테스트·보안 스킬

Review authentication, payments, API endpoints, and sensitive data handling for security weaknesses. Checklists and code examples cover input validation, secret storage, access permissions, common web attacks, dependency checks, and security tests before deployment.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review authentication and access permissions
• Check input validation for forms and file uploads
• Inspect secret handling and payment logs

Develop features, fix bugs, and refactor code by writing tests before implementation. The workflow combines unit, integration, and end-to-end tests of complete user flows, with an 80% coverage requirement and checks for errors and boundary cases.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Build a new feature from user journeys
• Write a test that reproduces a bug before fixing it
• Refactor existing code while keeping tests passing

Run OpenClaw tests and reproduce bugs on remote machines through Crabbox. Choose a suitable execution provider, verify realistic user workflows, and report the actual provider, environment ID, logs, and timing.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Run broad OpenClaw tests in a remote CI environment
• Reproduce installation or Docker bugs
• Verify behavior on macOS, Windows, or WSL2

Build CI workflows that use mirrord to test applications against services in a real Kubernetes cluster. Configure runner access, start and stop application sessions, validate configuration files, and troubleshoot connection, permission, and logging problems.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Run integration and end-to-end tests against staging
• Create mirrord workflows for GitHub Actions or GitLab CI
• Configure Kubernetes access from a CI runner

Test how an app handles slow or failing dependencies by adding delays and connection errors to outgoing TCP connections in a mirrord session. Create reusable rules, manage them during development, and include them in CI tests.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Simulate slow database connections
• Test retry behavior during connection timeouts
• Run integration tests with failures in CI

Review DeFi smart contracts for ten classes of security flaws, including inconsistent accounting, missing permissions, and price manipulation. The skill helps prioritize audit targets and build Foundry tests that reproduce a finding and demonstrate its impact.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Prioritize DeFi protocols for security review
• Check related functions for inconsistent state updates
• Review price feeds and vault accounting

Discover subdomains, live hosts, and URLs to build a prioritized map for web security testing. Includes JavaScript analysis, API specification discovery, and monitoring for new subdomains, JavaScript changes, and GitHub commits.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Building an inventory of web assets
• Prioritizing API and authentication endpoints
• Finding endpoints and secrets in JavaScript

Assess internet-exposed VMware management services by identifying versions, matching known vulnerabilities, and checking authentication settings and information exposure. Use the findings to document affected services, supporting evidence, and the potential impact on virtual infrastructure.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Identify versions of publicly exposed VMware services
• Match patch levels against known vulnerabilities
• Review SSO metadata and management interface exposure

Review vulnerability findings before drafting a bug bounty report. Seven validation questions and submission checklists help assess scope, reproducibility, demonstrated impact, duplicate reports, and whether the claimed severity matches the available evidence.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Decide whether a finding is ready to report
• Recheck suspected authentication bypasses
• Match severity claims to demonstrated impact

Inspect public repositories, build artifacts, and container images for software supply chain risks. The skill identifies exposed internal package names, unsafe workflow configurations, and leaked secrets, while requiring build evidence before treating unclaimed package names as exploitable.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigate exposed internal package names
• Review public GitHub Actions workflows
• Inspect public container layers for secrets

Find test inputs and filter bypass examples for web security checks, organized by vulnerability type. Includes URL classification patterns, discovery wordlists, and examples of combining findings to demonstrate concrete security impact.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Choosing test inputs for injection vulnerabilities
• Reviewing authentication and MFA bypass patterns
• Classifying URLs and selecting discovery wordlists

Turn validated vulnerabilities into clear bug bounty reports for HackerOne, Bugcrowd, Intigriti, or Immunefi. Platform templates help organize demonstrated impact, reproducible steps, supporting evidence, severity reasoning, and concrete fixes in language reviewers can follow.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Draft a report using a platform-specific template
• Write clear titles and impact summaries
• Organize reproduction steps and supporting evidence

