Security & Testing Agent Skills for Claude Code

Logic Challenger (Red Team) - Ask critical questions, find edge cases.

Security Auditor - Perform evidence-backed application, dependency, secret, and threat-model audits without silently modifying code.

Test Runner & Coverage - Design and run evidence-backed tests for requirements, regressions, and failure paths.

Install a pre-commit hook that scans .specstory/history for secrets before commits.

Set up Spectron (deprecated) tests for legacy Electron application testing

Guides automated testing of SPIP plugins and squelettes using PHPUnit — the standard test tool for SPIP.

Test-driven development for Spring Boot using JUnit 5, Mockito, MockMvc, Testcontainers, and JaCoCo.

Verification loop for Spring Boot projects: build, static analysis, tests with coverage, security scans, and diff review before release or…

Remediates SQL injection security findings safely using validated execution plans, allowlisted tools, and strict outcome verification.

Execute comprehensive SQL injection vulnerability assessments on web applications to identify database security flaws, demonstrate…

Guides structured bug bounty and vulnerability research workflows across five core testing phases with curated playbooks and methodology.

SRE-focused security reasoning for designing, reviewing, and operating systems, automation, recovery mechanisms, operator workflows, and…

Generates and configures SSH keys on macOS, covering ed25519 key creation, passphrase storage in the login Keychain via ssh-add…

This skill should be used when the user asks to "pentest SSH services", "enumerate SSH configurations", "brute force SSH credentials"…

CI testing for WebContainer apps with Playwright browser tests.

Look up the latest TheFocus.AI standards, inspect the current (or named) project, and write a dated mapping report: how the project…

Integration with security-focused static analysis tools

Guides the agent on executing static security scanning, auditing code for shell injections, and verifying API credential masks.

Stay strictly inside the current working directory — do not read, search, list, navigate to, or take any inspiration from anywhere else on…

Apply STRIDE methodology to systematically identify threats.

Stryker mutation testing for assessing test suite quality and effectiveness