测试与安全技能

Route reverse engineering and security tasks to a specialist skill based on the target, purpose, and available tools. Establish the case scope and authorization status, then prepare supported tools before handing off the work.

中文简介正在准备中。当前显示英语简介。

• Choose a specialist skill for an unfamiliar analysis task
• Route work spanning several security disciplines
• Record case scope and authorization before analysis

Evaluate how Chatbox answers questions about large attachments using synthetic and real documents. Check whether the model retrieves file content when needed, skips retrieval for unrelated requests, and investigate failures through the actual application flow.

中文简介正在准备中。当前显示英语简介。

• Verify retrieval for questions about large attachments
• Test file-related questions without explicit search requests
• Check that unrelated requests skip file retrieval

Learn how to check Claude Code tool calls against a policy and create digitally signed execution records. This walkthrough covers setup, offline verification, tamper demonstrations, and CI/CD integration before adopting the protect-mcp runtime plugin.

中文简介正在准备中。当前显示英语简介。

• Evaluate signed audit records before adopting runtime hooks
• Demonstrate offline verification and tamper detection
• Verify agent execution records in CI/CD

Set up automated security checks that inspect source code without running the application. Configure Semgrep, SonarQube, or CodeQL, add project-specific rules, reduce false alarms, and define criteria for blocking problematic changes.

中文简介正在准备中。当前显示英语简介。

• Adding automated security scans to CI/CD
• Creating security rules for project-specific code patterns
• Reducing false alarms and scan time

Capture and analyze network traffic to understand custom protocols, including message boundaries and field meanings. Use the findings to document formats, investigate communication problems, and validate behavior through replay and tests with unusual inputs.

中文简介正在准备中。当前显示英语简介。

• Investigating network communication failures
• Understanding proprietary message formats
• Documenting protocol specifications

Turn identified threats and business needs into specific, testable security requirements. Define priorities, explain the rationale, and develop security user stories, acceptance criteria, and test cases linked to the risks they address.

中文简介正在准备中。当前显示英语简介。

• Turn threat models into security requirements
• Write security user stories and acceptance criteria
• Develop security test cases

Set up ShellCheck to inspect shell scripts without running them. Understand warnings, configure checks for the intended shell, document exceptions, and integrate analysis into CI, editors, or checks that run before commits.

中文简介正在准备中。当前显示英语简介。

• Reviewing existing shell scripts for common issues
• Adding shell script checks to CI/CD
• Configuring checks for the intended shell

Review AI-generated code for problems hidden behind successful runs. Check failure handling, resource cleanup, unusual inputs, nonexistent dependencies, and departures from project conventions to identify missing safeguards before merging or accepting the work as complete.

中文简介正在准备中。当前显示英语简介。

• Audit code after an AI generation session
• Review an AI-generated pull request before merging
• Investigate brittle code that appears to work

Map security threats into attack trees, branching diagrams that connect an attacker’s goal to possible steps. Assess cost, time, expertise, and detection likelihood to identify defense gaps, prioritize mitigations, and explain risks to stakeholders.

中文简介正在准备中。当前显示英语简介。

• Visualizing complex attack scenarios
• Identifying defense gaps and priorities
• Explaining security risks to stakeholders

Identify security threats in system designs using STRIDE, a method covering six threat categories. Use structured questions to review components, prioritize threats by impact, and document findings and possible safeguards.

中文简介正在准备中。当前显示英语简介。

• Start a threat modeling session
• Review the security of an existing system design
• Document threats and possible safeguards

Set up human approval for Claude Code actions such as PR reviews, merges, and CI changes. Configure Cedar authorization rules and signed records of allowed actions that can be checked offline with a public key.

中文简介正在准备中。当前显示英语简介。

• Requiring approval before PR reviews and merges
• Gating issue actions and release publishing
• Requiring approval for CI changes and protected branch pushes

Match identified security threats with controls that prevent, detect, or help recover from attacks. Use the mappings to find coverage gaps, prioritize security spending, and create remediation plans with multiple layers of protection.

