Security & Testing Agent Skills for Claude Desktop

Use when writing, reviewing or auditing an end-to-end acceptance suite, especially one that was bulk-generated.

Builds vendor-agnostic detection rules using the Sigma rule format for

Build effective detection rules using Splunk Search Processing Language

Configure SAML 2.0 identity federation between on-premises Active Directory (via AD FS or a third-party IdP) and Microsoft Entra ID…

Generate log2timeline and Plaso super-timelines and triage them in Timesketch.

Build automated IOC enrichment pipelines in Splunk Enterprise Security by ingesting threat feeds into KV Store collections and correlating…

Builds automated threat intelligence feed integration pipelines connecting

Execute comprehensive web application security testing using Burp Suite's integrated toolset, including HTTP traffic interception and…

This skill should be used when the user asks to write, review, debug, optimize, test, fuzz, port, harden, profile, or design software in…

Measure the review panel against fixtures whose defects are known in advance - catch rate and false-positive rate per lens.

Test-driven development with red-green-refactor loop.

Methodology for detecting client SOC patches, attacker activity, and security-state changes that occur DURING a red-team engagement — and…

Implement or repair stable, observable software behavior through a compact verified test-first Red-Green-Refactor loop.

Add, remove, move, gate, bin, or restore tests and subplans in an active test flow while preserving dependencies and variant intent.

Use when changing software whose existing behaviour matters — fixing bugs or regressions, refactoring, migrating schemas or APIs, changing…

Use when planning, running, or learning from chaos engineering experiments.

This skill uses the owasp-compliance-checker plugin to automatically identify potential security vulnerabilities based on the OWASP Top 10…

Fix a bug from the issue tracker.

Demonstrate Inadequate Identity & Access Management (CICD-SEC-2) during an authorized assessment — abusing over-permissioned, stale, or…

Demonstrate Insufficient Logging & Visibility (CICD-SEC-10) during an authorized assessment — showing that malicious activity in the CI/CD…

Govern third-party services in the CI/CD ecosystem against CICD-SEC-8.