Test design, vulnerability assessment, and quality assurance (13.1K skills)
Run a staged testing workflow that checks type errors first, executes unit and integration tests in parallel, and runs end-to-end tests only after they pass. Receive pass and fail counts with details about failures.
Verify that infrastructure code is connected to the system and actually runs. Trace execution paths, check hook registration and database configuration, and test the full workflow to identify unused code or duplicate implementations before declaring completion.
Follow execution rules when testing in Agentica’s asynchronous REPL, an interactive code environment. Await tools that return pending results, and keep computation and the return statement in one code block so both execute in the same response.
Use this skill for end-to-end testing of a persistence pipeline, the sequence of steps that saves data. The supplied material states this purpose but provides only placeholder instructions, without concrete checks.
Run final checks after reviewed SDK changes, covering dependency installation, builds, types, generated declarations, linting, tests, and formatting. The workflow requires every check to pass before the work is marked complete.
Investigate runtime behavior that code review and normal tests cannot resolve. Plan controlled cases, disclose commands and effects for approval, then use temporary scripts to report observed results, comparison conditions, and supporting evidence.
Audit JS SDK logs, exceptions, and telemetry for exposed model or tool inputs and outputs. It traces values to logging destinations, verifies suppression settings, fixes demonstrated leaks, and adds regression tests while preserving permitted operational diagnostics.
Measure JS SDK test coverage and identify untested behavior using coverage reports. It supports gap assessments and scoped test improvements, prioritizing public behavior, error handling, cancellation, and lifecycle paths, then reporting verification results and remaining gaps.
Analyze existing logs and source files from a completed example run to verify that intended actions actually occurred. Review every entry, classify failures and skips, and report evidence without running examples, controlling processes, or modifying files.
Validate vulnerability findings by checking code, reachable attack paths, observable test results, and realistic prerequisites. The workflow produces evidence-backed reports and assesses binary constraints for memory corruption issues before exploit development proceeds.
Coordinate specialist agents to investigate suspicious activity in public GitHub repositories. Collect evidence from multiple sources, develop and test hypotheses, verify original records, and produce a report covering timelines, actors, and impact.
Collect GitHub activity and local git history as evidence for investigations, then save, filter, and share it as JSON. The skill also supports recovering deleted content from archives and checking stored evidence against its original sources.
Investigate GitHub security incidents by querying archived public activity with BigQuery. Recover recorded details of deleted issues and pull requests, identify the accounts involved, and reconstruct timelines to check claims about repository activity.
Check whether specific source lines ran during tests using gcov coverage data, which records code execution. Inspect one or several lines and report execution counts, with exit codes distinguishing uncovered lines from errors.
Add gcov coverage measurement to C/C++ projects and see which lines, branches, and functions tests execute. The skill covers Makefile and CMake settings, test execution, and text or HTML reports that help identify untested code.
Observe running apps and binaries with Frida, a tool for inspecting programs during execution. Capture API calls, function activity, and script events in organized run folders across local, USB-connected, or remote targets.
Understand how unfamiliar code works from a security perspective. The skill maps architecture, follows untrusted input through the code, and searches for similar vulnerability patterns, with file and line references to support static analysis and finding validation.
Review code that has not yet been checked by forming security hypotheses and testing them with analysis tools. The skill records evidence, checks whether affected code is reachable, searches for related patterns, and preserves review progress across sessions.
Reviews lean-ctx tool calls in Claude Code session logs, separates tool defects from input mistakes, and checks existing reports. Reproducible problems are documented as GitHub issues with exact steps, expected behavior, and environment details.
Run existing Tutti scenarios against a live agent provider, audit the captured session records, and replay them in a fresh isolated environment. Check evidence for each tested action, diagnose mismatches, and prepare verified recordings for publication.
Audit and improve Tutti tests by identifying the behavior each test protects and the realistic faults it should detect. Choose the appropriate test scope, check for duplicate coverage, control setup, and verify that required CI jobs execute the tests.
Checks the visual quality of web pages, terminal interfaces, and paginated documents. Uses phone and desktop captures, light and dark themes, and an Apple design checklist to produce screenshot evidence and item-by-item verdicts.
Reviews completed changes against the original goal, constraints, code quality, and security. Combines hands-on checks of the actual application or API with recorded evidence, then reports blockers and a passed, failed, or inconclusive verdict.
Guide authorized cross-site scripting testing, where injected scripts run in a web page. Define test boundaries, choose alternative investigation paths, and document reproduction evidence before reporting findings or ending an inconclusive investigation.