Security & Testing Agent Skills for HTTP / API

Use when adding, fixing, or improving how an app authenticates users or protects an API, or when using or configuring any Auth0 feature…

This skill should be used when the user asks about "authentication in Next.js", "NextAuth", "Auth.js", "middleware auth", "protected…

Design and review secure authentication and credential lifecycles.

Design and review server-side authorization for users, services, organizations, resources, and individual fields.

This skill automates API endpoint testing, including request generation, validation, and comprehensive test coverage for REST and GraphQL…

Automated compliance checking against CIS, PCI-DSS, HIPAA, and SOC 2 benchmarks

Azure Key Vault SDK for Python. Use for secrets, keys, and certificates management with secure storage.

Secure key management for AI agents. Use when handling private keys, API secrets, wallet credentials, or when building systems that need…

Apply BambooHR security best practices for API keys, webhook verification,

Diagnosis loop for bugs and performance regressions.

Blind-test how a skill or prompt change affects agent behavior before promoting it.

Apply when debugging. Trace each symptom to its root cause and fix it there; reproduce first, ask why until you reach it, resist nil-check…

Test-driven development with red-green-refactor loop.

Use when facilitating BDD collaboration between developers, testers, and business stakeholders.

Independent local multi-model review for contested, security-sensitive, high-risk, or merge-critical plans and changes.

Bug condition/postcondition formalization as testable Behavior Contracts.

Go behind a program to discover what it ACTUALLY uses — its real dependencies, libraries, syscalls, files, network endpoints, env/config…

Run CIS Kubernetes Benchmark checks and remediate findings with kube-bench.

Find what a change could break somewhere else before it ships, beyond the diff, and prove the one fact it's safe because of by running…

Safety guardrails for destructive commands.

Freshly judge whether a finished change is actually proven against bead or caller acceptance — the independent verdict before merge…