Test design, vulnerability assessment, and quality assurance (13K skills)
Helps plan NetExec commands for penetration testing in Active Directory, the system used to manage Windows domain accounts. Covers authentication checks, shared resources, permissions, and information collection with examples organized by network protocol.
Assess server-side template injection, where user input is interpreted as template code. Identify template engines, evaluate information exposure and code execution risks, and organize evidence alongside detection and prevention measures.
Plan persistence testing for authorized Windows and Linux security exercises, examining how access can survive logons or restarts. The skill compares mechanisms by privilege level and environment, with validation steps, detection indicators, and cleanup considerations.
Launch and control a real game to verify mods through screenshots and logs. Automate menus, keyboard and mouse input, and repeatable test scenes, with guidance for connecting an agent to game state through a JSON bridge.
Investigate a Sandcastle GitHub issue, classify the report, check for duplicates or existing fixes, and attempt reproduction with Docker. Return a minimal reproduction script, observed results, and a likely cause, noting any environment limitations.
Screen incoming files and URLs before document processing by checking blocked domains, open-access permissions, and file types. Produce a pass or reject decision, a risk report, and a tracking ID, with rejection when required checks cannot run.
Screen documents and external URLs before they enter a processing workflow. Check blocked domains and document permissions, then produce a pass or reject decision, a risk report, and a tracking ID for later review.
Run OpenClaw tests and reproduce bugs on remote machines through Crabbox. Choose a suitable execution provider, verify realistic user workflows, and report the actual provider, environment ID, logs, and timing.
Audit Google Drive sharing without changing permissions. Use gog to identify public links, external sharing, broad domain access, potentially outdated grants, and ownership anomalies, then document affected files and supporting evidence.
Verify work before reporting completion, committing changes, or creating a pull request. Run the checks that support each claim, inspect their output and exit codes, and report the actual results rather than relying on assumptions or agent reports.
Guides feature development and bug fixes through test-driven development: write a test, confirm the expected failure, then add the minimum code to pass. It also covers refactoring and checking the full test suite.
Stress test one interface component on a temporary page using scenarios that its inputs and states can actually produce. View the examples together, record visible failures, and keep the annotated page available as a visual report.
Review and fix interface accessibility against WCAG 2.2, a web accessibility standard. Check keyboard navigation, focus, screen reader labels, forms, motion, and zoom, then report failures with their criteria and implement fixes using the project's existing styling system.
Get documentation-based help with deepsec, an AI vulnerability scanner. Initialize or resume setup, configure scans and model credentials, and create detection rules or plugins using the documentation bundled with the installed version.
Run an AI vulnerability scan on uncommitted changes, changes against main, or an entire codebase. Filter candidate files, investigate potential security issues, and review findings with severity ratings, with options to revalidate and export results.
Verify development results before reporting success or preparing commits and pull requests. Run checks that support each claim, inspect their actual output, and report remaining gaps instead of relying on assumptions or another agent’s success message.
Explore a web application as a user to find bugs and usability problems. Produce a structured report with reproducible steps, screenshots, and videos for interaction issues, giving responsible teams clear evidence to investigate.
Develop features and fix bugs by writing a behavior test first, observing its expected failure, and adding the minimum code needed to pass. Then clean up the code while keeping tests passing, applying this process where regression risk warrants it.
Write and review Go tests using patterns suited to functions, file operations, and terminal interfaces. Cover multiple scenarios, check state changes, and compare rendered output with saved expected results while keeping slow integration tests separately skippable.
Run two independent reviewers against the same fixed target, then compare their findings. With approval, address severe issues confirmed by both and reassess the fixes, using at most two correction rounds before a final verdict.
Create and verify gentle-ai journeys, which are scripted sequences of product actions. Check their declarations separately from actual execution, review outdated expectations after behavior changes, and record execution results for pull requests.
Test running Native SDK apps by checking readiness, inspecting windows, driving widgets, and checking communication between JavaScript and Zig. Includes repeatable canvas screenshots and basic integration tests to confirm that key app features work.
Independently rerun an unchanged bug reproduction package before repair. Check whether compiler diagnostics or runtime assertions support the exact reported claim, then preserve execution evidence and record a confirmed, unconfirmed, or inconclusive judgment.
Coordinate investigations into regressions introduced by PRs or commits. Assign preparation, discovery, reproduction, independent verification, decisions, and reporting to separate stages, while preserving evidence and progress records for later resumption.