Test design, vulnerability assessment, and quality assurance (13K skills)
Test Temporal workflows and activities with pytest using time-skipping, mocked activities, and replay checks for determinism. The guidance covers unit and integration tests, local setup, and ways to investigate test failures.
Understand security risks during Jackson JSON deserialization in Java, when input is being turned into objects. The guidance explains why checking objects afterward can miss structural attacks such as empty keys, duplicate keys, nested input, and polymorphic type handling.
Assess packet captures for port scans, DoS patterns, and command-and-control beaconing using the guide’s stated thresholds. It combines port entropy, SYN-only traffic, port counts, traffic spike ratios, and timing variation to classify patterns.
Check interval instruction JSON and mask NPZ outputs before handoff. The skill validates key formats, frame ranges, sampled-frame counts, required mask components, and sparse matrix structure, helping catch missing or inconsistent output data without relying on ground truth.
Generate maintainable unit tests from existing source code across multiple languages and frameworks. The skill identifies test scenarios, including edge cases, and can provide mocks, fixtures, coverage gap reports, test documentation, and commands for CI pipelines.
Plan and improve automated testing across development workflows, from test-first TDD cycles to AI-assisted test generation, self-healing UI tests, and CI/CD integration. Get practical guidance on framework choices, test data, reporting, and quality checks.
Connect identified threats to security controls and practical mitigations. Use the mapping to review coverage, prioritize security investments, plan remediation work, and assess whether existing controls address the risks that matter.
Test Temporal workflows in Python with pytest, including unit, integration, and replay tests. Use time-skipping to run long workflows quickly, mock activities to isolate workflow logic, and replay histories to check determinism before changes are deployed.
Use the STRIDE threat modeling method to examine system architecture and security decisions in a structured way. The skill helps teams identify potential threats, document findings, prepare for audits, and build a shared understanding of security risks.
Review a system design to identify assets, entry points, and possible attack paths. Apply methods such as STRIDE, prioritize risks, propose mitigations, and document remaining risks and security requirements for planning or review.
Review Solidity smart contracts for common security risks and apply safer implementation patterns. Use the guidance when writing contracts, examining existing code for vulnerabilities, building blockchain security measures, or preparing a contract for a professional audit.
Create failing tests for the TDD red phase to define expected behavior before implementation. Cover normal cases, edge conditions, and errors, while checking that failures reflect missing behavior rather than broken setup. Get complete test files and guidance for running them.
Use this skill to inspect screenshots and verify whether UI changes match their goals. It checks visual consistency, design system rules, responsive layouts, and accessibility cues such as contrast and focus indicators, then reports issues and suggested fixes.
Structure feature development around test-driven development: define requirements, write tests that fail first, implement the smallest change, then refactor and validate. It supports incremental or suite-based work, with checkpoints for test results and coverage.
Turn threat analysis and business context into actionable security requirements. Use the results to write security user stories, define acceptance criteria, create test cases, or map requirements to compliance needs and architecture documentation.
Assess software systems against standards such as GDPR, HIPAA, SOC 2, and PCI-DSS. The skill helps organize control checklists, identify gaps, plan implementation steps, and prepare monitoring or audit evidence, while avoiding claims of formal compliance without an audit.
Check how web applications work with VoiceOver, NVDA, and JAWS. Use the guidance to validate ARIA, forms, navigation, and dynamic content announcements, then investigate compatibility problems affecting assistive technology users.
Coordinate reviewers focused on code quality, security, architecture, and performance to assess a codebase from multiple angles. Consolidate their findings, surface conflicting recommendations, and produce a unified report of issues and improvement suggestions.
Set up static application security testing (SAST), which checks source code for vulnerabilities, with tools such as Semgrep, SonarQube, and CodeQL. Integrate scans into CI/CD, tune rules and false positives, and define quality gates for findings.
Coordinate a security hardening effort across applications, infrastructure, and delivery processes. The workflow organizes vulnerability assessment, risk prioritization, remediation, defensive controls, validation, compliance checks, and ongoing security monitoring.
Combine static analysis with AI-assisted review to examine code changes for security flaws, performance risks, bugs, maintainability, and architectural concerns. Receive prioritized comments with file and line references, explanations, and concrete fix examples, with workflows suited to review automation.
Scan project dependencies across multiple ecosystems for known vulnerabilities, outdated packages, and license risks. The skill can generate an SBOM, a list of software components, assess findings, and outline remediation steps for supply chain visibility.
Analyze executable files and libraries to understand their structure and behavior. The skill guides static and dynamic analysis with reverse engineering tools, helping document functions, data structures, protocols, and potential security findings for authorized research.
Create and improve Python tests with pytest, fixtures, mocks, and parameterization. Use the skill to set up test suites, test APIs or async code, apply test-driven development, and investigate failing tests with practical testing guidance.