Security & Testing Agent Skills

Use after a failure has occurred (bug shipped, test broke, deploy rolled back, data lost, security incident) — the impulse is to fix the…

Performs evidence-driven root-cause diagnosis and regression-tested fixes for technical failures, build errors, and runtime bugs.

macOS app signing artifacts: inspect code signatures, entitlements, hardened runtime, sandbox, Gatekeeper, and trust failures; exclude…

macOS Xcode and SwiftPM tests: run focused scopes and diagnose build, assertion, crash, async-flake, fixture, entitlement, and host-app…

Periodic pass that keeps a project's verification skill and feature map honest: parallel source readers per feature, one live session…

Threat-model product features, APIs, data flows, secrets, permissions, supply-chain changes, auth boundaries, and risky code paths before…

Define behavioral contracts, run adversarial tests, and detect regressions for AI agents — invariants, edge cases, statistical analysis…

Spawn a fresh adversarial reviewer mid-implementation for any non-trivial decision — branching logic, cross-module boundaries…

Scan skill files, CLAUDE.md, MCP configs, and agent prompts for prompt injection patterns

Root cause analysis with dependency tracing and call stack analysis

Use when you need to understand why capabilities differ across configurations, user types, or deployment environments, or when…

Analyzes, disassembles, and patches binary executables using the radare2 command-line tool suite for reverse engineering workflows.

Analyzes compiled binaries, obfuscated bytecode, firmware, and virtualized targets using static, dynamic, and symbolic execution techniques.

Smoke test Mastra projects locally or deploy to staging/production.

When to activate: C++ testing, Google Test, GTest, GMock, Catch2, doctest, fixtures, parameterized tests, benchmarks, mocking

When to activate: Go tests, table-driven tests, testify, mocks, subtests, benchmarks, fuzz testing, test helpers

When to activate: Kotlin testing, JUnit 5, Kotest, MockK, Testcontainers, coroutine testing, Spring test slices, runTest

When to activate: privacy by design, PbD, DPIA, data minimization, purpose limitation, privacy impact assessment, privacy engineering…

When to activate: pytest, TDD, test fixtures, parametrize, async tests, coverage, mocking, hypothesis

When to activate: Swift Testing framework, XCTest, unit tests, async tests, test macros, parameterized tests, Swift mocking

Use when reviewing the source code of an MCP server or client implementation — not just its runtime config — for authentication, session…