepared. Showing the original description.
Audit Orchestrator
The English summary is being prepared. Showing the original description.
Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal). (project, gitignored)
The English summary is being prepared. Showing the original description.
Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI/CD pipeline security for prompt injection risks, or evaluating agentic action configurations.
The English summary is being prepared. Showing the original description.
Augmented reality (AR) reality tech. Passthrough overlays, hit-test/anchors, occlusion, lighting, camera permissions, and safety.
The English summary is being prepared. Showing the original description.
Primary Aptos testnet wallet for transaction origination. Use when initiating test transactions.
The English summary is being prepared. Showing the original description.
Query and explore the 2600: The Hacker Quarterly magazine archive (1984-present) via DuckDB. Provides structured access to 168+ issues covering hacker culture, security, privacy, telephony, and digital rights without loading full content into context.
The English summary is being prepared. Showing the original description.
When the user wants to plan, design, or implement an A/B test or experiment. Also use when the user mentions "A/B test," "split test," "experiment," "test this change," "variant copy," "multivariate test," or "hypothesis." For tracking implementation, see analytics-tracking.
The English summary is being prepared. Showing the original description.
Cloud laboratory platform for automated protein testing and validation. Use when designing proteins and needing experimental validation including binding assays, expression testing, thermostability measurements, enzyme activity assays, or protein sequence optimization. Also use for submitting experiments via API, tracking experiment status, downloading results, optimizing protein sequences for better expression using computational tools (NetSolP, SoluProt, SolubleMPNN, ESM), or managing protein design workflows with wet-lab validation.
The English summary is being prepared. Showing the original description.
Hypothesis-Test Loops via REPL for Exploratory Abductive Inference
The English summary is being prepared. Showing the original description.