Test design, vulnerability assessment, and quality assurance (13K skills)
Design metrics that measure whether a workflow achieved its intended outcome using recorded session evidence. Choose built-in checks or custom JavaScript, retain suitable Bash evaluators, and define tests that distinguish success, failure, and missing evidence.
Review git and gh operations in gh-aw workflows to check credential availability for each repository. Identify missing token handoffs, risky expansions of limited checkouts, and error handling needed where credentials are intentionally unavailable.
Explore web application vulnerabilities by class, including access control failures, XSS, and SQL injection. Use root causes, testing checklists, and examples to plan investigations and distinguish observable security impact from an initial warning sign.
Evaluate security findings before writing a bug bounty report. Check reproducibility, scope, practical impact, duplicates, and behavior across user sessions, then use submission checklists and CVSS 3.1 guidance to prepare evidence and assess severity.
Find test inputs and bypass references for web security checks, including XSS, SQL injection, and access control flaws. Use the guidance to investigate impact and assess whether a finding is suitable for a vulnerability report.
Plan bug bounty sessions around a clear goal and selected vulnerability types. Guides movement through reconnaissance, mapping, discovery, proof, and reporting, with prompts and routing to help decide what to investigate next.
Audit MCP servers, which connect AI agents to external tools, for injected instructions, excessive access, secret leaks, and unapproved actions. Trace untrusted input through tool calls and document demonstrated issues with concrete fixes.
Test Android and iOS apps by capturing real app traffic and checking backend APIs. When traffic is blocked or cannot be replayed, use decompilation and runtime inspection to uncover endpoints, inspect secrets, or understand request signing.
Test web APIs, authentication, and LLM features with six Python scanners. Check cross-site access rules, header injection, database inputs, and signed login tokens, then investigate hidden server behavior through external callbacks and chatbot responses.
Turn validated security findings into clear bug bounty reports for HackerOne, Bugcrowd, Intigriti, or Immunefi. Provides templates, reproducible evidence structure, severity scoring guidance, and submission checks focused on demonstrated impact.
Map a website’s exposed services by collecting subdomains, active hosts, and current or historical URLs. Inspect JavaScript and exposed files, prioritize areas for security testing, and monitor new subdomains and GitHub commits.
Guide bug bounty work from target research and vulnerability hunting through validation and reporting. Compare authenticated users, investigate related weaknesses, and organize reproducible evidence of practical impact before preparing a submission.
Review CI/CD pipelines, the workflows that build and release software, for unsafe code execution, exposed secrets, and excessive permissions. Combine automated scanning with manual checks to document reproducible findings and suggested fixes.
Assess what exposed credentials can access in AWS, GCP, and Azure. Map permissions, test paths to higher privileges, and document demonstrated impact using benign test objects within an explicitly authorized assessment scope.
Guide a bug bounty investigation from scope checks and asset discovery to vulnerability testing, impact validation, and report writing. Covers web applications, source code, and AI features, with an emphasis on reproducible evidence of real harm.
Review DeFi smart contracts using ten vulnerability classes, related-function comparisons, and code search patterns. Includes target selection criteria and a Foundry test template for building reproducible proofs of security issues.
Investigate API requests that fail to replay because of client-generated signatures or anti-bot tokens. Start with captured traffic, identify the blocking inputs or signing function, and validate a reproducible request for further security testing.
Plan explicitly permitted credential testing, from preparing password candidates and usernames to choosing a login mode. Covers breach-frequency ranking, attempt pacing, success detection, audit logs, and conditions for stopping the test.
Audit GraphQL APIs for exposed schemas, missing access checks, injection risks, and weak query limits. Combine automated tools with targeted checks to investigate data exposure, unauthorized operations, and resource exhaustion, then document findings with reproducible evidence.
Review EVM and Solana tokens for hidden minting, blocked sales, fee changes, and liquidity withdrawal risks. Combine code scanning with checks of privileged controls to identify mechanisms that could enable a rug pull, or issuer exit scam.
Test LLM applications for malicious instructions, information leaks, and unsafe tool use. The skill runs attack cases and checks observable evidence, helping distinguish suspicious replies from reproducible failures with concrete impact.
Audit a deployed AI agent through its product interface to test tool misuse, cross-user memory leaks, and unauthorized actions. Focuses on observable actions and reproducible evidence, including whether required human confirmation can be bypassed.
Advance one queued QA task by adding tests or test tooling, recording the work, and opening a pull request. The skill also manages its in-flight QA requests and merges into auto-qa after CI passes.
Find a valuable gap in test coverage by checking code, existing tests, and QA priorities. The skill creates at most one locked GitHub issue with concrete test cases, ready for later implementation.