테스트·보안 스킬

Evaluate agent and skill outputs against expected results. Score accuracy, completeness, and consistency, compare performance with a baseline, and use regression cases to spot quality drops after changes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking a new agent or skill against expected outputs
• Finding regressions after changing instructions
• Running periodic quality audits

Protects sensitive files such as environment settings, credentials, and private keys by checking access against more than 195 patterns in 12 categories. It also detects attempts to reach those files through Bash pipelines and supports session-specific exceptions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Prevent agents from reading credentials or secret configuration files
• Block indirect access to sensitive paths through shell pipelines
• Allow approved file access exceptions for a session

Enforce a test-first workflow: write a failing test, implement the smallest change that passes, then refactor while keeping tests green. Run tests in one-shot mode, record exit codes as evidence, and surface repeated failures or scope concerns during implementation.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Implementing a feature with tests written first
• Adding a regression test while fixing a bug
• Recording test results at each development step

Require verifiable evidence before reporting that a build, fix, review, or task is complete. Check test results, logs, build output, and exit codes so completion claims are grounded in observed results rather than assumptions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Verifying a build before reporting completion
• Checking evidence for a bug fix
• Reviewing test and log results before approval

Use this skill to guide feature work and bug fixes through Red-Green-Refactor: write a failing test first, add only enough code to pass it, then improve code quality. It also sets an 80% coverage threshold and records test results.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Starting a feature with a test that defines expected behavior
• Fixing a bug by writing a regression test first
• Refactoring while checking that tests continue to pass

Analyze a Python project to identify functions that are promising fuzzing targets. Rank relevant files and functions, review existing tests and their coverage, then prepare a small shortlist with harness guidance and structured follow-up notes.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Finding parser or decoder functions to fuzz
• Choosing fuzz targets using existing test coverage
• Preparing a shortlist before building fuzzing harnesses

Prepare benchmark tasks for evaluating how AI agents use skills. Follow the repository workflow to initialize a task, define realistic and verifiable outcomes, validate it with an oracle run, compare runs with and without skills, and prepare a submission pull request.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Create a benchmark task for agent skills
• Check how the benchmark repository is organized
• Validate a task before submission

Learn the syzlang patterns used to describe ioctl system calls for Syzkaller fuzzing. The skill covers argument types, input and output pointers, structures, flags, and file descriptor resources, with examples to guide description files.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Describing ioctl commands for Syzkaller fuzzing
• Choosing syzlang types for ioctl arguments
• Defining structures and flag sets in syscall descriptions

Build fuzz targets for Python libraries with Atheris, a coverage-guided fuzzing engine based on LibFuzzer. The guide covers input handling, code instrumentation, custom mutators for structured data, and coverage reports to help uncover crashes and exceptions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Creating a fuzz target for a Python parser
• Instrumenting Python code to track coverage
• Handling structured inputs with a custom mutator

Review SkillsBench task pull requests by classifying their track, checking policy rules, benchmarking Oracle, Claude, and Codex runs with and without skills, and auditing agent traces for skill use or cheating. It produces a readable report and a trajectory bundle.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing a SkillsBench task PR
• Running skill and no-skill benchmarks
• Auditing agent trajectories for cheating

Scan dependency lock files with Trivy using a vulnerability database prepared in advance, so the scan can run without internet access. Save findings as JSON, check whether the database is available, and handle common scan setup errors.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Scanning package lock files without network access
• Saving dependency findings as a JSON report
• Checking an offline vulnerability database

Turn structured vulnerability scan data, such as Trivy JSON, into a filtered CSV audit report. Define clear columns, map fields, handle missing values, and use severity levels to focus the report on selected findings.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Create a CSV audit report from scanner JSON
• Filter findings to high or critical severity
• Map vulnerability fields into spreadsheet columns

Create a SkillsBench task from an idea or an existing workflow. The skill guides task prompts, environments, tests, reference solutions, and reusable skills, then helps validate the task, review it, run agent evaluations, and prepare a PR.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Turning a spreadsheet workflow into a benchmark task
• Converting a prompt into a SkillsBench task
• Preparing tests and a reference solution

Learn how Suricata rules combine traffic direction, fixed text, regular expressions, and protocol-aware buffers. Use these building blocks to express multi-condition HTTP matches and reduce alerts from unrelated traffic, while composing the final rule for your specific task.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Learning the parts of a Suricata alert rule
• Matching HTTP methods, paths, headers, and bodies
• Combining several conditions to narrow traffic alerts

Extract CVSS vulnerability severity scores from structured data, checking NVD, GHSA, and RedHat in a defined order. Handle missing values, fall back from version 3 to version 2 when available, and retain source details for security reports.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Adding vulnerability scores to a security report
• Choosing among CVSS scores from multiple sources
• Handling missing CVSS values in scan results

Run Suricata on PCAP files without live traffic, then inspect alerts in eve.json. The workflow covers checking rule syntax, counting and viewing alert details, and comparing known-positive and known-negative captures while iterating on rules.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Analyzing saved PCAP traffic offline
• Checking alert IDs and signatures in eve.json
• Validating rule syntax before a run

Measure page and API load times, network request timing, JavaScript and layout metrics, and visual shifts such as CLS or theme flicker. Included scripts help compare behavior before and after a change and inspect likely sources of slow or unstable pages.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Compare page performance before and after a fix
• Measure API response times and network request order
• Find layout shifts that affect visual stability

Write and review Python tests with pytest, using focused test cases, fixtures, parameterization, mocking, and async tests. The guidance helps diagnose failures, test errors and external boundaries, and improve coverage while keeping tests readable and easier to maintain.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Writing focused pytest tests
• Reviewing test structure and fixtures
• Debugging a failing Python test

Test Temporal workflows and activities with pytest using time-skipping, mocked activities, and replay checks for determinism. The guidance covers unit and integration tests, local setup, and ways to investigate test failures.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Writing fast workflow tests with time-skipping
• Mocking activities in integration tests
• Checking workflow determinism with replay tests

Review changes on the current branch for security vulnerabilities, bugs, and code quality problems. It maps risky inputs and operations, checks each changed file against a security checklist, verifies potential findings in context, and reports evidence and concrete fixes without editing code.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Review a branch before merging
• Check code changes for security vulnerabilities
• Audit modified files for bugs

Understand security risks during Jackson JSON deserialization in Java, when input is being turned into objects. The guidance explains why checking objects afterward can miss structural attacks such as empty keys, duplicate keys, nested input, and polymorphic type handling.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing when JSON input should be validated
• Understanding risks from duplicate or empty JSON keys
• Assessing polymorphic type handling in Jackson

Review application security with scripts for threat modeling, security audits, and penetration testing, plus references on architecture patterns and cryptography. Use it to inspect a project, identify security concerns, and guide security focused implementation work.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reviewing an application's security architecture
• Checking a project for security issues
• Planning a penetration test

Measure page and API performance, layout shifts, and theme flicker before and after a change. Included scripts use Playwright and Chrome DevTools Protocol data to report request timings, browser metrics, and visual stability signals for review.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Checking page performance before and after a change
• Measuring layout shifts with CLS
• Detecting a brief flash when dark theme loads

Guide authorized security assessments of SSH services, from discovering hosts and reviewing versions, algorithms, and authentication methods to checking known vulnerabilities and documenting tunnels. The workflow also covers credential testing and post-access review, with reports of findings and configurations.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Auditing SSH versions, algorithms, and authentication settings
• Assessing SSH credentials during an authorized test
• Checking known SSH vulnerabilities and misconfigurations