Testing & Security skills

Assess Shadow Credentials account takeover during authorized Active Directory testing. Examine permissions that allow public key registration, validate authentication without a password reset, and document credential cleanup, detection opportunities, and access control changes needed for remediation.

• Assessing risky permissions identified in BloodHound
• Validating account takeover without resetting a password
• Generating directory change records during security exercises

Observe malware in an isolated Cuckoo Sandbox environment and review its processes, network traffic, and system changes. Use the findings to trace infection stages, identify persistence mechanisms, and extract indicators of compromise for behavioral reports.

• Investigating suspicious files after static analysis
• Tracing multi-stage infections and persistence mechanisms
• Extracting indicators of compromise from observed behavior

Investigate Linux kernel rootkits, malware that hides inside the operating system's core. Analyze memory dumps with Volatility3, compare system views, and run live scans to identify hidden modules, altered calls, and suspicious inconsistencies.

• Investigate suspected Linux rootkit infections
• Find hidden kernel modules in memory dumps
• Compare module lists for signs of concealment

Inspect Windows startup entries with Sysinternals Autoruns to find possible malware persistence, settings that let malware restart automatically. Review signatures, file locations, and changes from a clean baseline to identify entries that need investigation.

• Investigating suspicious startup entries on a Windows endpoint
• Comparing startup settings against a clean baseline
• Checking for remaining malware startup entries after cleanup

Analyze Kubernetes API server audit logs to identify pod access, secret reads, permission changes, privileged pods, and anonymous requests. Use the event patterns to reconstruct suspicious activity and develop detection rules for security monitoring systems.

• Tracing API activity during a suspected cluster compromise
• Reviewing access to Kubernetes secrets
• Investigating permission changes and privileged pods

Acquire Linux memory with LiME and examine it using Volatility 3. Extract processes, network connections, command history, loaded kernel modules, and signs of injected code to support investigations of compromised Linux systems.

• Acquiring memory from a compromised Linux system
• Comparing process lists to investigate hidden processes
• Reviewing command history and network connections

Inspect suspicious PDFs without opening them in a document viewer. Use peepdf, pdfid, and pdf-parser to examine internal objects, extract embedded code and files, and report threat indicators such as URLs and hashes.

• Triaging suspicious PDF email attachments
• Investigating PDF exploit documents
• Extracting embedded JavaScript and files

Analyze malware communication with command servers to understand periodic check-ins, message formats, encoded data, and backup destinations. Produces a structured analysis report and network detection rules based on captured traffic and malware code.

• Investigating malware communication in captured traffic
• Measuring periodic check-in intervals and timing variation
• Mapping command servers and backup destinations

Investigate malware hidden in boot records, UEFI firmware, or the operating system’s core. The skill guides evidence collection, boot integrity checks, firmware and memory analysis, and reporting of persistence mechanisms and remediation steps when compromise survives an OS reinstall.

• Investigating infections that survive an OS reinstall
• Examining unexplained Secure Boot integrity violations
• Finding hidden processes and suspicious kernel drivers

Audit whether an AI agent follows its intended purpose, business rules, and permission boundaries. The skill guides setup discovery, test configuration, execution against an agent endpoint or substitute model, and interpretation of scores from selected judging models.

• Auditing an agent's compliance with business rules
• Testing permission boundaries and dangerous tools
• Evaluating an agent through its HTTP endpoint

Write and run tests for features and fixes, starting with likely failures and boundary cases. Use behavior-focused checks, suitable test environments, and coverage results to assess whether changes are ready.

• Writing tests for a new feature
• Adding regression tests for a bug fix
• Updating existing tests after behavior changes

Test runnable software through normal and hostile end-to-end scenarios, checking complete behavior across a workflow. Investigate failures, apply fixes, rerun checks, and produce an evidence-backed report covering results, cleanup, and remaining risks.

• Check behavior with malformed input
• Verify cancellation and resumption
• Investigate flaky tests

Review websites for security, browser compatibility, and code quality. Identify issues in HTTPS settings, third-party libraries, HTML, and error handling, then apply concrete improvements using checklists and implementation examples.

• Reviewing website security settings
• Checking third-party libraries for vulnerabilities
• Replacing deprecated browser APIs

Audit websites for accessibility barriers and improve image descriptions, color contrast, forms, keyboard navigation, and screen reader support. Provides code examples and automated and manual testing guidance for work toward WCAG 2.1 AA or AAA accessibility standards.

• Auditing a website for accessibility issues
• Fixing form labels and error announcements
• Checking keyboard navigation and dialog focus

Configure safety checks for LLM applications with NeMo Guardrails. Covers attempts to bypass safety rules, input and output validation, masking personal information, and checking factual claims through programmable rules and integrations.

• Detecting instructions that try to bypass safety rules
• Masking personal information before processing
• Adding factual checks to generated answers

Turn feature requirements into test plans, step-by-step manual tests, regression suites for checking existing features, and reproducible bug reports. The skill also supports comparing implemented interfaces with Figma designs and documenting visual differences.

• Plan tests for a new feature
• Write manual checkout test cases
• Organize regression checks before a release

Build safety checks for LLM prompts and responses using Meta's LlamaGuard moderation model. Classify potentially harmful content, block flagged messages, serve checks through an API, and integrate them with NeMo Guardrails.

• Checking prompts before sending them to an LLM
• Filtering responses before displaying them
• Building a moderation API

Review security across web apps, APIs, mobile apps, Kubernetes, and AI agents using six OWASP references. Identify risky authentication, access controls, configurations, and prompt handling, then use examples and checklists to plan fixes.

• Review login flows and access controls
• Check API authorization and data exposure
• Review mobile app storage and communications

Design tests that assess an AI agent's capabilities and reliability. Covers repeated runs to measure variation, checks for required behavior, and adversarial testing to expose failures that ordinary successful examples may miss.

• Measuring variation across repeated runs of the same test
• Checking whether an agent follows required behavior
• Testing responses to unexpected or adversarial inputs

Compare Storybook screenshots before and after a code change in both dark and light themes. Check rendering noise, annotate meaningful differences, and export a shareable visual report that helps reviewers see what changed and what stayed identical.

• Compare screens before and after a code change
• Check visual regressions in dark and light themes
• Share annotated screenshot comparisons in a PR

Build Storybook page stories for SigNoz by mapping API requests, display states, and URL parameters. Use msw mock responses, which simulate API replies, and controls to inspect loading, errors, permissions, and other page states.

• Creating Storybook stories for SigNoz pages
• Switching between loading, empty, and error states
• Checking how permissions affect buttons and controls

Process AI model responses through a specified Google Model Armor template before sending them to users. Supply response text directly, pipe output from another command, or provide a JSON request for outbound safety processing.

• Check model responses before showing them to users
• Pipe model command output into safety processing
• Process response text with a specified template

Create a Google Model Armor template for checking AI prompts and responses. Specify a Google Cloud project, location, and template ID, then use a preset or provide custom settings in JSON.

• Creating a template with the jailbreak preset
• Defining template settings in JSON
• Preparing a template for prompt and response checks

Use Google Model Armor to filter user prompts and model responses for safety. The skill covers creating templates that define checks and discovering command parameters before making API calls through the gws command-line tool.

• Check user prompts through a Model Armor template
• Check model responses through a Model Armor template
• Create a template for content safety checks