测试与安全技能

Review a source tree for plausible security vulnerabilities without building or running it. The skill can use a threat model to choose review areas and produces JSON and Markdown findings for a later triage step.

中文简介正在准备中。当前显示英语简介。

• Screening a codebase for security issues
• Reviewing code against an existing threat model
• Preparing candidate findings for a triage workflow

Create a threat model for a codebase by interviewing its owner, deriving risks from code and past vulnerability evidence, or combining both approaches. The result is a structured THREAT_MODEL.md that maps threats, entry points, and recommended mitigations.

中文简介正在准备中。当前显示英语简介。

• Mapping a codebase's attack surface
• Documenting risks for a new system design
• Assessing inherited or third-party code

Verify finished work against acceptance criteria using executable checks and a review of whether each requirement is met. Multiple models can review uncertain cases, and rejected work can enter an automated repair loop when the required Seed is available.

中文简介正在准备中。当前显示英语简介。

• Checking finished work against its specification
• Verifying observed behavior against acceptance criteria
• Requesting multiple model reviews for uncertain results

Check code, documents, API responses, and other outputs against a defined quality bar. Receive a score, a pass, revise, or fail verdict, and practical suggestions, with observed behavior informing checks where applicable tools are available.

中文简介正在准备中。当前显示英语简介。

• Checking code against acceptance criteria
• Reviewing a document for missing content
• Checking API responses against expectations

Inspect platform support and configured restrictions for the Claude Code sandbox, which limits command access. Review writable paths, protected credential files, allowed network domains, and excluded commands. Recent violation log inspection is not yet implemented.

中文简介正在准备中。当前显示英语简介。

• Checking sandbox settings before autonomous work
• Investigating restrictions behind blocked commands
• Reviewing allowed domains and file access

Run a quick code security review for exposed credentials, injection risks, unsafe page content, vulnerable dependencies, and authentication issues. Receive findings grouped by severity, with file locations and suggested fixes to prioritize remediation.

中文简介正在准备中。当前显示英语简介。

• Reviewing sensitive code changes before merging
• Checking for exposed credentials
• Reviewing authentication and injection risks

Check Claude Code configuration against a supplied threat database. Review installed skills, MCP servers that connect external tools, hooks, permissions, and exposed credentials, then receive findings grouped by severity with prioritized actions.

中文简介正在准备中。当前显示英语简介。

• Review configuration after installing skills or MCP servers
• Find overly broad permissions and dangerous settings
• Check configuration files for exposed keys and tokens

Analyze SonarCloud findings for a pull request, a proposed code change. Group issues by severity, type, file, and rule, then produce a report highlighting frequent problems and recommended priorities without modifying code.

中文简介正在准备中。当前显示英语简介。

• Reviewing quality findings before merging a pull request
• Finding files and rules with the most issues
• Prioritizing bugs and security findings

Check a Proofpack release candidate before packaging by running tests, validating the candidate, and inspecting the package locally. Compare the source state and command results with the evidence log, then report passed, failed, or unknown checks.

中文简介正在准备中。当前显示英语简介。

• Checking a Proofpack candidate before packaging
• Comparing local verification with recorded evidence
• Finding unverified checks or uncovered changes

Audit a project and its Claude Code configuration for exposed credentials, vulnerable dependencies, malicious instructions, and hook security. Receive a scored report with evidence, severity levels, and a prioritized plan for addressing the findings.

中文简介正在准备中。当前显示英语简介。

• Reviewing project security before production deployment
• Checking credentials against Git history
• Inspecting Claude Code settings and security hooks

Coordinate threat research and updates in AgentSec, then synchronize validated results to the guide and landing page. Check compatibility data and the searchable catalogue, and report the status of each repository separately.

中文简介正在准备中。当前显示英语简介。

• Updating threat information through AgentSec
• Synchronizing validated security feeds
• Checking new records in the searchable catalogue

Evaluate staged Git changes before committing using an LLM, a language model acting as a reviewer. Receive correctness, completeness, and safety scores, plus issues by severity, to decide whether to fix, commit, or stop.

