Test design, vulnerability assessment, and quality assurance (13K skills)
Organize AI agent security findings using the ten OWASP ASI risk categories. Map issues such as leaked credentials or unauthorized tool calls to category IDs, and assign severity levels with suggested remediation timeframes.
Tests communication between collaborating AI agents for private data exposure, impersonation, unsafe message channels, and unauthorized access to privileged tools. It records confirmed problems with conversation evidence, potential impact, and suggested security measures.
Test whether a browsing AI agent follows fake security verification instructions that expose stored personal information through URL paths. Examine chained navigation, memory disclosure, and constructed URLs, then document confirmed findings with evidence and mitigation suggestions.
Assess AI products, agents, MCP servers, and skill packages through authorized security testing. It models access boundaries, tests injection and tool misuse, and produces evidence-based reports with business impact, defensive successes, and concrete remediation steps.
Test whether an AI agent stores hostile instructions in persistent memory and follows them later. The skill uses marked test instructions and follow-up dialogue to document storage confirmations or changes in subsequent responses.
Probe AI agents through dialogue to check for unexpected command execution, file access outside intended paths, and prompted network requests. It selects tests based on available tools and records confirmed behavior with conversation evidence and mitigation suggestions.
Check an OpenClaw environment for risky settings, unsafe skills, known software vulnerabilities, and privacy exposure. It combines local checks with optional online threat lookups and also supports reviewing individual skills before installation.
Test whether an AI agent reveals sensitive information through progressively stronger dialogue prompts. Check API keys, personal data, system instructions, and internal settings, then report findings only when sensitive content is actually accessible.
Tests whether user messages can override an AI agent’s instructions or impersonate a higher authority. It checks for exposed internal instructions and changed behavior, then reports confirmed findings with prompts and responses as evidence.
Check how an agent handles file saves, uploads and archive extraction. Test whether user supplied paths can escape the intended directory, then report confirmed unsafe handling with response evidence and suggested safeguards.
Test whether an AI agent reveals another user's data or performs actions beyond the caller's permissions. Dialogue probes cover access across users or organizations, admin functions, and attempts to gain higher privileges without authorization.
Test whether an agent misuses user trust by requesting secrets, making false safety guarantees, recommending unsafe actions, or impersonating authority. Confirmed issues are recorded with dialogue evidence, potential impact, and suggested improvements.
Write and run integration tests for GenLayer contracts in a running environment. Check agreement between the leader and validators, real web and LLM calls, and transaction execution results before deploying your contracts.
Writes and runs in-memory tests for GenLayer intelligent contracts. It checks state changes, permissions, and error handling, and uses simulated web and language model responses to test parsing without a server or Docker.
Check GenLayer intelligent contracts before testing. This skill uses the GenVM linter to find forbidden code patterns, SDK usage errors, and type mismatches, with JSON output for repeated fixes and commands to extract contract interface definitions.
Document visual work with real screenshots captured before a change, during key interactions, and after completion. Inspect each image and share captioned files throughout the task so users can review progress and redirect the work early.
Evaluate work on a ten-point scale using clear criteria, then improve each item toward a chosen target. Record evidence, compare before-and-after scores, and explain any remaining gaps without rounding scores up to claim success.
Test browser games through repeatable game states and short real playthroughs. Check controls, progression, saves, device layouts, and visible feedback, then report bugs with reproduction steps, severity, and browser evidence.
Compare a website with supplied references to identify originality risks in text, images, videos, layout, motion, and code history. Produce evidence-backed findings and practical fixes while distinguishing common design patterns from distinctive copying.
Review changes or finished work, check claims against tests, logs, running software, or source files, and explain the findings in plain language. It separates verified facts from assumptions and makes incomplete checks and remaining uncertainty clear.
Interpret n8n validation results and fix configuration, connection, and expression issues. Distinguish blocking errors from warnings and known false positives, choose suitable validation settings, review automatic fixes, and test actual outputs after structural checks pass.
Compare five Codex execution setups on Terminal-Bench 4.0 under matching conditions. The skill covers benchmark configuration, separate verification environments, image preparation, and result interpretation to help identify misleading scores caused by setup errors.
Review the exact final set of changes for a LoopX goal, checking reuse, simplification, concrete risks, and project validations. Record and verify a quality receipt, a review record tied to those specific changes.
Review a source tree for plausible security vulnerabilities without building or running it. The skill can use a threat model to choose review areas and produces JSON and Markdown findings for a later triage step.