Test design, vulnerability assessment, and quality assurance (13.1K skills)
Assess web applications for path traversal, a flaw that exposes files outside intended folders. Follow structured checks to identify vulnerable inputs, document demonstrated access, assess data exposure, and prepare remediation guidance.
Guides authorized security assessments with Metasploit, from scanning and vulnerability testing to payload generation, code used during a test, and post-exploitation investigation. It also covers session management and recording evidence of findings.
Runs HTTP load tests with gradually increasing concurrent connections. It measures response-time percentiles, throughput, and errors, identifies where performance starts to deteriorate, and recommends a concurrency level based on the results.
Test whether changing record IDs or filenames exposes another user's data in a web application. This skill guides access control checks, evidence collection, impact assessment, and fixes for IDOR, a flaw in resource authorization.
Learn how to conduct an authorized penetration test, a security assessment that checks exploitable weaknesses. Follow guidance from initial research and scanning through validation, evidence collection, and reporting with remediation recommendations.
Explains how to assess paths from limited user access to administrator privileges on Linux and Windows. Covers local permission weaknesses and Active Directory, a Windows domain management system, with tool selection and documentation guidance for authorized testing.
Test web applications for HTML injection, where user input becomes page markup. Identify affected inputs, verify stored or reflected behavior, assess visual manipulation and phishing risks, and document findings with remediation guidance.
Scan projects for known dependency vulnerabilities, exposed credentials, and risky code patterns such as SQL injection. Produces text or JSON reports with file locations and severity levels, with options to run individual checks.
Set up HTTP, HTTPS, SNMP for device information, and SMB for file sharing in a penetration testing lab. Follow configuration and testing steps to inspect exposed information, check access permissions, and review service logs.
Create Playwright tests for user workflows, APIs, and visual changes. Use TypeScript or JavaScript examples to choose reliable page elements, manage login state, diagnose intermittent failures, and configure automated test runs in CI.
Assess AWS security through penetration testing, a process for checking exploitable weaknesses. Examine IAM permissions, storage, compute resources, and credential exposure to identify privilege escalation paths and document security audit findings.
Assess Linux systems for weaknesses that let a regular user gain administrator access. Guides inspection of permissions, scheduled tasks, and vulnerable components, with findings, evidence, and remediation recommendations documented for review.
Assess Azure, AWS, and GCP security through resource inventories, authentication checks, permission reviews, and misconfiguration testing. Supports authorized assessments that document exposed credentials, rate risks, and recommend improvements for each cloud platform.
Plan and coordinate penetration tests with checklists covering objectives, scope, environment preparation, tester selection, monitoring, and follow-up. Helps teams define deliverables, prioritize vulnerabilities, arrange fixes and verification, and clean up test accounts and artifacts.
Test REST, SOAP, and GraphQL APIs for authentication flaws, improper access to other users’ records, and unsafe input handling. Guides endpoint discovery and request variations to identify vulnerabilities and document evidence of unauthorized access.
Check code and agent outputs, track reliability scores, and roll back changes that fail a chosen threshold. Includes quality reports, live monitoring, and integration with automated build and deployment workflows.
Review and strengthen security in claude-flow v3 by addressing dependency risks, password hashing, credential generation, input validation, file paths, and command execution. It also guides threat modeling and tests for security-critical code.
Look across feedback, operational data, errors, and delivery failures over a defined period to find recurring problems. Trace patterns to shared causes, examine earlier fixes, and recommend systemic changes, implementing and verifying them only when configured policies allow.
Verify BB workflows in an isolated development app using browser interactions and the matching source CLI. Select relevant checks, collect screenshots and persisted-state evidence, and report passes, failures, untested cases, and blockers separately.
Collect user-provided API keys and other credentials through a form and save them to a specified dotenv configuration file. Request multiple variables together without exposing their values in chat, command arguments, or output visible to the agent.
Create a repository-specific verification skill and a comprehensive feature map for an app. It documents launch, UI, CLI, and API checks, then runs the instructions to capture evidence and distinguish verified features from untested or blocked ones.
Audit an existing app verification skill against source code and the running application. Update outdated instructions, feature maps, and test helpers using evidence, while reporting product bugs and blocked checks separately.
Review new and existing tests for meaningful behavior coverage, duplication, and dependence on implementation details. Gather evidence before cleanup, preserve tests that protect independent contracts, and verify that removed tests leave their regression checks covered elsewhere.
Run Unity tests in EditMode or PlayMode, selecting specific assemblies, namespaces, classes or methods. Review individual outcomes and durations, filter results, and include failure messages, logs or stack traces to investigate problems.