테스트·보안 스킬

Test APIs for NoSQL injection, where user input changes database queries unexpectedly. The skill focuses on MongoDB login bypass, unauthorized data retrieval, and response timing checks, and also covers Redis command injection through server-side requests.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Test MongoDB login APIs for authentication bypass
• Review search filters and URL parameters for injection
• Investigate suspected injection through response timing

Guide bug bounty work from checking authorized scope and discovering assets to testing web and AI features. Validate practical impact, investigate related weaknesses, and organize reproducible evidence into a vulnerability report.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Planning research for a new bug bounty target
• Reviewing source code for security weaknesses
• Testing chatbot and AI feature security

Assess classic ASP.NET applications for security weaknesses in ViewState, the data used to preserve page state, exposed logs, error details, and service endpoints. Organize evidence and separate observed weaknesses from demonstrated impact when preparing findings.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review classic ASP.NET Webforms security
• Check exposure of trace and error logs
• Inspect WCF service metadata access

Investigate security flaws in OAuth login flows, including weak redirect checks, leaked access tokens, and skipped authentication steps. The skill guides testing of web and mobile integrations and helps document demonstrated impact and reproducible findings.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing redirect validation in social login
• Checking state and nonce validation
• Investigating mobile login links

Guide bug bounty work from asset discovery to validation and reporting, while resolving local locations of security tools, wordlists, and cloned projects. It covers web and AI security testing with an emphasis on demonstrated impact.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Locate installed security tools and wordlists
• Plan reconnaissance within a program's scope
• Investigate related weaknesses and their combined impact

Inspect NTLM authentication responses from public IIS, SharePoint, and Exchange services to identify exposed internal domains, server names, and timestamps. Assess the disclosure in context and prepare reproducible evidence without completing authentication.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking public services that advertise NTLM authentication
• Extracting internal domains and server names from responses
• Assessing the impact of exposed Active Directory structure

Investigate file inclusion and path traversal flaws that let applications access unintended files. The skill guides checks for sensitive data exposure and possible code execution, using content evidence or repeatable indirect signals to avoid false positives.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review download and template file paths
• Check whether file reads expose secrets
• Validate file access when content is not displayed

Find open redirects, where a website sends visitors to an externally controlled address. Check URL parameters and browser scripts, confirm actual navigation, and investigate whether the redirect can expose OAuth authorization codes or enable server-side access to internal services.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Find redirect candidates in collected URLs
• Review JavaScript that controls browser navigation
• Assess OAuth authorization code exposure through redirects

Assess gRPC services for exposed internal methods, missing access controls, identity spoofing through proxies, and unencrypted traffic. The skill guides service discovery and validates findings using response status codes, external reachability, and demonstrated effects on private data or system state.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Inventory exposed gRPC services and methods
• Check authentication and permissions on internal APIs
• Compare identity handling at proxies and backends

Assess what discovered cloud credentials allow across AWS, Azure, GCP, and Kubernetes. The skill guides identity checks, permission review, and paths to higher privileges, then helps document impact, activity, and cleanup within the engagement's agreed scope.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Assess permissions granted by discovered cloud credentials
• Review role trust and access across cloud accounts
• Check permissions assigned to anonymous Cognito identities

Prepare Bugcrowd submissions with accurate vulnerability categories, evidence-based severity requests, and explanations of program scope. Structure references between related reports, document QA testing conditions, and draft responses when a finding is downgraded or considered out of scope.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Choose a suitable Bugcrowd vulnerability category
• Explain a severity request using demonstrated impact
• Respond to out-of-scope decisions

Review multi-factor authentication flows for skipped checks, reused one-time codes, weak backup paths, and verification races. It focuses on proving access to protected resources rather than relying on interface behavior or response codes alone.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Check access before completing multi-factor authentication
• Test one-time code reuse and validation behavior
• Review backup codes and trusted-device cookies

Assess externally exposed enterprise SSL VPN gateways by identifying products, checking known vulnerabilities, and reviewing authentication backends and SAML settings. The skill provides vendor-specific checks and a staged workflow that starts with less disruptive identification before deeper testing.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Identify products behind exposed SSL VPN portals
• Triage known vulnerabilities by VPN vendor
• Review SAML settings on remote-access gateways

Test for race conditions, where simultaneous requests disrupt expected processing order. Investigate duplicate redemptions, balance or vote changes, and authentication or request-limit failures, then verify actual effects and record reproducibility.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Check coupons and gift cards for duplicate redemption
• Test balance updates and voting limits under concurrent requests
• Investigate timing flaws in authentication and account creation

Prepare an isolated local environment for manually testing DevSpace changes. Copy existing settings and state into the current checkout, build interface assets, start the development server, and refresh the test snapshot when needed.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Setting up a worktree for local manual testing
• Checking ChatGPT app, widget, CSS, or icon changes
• Refreshing the local QA snapshot from normal DevSpace state

Review completed code through three roles: a critical reviewer, a verifier, and an adjudicator. Check evidence, look for bugs introduced by fixes, and produce an actionable repair list with regression tests and traceable review reports.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing code before a release
• Checking major refactors for regressions
• Verifying that reported fixes actually work

Inspect agent skills, plugins, and MCP servers locally before installation. Use a reviewed scanning policy to identify malicious instructions, risky commands, secret exposure, and dependency risks, then summarize findings and recommended next steps.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking a SKILL.md before installation
• Inspecting an MCP server for suspicious instructions or commands
• Reviewing a third-party agent repository

Migrate TypeScript test data from type assertions to @total-typescript/shoehorn helpers. Use partial objects for focused tests and deliberately invalid data for error cases, then check that the migrated tests pass type checking.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Replace type assertions in test files
• Create test objects with only the properties needed
• Supply deliberately invalid data for error tests

Build features or fix bugs by writing one failing test, then the minimum code needed to pass it. Test agreed public interfaces, the boundaries callers use, to check behavior without depending on internal implementation details.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Building a feature through test-first development
• Fixing a bug with a failing test first
• Writing behavior-focused integration tests

Test local web applications with Python scripts using Playwright, a browser automation tool. Verify interface behavior, investigate problems, capture screenshots, and inspect browser logs, with a helper that manages one or more application servers.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Verify buttons, links, and form behavior
• Investigate problems in dynamic web interfaces
• Capture screenshots of local applications

Investigate unexpected tool blocks and repeated permission prompts in Kode. The skill checks approved tools, command restrictions, inherited permissions, and session records, then verifies behavior by repeating the blocked action while preserving required user approval.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating an unexpectedly blocked tool
• Diagnosing repeated permission prompts
• Comparing permissions for main agents and subagents

Inspect Kiln’s interface in a real browser, capture screenshots, and run or debug end-to-end tests that check complete user flows. A sandbox with sample project data provides populated screens for checking UI changes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking the appearance and behavior of a changed screen
• Capturing screenshots of Kiln
• Running or debugging the existing end-to-end test suite

Check a Kiln branch or pull request through real browser interactions. Multiple agents test separate feature areas in isolated environments, then combine findings into a severity-ranked Markdown report with reproduction steps and expected versus actual behavior.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking all new behavior in a branch or pull request
• Testing multiple feature areas in parallel
• Finding UI text issues and inconsistent interactions

Validate a Kiln release candidate with standard code checks and selected tests against live APIs. Diagnose failures, inspect outdated model selections and coverage gaps, and produce a report with recommended actions without changing code or tests.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Validate a release candidate before publication
• Diagnose failures in live API tests
• Check test model selections for outdated versions