测试与安全技能

Understand security risks during Jackson JSON deserialization in Java, when input is being turned into objects. The guidance explains why checking objects afterward can miss structural attacks such as empty keys, duplicate keys, nested input, and polymorphic type handling.

中文简介正在准备中。当前显示英语简介。

• Reviewing when JSON input should be validated
• Understanding risks from duplicate or empty JSON keys
• Assessing polymorphic type handling in Jackson

Measure page and API performance, layout shifts, and theme flicker before and after a change. Included scripts use Playwright and Chrome DevTools Protocol data to report request timings, browser metrics, and visual stability signals for review.

中文简介正在准备中。当前显示英语简介。

• Checking page performance before and after a change
• Measuring layout shifts with CLS
• Detecting a brief flash when dark theme loads

Assess packet captures for port scans, DoS patterns, and command-and-control beaconing using the guide’s stated thresholds. It combines port entropy, SYN-only traffic, port counts, traffic spike ratios, and timing variation to classify patterns.

中文简介正在准备中。当前显示英语简介。

• Assessing packet data for port scanning
• Checking traffic spikes against the DoS threshold
• Looking for regular command-and-control beacon timing

Check interval instruction JSON and mask NPZ outputs before handoff. The skill validates key formats, frame ranges, sampled-frame counts, required mask components, and sparse matrix structure, helping catch missing or inconsistent output data without relying on ground truth.

中文简介正在准备中。当前显示英语简介。

• Checking interval instructions before submission
• Validating mask frame counts and components
• Finding frame-range or sparse-matrix inconsistencies

Generate maintainable unit tests from existing source code across multiple languages and frameworks. The skill identifies test scenarios, including edge cases, and can provide mocks, fixtures, coverage gap reports, test documentation, and commands for CI pipelines.

中文简介正在准备中。当前显示英语简介。

• Generating unit tests for existing code
• Adding edge case and dependency mock coverage
• Finding gaps in current test coverage

Plan and improve automated testing across development workflows, from test-first TDD cycles to AI-assisted test generation, self-healing UI tests, and CI/CD integration. Get practical guidance on framework choices, test data, reporting, and quality checks.

中文简介正在准备中。当前显示英语简介。

• Designing a test automation strategy
• Creating AI-assisted visual regression tests
• Building self-healing UI tests

Connect identified threats to security controls and practical mitigations. Use the mapping to review coverage, prioritize security investments, plan remediation work, and assess whether existing controls address the risks that matter.

中文简介正在准备中。当前显示英语简介。

• Prioritizing security investments against threats
• Creating a remediation roadmap
• Checking control coverage

Test Temporal workflows in Python with pytest, including unit, integration, and replay tests. Use time-skipping to run long workflows quickly, mock activities to isolate workflow logic, and replay histories to check determinism before changes are deployed.

中文简介正在准备中。当前显示英语简介。

• Testing workflows with time-skipping
• Mocking activities in integration tests
• Checking determinism with replay tests

Use the STRIDE threat modeling method to examine system architecture and security decisions in a structured way. The skill helps teams identify potential threats, document findings, prepare for audits, and build a shared understanding of security risks.

中文简介正在准备中。当前显示英语简介。

• Starting a threat modeling session
• Reviewing an existing system architecture
• Documenting security threats and findings

Review a system design to identify assets, entry points, and possible attack paths. Apply methods such as STRIDE, prioritize risks, propose mitigations, and document remaining risks and security requirements for planning or review.

中文简介正在准备中。当前显示英语简介。

• Reviewing a new system design for security gaps
• Identifying threats to a feature or data flow
• Prioritizing mitigations before an audit

Review Solidity smart contracts for common security risks and apply safer implementation patterns. Use the guidance when writing contracts, examining existing code for vulnerabilities, building blockchain security measures, or preparing a contract for a professional audit.

中文简介正在准备中。当前显示英语简介。

• Writing a Solidity smart contract
• Reviewing a contract for vulnerabilities
• Applying secure patterns to a DeFi protocol

Create failing tests for the TDD red phase to define expected behavior before implementation. Cover normal cases, edge conditions, and errors, while checking that failures reflect missing behavior rather than broken setup. Get complete test files and guidance for running them.

