Security & Testing Agent Skills for Claude Desktop

Blind-test how a skill or prompt change affects agent behavior before promoting it.

Apply after completing a task, before declaring done.

Executes and debugs baserCMS PHPUnit unit test suites in Docker environments for core and standalone plugins.

Companion to bb-ops/playbooks/{prompt-injection,indirect-prompt-injection}.yaml.

Companion to bb-ops/playbooks/{idor,broken-access-control,jwt,oauth,auth-bypass}.yaml.

Companion to the handoff agent. These are the rules for writing tasks the human will actually execute.

Companion to bb-ops/playbooks/{business-logic,race-condition}.yaml.

Companion to verifier + bypass-researcher roles.

Companion to bb-ops/playbooks/{xss,xss-dalfox,dom-xss,cors,open-redirect,config-review,csrf,file-upload,http-smuggling,cache-poison,host-he…

Use when facilitating BDD collaboration between developers, testers, and business stakeholders.

Change-impact and completion audit for wide, risky, cross-cutting, or merge-critical work.

Safety guardrails for destructive commands.

This skill should be used when the user invokes the bridge-check command or asks to verify the isolated Devin bridge.

Identify and exploit authentication and session management vulnerabilities in web applications.

Complete bug bounty workflow — recon (subdomain enumeration, asset discovery, fingerprinting, HackerOne scope, source code audit)…

Standardizes vulnerability reporting with triager-friendly formats, calibrated severities, and reproducible evidence.

Proactively hunt the codebase for bugs of every size — major reliability bugs (connection/network failures, missing timeouts, unhandled…

Full bug hunt cycle — dispatch 4 sibling bug-hunter methodology skills in parallel, cross-validate findings, present design decisions, and…

Find correctness bugs in source code through differential and invariant-based analysis.

Evaluates bug fixes by diagnosing root causes, tracing call-chain and data-flow impacts, and assessing regression risks before code…

Bugcrowd-specific reporting tactics complementing report-writing: VRT category search-and-fallback strategy when no exact match exists…