测试与安全技能

Assess weaknesses in the software supply chain, from dependency packages to build pipelines and distributed artifacts. Covers authorized proof-of-concept testing, package confusion, container image risks, signing abuse, and defensive checks for tampering.

中文简介正在准备中。当前显示英语简介。

• Assess dependency confusion risks in package registry settings
• Review tampering risks in CI/CD artifacts and container images
• Plan a non-destructive proof of concept and remediation report

Support shellcode development for security testing: small machine-code programs executed in memory. The skill covers x86/x64 implementation, code that works regardless of its memory address, loaders, executable conversion, debugging, and platform-specific execution constraints.

中文简介正在准备中。当前显示英语简介。

• Studying address-independent x86/x64 code
• Reviewing loader memory allocation and execution
• Comparing EXE and DLL conversion tools

Turn penetration test and red team results into reports for executives and technical teams. Structure findings, explain severity scores and business impact, organize evidence, and document remediation steps and retest plans.

中文简介正在准备中。当前显示英语简介。

• Preparing a final penetration test report
• Rewriting an executive summary for nontechnical readers
• Creating a reusable security reporting template

Launch and control a real game to verify mods through screenshots and logs. Automate menus, keyboard and mouse input, and repeatable test scenes, with guidance for connecting an agent to game state through a JSON bridge.

中文简介正在准备中。当前显示英语简介。

• Verify a mod inside the running game
• Automate menu navigation and keyboard or mouse input
• Build a repeatable test or demo scene

Screen incoming files and URLs before document processing by checking blocked domains, open-access permissions, and file types. Produce a pass or reject decision, a risk report, and a tracking ID, with rejection when required checks cannot run.

中文简介正在准备中。当前显示英语简介。

• Screening documents before adding them to a knowledge base
• Checking source domains and open-access permissions
• Recording intake decisions and their reasons

Screen documents and external URLs before they enter a processing workflow. Check blocked domains and document permissions, then produce a pass or reject decision, a risk report, and a tracking ID for later review.

中文简介正在准备中。当前显示英语简介。

• Screening documents before adding them to a knowledge base
• Checking external URLs against a domain blocklist
• Reviewing document permissions before processing

Investigate a Sandcastle GitHub issue, classify the report, check for duplicates or existing fixes, and attempt reproduction with Docker. Return a minimal reproduction script, observed results, and a likely cause, noting any environment limitations.

中文简介正在准备中。当前显示英语简介。

• Classifying a reported Sandcastle issue
• Reproducing a bug in Docker
• Checking for duplicate reports or existing fixes

Audit Google Drive sharing without changing permissions. Use gog to identify public links, external sharing, broad domain access, potentially outdated grants, and ownership anomalies, then document affected files and supporting evidence.

中文简介正在准备中。当前显示英语简介。

• Review public links and external sharing
• List files accessible to a specific person
• Check broad domain access and potentially outdated grants

Run OpenClaw tests and reproduce bugs on remote machines through Crabbox. Choose a suitable execution provider, verify realistic user workflows, and report the actual provider, environment ID, logs, and timing.

中文简介正在准备中。当前显示英语简介。

• Run broad OpenClaw tests in a remote CI environment
• Reproduce installation or Docker bugs
• Verify behavior on macOS, Windows, or WSL2

Guides feature development and bug fixes through test-driven development: write a test, confirm the expected failure, then add the minimum code to pass. It also covers refactoring and checking the full test suite.

中文简介正在准备中。当前显示英语简介。

• Define expected behavior before building a feature
• Reproduce a bug with a failing test
• Refactor code while keeping tests passing

Verify work before reporting completion, committing changes, or creating a pull request. Run the checks that support each claim, inspect their output and exit codes, and report the actual results rather than relying on assumptions or agent reports.

中文简介正在准备中。当前显示英语简介。

• Verify results before reporting completion
• Reproduce the original bug to check a fix
• Check tests and builds before committing or opening a PR

Review and fix interface accessibility against WCAG 2.2, a web accessibility standard. Check keyboard navigation, focus, screen reader labels, forms, motion, and zoom, then report failures with their criteria and implement fixes using the project's existing styling system.

