测试与安全技能

Prepare for SOC 2 Type I or Type II audits by organizing evidence and reviewing controls against Trust Service Criteria. The skill identifies missing or weak controls and produces a readiness report, remediation backlog, and auditor interview guide.

中文简介正在准备中。当前显示英语简介。

• Preparing an evidence checklist for SOC 2 criteria
• Assessing readiness across CC1–CC9
• Reviewing access controls such as MFA and RBAC

Review access permissions in application code and cloud configuration. Build a role-to-resource permission matrix, identify excessive grants, missing authorization checks, and routes to higher privileges, then report severity, compliance gaps, and specific remediation steps.

中文简介正在准备中。当前显示英语简介。

• Finding missing authorization checks in API routes
• Reviewing overly broad AWS IAM permissions
• Checking role permissions and separation of duties

Review an AssemblyAI speech workflow’s credentials, processing region, consent, retention, deletion, and model training settings. It helps document data handling decisions, validate the requested scope, and report risks without exposing audio, transcripts, or secrets.

中文简介正在准备中。当前显示英语简介。

• Reviewing privacy controls for a speech workflow
• Checking where audio and transcripts are processed
• Planning retention and deletion across downstream copies

Build automated checks for Attio integration changes using sample responses and response format tests. Produce pull request evidence without changing CRM records, with an optional, explicitly enabled read-only check against the live API.

中文简介正在准备中。当前显示英语简介。

• Adding automated checks for Attio integration pull requests
• Testing pagination, errors, and retry decisions
• Checking test outputs for exposed secrets or personal data

Inventory and audit agent system files such as skills, plugins, subagents, MCP configurations, hooks, and marketplace catalogs. It selects the relevant specification, runs available checks, and reports evidence, severity, remediation options, and any areas that remain unverified.

中文简介正在准备中。当前显示英语简介。

• Reviewing a skill or plugin before merging
• Checking a marketplace submission
• Auditing portability or security across agent files

Review Apple Notes automation scripts for appropriate permissions, protected exports, and secure credential handling. Establish local processing and cleanup practices, skip locked notes, and produce review evidence that excludes note content and secrets.

中文简介正在准备中。当前显示英语简介。

• Reviewing permissions for Notes automation
• Protecting exported notes and temporary files
• Moving script credentials into Keychain

Audit a repository’s tests across seven layers, from Git hooks to acceptance checks. Measure coverage and other quality checks, trace requirements to tests, and produce reports that identify gaps for handoff to a separate implementation skill.

中文简介正在准备中。当前显示英语简介。

• Finding gaps across seven testing layers
• Checking whether requirements have matching tests
• Reviewing changes that weaken test quality rules

Review a cryptocurrency wallet’s token approvals, contract interactions, and transaction patterns. The skill produces a risk score, flags concerning activity, and prioritizes approvals for review in a security report.

中文简介正在准备中。当前显示英语简介。

• Checking active token approvals for a wallet
• Reviewing transaction history for suspicious patterns
• Getting a wallet security score and risk summary

Set up CI tests for Apple Notes automation on macOS using a mock client, a stand-in for Notes.app. It also defines a separate integration test path on a self-hosted Mac with automation permissions.

中文简介正在准备中。当前显示英语简介。

• Running mock Apple Notes tests on pull requests
• Adding syntax checks for JXA scripts
• Testing Notes.app access on an authorized self-hosted Mac

Secure Apollo.io API integrations with protected key storage, limited permissions, and verified key rotation. Includes code patterns for masking personal information in logs and auditing source code for exposed keys and unsafe authentication.

中文简介正在准备中。当前显示英语简介。

• Review API key storage
• Mask personal information in logs
• Separate keys by required permissions

Gather diagnostic details for a failed, stalled, or empty Apify Actor run. The skill packages run metadata, logs, a small dataset sample, and environment information into an archive that can support troubleshooting or an Apify support request.

中文简介正在准备中。当前显示英语简介。

• Investigating an Actor run that failed
• Collecting evidence for an Apify support request
• Comparing a failed run with a successful one

Secure applications using the Claude API through key management, input checks, defenses against malicious instructions, and sensitive data screening. Test these controls in a sandbox and produce a verification record without exposing credentials or user content.

中文简介正在准备中。当前显示英语简介。

• Reviewing how Claude API keys are stored and rotated
• Testing defenses against malicious instructions in user input
• Checking inputs, responses, and logs for sensitive data

Set up CI checks for Claude API features, including fast unit tests that use mocks and gated prompt regression tests that call the live API. Define when secrets are exposed and how to limit test costs.