中文简介正在准备中。当前显示英语简介。

• Evaluate significant changes before committing
• Review changes in unfamiliar code
• Check changes to security-sensitive code

Audit a Claude Code installation for the cache issues documented in this skill. Check versions, configuration files, session resume usage, and installed binaries, then report exposure, suggested actions, and informational limits on tool result retention.

中文简介正在准备中。当前显示英语简介。

• Investigate cache behavior and unexpected costs
• Check session resume usage in settings and scripts
• Find outdated Claude Code binaries

Test a web application using branch changes, selected pages, or the whole app as scope. Choose among three testing levels, document issues with evidence, fix them in separate commits, and verify results in a release-readiness report.

中文简介正在准备中。当前显示英语简介。

• Checking changed pages before opening a pull request
• Running a quick check for major bugs before committing
• Reviewing a release candidate for visual and functional issues

Check background type checks, tests, and builds in a Git worktree, a separate working directory. Read verification logs to see results, failure counts, and errors, with suggested next actions while development continues.

中文简介正在准备中。当前显示英语简介。

• Checking background verification while continuing development
• Reviewing type errors and failed test names
• Distinguishing running checks from checks that have not run

Assess a codebase across seven areas, including exposed credentials, security, dependencies, structure, and tests. Receive category scores, findings tied to file locations, and a prioritized improvement plan with smaller tasks that can be completed quickly.

中文简介正在准备中。当前显示英语简介。

• Assessing the overall health of an inherited project
• Reviewing exposed credentials and security risks
• Identifying dependency and test coverage gaps

Generate tests for a specified file or module using the project’s testing conventions. Cover expected behavior, unusual inputs, boundaries, failures, and external interactions, with independent tests and mock substitutes for external dependencies.

中文简介正在准备中。当前显示英语简介。

• Add tests for existing functions or modules
• Check empty inputs and boundary values
• Test failures in APIs, databases, and file operations

Research new security advisories for coding agents and MCP, the protocol connecting agents to tools. Update AgentSec Triage records with source evidence and regression tests, then validate generated artifacts and synchronize the approved feed with dependent guides and pages.

中文简介正在准备中。当前显示英语简介。

• Refreshing threat records from recent security advisories
• Checking affected versions and fixes against primary sources
• Testing detector behavior for accepted threat records

Audit custom subagents, the specialized assistants used by Claude Code and Codex. Check whether definitions load, identify overlapping roles, review model choices and tool access, and receive scores with prioritized fixes and optional confirmed edits.

中文简介正在准备中。当前显示英语简介。

• Checking agents when joining a project
• Reviewing newly added or imported agents
• Investigating delegation to the wrong agent

Analyze security logs through four agent roles that parse events, detect anomalies, classify risk, and write an incident report. Use nginx, authentication, or system logs to review suspicious activity and receive a risk summary with recommended actions.

中文简介正在准备中。当前显示英语简介。

• Investigate suspicious access in nginx logs
• Analyze anomalies in authentication logs
• Classify risks found in security logs

Generate several separate solutions, compare them against criteria fixed in advance, and verify the selected result through executable checks or an independent reviewer. Keep a proof log documenting candidates, evidence, failures, and remaining limits.

中文简介正在准备中。当前显示英语简介。

• Comparing implementation options before choosing one
• Verifying a solution when a wrong choice would be costly
• Keeping evaluation evidence for delivery or audit

Run repository tests using commands suited to Python, Node, or Rust projects. Detect the project setup from its files, run the full suite or a selected target, and show passing results or failure details.

中文简介正在准备中。当前显示英语简介。

• Run the full test suite before pushing changes
• Test a specific file or folder
• Use test commands suited to each project

Audit Claude Code and Codex hooks, actions triggered by agent events. Check commands, trigger conditions, blocking behavior, and timeouts to identify why hooks fail to run, fail to block actions, or delay the agent.

中文简介正在准备中。当前显示英语简介。

• Validate hook settings before committing
• Investigate hooks that never run
• Check policy hooks that fail to block actions

Evaluate Claude Code agents, skills, and commands with weighted quality criteria. Get scores, readiness grades, template comparisons, and practical improvement suggestions in Markdown or JSON reports to guide reviews before release.

中文简介正在准备中。当前显示英语简介。

• Review skills before release
• Compare agent definitions with reference templates
• Quickly check critical quality criteria