Security & Testing Agent Skills for Claude Code

Execute and test GraphQL depth limit attacks using deeply nested recursive

Detect and flag personally identifiable information (PII) in text, code, and configurations.

Configure Cedar policy enforcement and Ed25519 signed receipts for Claude Code tool calls.

Check a prototype against the user stories and test scenarios it is supposed to satisfy — build a coverage map, walk each scenario as…

Performs command-line binary analysis, reverse engineering, and security research using the radare2 toolchain.

Bootstrap pointer that installs the external repo-scan skill from a pinned, reviewable commit.

Parses and processes SARIF files from static analysis tools like CodeQL, Semgrep, or other scanners.

Runs external LLM code reviews (OpenAI Codex or Google Antigravity CLI) on uncommitted changes, branch diffs, or specific commits.

Write secure web applications following security best practices.

Enforce security standards including RLS policies, webhook signature verification, Zod validation, environment variable safety, GDPR…

Write a STRIDE-based threat model for a service or feature.

Add security scanning to CI/CD with Strix — GitHub Actions, GitLab CI, or any pipeline — so every pull request gets a diff-scoped AI…

Safety Integrity Level calculation skill for SIF design and verification per IEC 61511

Use when the user wants to *check* whether text or markdown contains AI provenance watermarks, without modifying the input.

Agent skill for refinement - invoke with $agent-refinement

Quality assurance and testing protocols for statistical software

Turn a vague complaint or observed defect into a reproducible bug report — steps to reproduce, expected vs actual, environment, evidence…

Map advanced persistent threat (APT) group tactics, techniques, and

A Certificate Authority (CA) is the trust anchor in a PKI hierarchy,

Use for software supply-chain security assessment covering SBOM, SCA, CI/CD pipelines, container images, build integrity, dependency…

Audit codebases for quality, consistency, and broken patterns — use for pre-release or tech debt review