Security & Testing Agent Skills for Claude Desktop

Detect and triage OWASP AST02 Supply Chain Compromise — registry flooding, dependency confusion in a skill's nested…

Detect and triage OWASP AST04 Insecure Metadata — brand-impersonating skill names, permission-understating manifests, risk_tier spoofing…

Detect and triage OWASP AST06 Weak Isolation — skills executing in the host agent's security context (full filesystem, shell, and network)…

Detect and triage OWASP AST08 Poor Scanning — natural-language-only malicious intent, shell-parsing evasion (quote removal, IFS…

Detect and triage OWASP AST09 No Governance — no skill inventory, no approval workflow, orphaned skills after offboarding, regulated-data…

Detect and triage OWASP AST10 Cross-Platform Reuse — security metadata (risk_tier, permissions, signatures) silently dropped when a skill…

Suspicious Communications and Anomalous System Behavior

AWS security finding analysis: analyze findings, map to Atmos components/stacks, generate structured remediation with exact Terraform…

Audit a Go project's dependencies for known vulnerabilities, unmaintained modules, and unused requirements.

Assemble the evidence bundle, the sampling and the workpapers an auditor asks for, for one framework over one audit window, from Noru's…

Audits a project folder's AI harness maturity — state/memory, execution environment, control/enforcement, context management…

Looks up curated web security learning resources (XSS, SQLi, CSRF, SSRF, OAuth/JWT, deserialization, SAML, recon, evasion, defensive…

Run Playwright tests at scale with cloud-hosted browsers and integrated Azure portal reporting.

Expert in secure backend coding practices specializing in input validation, authentication, and API security.

Produce a STRIDE threat model for a system or feature.

Test-driven development. Use when the user wants to build features or fix bugs test-first, mentions "red-green-refactor", or wants…

Streamlines vulnerability triage, patch development, and pull request workflows for baserCMS GitHub Security Advisories.

Companion to bb-ops/playbooks/{ssrf,cloud-imds,config-review,secret-discovery,springboot}.yaml.

Companion to bb-ops/playbooks/{sqli,nosqli,cmdi,ssti,lfi,xxe,deserialization,rce}.yaml.

Behavior-Driven Development as a collaboration and specification practice, with pytest-bdd and behave as the bundled automation references.

X-ray any AI model's behavioral patterns — refusal boundaries, hallucination tendencies, reasoning style, formatting defaults.