Security & Testing Agent Skills for OpenAI Agents SDK

Coordinate either a repository quality assessment or acceptance-criteria verification of a specific feature.

Trigger: risk assessment, refactor risk.

Playwright end-to-end testing for Angular apps using the narrative-driven specs system (journeys, journey-maps, stories, features…

Anti-debugging detection and bypass — ptrace, debugger detection, timing checks, breakpoint detection.

Spin up a live local Omnigent server + runner and exercise the native Antigravity (agy) TUI harness (antigravity-native) end-to-end…

Spin up a live local Omnigent server and exercise the Antigravity (Gemini) SDK harness end-to-end — build antigravity agents, run real…

Apple firmware: inspect and reverse-engineer IPSWs, kernelcaches, dyld shared caches, private headers, entitlements, Mach-O binaries…

[COMMUNITY] Generate a Canada ATIP reconciliation — Access to Information Act exemption mapping, Privacy Act §4–§8 use/disclosure…

[COMMUNITY] Generate a Canada FITAA (Foreign Influence Transparency and Accountability Act, Bill C-70 2024) compliance assessment…

[COMMUNITY] Generate an ITSG-33 Statement of Applicability with TBS Standard on Security Categorization — Protected A/B/C, Secret, Top…

[COMMUNITY] Generate a Canada Security of Information Act handling plan — Special Operational Information (SOI) register, marking and…

INVOKE THIS SKILL when auditing an AI agent or LLM app for regulatory compliance.

Reviews a finished code change, document, issue output, execution graph, or integrated project result through predefined risk-selected…

Use when about to claim something works, is fixed, or ready to hand off — and when a task changed one or more repos and needs intentional…

Detect and triage OWASP AST01 Malicious Skills — hidden payloads (credential stealers, backdoors, social-engineering prose) shipped inside…

Detect and triage OWASP AST02 Supply Chain Compromise — registry flooding, dependency confusion in a skill's nested…

Detect and triage OWASP AST03 Over-Privileged Skills — permission manifests broader than a skill's stated function, logic-layer prompt…

Detect and triage OWASP AST04 Insecure Metadata — brand-impersonating skill names, permission-understating manifests, risk_tier spoofing…

Detect and triage OWASP AST05 Untrusted External Instructions — skills that fetch external documentation (URLs, runbooks, schemas) and…

Detect and triage OWASP AST06 Weak Isolation — skills executing in the host agent's security context (full filesystem, shell, and network)…

Detect and triage OWASP AST07 Update Drift — skills installed without immutable pinning that fall behind known-good versions, or that…