测试与安全技能

Audit code changes against Karpathy's 4 principles (Think Before Coding, Simplicity First, Surgical Changes, Goal-Driven Execution). Auto-called after Phase 5 IMPLEMENT; can also be invoked manually. Produces scored compliance report and blocks advancement if threshold not met.

中文简介正在准备中。当前显示原文说明。

Run WCAG 2.2 Level AA accessibility audits against generated UI. Use when a story has ui:true or when asked to audit accessibility.

中文简介正在准备中。当前显示原文说明。

Scans Cosmos SDK blockchains for 9 consensus-critical vulnerabilities including non-determinism, incorrect signers, ABCI panics, and rounding errors. Use when auditing Cosmos chains or CosmWasm contracts. (project, gitignored)

中文简介正在准备中。当前显示原文说明。

Testing for timing side channels and constant-time implementation verification.

中文简介正在准备中。当前显示原文说明。

Detects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or constant-time programming questions in C, C++, Go, Rust, Swift, Java, Kotlin, C#, PHP, JavaScript, TypeScript, Python, or Ruby.

中文简介正在准备中。当前显示原文说明。

Analyze code changes for security vulnerabilities using LLM reasoning and threat model patterns. Use for PR reviews, pre-commit checks, or branch comparisons.

中文简介正在准备中。当前显示原文说明。

Automate browser interactions for web testing, form filling, screenshots, and data extraction. Use when the user needs to: - Navigate websites and interact with web pages - Fill forms and click buttons - Take screenshots of web content - Test web applications - Extract information from web pages - Debug frontend issues in the browser - Monitor console logs and network requests - Record browser sessions as video This skill uses agent-browser for comprehensive browser automation. RECOMMENDATION: Disable Chrome DevTools or Playwright MCP when using this skill to save context.

中文简介正在准备中。当前显示原文说明。

Web application security testing with Burp Suite.

中文简介正在准备中。当前显示原文说明。

Scans Cairo/StarkNet smart contracts for 6 critical vulnerabilities including felt252 arithmetic overflow, L1-L2 messaging issues, address conversion problems, and signature replay. Use when auditing StarkNet projects. (project, gitignored)

中文简介正在准备中。当前显示原文说明。

Go-based security techniques from "Black Hat Go" extended with macOS, Cloud, Mobile, IoT, Supply Chain, API, Web3, AI/ML, Red Team, ATT&CK, and LLM chapters. 186 techniques, 36 tools, 33 defenses across 37 chapters. Includes adversarial bisimulation games with Ungar (order-dependent) and join-semilattice structures. AAIF-compatible multiplayer agent games for human-agent security exercises.

中文简介正在准备中。当前显示原文说明。

This skill integrates **Boxxy sandbox boundary testing** with the complete Trail of Bits firmware extraction methodology. Use this for extracting and analyzing firmware in heavily obfuscated, containerized, or restricted environments.

中文简介正在准备中。当前显示原文说明。

Prepare your codebase for security review using Trail of Bits' checklist. Helps set review goals, runs static analysis tools, increases test coverage, removes dead code, ensures accessibility, and generates comprehensive documentation (flowcharts, user stories, inline comments). (project, gitignored)

中文简介正在准备中。当前显示原文说明。

Python fuzzing with Atheris for discovering vulnerabilities in Python code.

中文简介正在准备中。当前显示原文说明。

Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.

中文简介正在准备中。当前显示原文说明。

Brain-Computer Interface with colored operad security boundaries. Maximally isolated EEG/neural data processing via VM→Container→Process enclosure with GF(3) conservation for Agent-O-Rama neural pathways.

中文简介正在准备中。当前显示原文说明。

Audit Orchestrator

中文简介正在准备中。当前显示原文说明。

Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field validations, and access control issues. Use when auditing Algorand projects (TEAL/PyTeal). (project, gitignored)

中文简介正在准备中。当前显示原文说明。

Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents running in CI/CD pipelines, including env var intermediary patterns, direct expression injection, dangerous sandbox configurations, and wildcard user allowlists. Use when reviewing workflow files that invoke AI coding agents, auditing CI/CD pipeline security for prompt injection risks, or evaluating agentic action configurations.

中文简介正在准备中。当前显示原文说明。

Augmented reality (AR) reality tech. Passthrough overlays, hit-test/anchors, occlusion, lighting, camera permissions, and safety.

中文简介正在准备中。当前显示原文说明。

Primary Aptos testnet wallet for transaction origination. Use when initiating test transactions.

中文简介正在准备中。当前显示原文说明。

Query and explore the 2600: The Hacker Quarterly magazine archive (1984-present) via DuckDB. Provides structured access to 168+ issues covering hacker culture, security, privacy, telephony, and digital rights without loading full content into context.

中文简介正在准备中。当前显示原文说明。

When the user wants to plan, design, or implement an A/B test or experiment. Also use when the user mentions "A/B test," "split test," "experiment," "test this change," "variant copy," "multivariate test," or "hypothesis." For tracking implementation, see analytics-tracking.

中文简介正在准备中。当前显示原文说明。

Cloud laboratory platform for automated protein testing and validation. Use when designing proteins and needing experimental validation including binding assays, expression testing, thermostability measurements, enzyme activity assays, or protein sequence optimization. Also use for submitting experiments via API, tracking experiment status, downloading results, optimizing protein sequences for better expression using computational tools (NetSolP, SoluProt, SolubleMPNN, ESM), or managing protein design workflows with wet-lab validation.

中文简介正在准备中。当前显示原文说明。

Hypothesis-Test Loops via REPL for Exploratory Abductive Inference

中文简介正在准备中。当前显示原文说明。