Security & Testing Agent Skills for OpenAI Agents SDK

Smoke test the Agent Builder feature branch end-to-end against a hermetic project scaffolded by the skill (linked to the current worktree).

Use this skill when handling user input, working with memory, file I/O, network operations, or implementing security-sensitive features.

BiSheng C translation from C. When you need to translate/convert/port C code (.c/.h) to BiSheng C (.cbs/.hbs), add ownership annotations…

BiSheng C translation from C. When you translate C code to BSC, add ownership annotations, or migrate a C project to BSC, you MUST use…

Resolve deny-by-default role capabilities at every shipped executor/provider boundary, require host enforcement attestations for dangerous…

Card/key/cdkey generation and verification workflow.

Career data governance inventories private workspace data and plans disclosure, export, retention, legal hold, scoped deletion, and…

Intercept destructive commands before execution — rm -rf, DROP TABLE, force-push, git reset --hard, and similar irreversible operations.

This skill should be used when the user wants to "run an evaluation", "evaluate my ADK agent", "write an eval dataset", "analyze eval…

Use when implementing any feature or bugfix, before writing implementation code

Use when running QA Lab channel message flow evidence.

Analyze codebase for resilience gaps — missing retry logic, absent timeouts, circuit-breaker opportunities, single points of failure, and…

Review local character animation with schema checks, Playwright browser previews, frame sampling, and FFmpeg/ffprobe final output checks.

Use before claiming work is complete, fixed, or passing.

Close Insufficient Logging & Visibility (CICD-SEC-10) with comprehensive, tamper-resistant CI/CD audit logging and alerting.

Demonstrate Insufficient Flow Control (CICD-SEC-1) during an authorized assessment — pushing code, config, or artifacts through the…

Harden CI/CD identity & access management against CICD-SEC-2.

Demonstrate Insufficient Pipeline-Based Access Controls (CICD-SEC-5) during an authorized assessment — abusing the fact that a running…

Harden Pipeline-Based Access Controls against CICD-SEC-5.

Demonstrate CI/CD secret exfiltration (CICD-SEC-6, Insufficient Credential Hygiene) during an authorized assessment — recovering pipeline…

Detect and prevent CI/CD secret exposure (CICD-SEC-6).