Test design, vulnerability assessment, and quality assurance (13K skills)
Review pending database migration SQL before applying schema changes. Check references between tables, rollback coverage, required defaults, destructive operations, and naming conventions, then report errors, warnings, and suggestions with file paths and line numbers.
Compare saved benchmark runs over time to track win rate, response times, escalation rate, and LLM baseline costs. Review changes between the first and latest runs, with flags for declining win rates or rising average latency.
Scan declared MCP servers and tools for permission, policy, and dependency issues without executing them. Produce JSON or a Markdown table, and set a severity threshold that determines whether a CI check fails.
Run three static audits covering architecture alignment, threats, and MCP server policies, permissions, and dependencies. Store timestamped results, track changes across runs, and fail scheduled CI jobs when findings reach a chosen severity.
Create a fixed JSON evaluation suite from a repository's existing tests and check its structure for errors. Use the suite with harness-evolve to compare variants against consistent tasks, independently of the repository's normal test command.
Compare a saved repository audit with a fresh audit in one command. Receive a structured report showing structural similarity, with an alert and exit code when similarity falls below your chosen threshold.
Review audit logs from agent federation, a system for connecting agents. Filter events by compliance mode, date, and severity, then summarize personal information detections, blocked threats, trust changes, and critical or error events.
Generate a read-only security report on threats involving MCP connections and operations. It groups findings by threat, reports the highest severity, and supports table or JSON output with a configurable severity threshold for failure.
Benchmark security detection systems against 10 known vulnerabilities and nine harmless decoys. Compare four approaches, including an evolved champion, and receive structured JSON covering detection, false alarms, patch tests, reproduction, unsafe outputs, and overall pass or fail.
Verify the witness chain, a linked record of evidence, for a Cognitum Seed device. Check for missing recording periods and broken hash links, report an integrity score, and save detected gaps for auditing.
Replay recorded browser actions on the original or an alternative URL to check UI changes or reproduce bugs. When a page element cannot be found, the skill searches for a similar target and records how many steps succeeded.
Compare two recorded browser sessions at matching step IDs using screenshots and accessibility snapshots, which describe page elements. Report the first difference and overall similarity to check interface changes or verify replayed sessions.
Test interface behavior in a real browser and save actions, checks, and screenshots in a replayable RVF session file. Use recorded sessions to repeat tests, investigate CI failures, and compare screenshots against an earlier baseline.
Inspect a site's login flow for token leaks, missing protections against forged requests, exposed session cookies, and OAuth configuration issues. Produce a structured findings report with severity ratings and a pass, warn, or fail verdict.
Check text, code, and configuration files for personal information and secrets before committing, logging, storing, or sending them. Identify categorized findings, flag their locations, and suggest redaction to hide sensitive details.
Check untrusted text before passing it to a model or executing it. Using AIDefence, it provides safety checks, detailed threat classifications, confidence scores, and scanning for attempts to override instructions or extract data.
Track documented code fixes across releases with a signed manifest, a list of fixes and their identifying text. Verify that markers remain in source files, inspect file changes, and use recorded history to identify commits associated with regressions.
Run a prepared set of test cases to check agent-booster success rates and routing decisions. Optionally compare results with Gemini or Claude models, then save detailed measurements and summaries as JSON records for later verification.
Review and strengthen security in claude-flow v3 by addressing dependency risks, password hashing, credential generation, input validation, file paths, and command execution. It also guides threat modeling and tests for security-critical code.
Measure performance in the agentic-flow worker system, including trigger detection, agent selection, caching, and concurrent operations. Run a full suite or individual benchmarks to compare response times and resource usage against configured targets.
Assess code change risk, locate complex areas, and inspect file statistics with ruflo analysis commands. The skill also guides running and extending ruflo’s regression guards, automated checks that help catch previously fixed problems.
Review parallax effects, where backgrounds and foregrounds move at different speeds. Check reduced-motion support and access to essential content, then suggest static alternatives and an optional site-wide control for disabling motion.
Review password fields for security and ease of use. Check autocomplete settings, accessible visibility controls, strength indicators, and password manager support, then verify relevant browser and HTTP behavior in an environment resembling production.
Review whether every page provides an accessible privacy policy link, especially in the footer. Check that the policy explains data collection, use, sharing, retention periods, contact details, and user rights, and identify missing information.