Packs

3 packs

Testing Handbook Skills

Skills from the Trail of Bits Application Security Testing Handbook (appsec.guide)

15 skills · pack

@alirezarezvani

Engineering Team

32 engineering skills: architecture, frontend, backend, fullstack, QA, DevOps, security, AI/ML, data engineering, Playwright (9 sub-skills), self-improving agent, Stripe integration, TDD guide, tech stack evaluator, Google Workspace CLI, a11y audit (WCAG 2.2), Azure cloud architect, GCP cloud architect, security pen testing, Snowflake development, adversarial-reviewer, ai-security, cloud-security,

16 skills · pack

Builds multi-language source code graphs for security analysis: call graphs, attack surface mapping, blast radius, taint propagation, complexity hotspots, and entry point enumeration. Generates Mermaid diagrams (call graphs, class hierarchies, dependency maps, heatmaps). Compares code graph snapshots for structural diff and evolution analysis. Runs graph-informed mutation testing triage (genotoxic

10 skills · pack

Results for “security-testing”

21 skills

Comprehensive LLM security testing prompts for bias detection, data leakage, alignment testing, and adversarial prompt resistance.

Testing strategies for MCP servers including unit tests, integration tests, schema validation, and security testingUse when "mcp testing, test mcp server, mcp inspector, mcp validation, mcp, testing, unit-testing, integration-testing, schema-validation" mentioned.

Launches four parallel read-only sub-agents to review a git diff or file scope for regressions, security risks, performance issues, and contract gaps, then aggregates findings into a prioritized fix path.

implementing-iec-62443-security-zones

Design and implement security zones and conduits for industrial automation and control systems per IEC 62443-3-2, including zone partitioning, firewall configuration, and validation through traffic analysis and penetration testing.

24.6k · bundle

code-review-and-quality

Conducts multi-axis code review across correctness, readability, architecture, security, and performance before merging any change.

ai-prompt-engineering-safety-review

Analyzes prompts for safety, bias, security vulnerabilities, and effectiveness, providing detailed improvement recommendations with frameworks, testing methodologies, and educational content.

More results

Watch, audit, and fix another agent's work by reconstructing the original request, inspecting evidence, and reporting gaps.

Run tests and systematically fix all failing tests using smart error grouping. Use when user asks to fix failing tests, mentions test failures, runs test suite and failures occur, or requests to make tests pass.

integration-testing

`analysis-agent`/`task-agent`/`review-agent`: use for database, broker, cache, HTTP, framework, process, or transaction seam proof; skip local, portfolio, and release-verdict work.

Static OWASP review of app code (injection, headers, deps). Use when "review security" or "check vulnerabilities". Session/route×gate/getSession → audit-auth-flows. Plan-only burndown → plan-security-audit. Table RLS → plan-rls-audit. LLM attacks → audit-llm-security.

safe-test-runner

Prepare and classify local test commands before asking approval to execute them.

security-router

Route security, compliance, privacy, crypto/Web3, framework security, vulnerability review, and risk prompts. Use when prompts mention security-review, security scans, bounty hunting, HIPAA, PHI, compliance, Web3 risk, smart contracts, x402, LLM trading risk, or framework-specific security.

security-hardening

AIDefence security layer with prompt injection blocking, input validation, sandboxed execution, output sanitization, and STRIDE threat modeling.

Designing red team attack scenarios, threat models, MITRE ATT&CK/OWASP application, Purple Team exercises, and AI/LLM red teaming. Use when adversarial security validation is needed.

ai-engineering-standards

Enforces production-grade Python and AI engineering standards for FastAPI, LangChain/LangGraph, RAG pipelines, and LLM integrations, covering type safety, error handling, testing, and security.

salesforce-apex-quality

Enforces bulk-safety rules, sharing model requirements, CRUD/FLS security, SOQL injection prevention, PNB test coverage, and modern Apex idioms for Salesforce development.

testing-for-system-prompt-leakage

Test LLM applications for system prompt leakage using manual payloads, garak, and Promptfoo to extract embedded secrets and routing logic.

24.6k · bundle

Entry-point router for the local Pump.fun skill suite. Use when the user asks about launching Pump.fun tokens, bonding-curve or AMM trading, quotes, fees, claims, incentives, SDK work, agent/MCP integration, security, testing, or release workflows.

executing-red-team-engagement-planning

Defines scope, objectives, rules of engagement, threat model selection, and operational timelines for red team engagements before any offensive testing begins.

24.6k · bundle

lucassantana-dev

Composite skill — full project health check across testing, config, hooks, performance, security, MCP, and plugins. Runs the audit skills in parallel and reconciles into one severity-ranked report with prioritized remediation plan. Use weekly per active project, before major releases, or as part of quarterly tech-debt review.

zephyr-agent-skills

Zephyr RTOS development — boards and devicetree, the build system (west, Kconfig, CMake, sysbuild), drivers and peripherals, BLE and networking, the kernel, storage, power, testing and debugging, security and OTA. Use this for ANY Zephyr RTOS or embedded-firmware task on a Zephyr project; it routes you to the right specialized skill via the zephyr-cli registry.