Test design, vulnerability assessment, and quality assurance (13K skills)
Design security controls for Google Cloud Agent Gateway, covering incoming client requests and outgoing agent tool calls. Produce architecture diagrams, configuration files, deployment commands, and validation scripts using Model Armor, IAP, and Agent Registry.
Audit and strengthen security for applications running on GKE. Configure pod traffic restrictions, sandbox isolation, namespace security standards, and Secret Manager volume mounts to protect workloads at the application and namespace level.
Evaluate whether Google SecOps rules detect threats described in articles or supplied text. Generate simulated attack logs, identify coverage gaps, summarize matching rules, and create rules for uncovered threats, with user approval before adding them.
Audit Google Mobile Ads SDK integration in iOS, Android, or Unity projects. Check test IDs, ad units, SKAdNetwork IDs, adapter compatibility, and ad preloading, then report findings and next steps in a table.
Review agent skills for risky behavior, excessive permissions, and hidden data sharing. It combines static scanning, which checks known risk patterns without running code, with source review to produce an evidence-based installation verdict.
Create or improve unit tests for Apache ShardingSphere classes. Cover the target class’s behavior and affected branches, verify explicitly requested coverage goals, and consolidate suitable scenarios into parameterized tests, which run the same checks with different inputs.
Verify Kortix changes with focused tests and real inputs and outputs. This skill guides test placement, API and CLI workflows, browser checks, database verification, and reporting of results, including skipped cases.
Build end-to-end tests that follow user journeys in browsers and mobile simulators or emulators. Guides e2e configuration, AI-driven actions, precise outcome checks, failure investigation, and exploratory bug hunts backed by reproducible tests.
Track tests that pass and fail on unchanged code using GitHub CI history. Score their instability over multiple runs, propose reasoned skips in a pull request, maintain a tracking issue, and summarize findings in Slack.
Assess reported phishing emails by checking sender authentication, links, and attachments. Post a risk rating, supporting evidence, and a recommended action to Slack, leaving blocking, deletion, and other changes to the security team.
Check new or updated pull requests in isolated checkouts, run the full test suite, and verify temporary test deployments through their public delivery path. Post pass or fail results with evidence to GitHub.
Prepare draft responses to security questionnaires received in Gmail using approved answers and policies. Fill a copy in the original spreadsheet layout, flag uncertain questions, and save a reply draft for security review.
Review Slack access requests against Okta role and team information, then prepare narrowly scoped GitHub or AWS IAM permissions. Apply changes only after an eligible person's approval and record the grant, reasoning, approver, and timestamp.
Run Lighthouse audits locally across multiple site pages using Unlighthouse, without an API key or API quota usage. Receive median scores for performance, accessibility, best practices, and SEO, alongside individual page results and reports.
Set up or run repeated verification in Codex with explicit checking commands and stopping conditions. This alias corresponds to Claude Code’s `/pua:loop` command and requires command output as evidence before reporting completion.
Run OpenShell’s Release Canary checks to verify that published development packages and Helm charts install and support basic sandbox operations. Use workflow logs and local Kubernetes reproduction steps to investigate failures before a public release.
Generate an OpenShell SBOM, an inventory of software components, with Syft. Fill missing license details from public registries, export CSV files for compliance review, and inspect or validate SBOMs attached to container images.
Review an authorized security issue in its private workflow. Check the affected code, assess whether the report is valid, explain severity and attack prerequisites, and propose a remediation plan with focused tests.
Turn plain-language requirements and optional API documentation into OpenShell sandbox network policies in YAML. Define allowed destinations, programs, and API operations, with optional middleware settings for inspecting or transforming traffic and controlling what happens when processing fails.
Implement an authorized fix for a reviewed security issue, check the plan against current code, and add regression tests to catch recurrence. Verify affected components and open a pull request that closes the issue while respecting disclosure rules.
Map sensitive data across the systems you manage, explore what a compromised asset could expose, and maintain a risk register. Record likelihood, impact, owners, mitigations, and review dates to support ongoing security planning.
Strengthen existing tests with fast-check by checking properties across generated inputs. Find bugs that example tests miss and reduce failing inputs to small, reproducible cases. Property testing is available; the other listed workflows remain planned.
Operate Chrome or Brave using signed-in browser sessions to verify deployed pages, reproduce bugs, inspect page structure, and examine errors or network traffic. An optional macOS bridge extends control to native applications and operating system input.
Investigate incidents and recurring defects with structured methods such as Five Whys and Fishbone cause maps. Identify multiple contributing conditions, build a blame-free account of what happened, and propose practical changes to prevent similar failures.