Turn enterprise red-team findings into client-facing reports with clear observations, business impact, remediation, and reproducible evidence. The skill provides report structure, severity and status guidance, and a Markdown-to-DOCX workflow with embedded screenshots and delivery checks.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Preparing final enterprise red-team reports
• Explaining findings to technical and business readers
• Packaging screenshots and evidence into DOCX

Guide authorized red-team exercises that simulate attackers seeking access and demonstrating impact. The skill organizes test priorities, evidence preservation, related application checks, and minimal data collection, with checklists for planning, ongoing work, and final validation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Preparing an authorized red-team exercise
• Reassessing findings after reproduction fails
• Checking related apps for a shared weakness

Review security discovery results to distinguish a target organization’s assets from unrelated assets sharing its name. Check ownership evidence, identify misleading web responses, quarantine uncertain entries, and recalculate severity counts before proceeding with security testing.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Check asset ownership before security testing
• Separate unrelated organizations with matching names
• Validate unusually high critical finding counts

Structure open-source intelligence research, meaning investigation using publicly available information, for authorized external assessments. Map organizational assets, record evidence and confidence levels, prioritize exposures, and prepare reports that explain technical findings and business risks.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Mapping an organization's externally exposed assets
• Recording evidence sources and confidence levels
• Prioritizing exposures within a limited research budget

Assess enterprise sign-in environments that use Okta, from identifying tenants to reviewing authentication factors and connected applications. The skill provides security testing workflows, configuration checks, and guidance on validating findings within an authorized assessment.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Identify Okta tenants used by corporate applications
• Review multi-factor authentication settings
• Check OIDC and SAML application configurations

Support authorized external security reconnaissance, the discovery of exposed systems and information. The skill provides search queries, probe references, secret detection patterns, and scoring guidance to help identify assets and organize findings with evidence and confidence levels.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Discovering public subdomains, APIs, and cloud storage
• Investigating exposed API keys and other secrets
• Identifying SSO services and Microsoft 365 exposure

Track changes during authorized red-team testing by comparing response times, headers, and account lockouts. Preserve evidence before and after changes, investigate possible defensive actions or concurrent attacks, and turn observations into timestamped findings.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigate why a confirmed vulnerability stops reproducing
• Record response changes that suggest defensive measures
• Examine newly appearing account lockouts

Review EVM and Solana meme coins for hidden minting, blocked sales, adjustable fees, and liquidity withdrawal risks. The skill guides source checks and on-chain verification to identify privileged controls that could enable a rug pull.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing token risks before investing
• Checking Solana mint and freeze authorities
• Verifying liquidity pool lock claims

Assess Microsoft 365 and Entra ID authentication using tenant discovery, login error analysis, and browser-based verification. It provides attempt tracking and evidence templates to distinguish credential results from access-policy restrictions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Map tenants associated with corporate domains
• Interpret login errors and access-policy blocks
• Manage attempt limits during credential testing

Assess iOS apps from IPA acquisition through file inspection and runtime testing. The skill helps uncover embedded credentials, insecure network settings, and app link handling issues using tools such as Frida, objection, and binary analysis utilities.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assessing an iOS app in a bug bounty program
• Finding credentials and API endpoints inside an IPA
• Reviewing ATS settings and inspecting app traffic

Investigate XXE, an XML parsing flaw, in APIs and document uploads. The skill guides entry point discovery, external callback checks, and evidence collection to establish whether files or internal services are actually exposed.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Check XML APIs for external entity processing
• Investigate SVG and Office document uploads
• Confirm blind XXE through external callbacks

Investigate cross-site scripting, where untrusted input executes as JavaScript in a web page. Check reflected, stored, and browser-side cases, distinguish escaped output from executable content, and validate reproducible behavior and user impact before reporting.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking how search terms and URL parameters appear in pages
• Testing stored content in wikis and profile fields
• Reviewing JavaScript paths that insert input into pages