Packs
3 packs@trailofbits
Testing Handbook Skills
Skills from the Trail of Bits Application Security Testing Handbook (appsec.guide)
15 skills · pack
@adobe
App Builder
Development, customization, testing, and deployment skills for Adobe App Builder projects
6 skills · pack
curated
Debug Web App with DevTools
Install this pack to test and debug a web application in a real browser using Chrome DevTools MCP.
7 skills · pack
Results for “test-app”
158 skillsasc-crash-triage
Fetches and summarizes TestFlight crash reports, beta feedback, and performance diagnostics using the asc CLI.
7
dogfood
Systematically explores a web application, finds issues, and produces a report with reproduction evidence for each finding.
61
ab-testing-framework
A/B and multivariate testing methodology. Design experiments, calculate sample sizes, determine statistical significance, avoid common pitfalls, and interpret results. Platform-agnostic framework applicable to landing pages, emails, ads, pricing, and product features. Use when the user asks about A/B testing, split testing, experiment design, statistical significance, or conversion experiments.
105 · bundle
django-tdd
Test-drive Django applications with pytest, factory_boy, and Django REST Framework, covering models, views, serializers, and API endpoints.
226k
django-tdd
Guides test-driven development for Django applications using pytest, factory_boy, and Django REST Framework, covering models, views, serializers, and API testing.
1
writing-skills
Guides the creation, editing, and verification of agent skills using a test-driven development approach, with structured documentation and quality gates.
20 · bundle
browser-testing-with-devtools
Tests and debugs web applications in real browsers using Chrome DevTools MCP, enabling DOM inspection, console error capture, network analysis, performance profiling, and visual verification with live runtime data.
69.5k
performing-directory-traversal-testing
Test web applications for path traversal vulnerabilities that allow reading or writing arbitrary files on the server by manipulating file path parameters.
24.6k · bundle
qa
Automates end-to-end QA: starts the app, exercises screens and API endpoints, verifies functionality and design quality, runs domain analysis, and fixes issues found.
13
race-condition
Race condition and TOCTOU testing for web apps. Use when testing one-time operations, concurrent HTTP abuse, rate-limit bypass, Turbo Intruder gates, HTTP/2 single-packet attacks, and CWE-362-style synchronization gaps.
21
orch-change-feature
Orchestrate altering an existing, working feature to new desired behavior by updating tests first, then changing implementation, reviewing, and committing with gated approval.
226k
kotlin-springboot
Provides best practices for building idiomatic Spring Boot applications with Kotlin, covering project setup, dependency injection, configuration, web layer, services, data layer, testing, and coroutines.
36.2k
pr
Prove a feature works by delegating verification to an independent sub-agent that drives the real app, then open a pull request with the proof.
770 · bundle
java-springboot
Provides best practices for developing high-quality Spring Boot applications, covering project structure, dependency injection, configuration, web layer, service layer, data layer, logging, testing, and security.
36.2k
dogfood
Systematically explore a web application to find bugs and UX issues, producing a structured report with screenshots, repro videos, and detailed steps for each finding.
559 · bundle
cli-anything
Builds, refines, tests, or validates a CLI-Anything harness for a GUI application or source repository, producing a stateful Click CLI with JSON output and REPL mode.
17
behavior-driven-development
Applies behavior-driven development principles including Gherkin scenarios and test-driven development. This skill should be used when the user asks to implement features, fix bugs, or when writing executable specifications and tests before writing production code.
580 · bundle
dbos-python
Build reliable, fault-tolerant Python applications with DBOS durable workflows, steps, queues, and communication patterns.
42.4k · bundle
broadcast
Applies the same change across multiple repositories in parallel using git worktrees, tests, and pull requests.
13
ecto-patterns
Ecto patterns for Phoenix/Elixir apps. Covers schemas, changesets, migrations, queries, Ecto.Multi, transactions, constraints, associations, pagination, tenant partitioning, performance, and testing.
71 · bundle
django-pro
Master Django 5.x with async views, DRF, Celery, and Django Channels. Build scalable web applications with proper architecture, testing, and deployment.
1
playwright
Use when testing or validating the client UI end-to-end - verifying a page renders, a form submits, navigation works, or checking visual/responsive behavior in a real browser. Use when the user asks to "test", "check", or "verify" something in the app that requires clicking through the UI, not just unit tests.
1
stack-go
Go backend conventions, patterns, and test infrastructure. Use when working with Go files, go.mod projects, Go modules, Go CLI, go build, go test, BubbleTea TUI apps, Lip Gloss styling, Charm libraries, goroutines, channels, interfaces, or Go dependency management.
1
cover-story
Write the context brief a first-time tester gets before testing an app, tool, codebase, or product — it explains WHAT the thing is and why it exists, while deliberately withholding HOW anything works. The companion to the fresh-eyes skill; the brief it produces is the "starting information" handed to a fresh-eyes tester. Use this whenever the user is preparing a fresh-eyes or first-time-user test and needs the setup material, or says things like "describe my app without giving anything away", "write the context card for the tester", "explain what it is but not how to use it", "set up the newcomer test", "what would the tester be told going in?", or wants a spoiler-free description of their product. Also use it when someone asks for the briefing/intro that a new tester, new hire, or evaluator should receive before first contact with the thing being tested.
0
testing-for-broken-access-control
Systematically test web applications for broken access control vulnerabilities including privilege escalation, missing function-level checks, and insecure direct object references.
24.6k · bundle
maui-dependency-injection
Configure dependency injection in .NET MAUI apps — service registration in MauiProgram.cs, lifetime selection, constructor injection, Shell navigation auto-resolution, platform-specific registrations, and testability patterns.
4k · bundle
testing-for-open-redirect-vulnerabilities
Identify and test open redirect vulnerabilities in web applications by analyzing URL redirection parameters, bypass techniques, and exploitation chains for phishing and token theft.
24.6k · bundle
gan-style-harness
Uses a multi-agent generator-evaluator feedback loop to build high-quality applications from a single prompt, inspired by GANs and Anthropic's harness design.
226k
performance-profiler
Systematically profile Node.js, Python, and Go applications to identify CPU, memory, and I/O bottlenecks, generate flamegraphs, analyze bundle sizes, optimize database queries, and run load tests with k6 and Artillery.
20.4k · bundle
testing-for-host-header-injection
Test web applications for HTTP Host header injection vulnerabilities to identify password reset poisoning, web cache poisoning, SSRF, and virtual host routing manipulation risks.
24.6k · bundle
csharp-pro
Write modern C# code with advanced features like records, pattern matching, and async/await. Optimizes .NET applications, implements enterprise patterns, and ensures comprehensive testing.
1
semgrep-rule-variant-creator
Ports existing Semgrep rules to new target languages with applicability analysis and test-driven validation.
6k · bundle
unship
Compare AI-generated UI variants in a running local app, then keep the chosen option and remove temporary code.
3
performing-bandwidth-throttling-attack-simulation
Simulates bandwidth throttling and network degradation attacks using tc, iperf3, and Scapy in authorized environments to test quality-of-service controls, application resilience, and network monitoring detection of traffic manipulation attacks.
24.6k · bundle
eval-driven-dev
Build automated evaluation pipelines for Python LLM applications using real LLM calls and structured test datasets.
36.2k · bundle
exploiting-insecure-deserialization
Identify and exploit insecure deserialization vulnerabilities in Java, PHP, Python, and .NET applications during authorized penetration tests.
24.6k · bundle