测试与安全技能

Use this application reconnaissance playbook to map one authorized app from its pages, scripts, traffic, and documentation. It produces a concise app portrait, host and endpoint inventory, exposed keys, response classifications, and an object flow for later security testing.

中文简介正在准备中。当前显示英语简介。

• Mapping an authorized app that only shows a login page
• Finding business hosts and APIs exposed by frontend scripts
• Recording exposed keys and hidden routes for later review

Use this guide to plan security testing for REST, mobile, or GraphQL APIs. It helps sort findings into documentation and endpoint discovery, authorization, token handling, or hidden-field checks, then directs the investigation to a focused topic.

中文简介正在准备中。当前显示英语简介。

• Planning a security review of an API
• Choosing checks after finding API documentation
• Sorting token, permission, and GraphQL concerns

Review API authentication that relies on bearer tokens, API keys, or JWTs. The playbook helps inspect token claims and key handling, test identity headers and rate limits, and spot weak trust boundaries such as mass assignment or cross-client token reuse.

中文简介正在准备中。当前显示英语简介。

• Reviewing API bearer token and API key handling
• Checking JWT claims and key references
• Testing header-based identity and rate limits

Use this playbook to assess flaws in application workflows that scanners can miss. It guides reviewers through price and coupon manipulation, race conditions, skipped steps, account permissions, subscription limits, and API state changes, with checklists for structured testing.

中文简介正在准备中。当前显示英语简介。

• Reviewing checkout flows for price or discount manipulation
• Checking whether parallel requests bypass a one-time limit
• Tracing multi-step login or password reset authorization

Assess misconfigured Active Directory permissions and trace possible privilege escalation paths. The guide covers BloodHound enumeration and risky ACL rights, including DCSync, shadow credentials, LAPS access, group changes, and writable Group Policy Objects, with examples of how these issues connect.

中文简介正在准备中。当前显示英语简介。

• Reviewing BloodHound results for paths to domain admin
• Checking risky ACL permissions on AD objects
• Assessing DCSync, shadow credential, or LAPS exposure

Use this guide to plan security checks for login, sessions, permissions, tokens, and identity protocols. It helps classify an authentication or authorization issue and points to a focused topic guide for the next step.

中文简介正在准备中。当前显示英语简介。

• Planning checks for login and session handling
• Reviewing access to users’ data and actions
• Sorting out OAuth, JWT, or SSO concerns

Use this playbook to check whether an API properly limits access to records and privileged actions. It helps organize tests across identifiers, request fields, HTTP methods, related resources, and user roles, so authorization gaps can be identified and documented.

中文简介正在准备中。当前显示英语简介。

• Checking whether one account can access another account’s records
• Reviewing API authorization across request fields and HTTP methods
• Testing whether regular users can reach admin functions

Explore GraphQL schemas and API requests to find undocumented fields, hidden parameters, batching behaviors, and authorization gaps. The playbook suggests discovery probes and clues in frontend or mobile code to guide security testing.

中文简介正在准备中。当前显示英语简介。

• Discovering GraphQL fields when introspection is limited
• Finding hidden request parameters in frontend and mobile code
• Testing batching and nested object authorization gaps

Use this skill to triage security issues in file downloads, paths, uploads, previews, and archive extraction. It helps identify where a file workflow is affected and routes the investigation to path traversal or upload validation topics.

中文简介正在准备中。当前显示英语简介。

• Reviewing download endpoints and file path handling
• Investigating upload, preview, or extraction workflows
• Choosing between path traversal and upload validation checks

Assess security risks across AI and machine learning systems, from model files and training pipelines to prediction APIs and autonomous agents. The guide covers poisoned models, adversarial inputs, model extraction, privacy attacks, LLM threats, and practical security scanning tools.

中文简介正在准备中。当前显示英语简介。

• Reviewing model files and ML supply chain risks
• Assessing adversarial robustness of a classifier
• Checking privacy risks in a model API

Analyze format string vulnerabilities in printf-family calls that use user-controlled input. The playbook explains how to identify the issue, inspect stack values, read or write memory with format specifiers, and reason about leaks and overwrite targets across 32-bit and 64-bit programs.

中文简介正在准备中。当前显示英语简介。

• Checking a printf-family call for a format string flaw
• Finding stack offsets and leaking process addresses
• Planning controlled memory writes with format specifiers

Assess Android apps during authorized security reviews. The playbook covers intercepting pinned HTTPS traffic, checking exposed components and WebViews, testing intent redirection and root detection, and examining overlays, app backups, and stored data for weaknesses.

