Test design, vulnerability assessment, and quality assurance (13K skills)
Summarize Playwright test results in a Markdown report with failures, timings, and tests that pass only after retries. Use configured reporting destinations and compare earlier reports when historical results are available.
Prepare SaaS teams for SOC 2 audits by mapping evaluation criteria to controls, the measures used to manage risk. Build control matrices, track supporting evidence, identify gaps, and assess readiness for Type I or Type II.
Set up Playwright, a browser testing tool, for an existing web project. Generate configuration, test folders, an example test, and applicable CI automation, then run the test and address setup failures.
Connect TestRail test cases with Playwright automated tests. Generate tests from documented steps, send execution results back, create test runs, and check which cases remain unlinked using case IDs recorded in each test.
Audit web applications for accessibility issues against WCAG 2.2 Level A and AA, the web accessibility standards. Get framework-specific code fixes, contrast checks, verification steps, and reports, with options for automated checks in development pipelines.
Move browser tests from Cypress or Selenium to Playwright with file-by-file conversion and verification. The skill also adapts shared helpers and element selectors, updates CI workflows and documentation, and reports tests that need manual work.
Create signed records for consequential agent actions such as deployments, deletions, and payments. Decide which actions need evidence, record the agent, action, target, and policy, then verify the resulting certificate offline to detect later changes.
Check Agent Skills for documentation structure and Python script behavior, then score quality and security posture. Get grades and improvement priorities, and use pass criteria in pre-commit checks or continuous integration, which runs checks automatically.
Check AI agent skills before installation by inspecting code, instructions, dependencies, and file access without running the code. Receive a PASS, WARN, or FAIL verdict with findings ranked by severity and suggested fixes.
Audit a codebase before production deployment across eight areas, including security, databases, dependencies, and AI usage. Receive findings with file locations, manual checklists, and a release verdict that blocks shipping when critical issues remain.
Audit environment files and repository contents for possible credential leaks, then prioritize findings by severity. Plan credential replacement, improve configuration examples, and establish checks in development and delivery pipelines to reduce accidental exposure.
Audit dependency files across eight language ecosystems for built-in vulnerability patterns, license conflicts, and indirect dependency risks. Generate a prioritized upgrade plan with testing and rollback notes, and pair results with live audit tools for current vulnerability coverage.
Scan API route definitions and generate test files for authentication, input validation, error responses, pagination, uploads, and rate limits. Supports Next.js App Router, Express, FastAPI, and Django REST, with Node and Python test outputs.
Identify security threats across system components and data flows, score their risks, and prioritize mitigations. Run a quick scan for exposed credentials and route requests beyond threat modeling to the appropriate specialist skills.
Assess web applications, APIs, and infrastructure for security weaknesses through authorized testing. The skill guides code review, dependency and secret scanning, targeted vulnerability checks, and report creation with evidence, severity ratings, and remediation priorities.
Plan authorized security exercises that simulate attackers reaching important assets. Organize techniques into attack stages, rank effort and detection risk, identify shared points across attack paths, and use findings to assess detection and response coverage.
Checks application code, dependencies, and security controls to identify vulnerabilities and plan fixes. Includes Python scanners, reports, incident response workflows, and guidance for adding security checks to CI/CD, the automated build and deployment process.
Creates test starters for React and Next.js applications and analyzes coverage reports to find untested code. Supports unit, integration, and browser-based tests, simulated API responses, reusable test data, and test runner configuration.
Assess detected security events by checking false positives, assigning incident types and severity levels, and identifying escalation routes. Guide initial response and forensic evidence collection, including records of who collected, held, and transferred each evidence item.
Investigate hidden attacker activity using focused hypotheses, indicators of compromise such as malicious domains, and statistical checks on logs. Rank investigation priorities, generate indicator sweep targets, and flag unusual behavior for human review.
Review cloud permissions, public storage access, network rules, and infrastructure definitions for security gaps. The skill helps identify risky configurations, rank findings by severity, and suggest narrower permissions, with fuller coverage for AWS than Azure or GCP.
Create unit test scaffolds, sample data, and mocks from code or specifications. Analyze coverage reports to prioritize missing tests, and guide test-driven development through failing tests, minimal implementation, and refactoring.
Review SOC 2 Type II audit readiness through six questions about controls, the organizational safeguards assessed over an observation period. Identify evidence gaps, control changes, and exceptions, then organize readiness findings and three concrete next actions.
Prepare for ISO 27001 audits by reviewing six areas of an information security management system: audit coverage, risks, access, suppliers, incidents, and management reviews. Summarize evidence gaps, readiness, and three priority actions with owners and timelines.