测试与安全技能

Compare an implementation with its OpenSpec specifications, tasks, and design decisions before archiving the change. Get a report on completion, requirement coverage, and consistency, with prioritized issues, actionable recommendations, and explicit limits where evidence is missing.

中文简介正在准备中。当前显示英语简介。

• Check for unfinished tasks before archiving a change
• Find gaps between specifications and implementation
• Review scenario tests and adherence to design decisions

Run a local check of test evidence and retain source paths in the result. The workflow stops when required evidence is missing, keeping the findings tied to their sources.

中文简介正在准备中。当前显示英语简介。

• Checking local test evidence
• Keeping source paths in check results
• Stopping a check when evidence is missing

Review proposed file operations, commands, network access, secret handling, or destructive actions against explicit sandbox rules that define permitted activity. Receive a JSON verdict and the exact rule behind it without performing the proposed action.

中文简介正在准备中。当前显示英语简介。

• Reviewing requested file operations before execution
• Checking commands or network access against sandbox rules
• Reviewing actions involving secrets or destructive changes

Evaluate an Agent Skill bundle before release by checking structure, activation conditions, output quality, scripts, safety, file integrity, and host compatibility. Receive a detailed JSON report that distinguishes local evidence checks from production readiness backed by external attestation.

中文简介正在准备中。当前显示英语简介。

• Reviewing a skill bundle before distribution
• Evaluating activation accuracy and output improvements
• Checking scripts, safety, and distributed files

Operate and test terminal apps without a display using named background sessions. Wait for visible screen changes, send keystrokes, reproduce Cline CLI bugs, capture text or PNG evidence, and write automated tests of interactive behavior.

中文简介正在准备中。当前显示英语简介。

• Reproducing Cline CLI interface bugs without a display
• Running an interactive process in the background
• Writing automated tests for terminal interactions

Assess an application against OWASP Top 10:2025 risk categories using Strix. Get findings backed by working exploit examples, organized by category, with clear explanations of what was tested and what remains unassessed.

中文简介正在准备中。当前显示英语简介。

• Assessing an app against OWASP Top 10:2025
• Testing access controls across users and tenants
• Organizing proven vulnerabilities by risk category

Turn Strix vulnerability findings into focused code fixes, prioritized by severity. Address root causes, rerun security scans and original exploit examples, and report the changes and verification results for each issue.

中文简介正在准备中。当前显示英语简介。

• Fixing vulnerabilities reported by Strix
• Prioritizing remediation by severity
• Retesting original exploits after code changes

Review source code with Strix to trace data flow and authorization checks, then test suspected vulnerabilities in a running environment. Receive proven findings with exploit examples and code locations, while keeping unconfirmed observations clearly identified.

中文简介正在准备中。当前显示英语简介。

• Reviewing a repository for security vulnerabilities
• Checking authorization logic in a specific service
• Reviewing security risks introduced by a branch

Set up Strix security checks in CI/CD to test pull request changes, report verified vulnerabilities, and gate merges. Covers both a CLI running on your own infrastructure and a managed service with pull request comments.

中文简介正在准备中。当前显示英语简介。

• Check pull request changes for vulnerabilities before merging
• Add Strix scans to GitHub Actions or GitLab CI
• Choose between managed reviews and scans on your own runners

Use Strix to test web apps, APIs, and source code for exploitable security flaws. Choose local or cloud execution, set testing scope and budget, and review validated findings with reproducible examples and structured reports.

中文简介正在准备中。当前显示英语简介。

• Security testing an application or API
• Testing source code alongside a deployed application
• Choosing between local and cloud execution

Test a running web application with Strix to find authentication, access control, and other security flaws. Review working proof-of-concept exploits, which demonstrate each issue, and use the evidence to guide fixes and retesting.

中文简介正在准备中。当前显示英语简介。

• Security testing a staging web application
• Checking access between accounts and organizations
• Testing a local development server

Plan and coordinate Strix security assessments across source code, running applications, APIs, and continuous integration pipelines. Combine findings into one prioritized remediation plan based on demonstrated impact, removing duplicates and documenting gaps in test coverage.

