Security & Testing Agent Skills

TDD London School workflow -- mock-first, outside-in test development

Automated technical architecture review, security assessment, scalability analysis

Use when implementing any feature or bugfix, before writing implementation code

Identify a .NET project's test platform, framework, command mode, and SDK-style vs classic project system.

How to write tests, when to use each type of test, and how to run them.

Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and…

Token integration and implementation analyzer based on Trail of Bits' token integration checklist.

Builds and queries multi-language source and binary code graphs for security analysis.

Runs a Trailmark summary analysis on a codebase.

Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI…

Identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes.

Use when CI tests fail on main branch after PR merge, when investigating flaky test failures, or when user provides a PR URL/number to…

Creates Prowler security checks following SDK architecture patterns.

Perform visual testing and UI verification using screenshots and DOM inspection.

Security engineer — IAM, secrets, threat modeling, hardening, auth, and supply chain security.

Prowler API patterns: RLS, RBAC, providers, Celery tasks.

Apply Windsurf security best practices for workspace isolation, data

Use when about to claim a feature is end-to-end shipped, done, complete, working, or reachable — especially after a backend/command/API…

Implement Kubernetes security policies including NetworkPolicy, PodSecurityPolicy, and RBAC for production-grade security.

Periodic pass that keeps a project's verification skill and feature map honest: parallel source readers per feature, one live session…

Ensure Encryption in Transit is Configured