Testing & Security skills

Drive the user's real, logged-in browser from the shell via the reins CLI. Because it's their actual browser, every site is already authenticated — so you can scrape behind logins, read cookies/tokens/localStorage, watch and replay live API traffic, call a site's own API as the signed-in user, and click/type/screenshot. Use whenever asked to interact with, test, scrape, extract data from, or automate a live webpage or authenticated site in the user's browser.

The English summary is being prepared. Showing the original description.

Use when writing or reviewing code that parses user input, builds SQL/shell commands, handles secrets/credentials, hashes passwords, changes auth checks, deserializes untrusted data, or constructs paths/URLs from input

The English summary is being prepared. Showing the original description.

Use when writing or reviewing tests, designing test data, naming a test, choosing what to assert, or writing test helpers/mocks/fixtures

The English summary is being prepared. Showing the original description.

Audit technical, on-page, and AI-search SEO for pages, sites, and content. Use when the user asks for `/seo-audit`, `/ai-seo`, SEO review, keyword targeting, heading structure, metadata, internal linking, content gaps, AEO, GEO, LLMO, or competitor SEO comparisons.

The English summary is being prepared. Showing the original description.

General workflow for auditing ML CI failures, experiment regressions, training run failures, golden metric failures, and telemetry-backed ML work-product claims from local repositories, logs, metrics, configs, and artifacts. Use when Codex needs to decide whether an ML failure is a model/convergence issue, correctness bug, data/config issue, infrastructure/runtime issue, evaluation/gating policy issue, or unsupported claim, and produce structured evidence-backed outputs.

The English summary is being prepared. Showing the original description.

Design, analyze, and document A/B tests for conversion, onboarding, pricing, lifecycle, and product experiments. Use when the user asks for `/ab-test-setup`, experiment design, sample size, statistical significance, A/B test analysis, ICE-scored test backlogs, or avoiding common testing mistakes.

The English summary is being prepared. Showing the original description.

Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.

The English summary is being prepared. Showing the original description.

Upgrade a consumer repo to the latest Lumen: audit the gap, bump every `@ledgerhq/lumen-*` package, apply each migration crossed, verify, and open the PR. Run from the consumer repo's root, only when asked to upgrade or audit Lumen there.

The English summary is being prepared. Showing the original description.

Use when asked to test a Lumen change against consumer repos before releasing it: a breaking or architectural change, a lint-plugin upgrade, peer/prod dependency moves, build or packaging changes, or to check how consumers use a component, prop or variant. Runs the change (or a usage scan) across the production consumers in the adoption registry and outputs a shareable HTML report.

The English summary is being prepared. Showing the original description.

Autonomous human-like browser control and professional QA/QC testing. Powered by agent-browser (Rust native CDP, zero Playwright) with ISTQB test matrix generation, automated testcase execution, console/network error tracing, and defect reporting.

The English summary is being prepared. Showing the original description.

Use when writing or editing component tests in libs/ui-react or libs/ui-rnative — shared structure and coverage conventions, plus the per-platform runner: Vitest + React Testing Library on web, Jest + React Native Testing Library on RN. Load this before writing tests.

The English summary is being prepared. Showing the original description.

Generate a NullPointer Studio styled PDF penetration test report from findings.json. Produces a professional dark-themed PDF with executive summary, risk dashboard, per-finding cards with business risk, remediation summary, and clean controls section.

The English summary is being prepared. Showing the original description.

Generates specific, implementable fixes for every finding in findings.json. Produces code patches (unified diff), configuration changes, dependency updates, and IaC fixes — not generic advice but actual before/after code. Uses the reproduction command from each finding as the verification step: "run this after the fix — it should now fail." Stores remediation data in findings.json so the dashboard shows a Fix button and /gh-export includes the remediation in GitHub issues. Chains from /pentester, /codebase, or any scan skill after findings are produced. Chains into /gh-export for export with remediation included.

The English summary is being prepared. Showing the original description.

Entry P1 category router for reconnaissance and methodology. Use when mapping scope, discovering assets, fingerprinting technology, building endpoint inventory, and choosing the first high-value security testing path.

The English summary is being prepared. Showing the original description.

Sensitive data patterns for security testing: API keys, credit cards, emails, SSNs, phone numbers, IPs, and more. Use for data discovery and validation.

The English summary is being prepared. Showing the original description.

SAML SSO assertion attack playbook. Use when testing signature validation, assertion wrapping, audience restrictions, ACS handling, XML trust boundaries, and enterprise SSO flaws.

The English summary is being prepared. Showing the original description.

Identify and exploit SMTP Open Relays. This skill teaches how to test mail servers to determine if they process email delivery regardless of the sender or recipient domain, enabling attackers to spoof internal addresses and bypass basic anti-phishing controls.

The English summary is being prepared. Showing the original description.

Essential exploitation payloads: anti-virus test files, file name exploits, malicious files. Curated for testing.

The English summary is being prepared. Showing the original description.

Top username lists for enumeration: common usernames, default credentials, names. Curated essentials for authorized testing.

The English summary is being prepared. Showing the original description.

Web shell samples for detection and analysis: PHP, ASP, ASPX, JSP, Python, Perl shells. Use for security research and detection system testing.

The English summary is being prepared. Showing the original description.

Prototype pollution testing for JavaScript stacks. Use when user input is merged into objects (query parsers, JSON bodies, deep assign), when configuring libraries via untrusted keys, or when hunting RCE gadgets via polluted Object.prototype in Node or the browser.

The English summary is being prepared. Showing the original description.

Reconnaissance and methodology playbook. Use when mapping assets, discovering endpoints, fingerprinting technology, and building a structured testing plan for a new target.

The English summary is being prepared. Showing the original description.

Race condition and TOCTOU testing for web apps. Use when testing one-time operations, concurrent HTTP abuse, rate-limit bypass, Turbo Intruder gates, HTTP/2 single-packet attacks, and CWE-362-style synchronization gaps.

The English summary is being prepared. Showing the original description.

Use when hunting self-hosted GitHub Actions runner vulnerabilities where fork pull requests can execute on privileged non-ephemeral runners. Trigger on: "self-hosted runner", "runs-on self-hosted", "fork PR workflow", "non-ephemeral runner", "first-time contributor approval", "runner images", "azure-builds runner", "outside collaborator approval", "runs-on matrix", "persistent runner", "Gato GitHub Attack Toolkit", "runner agent", self-hosted CI/CD runner abuse, "git config token", "workflow log deletion", runner C2.

The English summary is being prepared. Showing the original description.