中文简介正在准备中。当前显示英语简介。

• Choosing suitable security tests for a product
• Planning a security assessment before launch
• Combining findings into a prioritized remediation plan

Run security tests for web apps, APIs, and source code on Strix Cloud without local Docker or an LLM key. Register targets, review findings in a team dashboard, export results, and configure recurring scans or PR reviews.

中文简介正在准备中。当前显示英语简介。

• Running security tests without local Docker
• Tracking vulnerability status across a team
• Scheduling scans and starting PR security reviews

Test REST, GraphQL, and gRPC APIs with Strix using schemas, credentials, and example data. Investigate authorization flaws, excessive data exposure, and other API risks, then verify findings with requests that reproduce the issue.

中文简介正在准备中。当前显示英语简介。

• Testing an API from its specification
• Checking data access across tenants
• Verifying restrictions on administrator routes

Reviews completed changes through hands-on checks and one reviewer agent. It compares the implementation and recorded evidence with the original goal, constraints, code quality, and security requirements, then reports approval, specific blockers, or an inconclusive result.

中文简介正在准备中。当前显示英语简介。

• Reviewing completed changes before a pull request handoff
• Checking whether an implementation meets the original request
• Organizing failed checks and required fixes

Test omo Codex Light edition in an isolated environment using real Codex and a local mock model. Verify installation, plugin hooks, and terminal startup, with captured evidence and no calls to a real model API.

中文简介正在准备中。当前显示英语简介。

• Verify installation and config.toml changes in isolation
• Confirm plugin hooks run during a real Codex turn
• Check terminal interface startup

Review changes since the last npm release through parallel change analysis, hands-on quality checks, and an overall release assessment. Receive a readiness verdict, blocking issues, version recommendations, and a draft changelog with compatibility concerns.

中文简介正在准备中。当前显示英语简介。

• Assess readiness before an npm release
• Check breaking changes and migration needs
• Review version bump recommendations

Audit a codebase with three vulnerability hunters and two engineers who build small demonstrations of suspected flaws. Verify attack paths, assess severity from demonstrated impact, and report evidence, targeted fixes, and checks to prevent recurrence.

中文简介正在准备中。当前显示英语简介。

• Review security before a release
• Audit security risks in a pull request
• Verify whether a suspected flaw is exploitable

Check the appearance and interaction states of web pages, terminal interfaces, and paginated documents. Uses captured images, light and dark themes, viewport comparisons, and independent reviews to produce evidence-backed verdicts for each checklist item.

中文简介正在准备中。当前显示英语简介。

• Checking a UI after implementation changes
• Comparing a page with a design reference
• Finding Japanese text clipping and awkward wrapping

Check opencode commands, HTTP server behavior, lifecycle events, and terminal startup with purpose-built scripts. Find stored sessions by ID, title, or scoped message searches, and export conversations as JSON for further inspection.

中文简介正在准备中。当前显示英语简介。

• Check CLI commands and HTTP server health
• Observe lifecycle events associated with plugin hooks
• Check terminal startup and keyboard input

Test the Senpi adapter and task engine against the real senpi binary in an isolated environment. Check task and team behavior, record evidence in a consistent location, and verify that the existing agent directory remains untouched.

中文简介正在准备中。当前显示英语简介。

• Verify adapter behavior after code changes
• Test task execution and team recovery
• Check that skills reach child tasks

Review local character animations before sharing previews or final renders. Check structured design data, asset files, browser errors, sampled motion frames, and MP4 metadata, then classify the result as pass, revise, or fail.

中文简介正在准备中。当前显示英语简介。

• Checking character animation previews before sharing
• Finding missing assets and browser errors
• Inspecting sampled frames for motion and visual issues

Verify documents, spreadsheets, presentations, and web deliverables before sharing them. Combine file checks with inspection of freshly rendered output, and scan for unfinished text to catch clipped content, layout problems, and leftover placeholders.

中文简介正在准备中。当前显示英语简介。

• Check documents before delivery
• Inspect rendered pages for layout problems
• Find leftover placeholders and sample text

Add or update a focused, reusable test when fixing bugs or changing behavior. Keep it in the project's existing test structure, verify the relevant change, and maintain coverage as the expected behavior evolves.

中文简介正在准备中。当前显示英语简介。

• Adding a regression test for a bug fix
• Updating tests when expected behavior changes
• Delivering a reusable test suite required by a specification