Test design, vulnerability assessment, and quality assurance (13K skills)
Retrieve AWS Security Agent findings from penetration tests and code reviews, store sensitive details outside Git tracking, and prioritize risks. Produces a readable remediation plan and helps fix the highest-priority issues after user confirmation.
Run automated UI or API release tests through AWS DevOps Agent using an existing test profile. Check workflows, features, and regressions, follow progress updates, and save the completed test report as a Markdown file.
Review requirements or design documents alongside source code using AWS Security Agent. Identify security risks with STRIDE, a framework for classifying threats, and receive a report covering severity, affected assets, impacts, and recommended fixes.
Run penetration tests, simulated attacks on a live web application, with AWS Security Agent. Register and verify the target domain, test selected endpoints, track progress, and save detailed findings in a Markdown report.
Check code changes since a chosen Git reference with AWS Security Agent. Run a standalone diff scan before a commit or pull request, then collect findings by severity in a local Markdown report.
Scan a workspace with AWS Security Agent by uploading its source code to AWS. Review verified findings by severity, see affected code and remediation guidance, save detailed reports, and manage scan progress or cancellation.
Use AWS Secrets Manager credentials in database connections and API calls through asm-exec, a command wrapper that resolves secret references at runtime. This pattern helps keep plaintext passwords, tokens, and API keys out of the agent's context.
Prepare a workspace for AWS Security Agent by creating or reusing an agent space, a service role with AWS permissions, and an S3 bucket. It links these resources and saves local configuration for subsequent scans and penetration tests.
Plan, build, run, and analyze controlled failure experiments with AWS Fault Injection Service. Match failure scenarios to suitable actions, define targets and alarm-based stop conditions, configure permissions and logging, and examine how applications respond to disruption.
Configure AWS WAF to filter traffic to web apps and APIs. Set up rules against common exploits, bots, login abuse, and HTTP floods, then use logs and observation mode to tune rules and reduce false positives.
Test deployed Amazon MWAA workflows by checking readiness, starting a confirmed run, and monitoring its final status. Supports Python DAGs and Serverless YAML workflows, with diagnosis and fixes handed to related skills before controlled retesting.
Assess which AWS security services fit a workload, including coverage and cost considerations. Review configuration and reported findings through read-only checks, distinguish verified evidence from unknowns, and prepare recommendations for separate implementation.
Automate website checks with Playwright, a browser automation tool. Create reusable scripts to test login flows, links, and layouts at different screen sizes, capture screenshots, and verify the page after each requested interaction.
Build features or fix bugs by writing one failing test, then the smallest implementation that passes it. The skill focuses tests on agreed public interfaces, so they check observable behavior without depending on internal code structure.
Guide feature development and bug fixes by writing a test first, checking that it fails for the expected reason, and adding only enough code to pass. Then clean up the code while keeping all tests passing.
Compare code with OpenSpec specifications, task lists, and design documents before archiving a change. Produce a report covering unfinished work, missing requirements, scenario coverage, and design consistency, with prioritized issues and specific recommendations.
Verify completed changes with checks matched to their size, including builds, tests, and specification alignment. Record the evidence in a report, resolve failed checks through user decisions, and guide development branch cleanup.
Checks work before reporting completion, committing changes, or creating a pull request. It requires fresh verification commands, reviews their output and exit codes, and ties claims about tests, builds, fixes, and requirements to actual evidence.
Verify completed Comet Classic changes with builds, tests, security checks, and requirements checks. Record results and supporting evidence in a report, return failures to the build phase, and advance passing changes to the archive phase.
Verify a Classic change using builds, tests, security checks, and a final integrated code review. Choose light or full verification based on scope and risk, record evidence in a report, and route failures back for repair.
Verify completed code changes with checks suited to their size, including builds, tests, and design comparisons where required. Save verification evidence and guide the user through deciding how to handle the development branch.
Check a running product against acceptance criteria and record evidence of its behavior. Report setup, build, and user journey checks separately, including observed results, skipped checks, and precise manual instructions when runtime access is unavailable.
Test Ralph workflow presets using shell scripts and collect logs, completion status, iteration counts, and event metrics. Use the results to investigate configuration failures, timeouts, and problems with how work passes between roles.
Validate terminal interfaces from screenshots or captured text. An AI judge checks required content, layout, and rendering against predefined or custom criteria, then reports pass or fail with specific feedback on problems.