Security & Testing Agent Skills

[COMMUNITY] Generate a Canada ATIP reconciliation — Access to Information Act exemption mapping, Privacy Act §4–§8 use/disclosure…

[COMMUNITY] Generate a Canada FITAA (Foreign Influence Transparency and Accountability Act, Bill C-70 2024) compliance assessment…

[COMMUNITY] Generate an ITSG-33 Statement of Applicability with TBS Standard on Security Categorization — Protected A/B/C, Secret, Top…

[COMMUNITY] Generate a Canada Security of Information Act handling plan — Special Operational Information (SOI) register, marking and…

INVOKE THIS SKILL when auditing an AI agent or LLM app for regulatory compliance.

Reviews a finished code change, document, issue output, execution graph, or integrated project result through predefined risk-selected…

Use when about to claim something works, is fixed, or ready to hand off — and when a task changed one or more repos and needs intentional…

Detect and triage OWASP AST01 Malicious Skills — hidden payloads (credential stealers, backdoors, social-engineering prose) shipped inside…

Detect and triage OWASP AST02 Supply Chain Compromise — registry flooding, dependency confusion in a skill's nested…

Detect and triage OWASP AST03 Over-Privileged Skills — permission manifests broader than a skill's stated function, logic-layer prompt…

Detect and triage OWASP AST04 Insecure Metadata — brand-impersonating skill names, permission-understating manifests, risk_tier spoofing…

Detect and triage OWASP AST05 Untrusted External Instructions — skills that fetch external documentation (URLs, runbooks, schemas) and…

Detect and triage OWASP AST06 Weak Isolation — skills executing in the host agent's security context (full filesystem, shell, and network)…

Detect and triage OWASP AST07 Update Drift — skills installed without immutable pinning that fall behind known-good versions, or that…

Detect and triage OWASP AST08 Poor Scanning — natural-language-only malicious intent, shell-parsing evasion (quote removal, IFS…

Detect and triage OWASP AST09 No Governance — no skill inventory, no approval workflow, orphaned skills after offboarding, regulated-data…

Detect and triage OWASP AST10 Cross-Platform Reuse — security metadata (risk_tier, permissions, signatures) silently dropped when a skill…

Audits a project folder's AI harness maturity — state/memory, execution environment, control/enforcement, context management…

Behavior-Driven Development as a collaboration and specification practice, with pytest-bdd and behave as the bundled automation references.

X-ray any AI model's behavioral patterns — refusal boundaries, hallucination tendencies, reasoning style, formatting defaults.

Use for JS/TS performance-sensitive changes, benchmark additions, benchmark regressions, benchmark result JSON, or any claim that code is…