中文简介正在准备中。当前显示英语简介。

• Check flows using only the keyboard
• Fix control names and screen reader announcements
• Improve form labels and error feedback

Stress test one interface component on a temporary page using scenarios that its inputs and states can actually produce. View the examples together, record visible failures, and keep the annotated page available as a visual report.

中文简介正在准备中。当前显示英语简介。

• Check how a component handles long text
• Inspect a component inside narrow containers
• Compare relevant data and state scenarios

Run an AI vulnerability scan on uncommitted changes, changes against main, or an entire codebase. Filter candidate files, investigate potential security issues, and review findings with severity ratings, with options to revalidate and export results.

中文简介正在准备中。当前显示英语简介。

• Checking uncommitted changes for vulnerabilities
• Reviewing security issues in changes against main
• Scanning an existing codebase

Get documentation-based help with deepsec, an AI vulnerability scanner. Initialize or resume setup, configure scans and model credentials, and create detection rules or plugins using the documentation bundled with the installed version.

中文简介正在准备中。当前显示英语简介。

• Initializing deepsec and resuming interrupted setup
• Configuring scans, models, and credentials
• Creating or customizing vulnerability detection rules

Develop features and fix bugs by writing a behavior test first, observing its expected failure, and adding the minimum code needed to pass. Then clean up the code while keeping tests passing, applying this process where regression risk warrants it.

中文简介正在准备中。当前显示英语简介。

• Developing a feature from a failing behavior test
• Reproducing a bug before implementing its fix
• Refactoring while keeping behavior tests passing

Explore a web application as a user to find bugs and usability problems. Produce a structured report with reproducible steps, screenshots, and videos for interaction issues, giving responsible teams clear evidence to investigate.

中文简介正在准备中。当前显示英语简介。

• Checking core workflows before release
• Finding usability problems in forms and navigation
• Preparing bug reports with reproduction evidence

Verify development results before reporting success or preparing commits and pull requests. Run checks that support each claim, inspect their actual output, and report remaining gaps instead of relying on assumptions or another agent’s success message.

中文简介正在准备中。当前显示英语简介。

• Checking evidence before reporting a bug as fixed
• Confirming test and build results before a commit
• Verifying that a regression test detects the bug

Write and review Go tests using patterns suited to functions, file operations, and terminal interfaces. Cover multiple scenarios, check state changes, and compare rendered output with saved expected results while keeping slow integration tests separately skippable.

中文简介正在准备中。当前显示英语简介。

• Testing Go functions and parsers across multiple cases
• Checking file operations in temporary directories
• Testing Bubbletea state changes and interactions

Run two independent reviewers against the same fixed target, then compare their findings. With approval, address severe issues confirmed by both and reassess the fixes, using at most two correction rounds before a final verdict.

中文简介正在准备中。当前显示英语简介。

• Request two independent reviews of a specific target
• Separate confirmed issues from disputed findings
• Fix severe issues confirmed by both reviewers

Create and verify gentle-ai journeys, which are scripted sequences of product actions. Check their declarations separately from actual execution, review outdated expectations after behavior changes, and record execution results for pull requests.

中文简介正在准备中。当前显示英语简介。

• Adding a product operation journey
• Updating expectations after behavior changes
• Reproducing a bench failure from CI

Test running Native SDK apps by checking readiness, inspecting windows, driving widgets, and checking communication between JavaScript and Zig. Includes repeatable canvas screenshots and basic integration tests to confirm that key app features work.

中文简介正在准备中。当前显示英语简介。

• Checking app readiness and window state
• Testing widget input and interactions
• Comparing repeatable canvas screenshots

Handle one known local bug or testable bug hypothesis through reproduction, independent validation, repair, and regression checks. Produce a local patch commit and evidence reports that help reviewers judge whether the fix is ready.

中文简介正在准备中。当前显示英语简介。

• Investigate and repair one reported local bug
• Have separate agents verify reproduction and the fix
• Prepare evidence reports for patch review

Independently reproduce a reported runtime or compiler bug in a local repository. Build the baseline, exercise the actual artifact or compiler, and save logs and structured records distinguishing reproduction, absence of the behavior, and setup blockers.

中文简介正在准备中。当前显示英语简介。

• Reproduce a reported runtime bug locally
• Verify a compiler failure using its diagnostic
• Preserve logs and records for a reproduction handoff