Security & Testing Agent Skills for OpenAI Agents SDK

Detect and triage OWASP AST08 Poor Scanning — natural-language-only malicious intent, shell-parsing evasion (quote removal, IFS…

Detect and triage OWASP AST09 No Governance — no skill inventory, no approval workflow, orphaned skills after offboarding, regulated-data…

Detect and triage OWASP AST10 Cross-Platform Reuse — security metadata (risk_tier, permissions, signatures) silently dropped when a skill…

Audits a project folder's AI harness maturity — state/memory, execution environment, control/enforcement, context management…

Behavior-Driven Development as a collaboration and specification practice, with pytest-bdd and behave as the bundled automation references.

X-ray any AI model's behavioral patterns — refusal boundaries, hallucination tendencies, reasoning style, formatting defaults.

Use for JS/TS performance-sensitive changes, benchmark additions, benchmark regressions, benchmark result JSON, or any claim that code is…

Build, verify and evaluate evidence-backed protocol-agent releases: pin a document corpus by digest, prove citations as exact bytes, bind…

BiSheng C safe zones. When you need to understand _Safe functions, _Safe blocks, _Unsafe escape blocks, safe zone restrictions…

Ensure async-path backend code that could block the asyncio event loop is protected by a teeth-verified runtime anchor in…

Full safety mode: destructive command warnings + directory-scoped edits.

Master Test Architect and Quality Advisor.

BiSheng C safe zones. When you write _Safe functions, _Unsafe escape blocks, or decide where the safety boundary goes, use this Skill.

Audit an external AI/API provider and its integration into a BT6 repository for service reality, independent verification, trust…

Diagnose and fix an open bug tracked under bugs/ in the current repo, the test-driven way, then close it.

Find correctness bugs in source code through depth-first exploration.

Diagnose and fix software bugs through evidence-based investigation.

Turn a vague, intermittent, or environment-specific bug report into a minimal evidence-backed reproduction before proposing a fix.

Discovers BugBug project, repository, and tested-application context.

Demonstrate build-artifact tampering and lack of provenance (CICD-SEC-4/CICD-SEC-9 artifact integrity) during an authorized assessment…

Build discipline for agent sessions that WRITE code — the failure modes no review-shaped skill catches, because nothing is being reviewed.