中文简介正在准备中。当前显示英语简介。

• Adding mock-based unit tests to a Claude API project
• Checking prompt behavior against the live API on a protected branch
• Setting API key access and CI cost limits

Harden credentials and access in Anima and Figma design-to-code pipelines. Check token scope, server-side use, secret storage, and generated artifacts so exposed credentials or unapproved design access stop the pipeline safely.

中文简介正在准备中。当前显示英语简介。

• Review Figma token scopes and approved file access
• Keep Anima and Figma credentials out of browser code
• Check CI pipeline settings for exposed secrets

Scan an authorized endpoint’s TLS setup, including protocol versions, cipher suites, certificate validity, hostname matching, and downgrade risks. The report ranks specific findings by severity, maps them to relevant controls, and offers remediation guidance.

中文简介正在准备中。当前显示英语简介。

• Investigate a weak TLS finding from an audit
• Check a certificate chain and expiration date
• Review endpoint TLS settings before deployment

Analyze test coverage, the share of code exercised by tests, to find untested lines, branches, and functions. Get prioritized gaps, suggested test scenarios, comparisons with a baseline, and configuration for enforcing coverage thresholds in CI.

中文简介正在准备中。当前显示英语简介。

• Finding untested code paths
• Prioritizing tests for conditions and error handling
• Comparing coverage before and after changes

Audit a website’s HTTP and HTTPS security headers and cookie settings to find missing protections, configuration errors, and exposed server details. Get a security grade, prioritized fixes, and configuration examples for Nginx, Apache, and Cloudflare.

中文简介正在准备中。当前显示英语简介。

• Review CSP and HSTS settings
• Compare HTTP and HTTPS security headers
• Check cookie security attributes

Audit project libraries for known security vulnerabilities, outdated versions, and license issues across several package ecosystems. Trace problems through indirect dependencies and produce prioritized findings, upgrade commands, and alternatives for packages that are no longer maintained.

中文简介正在准备中。当前显示英语简介。

• Auditing library vulnerabilities before deployment
• Tracing vulnerabilities in indirect dependencies
• Planning package updates by priority

Review an Algolia integration for exposed write-capable keys, overly broad index access, and records visible to search users. The skill maps credentials and permissions, checks tenant restrictions, and produces findings, remediation steps, and a key rotation plan.

中文简介正在准备中。当前显示英语简介。

• Audit Algolia keys and permissions
• Check whether search exposes sensitive records
• Review tenant-specific search restrictions

Review an Algolia search release before production by checking relevance, credentials, indexing, event tracking, monitoring, and rollback evidence. It produces a release-bound checklist with failed gates, approved waivers, and a clear go or no-go decision.

中文简介正在准备中。当前显示英语简介。

• Preparing a new search index for production
• Reviewing changed Algolia settings or credentials
• Checking search UI, events, and monitoring before launch

Map people and application actors to Algolia team roles, API-key permissions, index limits, and tenant restrictions. Get a least-privilege access matrix, safe allow-and-deny checks, and lifecycle findings for rotation, SSO, and account changes.

中文简介正在准备中。当前显示英语简介。

• Reviewing least-privilege Algolia access
• Mapping service identities to API-key permissions
• Checking tenant-specific search restrictions

Build CI checks for Algolia records, settings, and queries using offline tests plus optional live checks on disposable indexes. Capture test evidence, clean up temporary indexes, and keep production credentials and write keys away from untrusted pull requests.

中文简介正在准备中。当前显示英语简介。

• Validate search changes in pull requests
• Run Algolia smoke tests in GitHub Actions
• Test against disposable indexes without changing production

Add or strengthen CI checks for Alchemy integrations. The workflow combines deterministic unit and contract tests with secret scans, fork protections, and controlled live checks, producing reviewable evidence for failures such as invalid keys, wrong chains, and unavailable providers.

中文简介正在准备中。当前显示英语简介。

• Adding Alchemy checks to a CI pipeline
• Hardening GitHub Actions for Alchemy integrations
• Keeping secrets out of fork pull request workflows

Check a local repository before AI-assisted edits and issue a Green, Yellow, or Red risk receipt. It highlights destructive commands, credential-writing automation, risky agent permissions, and Git state, then recommends whether to proceed, checkpoint, or stop for review.

中文简介正在准备中。当前显示英语简介。

• Check a repository before agent edits
• Review hooks and automation for destructive actions
• Find credential-writing scripts or workflows