中文简介正在准备中。当前显示英语简介。

• Defining expected behavior before implementing a feature
• Capturing edge cases in tests for new behavior
• Checking that test failures expose missing functionality

Structure feature development around test-driven development: define requirements, write tests that fail first, implement the smallest change, then refactor and validate. It supports incremental or suite-based work, with checkpoints for test results and coverage.

中文简介正在准备中。当前显示英语简介。

• Planning acceptance criteria and test cases
• Building one feature test by test
• Developing a full test suite before implementation

Use this skill to inspect screenshots and verify whether UI changes match their goals. It checks visual consistency, design system rules, responsive layouts, and accessibility cues such as contrast and focus indicators, then reports issues and suggested fixes.

中文简介正在准备中。当前显示英语简介。

• Check whether a UI change matches its goal
• Review responsive layouts across screen sizes
• Verify contrast and visible focus indicators

Turn threat analysis and business context into actionable security requirements. Use the results to write security user stories, define acceptance criteria, create test cases, or map requirements to compliance needs and architecture documentation.

中文简介正在准备中。当前显示英语简介。

• Turning a threat model into requirements
• Writing security user stories
• Creating security test cases

Assess software systems against standards such as GDPR, HIPAA, SOC 2, and PCI-DSS. The skill helps organize control checklists, identify gaps, plan implementation steps, and prepare monitoring or audit evidence, while avoiding claims of formal compliance without an audit.

中文简介正在准备中。当前显示英语简介。

• Checking readiness for GDPR or HIPAA requirements
• Building control checklists and audit evidence
• Finding compliance gaps and prioritizing fixes

Coordinate reviewers focused on code quality, security, architecture, and performance to assess a codebase from multiple angles. Consolidate their findings, surface conflicting recommendations, and produce a unified report of issues and improvement suggestions.

中文简介正在准备中。当前显示英语简介。

• Review a codebase for security and quality issues
• Assess architecture and performance in parallel
• Combine findings from several specialized reviewers

Check how web applications work with VoiceOver, NVDA, and JAWS. Use the guidance to validate ARIA, forms, navigation, and dynamic content announcements, then investigate compatibility problems affecting assistive technology users.

中文简介正在准备中。当前显示英语简介。

• Checking screen reader compatibility
• Testing ARIA behavior
• Debugging accessible forms

Set up static application security testing (SAST), which checks source code for vulnerabilities, with tools such as Semgrep, SonarQube, and CodeQL. Integrate scans into CI/CD, tune rules and false positives, and define quality gates for findings.

中文简介正在准备中。当前显示英语简介。

• Adding automated security scans to CI/CD
• Creating custom code security rules
• Tuning noisy findings and scan performance

Coordinate a security hardening effort across applications, infrastructure, and delivery processes. The workflow organizes vulnerability assessment, risk prioritization, remediation, defensive controls, validation, compliance checks, and ongoing security monitoring.

中文简介正在准备中。当前显示英语简介。

• Coordinating security assessment and remediation
• Prioritizing findings from scans and threat modeling
• Checking security controls and compliance gaps

Combine static analysis with AI-assisted review to examine code changes for security flaws, performance risks, bugs, maintainability, and architectural concerns. Receive prioritized comments with file and line references, explanations, and concrete fix examples, with workflows suited to review automation.

中文简介正在准备中。当前显示英语简介。

• Reviewing a complex pull request across several concerns
• Designing an AI-assisted code review workflow
• Finding security and performance risks in code changes

Scan project dependencies across multiple ecosystems for known vulnerabilities, outdated packages, and license risks. The skill can generate an SBOM, a list of software components, assess findings, and outline remediation steps for supply chain visibility.

中文简介正在准备中。当前显示英语简介。

• Auditing packages for vulnerabilities
• Generating an SBOM for compliance
• Prioritizing fixes for outdated dependencies

Analyze executable files and libraries to understand their structure and behavior. The skill guides static and dynamic analysis with reverse engineering tools, helping document functions, data structures, protocols, and potential security findings for authorized research.

中文简介正在准备中。当前显示英语简介。

• Understanding an undocumented executable
• Analyzing a library's authentication behavior
• Working through a CTF binary challenge

Create and improve Python tests with pytest, fixtures, mocks, and parameterization. Use the skill to set up test suites, test APIs or async code, apply test-driven development, and investigate failing tests with practical testing guidance.

中文简介正在准备中。当前显示英语简介。

• Writing unit tests for Python code
• Setting up a pytest test suite
• Testing APIs and external service integrations