测试设计、漏洞检测、质量保证（1.3万 个）
Design metrics that measure whether a workflow achieved its intended outcome using recorded session evidence. Choose built-in checks or custom JavaScript, retain suitable Bash evaluators, and define tests that distinguish success, failure, and missing evidence.
中文简介正在准备中。当前显示英语简介。
Review git and gh operations in gh-aw workflows to check credential availability for each repository. Identify missing token handoffs, risky expansions of limited checkouts, and error handling needed where credentials are intentionally unavailable.
中文简介正在准备中。当前显示英语简介。
Explore web application vulnerabilities by class, including access control failures, XSS, and SQL injection. Use root causes, testing checklists, and examples to plan investigations and distinguish observable security impact from an initial warning sign.
中文简介正在准备中。当前显示英语简介。
Evaluate security findings before writing a bug bounty report. Check reproducibility, scope, practical impact, duplicates, and behavior across user sessions, then use submission checklists and CVSS 3.1 guidance to prepare evidence and assess severity.
中文简介正在准备中。当前显示英语简介。
Find test inputs and bypass references for web security checks, including XSS, SQL injection, and access control flaws. Use the guidance to investigate impact and assess whether a finding is suitable for a vulnerability report.
中文简介正在准备中。当前显示英语简介。
Plan bug bounty sessions around a clear goal and selected vulnerability types. Guides movement through reconnaissance, mapping, discovery, proof, and reporting, with prompts and routing to help decide what to investigate next.
中文简介正在准备中。当前显示英语简介。
Audit MCP servers, which connect AI agents to external tools, for injected instructions, excessive access, secret leaks, and unapproved actions. Trace untrusted input through tool calls and document demonstrated issues with concrete fixes.
中文简介正在准备中。当前显示英语简介。
Test Android and iOS apps by capturing real app traffic and checking backend APIs. When traffic is blocked or cannot be replayed, use decompilation and runtime inspection to uncover endpoints, inspect secrets, or understand request signing.
中文简介正在准备中。当前显示英语简介。
Test web APIs, authentication, and LLM features with six Python scanners. Check cross-site access rules, header injection, database inputs, and signed login tokens, then investigate hidden server behavior through external callbacks and chatbot responses.
中文简介正在准备中。当前显示英语简介。
Turn validated security findings into clear bug bounty reports for HackerOne, Bugcrowd, Intigriti, or Immunefi. Provides templates, reproducible evidence structure, severity scoring guidance, and submission checks focused on demonstrated impact.
中文简介正在准备中。当前显示英语简介。
Map a website’s exposed services by collecting subdomains, active hosts, and current or historical URLs. Inspect JavaScript and exposed files, prioritize areas for security testing, and monitor new subdomains and GitHub commits.
中文简介正在准备中。当前显示英语简介。
Guide bug bounty work from target research and vulnerability hunting through validation and reporting. Compare authenticated users, investigate related weaknesses, and organize reproducible evidence of practical impact before preparing a submission.
中文简介正在准备中。当前显示英语简介。
Review CI/CD pipelines, the workflows that build and release software, for unsafe code execution, exposed secrets, and excessive permissions. Combine automated scanning with manual checks to document reproducible findings and suggested fixes.
中文简介正在准备中。当前显示英语简介。
Assess what exposed credentials can access in AWS, GCP, and Azure. Map permissions, test paths to higher privileges, and document demonstrated impact using benign test objects within an explicitly authorized assessment scope.
中文简介正在准备中。当前显示英语简介。
Guide a bug bounty investigation from scope checks and asset discovery to vulnerability testing, impact validation, and report writing. Covers web applications, source code, and AI features, with an emphasis on reproducible evidence of real harm.
中文简介正在准备中。当前显示英语简介。
Review DeFi smart contracts using ten vulnerability classes, related-function comparisons, and code search patterns. Includes target selection criteria and a Foundry test template for building reproducible proofs of security issues.
中文简介正在准备中。当前显示英语简介。
Investigate API requests that fail to replay because of client-generated signatures or anti-bot tokens. Start with captured traffic, identify the blocking inputs or signing function, and validate a reproducible request for further security testing.
中文简介正在准备中。当前显示英语简介。
Plan explicitly permitted credential testing, from preparing password candidates and usernames to choosing a login mode. Covers breach-frequency ranking, attempt pacing, success detection, audit logs, and conditions for stopping the test.
中文简介正在准备中。当前显示英语简介。
Audit GraphQL APIs for exposed schemas, missing access checks, injection risks, and weak query limits. Combine automated tools with targeted checks to investigate data exposure, unauthorized operations, and resource exhaustion, then document findings with reproducible evidence.
中文简介正在准备中。当前显示英语简介。
Review EVM and Solana tokens for hidden minting, blocked sales, fee changes, and liquidity withdrawal risks. Combine code scanning with checks of privileged controls to identify mechanisms that could enable a rug pull, or issuer exit scam.
中文简介正在准备中。当前显示英语简介。
Test LLM applications for malicious instructions, information leaks, and unsafe tool use. The skill runs attack cases and checks observable evidence, helping distinguish suspicious replies from reproducible failures with concrete impact.
中文简介正在准备中。当前显示英语简介。
Audit a deployed AI agent through its product interface to test tool misuse, cross-user memory leaks, and unauthorized actions. Focuses on observable actions and reproducible evidence, including whether required human confirmation can be bypassed.
中文简介正在准备中。当前显示英语简介。
Advance one queued QA task by adding tests or test tooling, recording the work, and opening a pull request. The skill also manages its in-flight QA requests and merges into auto-qa after CI passes.
中文简介正在准备中。当前显示英语简介。
Find a valuable gap in test coverage by checking code, existing tests, and QA priorities. The skill creates at most one locked GitHub issue with concrete test cases, ready for later implementation.
中文简介正在准备中。当前显示英语简介。