Test design, vulnerability assessment, and quality assurance (13K skills)
Browse, inspect, create, and update exploratory testing sessions in TestDino, where testers investigate behavior beyond fixed test steps. Filter sessions by assignee, release, tags, or status, then assign work or change a session’s state using its ID.
Use SQLMap to test SQL injection, where application inputs can alter database queries. The skill guides automated detection, database and table discovery, selected data extraction, and documentation of the vulnerability type and severity.
Review web application code against OWASP Top 10 (2021), a list of common security risks. Receive findings with file locations, severity ratings, concrete fix code, and a prioritized list of remediation tasks.
Automate browser tasks with playwright-cli, including navigation, form filling, and data extraction. Test web applications, capture screenshots, reuse login sessions, and generate test code through command-line browser controls.
Assess WordPress security using WPScan and related tools. Identify versions, themes, plugins, and exposed user information, then examine known vulnerabilities, configuration problems, and weak passwords to produce assessment findings and evidence.
Assess SSH services by discovering servers, reviewing encryption settings, testing passwords and keys, and investigating known vulnerabilities. Includes guidance on SSH tunnels and port forwarding, with reports covering configuration, authentication weaknesses, and forwarding setups.
Assess mail server security by checking unauthorized relaying, exposed user accounts, weak authentication, encryption, and sender verification records. This skill guides SMTP testing and helps organize findings into an assessment report with practical configuration improvements.
Assess web applications for SQL injection, where user input changes database queries. Guides authorized testing through response comparisons, timing checks, impact demonstrations, and evidence collection, leading to vulnerability reports and remediation recommendations.
Guides security scanning across networks, web applications, wireless systems, and cloud environments. Helps select and configure tools, check findings for false positives, prioritize risks, and prepare reports with remediation recommendations.
Use Shodan to investigate internet-exposed devices and services on authorized targets. Guidance covers web searches, command-line tools, and APIs to compile asset inventories, review known vulnerability information, monitor networks, and export findings.
Build features or fix bugs through test-driven development: write one failing test, add enough code to pass, then refactor. Focuses on observable behavior through public interfaces, helping tests remain useful when internal code changes.
Move browser tests from Cypress or Selenium / WebDriver to Playwright using dedicated migration guides. Covers corresponding commands, changes in test architecture, and incremental adoption strategies to help plan and carry out the transition.
Analyze Git history to find frequently changed files, understand contributor involvement, and detect exposed credentials. Use the results to prioritize code reviews, choose reviewers, and identify areas that may need restructuring.
Investigate Windows weaknesses that could let a standard user gain Administrator or SYSTEM access. Guides authorized penetration tests through system inspection, credential checks, escalation validation, and reports with remediation recommendations.
Assess web applications for XSS, where injected scripts run in a browser, and HTML injection flaws. Classify stored, reflected, and DOM-based issues, demonstrate their impact in controlled tests, and prepare findings with remediation recommendations.
Build a software quality assurance process with structured test cases, execution tracking, bug severity levels, and quality metrics. Includes templates for progress reports and team handoffs, plus prompts for agent-driven test execution.
Understand common web application vulnerabilities through organized explanations of their causes, impacts, and mitigations. Use the reference to review authentication, APIs, access controls, and configuration issues, or build checklists for security assessments.
Write and improve Playwright tests for browser workflows, APIs, components, visual changes, and accessibility. Provides TypeScript and JavaScript patterns for selecting elements, waiting reliably, managing authentication and test data, and investigating intermittent failures.
Organize Playwright tests with guidance on Page Object Model, a pattern that groups code by page. Learn how to structure page objects and decide when fixtures or helpers offer a simpler approach.
Map an authorized target's subdomains, active websites, and technologies, then organize vulnerability checks with security tools. The skill covers reconnaissance workflows, automated scans, and XSS testing for flaws that let injected scripts run in web pages.
Assess web application login and session security, including password rules, multi-factor authentication, and password resets. The skill guides testing and documents weaknesses, session behavior, and recommendations for strengthening authentication.
Scan projects for known dependency vulnerabilities, exposed credentials, and risky code patterns such as SQL injection. Produces text or JSON reports with file locations and severity levels, with options to run individual checks.
Guide Windows domain penetration testing through Active Directory reconnaissance, credential attacks, privilege escalation, and certificate service checks. Use references for tools such as BloodHound and Impacket to examine attack paths and understand testing prerequisites.
Explains how to assess paths from limited user access to administrator privileges on Linux and Windows. Covers local permission weaknesses and Active Directory, a Windows domain management system, with tool selection and documentation guidance for authorized testing.