Security & Testing Agent Skills for OpenAI Agents SDK

Build features with tests-before-code rigor — use for new features needing test coverage

Semgrep is a fast static analysis tool for finding bugs and enforcing code standards.

Execute Vitest and Playwright test suites with result collection and failure analysis.

This skill should be used when generating comprehensive test cases from PRD documents or user requirements.

Reference-only filter syntax for VSTest and MTP with MSTest, NUnit, xUnit v3, and TUnit.

This skill should be used when the user asks to "plan a penetration test", "create a security assessment checklist", "prepare for…

Use after generating code, after accepting AI suggestions, or when reviewing AI-written modules.

Scans Algorand smart contracts for 11 common vulnerabilities including rekeying attacks, unchecked transaction fees, missing field…

Parses Kubernetes API server audit logs (JSON lines) to detect exec-into-pod, secret access, RBAC modifications, privileged pod creation…

Find and prove excessive data exposure (part of API3:2023) in an API during an authorized test — endpoints that return more object…

Use when the user asks to generate API tests, create integration test suites, test REST endpoints, or build contract tests.

Use when fixing dependency vulnerabilities, running pnpm audit, or when the audit-dependencies CI check fails

Analyze text and images for harmful content using Azure AI Content Safety (@azure-rest/ai-content-safety).

Bug → spec protocol. When a bug is found or a test fails, trace the cause, decide whether a new §V invariant would catch recurrence…

BDD requirements discovery methodology - Example Mapping, Three Amigos, conversational patterns, Given-When-Then translation, and…

Burp Suite Professional is an HTTP interception proxy with numerous security testing features.

Read-only drift detector. Diffs SPEC.md against current code and reports violations grouped by severity. Writes nothing — suggests…

Use when about to claim work is complete, fixed, or passing, before committing or creating PRs — requires running verification commands…

Bug diagnosis and fixing specialist - analyzes errors, identifies root causes, provides fixes, and writes regression tests.

Debug and analyze errors following best practices

Check every dependency in a package.json against live CVE databases and security advisories in real time — specifically targeting…