Agent skills for Windsurf (legacy)

Tests APIs for mass assignment (auto-binding), OWASP API3:2023, by identifying

Systematically assesses REST, GraphQL, and gRPC API endpoints against the OWASP

Use when the user wants to audit test quality, find flaky test patterns, speed up test execution, or prepare for Swift Testing migration.

Systematically tests web applications and APIs for broken access control

Manually identifies flaws in application business logic - price manipulation,

Tests web application email functionality (contact forms, password reset,

Test web applications for HTTP Host header injection vulnerabilities

Tests JWT implementations for algorithm confusion, "none" algorithm bypass,

Identifies and exploits open redirect vulnerabilities by analyzing URL

Identifying sensitive data exposure vulnerabilities including API key

Test web applications for XML injection vulnerabilities including XXE,

Tests web applications for reflected, stored, and DOM-based Cross-Site

Identifying and validating cross-site scripting vulnerabilities using

Discovering and exploiting XML External Entity injection vulnerabilities

Assessing JSON Web Token implementations for cryptographic weaknesses,

Tests authentication and authorization mechanisms in mobile application

Tests OAuth 2.0 and OpenID Connect implementations for authorization code

Apply Google Testing on the Toilet (TotT) rules when writing tests, reviewing a test diff, choosing mocks vs fakes, diagnosing brittle or…

Write effective tests across the stack—unit, integration, E2E, and visual regression.

Testing reconnaissance — inventory all tests, frameworks, coverage, CI integration, and assess testing maturity for project takeover.

Test web applications for security vulnerabilities including SQLi, XSS, command injection, JWT attacks, SSRF, file uploads, XXE, and API…