Test design, vulnerability assessment, and quality assurance (13K skills)
Prepare for SOC 2 Type I or Type II audits by organizing evidence and reviewing controls against Trust Service Criteria. The skill identifies missing or weak controls and produces a readiness report, remediation backlog, and auditor interview guide.
Review access permissions in application code and cloud configuration. Build a role-to-resource permission matrix, identify excessive grants, missing authorization checks, and routes to higher privileges, then report severity, compliance gaps, and specific remediation steps.
Review an AssemblyAI speech workflow’s credentials, processing region, consent, retention, deletion, and model training settings. It helps document data handling decisions, validate the requested scope, and report risks without exposing audio, transcripts, or secrets.
Build automated checks for Attio integration changes using sample responses and response format tests. Produce pull request evidence without changing CRM records, with an optional, explicitly enabled read-only check against the live API.
Inventory and audit agent system files such as skills, plugins, subagents, MCP configurations, hooks, and marketplace catalogs. It selects the relevant specification, runs available checks, and reports evidence, severity, remediation options, and any areas that remain unverified.
Review Apple Notes automation scripts for appropriate permissions, protected exports, and secure credential handling. Establish local processing and cleanup practices, skip locked notes, and produce review evidence that excludes note content and secrets.
Audit a repository’s tests across seven layers, from Git hooks to acceptance checks. Measure coverage and other quality checks, trace requirements to tests, and produce reports that identify gaps for handoff to a separate implementation skill.
Review a cryptocurrency wallet’s token approvals, contract interactions, and transaction patterns. The skill produces a risk score, flags concerning activity, and prioritizes approvals for review in a security report.
Set up CI tests for Apple Notes automation on macOS using a mock client, a stand-in for Notes.app. It also defines a separate integration test path on a self-hosted Mac with automation permissions.
Secure Apollo.io API integrations with protected key storage, limited permissions, and verified key rotation. Includes code patterns for masking personal information in logs and auditing source code for exposed keys and unsafe authentication.
Gather diagnostic details for a failed, stalled, or empty Apify Actor run. The skill packages run metadata, logs, a small dataset sample, and environment information into an archive that can support troubleshooting or an Apify support request.
Secure applications using the Claude API through key management, input checks, defenses against malicious instructions, and sensitive data screening. Test these controls in a sandbox and produce a verification record without exposing credentials or user content.
Set up CI checks for Claude API features, including fast unit tests that use mocks and gated prompt regression tests that call the live API. Define when secrets are exposed and how to limit test costs.
Harden credentials and access in Anima and Figma design-to-code pipelines. Check token scope, server-side use, secret storage, and generated artifacts so exposed credentials or unapproved design access stop the pipeline safely.
Scan an authorized endpoint’s TLS setup, including protocol versions, cipher suites, certificate validity, hostname matching, and downgrade risks. The report ranks specific findings by severity, maps them to relevant controls, and offers remediation guidance.
Analyze test coverage, the share of code exercised by tests, to find untested lines, branches, and functions. Get prioritized gaps, suggested test scenarios, comparisons with a baseline, and configuration for enforcing coverage thresholds in CI.
Audit a website’s HTTP and HTTPS security headers and cookie settings to find missing protections, configuration errors, and exposed server details. Get a security grade, prioritized fixes, and configuration examples for Nginx, Apache, and Cloudflare.
Audit project libraries for known security vulnerabilities, outdated versions, and license issues across several package ecosystems. Trace problems through indirect dependencies and produce prioritized findings, upgrade commands, and alternatives for packages that are no longer maintained.
Review an Algolia integration for exposed write-capable keys, overly broad index access, and records visible to search users. The skill maps credentials and permissions, checks tenant restrictions, and produces findings, remediation steps, and a key rotation plan.
Review an Algolia search release before production by checking relevance, credentials, indexing, event tracking, monitoring, and rollback evidence. It produces a release-bound checklist with failed gates, approved waivers, and a clear go or no-go decision.
Map people and application actors to Algolia team roles, API-key permissions, index limits, and tenant restrictions. Get a least-privilege access matrix, safe allow-and-deny checks, and lifecycle findings for rotation, SSO, and account changes.
Build CI checks for Algolia records, settings, and queries using offline tests plus optional live checks on disposable indexes. Capture test evidence, clean up temporary indexes, and keep production credentials and write keys away from untrusted pull requests.
Add or strengthen CI checks for Alchemy integrations. The workflow combines deterministic unit and contract tests with secret scans, fork protections, and controlled live checks, producing reviewable evidence for failures such as invalid keys, wrong chains, and unavailable providers.
Check a local repository before AI-assisted edits and issue a Green, Yellow, or Red risk receipt. It highlights destructive commands, credential-writing automation, risky agent permissions, and Git state, then recommends whether to proceed, checkpoint, or stop for review.