Test design, vulnerability assessment, and quality assurance (13K skills)
Independently rerun supplied proof-of-concept code against freshly built versions from before and after a change. Compare observed behavior, verify reachability through real interfaces, and preserve separate logs showing agreement, divergence, or blockers.
Coordinate investigations into regressions introduced by PRs or commits. Assign preparation, discovery, reproduction, independent verification, decisions, and reporting to separate stages, while preserving evidence and progress records for later resumption.
Independently reproduce a reported runtime or compiler bug in a local repository. Build the baseline, exercise the actual artifact or compiler, and save logs and structured records distinguishing reproduction, absence of the behavior, and setup blockers.
Review a specific code change and trace its callers to identify behavior that may have broken. Record suspected regressions, reachable triggers, evidence needs, and coverage gaps so a separate reproduction step can investigate them.
Handle one known local bug or testable bug hypothesis through reproduction, independent validation, repair, and regression checks. Produce a local patch commit and evidence reports that help reviewers judge whether the fix is ready.
Build and run systems before and after a change, then execute the same reproduction procedure against both. Save environment details, inputs, commands, and separate logs to document observed behavior and any setup blockers.
Independently verifies a committed security patch by testing the original, patched, and fully reverted code. It preserves test evidence, checks the declared repair scope, and reports confirmed failures, missing evidence, and limits of what was proven.
Assess source code and live reproduction evidence to decide whether a change introduced a regression, a newly caused defect. Record supported conclusions, exclusions, severity, and unresolved gaps in an evidence-linked decision file.
Prepare a regression investigation by fixing the exact before and after source versions, preserving PR or commit context, and producing a sealed preparation record that explains change boundaries and evidence collection limits.
Create dictionaries of keywords and identifying byte sequences for fuzzing, or testing with generated inputs. Extract useful entries from code, binaries, or specifications, then configure fuzzers to explore parsing paths beyond initial input validation.
Evaluate vulnerability reports using seven practical criteria, including attacker capabilities, real usage, documented behavior, and remediation costs. Produce a reasoned decision to accept, dismiss, or request more evidence before committing to deeper investigation.
Build a custom fuzzer, a tool that tests code with many generated inputs, using LibAFL in Rust. Combine input mutation, execution feedback, scheduling, and target execution components when standard fuzzers offer insufficient control.
Checks cryptographic code against known attacks and edge cases using Project Wycheproof test vectors, predefined inputs and expected results. Helps load cases, interpret failures, compare implementations, and integrate checks into automated testing.
Turn a Mermaid sequence diagram of a cryptographic protocol into a ProVerif model, a file for formal security checks. It includes queries for secrecy, authentication, replay resistance, and forward secrecy where applicable.
Build a graph of functions and calls across multiple programming languages to investigate entry points, paths to sensitive operations, and potential impact. Use the results to prioritize security reviews and connect external findings with source code.
Compare code structure across two commits, tags, or directories to identify security-relevant changes. Produces a report on new attack paths, privilege boundaries, complexity, and how widely a change could affect other functions.
Evaluate how well existing tests catch code changes, then combine the results with function relationships. Get a report separating harmless findings, missing unit tests, and targets for fuzzing, which tests many generated inputs.
Compares code relationships before and after a branch, pull request, or release change using Trailmark. Flags structural security regressions, such as removed authorization checks or newly reachable sensitive operations, and provides evidence for reviewers.
Set up libFuzzer to test C/C++ code with varied inputs guided by which code paths run. Build test harnesses, manage sample inputs and dictionaries, enable error detectors, and reproduce crashes or investigate stalled coverage.
Measure which code fuzzing reaches as it tries many generated inputs. Use coverage reports to find unreachable areas, compare progress, and guide improvements to test harnesses, starting inputs, or dictionaries of useful input values.
Identify checks and changing global state that block fuzzing, then adjust them in fuzzing builds. The skill covers targeted validation bypasses, repeatable behavior, coverage comparisons, and checks for false crash reports introduced by patches.
Set up Atheris to test Python code and C extensions with automatically varied inputs. It guides test harness creation, coverage tracking to explore more code, and AddressSanitizer setup for finding memory errors.
Builds and improves C/C++ and Rust fuzzing harnesses, the entry points that feed generated test data into code. Helps structure inputs, reach more code paths, and address crashes caused by inconsistent test behavior.
Audit C/C++ and Rust code for secrets left in memory. It checks missing or incomplete wipes, examines compiler output for removed cleanup operations, and produces reports with evidence and suggested fixes.