Test design, vulnerability assessment, and quality assurance (13K skills)
Review code for correctness, security, performance, and maintainability, reporting only findings with at least 80% confidence. Prioritize issues by severity, apply remediation, and review the changes again for up to two cycles, stopping when no critical or high issues remain.
Use this skill to guide feature work and bug fixes through Red-Green-Refactor: write a failing test first, add only enough code to pass it, then improve code quality. It also sets an 80% coverage threshold and records test results.
Require verifiable evidence before reporting that a build, fix, review, or task is complete. Check test results, logs, build output, and exit codes so completion claims are grounded in observed results rather than assumptions.
Audit agent projects across five security areas using 102 static analysis rules. Review exposed credentials, permissions, hooks, MCP risks, and agent configuration, with an optional red-team simulation that assesses exploitability and suggests defenses.
Enforce a test-first workflow: write a failing test, implement the smallest change that passes, then refactor while keeping tests green. Run tests in one-shot mode, record exit codes as evidence, and surface repeated failures or scope concerns during implementation.
Analyze a Python project to identify functions that are promising fuzzing targets. Rank relevant files and functions, review existing tests and their coverage, then prepare a small shortlist with harness guidance and structured follow-up notes.
Build fuzz targets for Python libraries with Atheris, a coverage-guided fuzzing engine based on LibFuzzer. The guide covers input handling, code instrumentation, custom mutators for structured data, and coverage reports to help uncover crashes and exceptions.
Prepare benchmark tasks for evaluating how AI agents use skills. Follow the repository workflow to initialize a task, define realistic and verifiable outcomes, validate it with an oracle run, compare runs with and without skills, and prepare a submission pull request.
Run Suricata on PCAP files without live traffic, then inspect alerts in eve.json. The workflow covers checking rule syntax, counting and viewing alert details, and comparing known-positive and known-negative captures while iterating on rules.
Learn the syzlang patterns used to describe ioctl system calls for Syzkaller fuzzing. The skill covers argument types, input and output pointers, structures, flags, and file descriptor resources, with examples to guide description files.
Learn how Suricata rules combine traffic direction, fixed text, regular expressions, and protocol-aware buffers. Use these building blocks to express multi-condition HTTP matches and reduce alerts from unrelated traffic, while composing the final rule for your specific task.
Turn structured vulnerability scan data, such as Trivy JSON, into a filtered CSV audit report. Define clear columns, map fields, handle missing values, and use severity levels to focus the report on selected findings.
Extract CVSS vulnerability severity scores from structured data, checking NVD, GHSA, and RedHat in a defined order. Handle missing values, fall back from version 3 to version 2 when available, and retain source details for security reports.
Scan dependency lock files with Trivy using a vulnerability database prepared in advance, so the scan can run without internet access. Save findings as JSON, check whether the database is available, and handle common scan setup errors.
Review SkillsBench task pull requests by classifying their track, checking policy rules, benchmarking Oracle, Claude, and Codex runs with and without skills, and auditing agent traces for skill use or cheating. It produces a readable report and a trajectory bundle.
Create a SkillsBench task from an idea or an existing workflow. The skill guides task prompts, environments, tests, reference solutions, and reusable skills, then helps validate the task, review it, run agent evaluations, and prepare a PR.
Measure page and API load times, network request timing, JavaScript and layout metrics, and visual shifts such as CLS or theme flicker. Included scripts help compare behavior before and after a change and inspect likely sources of slow or unstable pages.
Write and review Python tests with pytest, using focused test cases, fixtures, parameterization, mocking, and async tests. The guidance helps diagnose failures, test errors and external boundaries, and improve coverage while keeping tests readable and easier to maintain.
Review changes on the current branch for security vulnerabilities, bugs, and code quality problems. It maps risky inputs and operations, checks each changed file against a security checklist, verifies potential findings in context, and reports evidence and concrete fixes without editing code.
Review application security with scripts for threat modeling, security audits, and penetration testing, plus references on architecture patterns and cryptography. Use it to inspect a project, identify security concerns, and guide security focused implementation work.
Guide authorized security assessments of SSH services, from discovering hosts and reviewing versions, algorithms, and authentication methods to checking known vulnerabilities and documenting tunnels. The workflow also covers credential testing and post-access review, with reports of findings and configurations.
Understand security risks during Jackson JSON deserialization in Java, when input is being turned into objects. The guidance explains why checking objects afterward can miss structural attacks such as empty keys, duplicate keys, nested input, and polymorphic type handling.
Measure page and API performance, layout shifts, and theme flicker before and after a change. Included scripts use Playwright and Chrome DevTools Protocol data to report request timings, browser metrics, and visual stability signals for review.
Test Temporal workflows and activities with pytest using time-skipping, mocked activities, and replay checks for determinism. The guidance covers unit and integration tests, local setup, and ways to investigate test failures.