中文简介正在准备中。当前显示英语简介。

• Prioritizing security investments
• Creating a security remediation roadmap
• Checking gaps in existing security controls

Create automated shell script tests with Bats, a Bash testing tool. Check exit codes, output, and failure cases, organize reusable test helpers and data, and run checks across shells or in CI/CD pipelines.

中文简介正在准备中。当前显示英语简介。

• Add automated tests to shell scripts
• Check invalid input and missing file errors
• Test behavior in bash, sh, and dash

Set up rules that allow or block Claude Code tool calls, and record executed tool names in digitally signed receipts. The skill also explains offline verification and the limits of what those records prove.

中文简介正在准备中。当前显示英语简介。

• Restricting which Claude Code tools may run
• Recording tool names in digitally signed receipts
• Verifying receipts offline with a public key

Explains how PluginEval combines structural checks and experimental model assessments into quality scores. Helps interpret low scores, identify improvement areas, set marketplace thresholds, and explain what evaluation badges actually represent.

中文简介正在准备中。当前显示英语简介。

• Investigating why a skill received a low score
• Improving descriptions that define when a skill should run
• Setting score thresholds for marketplace listings

Investigate security incidents using memory dumps, saved copies of RAM. The skill guides memory acquisition, process and network analysis, suspicious code detection, and evidence extraction with Volatility and related tools, including checks for capture integrity.

中文简介正在准备中。当前显示英语简介。

• Capturing RAM before shutting down a system under investigation
• Finding suspicious processes and network connections in memory
• Extracting executables and strings for malware analysis

Create and organize Python tests with pytest. Use reusable setup, mock replacements for external services, controlled test time, and coverage reports to check normal behavior, failures, retries, and interactions between application components.

中文简介正在准备中。当前显示英语简介。

• Add unit and integration tests to Python code
• Replace external services with mocks in tests
• Check retry behavior and time-dependent logic

Identify software protections that hinder inspection, such as debugger detection and obfuscation that makes code harder to understand. Support authorized binary analysis and CTF security challenges with protection findings, bypass strategies, reports, and analysis scripts.

中文简介正在准备中。当前显示英语简介。

• Identify protections in an authorized malware sample
• Plan analysis of a packed executable
• Implement debugger detection for a CTF challenge

Help secure payment systems using PCI DSS, the payment card data security standard. Covers encryption, log masking, access controls, and tokenization, which replaces card details with substitute values to reduce direct handling of sensitive data.

中文简介正在准备中。当前显示英语简介。

• Designing secure payment flows
• Replacing card details with payment tokens
• Reviewing sensitive data in logs and storage

Guides Kubernetes security configuration with network restrictions, Pod execution rules, and role-based access control. Use its configuration examples to separate workloads, limit permissions, and enforce deployment requirements across a cluster.

中文简介正在准备中。当前显示英语简介。

• Restricting communication between application components
• Giving ServiceAccounts only the permissions they need
• Running Pods with restricted privileges

Build end-to-end tests with Playwright and Cypress to check complete user workflows, such as login and checkout. Improve test reliability through stable element selection, independent test data, appropriate waits, and debugging with traces and screenshots.

中文简介正在准备中。当前显示英语简介。

• Automate tests for login and checkout workflows
• Investigate tests that fail intermittently
• Run browser tests in CI/CD pipelines

Write JavaScript and TypeScript tests with Jest, Vitest, and Testing Library. Covers functions, UI components, and APIs, including mock replacements for external services, reusable test data, and setup for automated testing.

中文简介正在准备中。当前显示英语简介。

• Set up testing for a new project
• Test functions and API error handling
• Check React component behavior

Configure a Claude Code hook that checks shell commands before execution and blocks flags that skip Git checks or commit signing. It helps preserve existing commit quality checks while documenting the guard's limits.

中文简介正在准备中。当前显示英语简介。

• Blocking flags that skip commit checks
• Preventing commands that disable commit signing
• Sharing Claude Code guard settings across a team

Guide web app testing with screen readers such as VoiceOver, NVDA, and JAWS. Check forms, dialogs, keyboard navigation, and spoken update notifications to identify accessibility problems across desktop and mobile browser combinations.

中文简介正在准备中。当前显示英语简介。

• Checking form labels and error announcements
• Testing dialog focus behavior
• Verifying announcements for changing content