中文简介正在准备中。当前显示英语简介。

• Testing Android apps during an authorized assessment
• Reviewing exported components and deep links
• Checking WebView settings and app backups

Choose focused tests for DeepSeek Harness plugins and package changes, from unit checks and snapshots to real API, browser, composition, and packaged-entry tests. For version migrations, validate the exact target runtime through a seven-touchpoint workflow.

中文简介正在准备中。当前显示英语简介。

• Choosing tests for a plugin code change
• Testing a Harness version migration
• Checking a packaged plugin through its real entry point

Turn a real DSH plugin migration or version corridor into an auto-graded Harbor benchmark task. Create a fixture, agent instructions, scoring judge, and reference solution, then connect the task to the existing benchmark suite. This skill creates tasks; it does not run benchmarks.

中文简介正在准备中。当前显示英语简介。

• Turning a real plugin migration into a benchmark task
• Making an existing version card executable as an exam
• Building a fixture that reproduces an observable upgrade failure

Check a completed task by comparing its claims with the actual changes and rerunning the stated checks. The skill looks for weakened tests, unsupported success reports, and unrelated changes, then gives an evidence-based verdict with caveats or a recommended fix.

中文简介正在准备中。当前显示英语简介。

• Verify an agent's completed code changes
• Check whether reported tests really pass
• Review a diff for weakened tests or scope creep

Review a WordPress plugin’s Abilities API registrations by comparing annotations with callback behavior, checking permissions and input schemas, and validating audit documents. Choose static source inspection or runtime checks in a running environment, then receive a structured report with findings.

中文简介正在准备中。当前显示英语简介。

• Check abilities before submitting a plugin change
• Look for callbacks that write despite a readonly annotation
• Validate an abilities audit document

Choose focused unit, end-to-end, Caddyfile fixture, automation, and CI checks for caddy-security changes. It helps maintain relevant test coverage, reproduce failures, and report exactly what the selected checks establish; official OpenID Provider conformance is an opt-in workflow.

中文简介正在准备中。当前显示英语简介。

• Choosing tests for a focused code change
• Adding or updating Caddyfile adaptation fixtures
• Reproducing a CI failure locally

Before reporting that work is complete, run the full command that can verify the claim and inspect its output and exit code. The skill helps agents distinguish tested results from assumptions when checking tests, builds, fixes, and requirements.

中文简介正在准备中。当前显示英语简介。

• Verify tests before reporting they pass
• Check a build before calling work complete
• Confirm a bug fix with a test for the original issue

Use this skill to plan and automate checks for web apps, including unit, integration, end-to-end, load, security, visual, and accessibility testing. It covers browser and mobile checks, test flakiness, and Core Web Vitals, which measure user-facing performance.

中文简介正在准备中。当前显示英语简介。

• Automating browser-based end-to-end checks
• Testing functions, APIs, and integrated features
• Checking load performance before release

Use this skill to write or review LoongCollector unit tests, end-to-end tests, and performance benchmarks. It guides test structure, boundary and failure coverage, and realistic performance comparisons so test results reflect the behavior being checked.

中文简介正在准备中。当前显示英语简介。

• Writing or reviewing C++ and Go unit tests
• Creating BDD-style end-to-end tests
• Benchmarking performance-sensitive code

Scan staged changes before a commit and commit history before a push for API keys, access tokens, and other common credentials. The guidance explains how to replace exposed values, move them to environment variables, and clean affected history.

中文简介正在准备中。当前显示英语简介。

• Checking staged changes for credentials before committing
• Scanning commits for secrets before pushing
• Finding and cleaning commits that contain sensitive values

Use this skill to design, write, run, and debug LoongCollector end-to-end tests. It explains feature scenarios, registered steps, local Docker Compose execution, log inspection, and common configuration pitfalls so agents can work through test failures.

中文简介正在准备中。当前显示英语简介。

• Planning coverage for a new end-to-end test
• Writing a feature scenario with registered steps
• Running one Docker Compose test case locally

Learn how the LoongCollector end-to-end test framework connects feature scenarios to Go behavior functions. Use the guide to write BDD test cases, add and register custom steps, and understand existing test actions for setup, triggers, verification, and cleanup.

中文简介正在准备中。当前显示英语简介。

• Understanding the E2E test framework structure
• Writing feature files with scenarios and steps
• Adding and registering a custom Go behavior function

Use this guide to write and run BDD Godog end-to-end tests with consistent names, environment tags, and registered test steps. It outlines a flow for preparing an environment, generating logs, and checking collected results while keeping tests focused and maintainable.

中文简介正在准备中。当前显示英语简介。

• Writing a new BDD Godog end-to-end test
• Choosing test names and environment tags
• Building a log generation and verification flow